selinux September 2004

selinux@lists.fedoraproject.org

38 participants
57 discussions

/etc/hal/capability.d/printer_update.hal
by Tom London 10 Sep '04

10 Sep '04

Notice the following: Sep 9 09:37:55 fedora kernel: audit(1094747875.090:0): avc: denied { execute } for pid=3131 exe=/usr/sbin/hald name=printer_update.hal dev=hda2 ino=280646 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file Sep 9 09:37:55 fedora kernel: audit(1094747875.090:0): avc: denied { execute } for pid=3131 exe=/usr/sbin/hald name=printer_update.hal dev=hda2 ino=280646 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file Should the following be added to hald.fc? /etc/hal/capability.d/printer_update.hal -- system_u:object_r:hald_exec_t (similar to /etc/hal/device.d/printer_remove.hal ?) tom -- Tom London

1 0

relabeling cycles...
by Tom London 09 Sep '04

09 Sep '04

No matter how often I 'fix' these files with either setfiles or fixfiles, they seem to revert back the next reboot. I think I've also booted single-user to do relabeling with the same effect. Not clear this affects functioning in any way. tom > /usr/sbin/setfiles: relabeling /var/run/saslauthd/mux.accept from > system_u:object_r:saslauthd_var_run_t to system_u:object_r:var_run_t > /usr/sbin/setfiles: relabeling /var/run/saslauthd/mux from > system_u:object_r:saslauthd_var_run_t to system_u:object_r:var_run_t > /usr/sbin/setfiles: relabeling /tmp/.X11-unix from > system_u:object_r:xdm_tmp_t > to system_u:object_r:xdm_xserver_tmp_t > /usr/sbin/setfiles: relabeling /tmp/.X0-lock from > system_u:object_r:xdm_xserver_tmp_t to system_u:object_r:xdm_tmp_t

2 1

latest Rawhide... selinux-policy-strict-1.17.9-2
by Tom London 09 Sep '04

09 Sep '04

Newest Rawhide packages improve things a bit for strict/enforcing, but still no joy. When booting strict/enforcing, the system seems to boot to single user mode, but is unable to write to the console. Last messages are avc denials from /bin/dmesg, that seem to occur just before the 'Welcome to Fedora' message. I can hear the device discovery going on, but nothing on the console. After about 5 minutes, ALT-CTL-DEL brought the system down, with the customary console messages. (But, error messages about most file systems not being mounted). Here are the early avcs... Sep 3 07:25:35 fedora kernel: audit(1094196259.050:0): avc: denied { create } for pid=1 exe=/sbin/init name=initctl scontext=system_u:system_r:init_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file Sep 3 07:25:36 fedora smartd[2856]: Opened configuration file /etc/smartd.conf Sep 3 07:25:36 fedora kernel: audit(1094196259.050:0): avc: denied { associate } for pid=1 exe=/sbin/init name=initctl scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:fs_t tclass=filesystem Sep 3 07:25:36 fedora smartd[2856]: Configuration file /etc/smartd.conf parsed. Sep 3 07:25:36 fedora kernel: audit(1094196259.050:0): avc: denied { read write } for pid=1 exe=/sbin/init name=initctl dev=tmpfs ino=2095 scontext=system_u:system_r:init_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file Sep 3 07:25:36 fedora smartd[2856]: Device: /dev/hda, opened Sep 3 07:25:36 fedora kernel: audit(1094196259.050:0): avc: denied { getattr } for pid=1 exe=/sbin/init path=/dev/initctl dev=tmpfs ino=2095 scontext=system_u:system_r:init_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file Sep 3 07:25:36 fedora smartd[2856]: Device: /dev/hda, found in smartd database. Sep 3 07:25:36 fedora kernel: audit(1094196259.312:0): avc: denied { read write } for pid=344 exe=/bin/hostname name=console dev=tmpfs ino=864 scontext=system_u:system_r:hostname_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:36 fedora kernel: audit(1094196259.382:0): avc: denied { search } for pid=346 exe=/bin/bash dev=tmpfs ino=863 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:unlabeled_t tclass=dir Sep 3 07:25:36 fedora kernel: audit(1094196259.382:0): avc: denied { read write } for pid=346 exe=/bin/bash name=tty dev=tmpfs ino=1227 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:37 fedora smartd[2856]: Device: /dev/hda, is SMART capable. Adding to "monitor" list. Sep 3 07:25:37 fedora kernel: audit(1094196260.276:0): avc: denied { read write } for pid=490 exe=/bin/mount name=console dev=tmpfs ino=864 scontext=system_u:system_r:mount_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:37 fedora smartd[2856]: Monitoring 1 ATA and 0 SCSI devices Sep 3 07:25:37 fedora kernel: audit(1094196260.277:0): avc: denied { search } for pid=490 exe=/bin/mount dev=tmpfs ino=863 scontext=system_u:system_r:mount_t tcontext=system_u:object_r:unlabeled_t tclass=dir Sep 3 07:25:37 fedora kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts Sep 3 07:25:38 fedora smartd[2858]: smartd has fork()ed into background mode. New PID=2858. Sep 3 07:25:38 fedora kernel: audit(1094196260.368:0): avc: denied { read write } for pid=514 exe=/sbin/consoletype name=console dev=tmpfs ino=864 scontext=system_u:system_r:consoletype_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora smartd: smartd startup succeeded Sep 3 07:25:38 fedora kernel: audit(1094196260.368:0): avc: denied { getattr } for pid=514 exe=/sbin/consoletype path=/dev/console dev=tmpfs ino=864 scontext=system_u:system_r:consoletype_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora kernel: audit(1094196260.368:0): avc: denied { ioctl } for pid=514 exe=/sbin/consoletype path=/dev/console dev=tmpfs ino=864 scontext=system_u:system_r:consoletype_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora kernel: audit(1094196262.158:0): avc: denied { read write } for pid=724 exe=/sbin/minilogd name=console dev=tmpfs ino=864 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora kernel: audit(1094196262.158:0): avc: denied { use } for pid=724 exe=/sbin/minilogd path=/init dev=rootfs ino=17 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=fd Sep 3 07:25:38 fedora kernel: audit(1094196262.158:0): avc: denied { read } for pid=724 exe=/sbin/minilogd path=/init dev=rootfs ino=17 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:root_t tclass=file Sep 3 07:25:38 fedora kernel: audit(1094196262.159:0): avc: denied { search } for pid=724 exe=/sbin/minilogd dev=tmpfs ino=863 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=dir Sep 3 07:25:38 fedora kernel: audit(1094196262.159:0): avc: denied { write } for pid=724 exe=/sbin/minilogd dev=tmpfs ino=863 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=dir Sep 3 07:25:38 fedora kernel: audit(1094196262.159:0): avc: denied { add_name } for pid=724 exe=/sbin/minilogd name=log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=dir Sep 3 07:25:38 fedora kernel: audit(1094196262.159:0): avc: denied { create } for pid=724 exe=/sbin/minilogd name=log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file Sep 3 07:25:38 fedora kernel: audit(1094196262.160:0): avc: denied { getattr } for pid=727 exe=/sbin/minilogd path=/dev/log dev=tmpfs ino=2641 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file Sep 3 07:25:38 fedora kernel: audit(1094196262.217:0): avc: denied { read write } for pid=730 exe=/bin/dmesg name=console dev=tmpfs ino=864 scontext=system_u:system_r:dmesg_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora acpid: acpid startup succeeded Sep 3 07:25:38 fedora kernel: audit(1094196262.285:0): avc: denied { read write } for pid=735 exe=/sbin/restorecon name=console dev=tmpfs ino=864 scontext=system_u:system_r:restorecon_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file Sep 3 07:25:38 fedora kernel: audit(1094196266.948:0): avc: denied { create } for pid=746 exe=/sbin/udev name=input scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=dir tom

4 3

[idea] udev + selinux
by Nigel Kukard 08 Sep '04

08 Sep '04

Just an idea, but why not have udev set the context on its root path? I have a simplistic patch for this if its a good idea. Regards Nigel Kukard

12 29

SELinux article in eWeek
by Frank Mayer 07 Sep '04

07 Sep '04

Not a depth article but generally favorable review of SELinux: http://www.eweek.com/article2/0,1759,1643024,00.asp Frank

1 0

RE: Users writting to home directory
by Don Patterson 07 Sep '04

07 Sep '04

> ----- Original Message ----- > From: "James R. Marcus" <jmarcus(a)mvalent.net> > To: "Stephen Smalley" <sds(a)epoch.ncsc.mil> > Cc: <selinux(a)tycho.nsa.gov> > Sent: Tuesday, August 24, 2004 2:14 PM > Subject: RE: Users writting to home directory > > > > Okay I tried just creating a user under home. While in permissive > > mode they can login to the ftp server and upload and download. > > However when I turn on enforced mode they get this message: > > > > C:\Documents and Settings\jmarcus\Desktop>ftp ftp Connected to > > ftp.mvalent.local. > > 220 Welcome to mValent, Inc. FTP service. > > User (ftp.mvalent.local:(none)): jmarcus7 > > 331 Please specify the password. > > Password: > > 500 OOPS: cannot change directory:/home/jmarcus7 500 OOPS: child > > died Connection closed by remote host. > > > > C:\Documents and Settings\jmarcus\Desktop> > > > > ftp policy # seuseradd -g users -d /home/jmarcus7 -m -s /bin/bash > > -c "James R. Marcus" jmarcus7 loading new policy... > > > > Error relabeling users home directory files: User is not defined in > > the policy. > > > In case anyone sees a similar problem, this bug was fixed in setools 1.4.x. To upgrade use the commands: Fedora - 'yum update setools' Gentoo - 'emerge setools' Don Patterson Tresys Technology www.tresys.com

1 0

(no subject)
by Frank Mayer 07 Sep '04

07 Sep '04

CALL FOR PRESENTATION PROPOSALS FIRST SECURITY ENHANCED LINUX SYMPOSIUM (www.selinux-symposium.org) The inaugural symposium on Security Enhanced Linux (SELinux) will be held March 2-4 2005 in the Silver Spring, Maryland, USA (near Washington, DC). SELinux brings the power of flexible mandatory access control such as type enforcement to Linux. The symposium is an opportunity to learn about SELinux and share technical and application experiences. The call for presentation and tutorial proposals is now open until October 1, 2004. All proposals will be reviewed by the review committees for inclusion in the symposium agenda. To submit proposals visit http://www.selinux-symposium.org.

1 0

Re: fedora-selinux-list Digest, Vol 7, Issue 1
by Stanley A. Klein 07 Sep '04

07 Sep '04

On Wed, 2004-09-01 at 12:00, Linas Vepstas <linas(a)austin.ibm.com> wrote: > > Every now and then, I look at SELinux, and I get scared away by its > complexity. This complexity makes it very hard to audit, and assure > oneself that its actually providing any real security, as opposed to > the illusion of security. During this email thread, there are > references to mysterious rules that neither party in the conversation > fully understands; this scares me. > This is not the first time I've heard about SELinux complexity. A colleague attended a meeting of the DC area SELinux Users Group and came away repeating stories about 50000 rules that needed to be defined for a typical system. His reaction was "How can you be sure you have done 50000 rules right?". I heard similar talk in the hallway at one of the EGOVOS conferences. I think the complexity derives from Mandatory Access Control rather than SELinux itself. Thus far almost all of the attention regarding SELinux policies has been given to basic computer infrastructure and basic system administration. Some of the packages in the basic infrastructure have hundreds of files. MAC requires each file in each package to be considered and its access control rules defined. The complexity in the rules is a consequence of the complexity in the infrastructure. The real issue is the adequacy of tools to manage the complexity. Furthermore, although SELinux has the mechanisms for defining and enforcing access control rules beyond the basic infrastructure, trying to develop policies based on business process rules and business considerations looks like a daunting task right now. By this I mean roles that get beyond sysadmin and user into areas such as bank teller or hospital primary care provider or control system operations shift supervisor, together with the rules appropriate to those roles in their business contexts. I think there are people working on tool concepts, but it seems we are a few years away from taming the complexity of MAC and SELinux sufficiently to allow users to easily and confidently define SELinux policies for applications based on business considerations. Stan Klein -- Stanley A. Klein, D.Sc. Principal Consultant Stan Klein Associates, LLC 301-881-4087

2 1

Re: log file names (was Additional rule files)
by Russell Coker 05 Sep '04

05 Sep '04

On Sat, 4 Sep 2004 11:12, Erich Schubert <erich(a)debian.org> wrote: > The next two rule sets are for the statistic tools "bindgraph" and > "mailgraph". The first parses bind query logs and does nice graphs out > of them, the second does the same for postfix+amavis logs. Do we need to have two different domains for programs that do the same thing? Both bindgraph and mailgraph can read the same file types as input and their output can be accessed by cgi-bin scripts. It seems that there is little (if any) benefit in isolating them. If we were to assign different types to different log files (may require code changes in syslogd) then we could deny the mailgraph program the ability to read log files other than mail.log and deny the bindgraph program the ability to read mail.log. Also note that in your policy both those programs can read /var/log/auth.log (Debian) and /var/log/secure (Fedora). This is not desirable, we probably should make changes to the syslog setup. One possible change is greater use of sub-directories in /var/log. We could have /var/log/security/ for auth.log, secure, and any other security critical log files and /var/log/mail/ for mail server log files (including POP server, and maybe webmail), etc. Doing this would allow different types for the log files with no code changes to syslogd, and this would make it more beneficial to have separate domains for mailgraph and bindgraph. I've CC'd this to fedora-selinux and debian-devel because if we make such changes then we want to get some cross-distribution agreement on file names. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 2

Wiped installation - 541 kernel - SELinux cleared?
by Jim Cornette 04 Sep '04

04 Sep '04

After viewing the logs myself, I think that SELinux was working properly. I deleted the installation and am using it as a clean download partition for the FC3T2 iso files. It looks like SELInux is working pretty decent up until gawk, the latest kernel, etc: Jim -- You're at the end of the road again.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2004