selinux July 2004

selinux@lists.fedoraproject.org

40 participants
54 discussions

SELinux and stunnel
by W. Michael Petullo 20 Jul '04

20 Jul '04

I am using stunnel to create an encrypted tunnel for SMTP connections to my ISP. I have configured xinetd to execute stunnel appropriately when a connection is made to localhost:465. This has stopped working when using recent strict policies. I now see the following errors in my system logs: Jul 19 20:42:16 imp kernel: audit(1090287736.954:0): avc: denied { execute } for pid=6363 exe=/usr/sbin/xinetd name=stunnel dev=dm-0 ino=48915 scontext=root:system_r:inetd_t tcontext=system_u:object_r:sbin_t tclass=file Jul 19 20:42:16 imp kernel: audit(1090287736.954:0): avc: denied { execute_no_trans } for pid=6363 exe=/usr/sbin/xinetd path=/usr/sbin/stunnel dev=dm-0 ino=48915 scontext=root:system_r:inetd_t tcontext=system_u:object_r:sbin_t tclass=file Jul 19 20:42:16 imp kernel: audit(1090287736.956:0): avc: denied { read } for pid=6363 exe=/usr/sbin/xinetd path=/usr/sbin/stunnel dev=dm-0 ino=48915 scontext=root:system_r:inetd_t tcontext=system_u:object_r:sbin_t tclass=file Jul 19 20:42:17 imp kernel: audit(1090287737.391:0): avc: denied { getattr } for pid=6363 exe=/usr/sbin/stunnel path=/dev/urandom dev=dm-0 ino=272235 scontext=root:system_r:inetd_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file Jul 19 20:42:17 imp kernel: audit(1090287737.395:0): avc: denied { read } for pid=6363 exe=/usr/sbin/stunnel name=urandom dev=dm-0 ino=272235 scontext=root:system_r:inetd_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file Jul 19 20:42:17 imp kernel: audit(1090287737.395:0): avc: denied { ioctl } for pid=6363 exe=/usr/sbin/stunnel path=/dev/urandom dev=dm-0 ino=272235 scontext=root:system_r:inetd_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file I am using: selinux-policy-strict-sources-1.15.5-2 selinux-policy-strict-1.15.5-2 policycoreutils-1.15.1-1 checkpolicy-1.14.1-1 libselinux-devel-1.15.1-1 libselinux-1.15.1-1 Should I put this in bugzilla? -- Mike

2 2

/etc/exports, /usr/sbin/exportfs ...
by Tom London 20 Jul '04

20 Jul '04

My log shows the following failure: Jul 19 18:58:38 fedora kernel: audit(1090288718.937:0): avc: denied { read } for pid=2363 exe=/usr/sbin/exportfs name=exports dev=hda2 ino=4472848 scontext=system_u:system_r:nfsd_t tcontext=system_u:object_r:exports_t tclass=file Jul 19 18:58:38 fedora exportfs[2363]: can't open /etc/exports for reading Jul 19 18:58:38 fedora exportfs: exportfs: can't open /etc/exports for reading I'm running strict/enforcing. tom

2 2

SELinux installation!
by Sajed Miremadi 20 Jul '04

20 Jul '04

Hi, I have a little problem in installing SELinux. I begin with writing "linux selinux" at the boot prompt and then after some steps I see that the SELinux has been actived. But when I choose "custom", I don't know which package include "/etc/security/selinux/src"(I mean the "src" directory). Because the "src" directory exist whenever I choose "everything" and installing in this mode will take very long time. thanx,

2 1

genhomedircon
by Russell Coker 19 Jul '04

19 Jul '04

The attached patch fixes a bug in genhomedircon. Without this if you create system users with "useradd -r" and give them home directories in unusual locations (such as /usr/DIR or /var/run/DIR) then a file_contexts file will be generated that will mess up your system. This match makes it check /etc/login.defs for the value of UID_MIN. Also perhaps we should make STARTING_UID default to 500. 500 is the default value for this in Fedora. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

Major problems after upgrade from FC1
by A. Gautier 18 Jul '04

18 Jul '04

I am about to pull what little is left of my hair out. I decided to upgrade from FC1 to FC2 by pointing yum to a FC2 repository and upgrading all packages. This worked for the most part but I am having massive problems with SELinux. I am not sure that SELinux got setup properly. One of this biggest problems that I have is that crond now no longer runs. I have been following the Fedora SELinux FAQ to get up to speed with lots of google searches and watching this list but I have not been able to solve my problem. My first problem is that system crond is not running. My user crontab is running fine. So, my question is could someone help me 1.) Make sure my setup is correct. 2.) Get the correct policies setup (I am also having a problem with postfix, but I think if I get #1 then there is enough info on the web to solve that problem). Also, the reason I think there is a configuration problem was because when following the FAQ to add a user: ------------------------------ EXCERPT: http://people.redhat.com/kwade/fedora-docs/selinux-faq-en/index.html#id3004… Q: How can I create a new Linux user account with the user's home directory having the proper context? A: You can create your new user with the standard useradd command, but first you must become root with a context of sysadm_r. This context switch has been incorporated into the su command: %>su - root Your default context is root:sysadm_r:sysadm_t. Do you want to choose a different one? [n] n %>useradd auser %>ls -Z /home drwxr-xr-x auser auser root:object_r:user_home_dir_t /home/auser ------------------------------ So I thought if I ran ls -Z /home I would get a similar result? ------------------------------ OUTPUT: ls -Z /home drwxr--r--+ <user> <group> (null) <user> Also, I get the (null) report on all directories in /root. ------------------------------ OUTPUT: sudo /usr/sbin/sestatus -v SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Policy version: 17 Policy booleans: user_ping inactive Process contexts: Current context: user_u:sysadm_r:sysadm_t Init context: system_u:system_r:kernel_t /sbin/mingetty system_u:system_r:kernel_t /usr/sbin/sshd system_u:system_r:kernel_t File contexts: Controlling term: user_u:object_r:devpts_t ----------------- EXCERPT: /var/log/messages Jul 12 12:00:00 sun kernel: audit(1089651600.583:0): avc: denied { compute_user } for pid=27396 exe=/usr/sbin/crond scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:security_t tclass=security Jul 12 12:00:00 sun kernel: audit(1089651600.584:0): avc: denied { compute_av } for pid=27396 exe=/usr/sbin/crond scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:security_t tclass=security Jul 12 12:00:00 sun kernel: audit(1089651600.586:0): avc: denied { check_context } for pid=27396 exe=/usr/sbin/crond scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:security_t tclass=security Jul 12 12:00:00 sun kernel: audit(1089651600.586:0): avc: denied { write } for pid=27396 exe=/usr/sbin/crond name=exec dev=proc ino=1795424277 scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=file Jul 12 12:00:00 sun kernel: audit(1089651600.587:0): avc: denied { setexec } for pid=27396 exe=/usr/sbin/crond scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=process Jul 12 12:00:00 sun kernel: audit(1089651600.587:0): avc: denied { transition } for pid=27396 exe=/usr/sbin/crond path=/bin/bash dev=hda3 ino=3850263 scontext=system_u:system_r:kernel_t tcontext=user_u:sysadm_r:sysadm_t tclass=process Jul 12 12:00:00 sun kernel: audit(1089651600.590:0): avc: denied { siginh } for pid=27396 exe=/bin/bash scontext=system_u:system_r:kernel_t tcontext=user_u:sysadm_r:sysadm_t tclass=process Jul 12 12:00:00 sun kernel: audit(1089651600.590:0): avc: denied { rlimitinh } for pid=27396 exe=/bin/bash scontext=system_u:system_r:kernel_t tcontext=user_u:sysadm_r:sysadm_t tclass=process Jul 12 12:00:00 sun kernel: audit(1089651600.590:0): avc: denied { noatsecure } for pid=27396 exe=/bin/bash scontext=system_u:system_r:kernel_t tcontext=user_u:sysadm_r:sysadm_t tclass=process Jul 12 12:00:01 sun kernel: audit(1089651601.074:0): avc: denied { execute } for pid=27400 exe=/usr/sbin/crond name=sendmail.postfix dev=hda3 ino=3391852 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sendmail_exec_t tclass=file Jul 12 12:00:01 sun kernel: audit(1089651601.074:0): avc: denied { execute_no_trans } for pid=27400 exe=/usr/sbin/crond path=/usr/sbin/sendmail.postfix dev=hda3 ino=3391852 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sendmail_exec_t tclass=file

4 5

howl
by Russell Coker 18 Jul '04

18 Jul '04

In howl there are two daemons, nifd and mDNSResponder. How do these relate to each other? Is there a need to put them in different SE Linux domains or should they both be in the same domain? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

install of kernel-2.6.7-1.492: mkinitrd fails in strict/enforcing .......
by Tom London 16 Jul '04

16 Jul '04

'yum update' for the kernel-2.6.7-1.492 doesn't work (strict/enforcing mode, selinux-policy-strict-1.15.5-2): kernel 100 % done 18/47 /bin/bash: /root/.bashrc: Permission denied /lib/modules/2.6.7-1.492 is not a directory. mkinitrd failed / [I checked, and no initrd-2.6.7-1.492.img in /boot] I found this message in /var/log/messages: Jul 16 07:52:15 fedora kernel: audit(1089989535.207:0): avc: denied { getattr } for pid=3420 exe=/bin/bash path=/lib/modules/2.6.7-1.492 dev=hda2 ino=3671053 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:modules_object_t tclass=dir I set 'strict/permissive', did 'rpm -e kernel-2.6.7-1.492' and did the 'yum update' again and got: Dependencies resolved I will do the following: [install: kernel 2.6.7-1.492.i686] Is this ok [y/N]: y Downloading Packages Running test transaction: WARNING: Multiple same specifications for /halt. WARNING: Multiple same specifications for /\.autofsck. Test transaction complete, Success! WARNING: Multiple same specifications for /halt. WARNING: Multiple same specifications for /\.autofsck. kernel 100 % done 1/1 / Kernel Updated/Installed, checking for bootloader Grub found - making this kernel the default Installed: kernel 2.6.7-1.492.i686 Transaction(s) Complete Something change? tom

3 4

/lib64/modules
by Russell Coker 15 Jul '04

15 Jul '04

Will kernel modules ever be stored in /lib64/modules? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

selinux-policy-strict-1.15.5-2 breaks mozilla....
by Tom London 15 Jul '04

15 Jul '04

selinux-policy-strict-1.15.5-2 mislabels /usr/lib/mozilla-1.7/mozilla-* as lib_t, instead of as mozilla_exec_t. mozilla.fc now has: /usr/lib(64)?/mozilla/mozilla-.* -- system_u:object_r:mozilla_exec_t but the files are in /usr/lib/mozilla-1.7/ Should the line in mozilla.fc be something like: /usr/lib(64)?/mozilla(-[0-9].*)?/mozilla-* -- system_u:object_r:mozilla_exec_t tom

2 1

Policy Management
by Kirk Vogelsang 15 Jul '04

15 Jul '04

I'm contemplating rolling my own policy.conf, using the latest strict as a base and trimming it down and wondering if others have gone this route as well. I'm well aware of the implications in doing this and moving away from the standard m4-based config. But what seem to be trivial tasks in modifying the policy file directly appear to become somewhat non-trivial in trying to make the same modification in the macro files. For example, I wish to disallow user_r any access to selinux_config_t. It appears as though access is granted to selinux_config_t via via full_user_role() via base_file_read_access(). full_user_role(user) adds quite a bit of functionality I want to keep as does base_file_read_access(user). So I'm not quite sure where to go from here. Removing this access from the policy.conf directly appears to be a matter of removing one or two lines. Maybe I'm going about things incorrectly? Do other's write and maintain their own policies independent of the policy*.rpm's? Thanx for and insight... ----- Kirk M. Vogelsang <kvogelsa(a)ccs.neu.edu> Northeastern University College of Computer Science

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2004