selinux July 2004

selinux@lists.fedoraproject.org

40 participants
54 discussions

policy addition for mozilla
by Richard Hally 09 Jul '04

09 Jul '04

Attached (and below) is a diff of a one line addition for mozilla_macros.te from the the selinux-policy-strict-sources-1.14.1-5. audit2allow generated the following from the avc denied messages I received when trying to run Mozilla: allow staff_mozilla_t xdm_tmp_t:dir { search }; Please add Thanks Richard Hally --- mozilla_macros.te.prev 2004-07-09 00:32:53.397132227 -0400 +++ mozilla_macros.te 2004-07-09 00:34:15.845137952 -0400 @@ -116,6 +116,7 @@ ifdef(`xdm.te', ` allow $1_mozilla_t xdm_t:fifo_file { write read }; +allow $1_mozilla_t xdm_tmp_t:dir { search }; allow $1_mozilla_t xdm_tmp_t:file { getattr read }; allow $1_mozilla_t xdm_tmp_t:sock_file { write }; ')dnl end if xdm.te --- mozilla_macros.te.prev 2004-07-09 00:32:53.397132227 -0400 +++ mozilla_macros.te 2004-07-09 00:34:15.845137952 -0400 @@ -116,6 +116,7 @@ ifdef(`xdm.te', ` allow $1_mozilla_t xdm_t:fifo_file { write read }; +allow $1_mozilla_t xdm_tmp_t:dir { search }; allow $1_mozilla_t xdm_tmp_t:file { getattr read }; allow $1_mozilla_t xdm_tmp_t:sock_file { write }; ')dnl end if xdm.te

3 2

fixfile.cron added.
by Daniel J Walsh 08 Jul '04

08 Jul '04

Todays policycoreutils has a new cron job, fixfiles.cron, that will run in /etc/cron.daily. This script will run a check on the file system on a daily basis looking for file contexts in the wrong state. It will them mail a list of files with the incorrect context to the root account. The following environment variables are set and can be overridden in the /etc/selinux/config directory. CRONTYPE="check" # You could change this to "restore" to have the script automatically clean up INVALIDFILE=/var/tmp/badcontext # Name of the file to store the badcontext file list CRONMAILTO="root" # Account to send mail to Suggestions on improvements? Comments? Dan

7 17

[ANN] setools 1.4.1 release
by Karl MacMillan 07 Jul '04

07 Jul '04

Setools version 1.4.1 has been released. It is available from the Tresys webpage at http://www.tresys.com/selinux/ or the SELinux CVS repository on sourceforge. This is a minor bug fix release. The changes include: - Support for version 18 policies. - A fix for a time zone related bug in seaudit. - The addition of the makefile target 'install-dev' that installs the libraries and headers necessary for third party developers to use the setools libraries (libapol, libseuser, libseaudit). Karl MacMillan Tresys Technology http://www.tresys.com (410)290-1411 ext 134

1 0

Tmpfs
by Ivan Gyurdiev 07 Jul '04

07 Jul '04

What's the situation with tmpfs? I have /tmp on tmpfs and I get lots of denials. Tmpfs doesn't seem to support xattrs, however.. SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Is /tmp on tmpfs something that should work, or is this not supported? What about /dev on tmpfs (or /udev)?

3 2

Re: RFE: show change of enforcing state in log ?
by Tom London 07 Jul '04

07 Jul '04

Interesting.... I was actually trying address a (slightly) different issue: how to recreate, after the fact, as much of the state as possible from the log. Can certainly add to the user space code to detect this change, and then emit a message to the log. Prior to your suggestion, I looked at the code for selinuxfs.c. I think a one line change could also do the trick: (I modeled this after the log prints on a policy load) *************** *** 135,140 **** --- 135,143 ---- length = task_has_security(current, SECURITY__SETENFORCE); if (length) goto out; + printk(KERN_INFO "setenforce: %s->%s\n", + (selinux_enforcing ? "enforcing" : "permissive"), + (new_value ? "enforcing" : "permissive")); selinux_enforcing = new_value; if (selinux_enforcing) avc_ss_reset(0); tom > ------------------------------------------------------------------------ > > * /From/: Stephen Smalley <sds epoch ncsc mil> > > ------------------------------------------------------------------------ > >On Tue, 2004-06-29 at 18:35, Tom London wrote: >> How difficult would it be to add 'old state->new state' to the log on a >> change in >> the enforcing state? Currently, 'setenforce' appears to be logged as a >> toggle.... > >The kernel just audits the permission check, i.e. that setenforce >permission was checked due to a change to the enforcing status. One >could add an additional auxiliary audit data type to avc_audit_data and >change the caller to supply the old and new states, but that would >require a patch to the SELinux kernel module, and I'm not sure it is >worthwhile. You can already have userspace receive notifications of >enforcing status changes, including the new value via netlink socket >messages; the userspace AVC in libselinux does this to detect changes in >permissive/enforcing status. > >-- >Stephen Smalley <sds epoch ncsc mil> >National Security Agency > > >

2 1

vi does not maintain contexts on symlinks
by Tom London 07 Jul '04

07 Jul '04

After accidentally editing '/etc/rc.sysinit' (a symlink to '/etc/rc.d/rc.sysinit') and getting a system that didn't boot in enforcing mode, I poked around a bit. It appears that the selinix patch to vi (emacs, ... ?) to maintain contexts across edits doesn't work if you point at the symlink instead of the 'real' file. [More precisely there is a function 'mch_copy_sec()' that calls get-/set-filecon(), but it appears that in the 'backup file' case, from_file and to_file are 'reversed'.] In my case, editing '/etc/rc.sysinit' changed the context of '/etc/rc.d/rc.sysinit' from 'system_u:object_r:initrc_exec_t' to 'root:object_r:etc_t'. I've bugzilla'ed this against vim here: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127361 but this may affect more than vim (e.g., emacs, ...) Is this patch Fedora based, or is there an upstream source? Am I breaking something else? tom

1 0

avc denied from postgresql
by Richard Hally 07 Jul '04

07 Jul '04

During bootup the postgresql server fails to start and produced the following avc denied message: Jun 15 05:09:12 new2 su(pam_unix)[2414]: session opened for user postgres by (uid=0) Jun 15 05:09:13 new2 kernel: audit(1087290553.569:0): avc: denied { write } for pid=2445 exe=/usr/bin/postgres name=data dev=hda2 ino=788097 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 15 05:09:14 new2 su(pam_unix)[2414]: session closed for user postgres Jun 15 05:09:15 new2 postgresql: Starting postgresql service: failed This is in enforcing mode with the strict policy selinux-policy-strict-1.13.4-5 Thanks for any help, Richard Hally

7 17

logrotate errors
by Aaron Ross 07 Jul '04

07 Jul '04

Hi all, I am having some problems with logrotate on a box with selinux enabled. Here's my current sestatus: [root@customer bin]# /usr/sbin/sestatus -v SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Policy version: 17 Policy booleans: user_ping inactive Process contexts: Current context: root:sysadm_r:sysadm_t Init context: system_u:system_r:kernel_t /sbin/mingetty system_u:system_r:kernel_t /usr/sbin/sshd system_u:system_r:kernel_t File contexts: Controlling term: root:object_r:devpts_t /etc/passwd root:object_r:file_t /etc/shadow root:object_r:file_t And here is an example of the errors I'm seeing: error: error getting file context /usr/local/apache/logs/access_log: No data available I've read the FAQ and I'll keep going through the introductions to SELinux, but if I could get a quick explanation of what's going wrong, I would be very grateful. Thanks, Aaron

2 1

RFE: show change of enforcing state in log ?
by Tom London 07 Jul '04

07 Jul '04

How difficult would it be to add 'old state->new state' to the log on a change in the enforcing state? Currently, 'setenforce' appears to be logged as a toggle.... tom

2 1

LSM program!
by Sajed Miremadi 06 Jul '04

06 Jul '04

Hi, Does anybody have an LSM program(with the source code)? And has anybody written a policy for the LSM? I mean codes that are not available in the kernel(those that are not default). thanx,

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2004