selinux January 2005

selinux@lists.fedoraproject.org

50 participants
68 discussions

1105 fails to boot....
by Tom London 07 Nov '05

07 Nov '05

Running strict/enforcing, latest rawhide: After installing latest packages, relabeling /etc, /bin, /lib, .... and rebooting, the system produces lots of udev type errors (cannot remove /dev/.udev_tdb/classSTUFF) and hangs on 'adding hardware' Boots (with messages) in permissive mode. Here are the 'early' AVCs: Jan 21 07:24:30 fedora kernel: SELinux: initialized (dev bdev, type bdev), uses genfs_contexts Jan 21 07:24:30 fedora kernel: SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts Jan 21 07:24:30 fedora kernel: SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts Jan 21 07:24:30 fedora kernel: audit(1106292231.919:0): avc: denied { read } for pid=478 exe=/bin/hostname path=/init dev=rootfs ino=17 scontext=system_u:system_r:hostname_t tcontext=system_u:object_r:root_t tclass=file Jan 21 07:24:30 fedora kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts Jan 21 07:24:30 fedora kernel: audit(1106292233.809:0): avc: denied { read } for pid=576 exe=/sbin/restorecon path=/init dev=rootfs ino=17 scontext=system_u:system_r:restorecon_t tcontext=system_u:object_r:root_t tclass=file Jan 21 07:24:30 fedora kernel: audit(1106292234.081:0): avc: denied { read } for pid=576 exe=/sbin/restorecon name=customizable_types dev=hda2 ino=4506184 scontext=system_u:system_r:restorecon_t tcontext=system_u:object_r:default_context_t tclass=file Jan 21 07:24:30 fedora kernel: audit(1106292235.062:0): avc: denied { use } for pid=702 exe=/bin/dmesg path=/init dev=rootfs ino=17 scontext=system_u:system_r:dmesg_t tcontext=system_u:system_r:kernel_t tclass=fd Jan 21 07:24:30 fedora kernel: audit(1106292235.062:0): avc: denied { read } for pid=702 exe=/bin/dmesg path=/init dev=rootfs ino=17 scontext=system_u:system_r:dmesg_t tcontext=system_u:object_r:root_t tclass=file Jan 21 07:24:30 fedora kernel: audit(1106292235.086:0): avc: denied { read } for pid=703 exe=/bin/bash path=/init dev=rootfs ino=17 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:root_t tclass=file Jan 21 07:24:30 fedora kernel: audit(1106292239.427:0): avc: denied { use } for pid=1233 exe=/sbin/kmodule path=/init dev=rootfs ino=17 scontext=system_u:system_r:kudzu_t tcontext=system_u:system_r:kernel_t tclass=fd Jan 21 07:24:30 fedora kernel: audit(1106292239.428:0): avc: denied { read } for pid=1233 exe=/sbin/kmodule path=/init dev=rootfs ino=17 scontext=system_u:system_r:kudzu_t tcontext=system_u:object_r:root_t tclass=file Jan 21 07:24:30 fedora ptal-mlcd: SYSLOG at ExMgr.cpp:652, dev=<mlc:usb:PSC_900_Series>, pid=2629, e=2, t=1106321070 ptal-mlcd successfully initialized. Jan 21 07:24:30 fedora ptal-printd: ptal-printd(mlc:usb:PSC_900_Series) successfully initialized using /var/run/ptal-printd/mlc_usb_PSC_900_Series*. Jan 21 07:24:30 fedora kernel: Floppy drive(s): fd0 is 1.44M I'll probe a bit, but any help is welcome! tom -- Tom London

4 7

ntpd drift.TEMP file
by mroselinux＠eastgranby.k12.ct.us 06 Mar '05

06 Mar '05

I have just built an FC3 samba server using the K12LTSP iso's and am getting the following messages on the log. Jan 21 01:55:14 admin ntpd[9988]: can't open /etc/ntp/drift.TEMP: Permission denied Jan 21 01:55:14 admin kernel: audit(1106290514.375:0): avc: denied { write } for pid=9988 exe=/usr/sbin/ntpd name=ntp dev=hda3 ino=3392705 scontext=root:system_r:ntpd_t tcontext=system_u:object_r:etc_t tclass=dir With SELinux enabled, the drift file could not be created. In permissive mode, the drift file is properly created and updated. What have I done wrong? [root@admin ntp]# ls -dZ . drwxr-xr-x ntp ntp system_u:object_r:etc_t [root@admin ntp]# ls -lZ drift -rw-r--r-- ntp ntp root:object_r:etc_t drift Mark Orenstein East Granby, CT School System

5 8

load_policy in chroot question
by Bob Kashani 21 Feb '05

21 Feb '05

When I install the selinux-policy-targeted rpm in a chroot it seems that load_policy is executed and loads the policy that's installed in the chroot into the running kernel (I'm assuming via %post). Should installing the selinux-policy-targeted rpm in a chroot allow this to happen? What if you're installing a policy into the chroot that's different than the one you have installed on your system? Is there a way to not allow load_policy to execute in a chroot? Here is the AVC messages I'm getting: Jan 8 21:38:23 chaucer kernel: audit(1105249103.605:0): avc: granted { load_policy } for pid=4233 exe=/usr/sbin/load_policy scontext=root:system_r:unconfined_t tcontext=system_u:object_r:security_t tclass=security Jan 8 21:38:23 chaucer kernel: security: 3 users, 4 roles, 316 types, 20 bools Jan 8 21:38:23 chaucer kernel: security: 53 classes, 7962 rules Bob -- Bob Kashani http://www.ocf.berkeley.edu/~bobk/garnome

6 17

New user/role transition error
by Steve Brueckner 19 Feb '05

19 Feb '05

I'm trying to add a new role and test it by adding a user with access to that role. I can su to the new user, but then when I try to newrole I get "... is not a valid context". Here are my steps so far; I'm starting from the default strict policy: #useradd engineer Added the following to .../strict/src/policy/users user engineer roles { user_r developer_r }; Added the following to .../strict/src/policy/domains/user.te full_user_role(developer) allow system_r developer_r allow sysadm_r developer_r allow user_r developer_r allow staff_r developer_r Added the following into in_user_role macro in .../strict/src/policy/macros/user_macros.te role developer_r types $1; Added the following to .../strict/src/policy/appconfig/default_type developer_r:user_t #make load steve$ id -Z user_u:user_r:user_t steve$ su engineer engineer$ id -Z engineer:user_r:user_t engineer$ newrole -r developer_r engineer:developer_r:user_t is not a valid context Any ideas what I've neglected in setting this up? Thanks!

2 1

SELinux on RH3
by Juan Espino 17 Feb '05

17 Feb '05

3 3

findutils-4.2.15
by Tim Waugh 17 Feb '05

17 Feb '05

Hi, I just updated findutils to 4.2.15 in devel. Please check that I didn't make any mistakes porting the findutils-selinux.patch. Thanks, Tim. */

3 2

Request Tracker 3
by Kanwar Ranbir Sandhu 03 Feb '05

03 Feb '05

Hello Everyone, Has anyone attempted to run RT3 (3.2.2) on a FC3 system? I'm running into a bunch of selinux errors, and I'm having problems resolving the issue: I'm just not very familiar with selinux. Here's the error in /var/log/httpd/error_log: ---start--- [Sun Jan 30 19:42:14 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sun Jan 30 19:42:17 2005] [notice] Digest: generating secret for digest authentication ... [Sun Jan 30 19:42:17 2005] [notice] Digest: done [Sun Jan 30 19:42:17 2005] [notice] LDAP: Built with OpenLDAP LDAP SDK [Sun Jan 30 19:42:17 2005] [notice] LDAP: SSL support unavailable [Sun Jan 30 19:42:17 2005] [notice] FastCGI: process manager initialized (pid 669) [Sun Jan 30 19:42:17 2005] [warn] FastCGI: server "/var/www/rt/bin/mason_handler.fcgi" started (pid 670) [Sun Jan 30 19:42:17 2005] [notice] mod_python: Creating 4 session mutexes based on 256 max processes and 0 max threads. [Sun Jan 30 19:42:19 2005] [notice] Apache/2.0.52 (Fedora) configured -- resuming normal operations [Sun Jan 30 19:42:22 2005] [warn] FastCGI: server "/var/www/rt/bin/mason_handler.fcgi" started (pid 679) [Sun Jan 30 19:42:27 2005] [warn] FastCGI: server "/var/www/rt/bin/mason_handler.fcgi" started (pid 681) [Sun Jan 30 19:42:32 2005] [warn] FastCGI: server "/var/www/rt/bin/mason_handler.fcgi" started (pid 682) Log file /var/log/rt.log couldn't be written or created. RT can't run. at /var/www/rt/lib/RT.pm line 204. ---end--- And here's what's output to /var/log/messages while that's going on: ---start-- avc: denied { getattr } for pid=681 exe=/usr/bin/perl path=/var/log dev=dm-5 ino=129025 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:var_log_t tclass=dir avc: denied { ioctl } for pid=693 exe=/usr/bin/perl path=/var/log/httpd/error_log dev=dm-5 ino=129070 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:httpd_log_t tclass=file avc: denied { read } for pid=693 exe=/usr/bin/perl name=tmp dev=dm-3 ino=12 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:tmp_t tclass=lnk_file ---end--- Ummm..not quite sure how to interpret that. But, it looks like selinux doesn't like the context of /var/log/rt.log, which currently is: -rw-r--r-- root rt system_u:object_r:httpd_log_t /var/log/rt.log And for /var/log/http (as well as for all files within): drwx------ root root system_u:object_r:httpd_log_t I could just turn off selinux, but seeing as how I've managed to run SugarCRM and Mambo on the same box, RT3 should work as well. Thanks in advance. Regards, Ranbir -- Kanwar Ranbir Sandhu Linux Consultant Systems Aligned Inc. www.systemsaligned.com

3 22

execmod avcs from today's policy
by Tom London 02 Feb '05

02 Feb '05

Running strict/enforcing, today's Rawhide. Noticed the avcs below in the log. I believe the java one may be from the sun JVM I have installed.... xscreensaver and helixplayer ones are new. My understanding is that I need to set the boolean 'allow_execmod' to allow this kind of thing (although nothing appears broken....) Do I have that correct? tom Jan 28 07:54:36 fedora gdm(pam_unix)[3218]: session opened for user tbl by (uid=0) Jan 28 07:54:48 fedora kernel: audit(1106927688.744:0): avc: denied { execmod } for pid=3491 comm=xscreensaver-gl path=/usr/X11R6/lib/libGL.so.1.2 dev=hda2 ino=4127021 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file Jan 28 07:54:57 fedora kernel: audit(1106927697.979:0): avc: denied { execmod } for pid=3549 comm=java path=/lib/libc-2.3.4.so dev=hda2 ino=3178539 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file Jan 28 07:55:19 fedora kernel: audit(1106927719.841:0): avc: denied { execmod } for pid=3650 comm=hxplay.bin path=/usr/lib/helix/plugins/swfrender.so dev=hda2 ino=4375247 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file Jan 28 07:55:21 fedora kernel: audit(1106927721.289:0): avc: denied { execmod } for pid=3650 comm=hxplay.bin path=/usr/lib/helix/plugins/oggfformat.so dev=hda2 ino=4376641 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file Jan 28 07:55:21 fedora kernel: audit(1106927721.316:0): avc: denied { execmod } for pid=3650 comm=hxplay.bin path=/usr/lib/helix/plugins/theorarend.so dev=hda2 ino=4376654 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file Jan 28 07:55:22 fedora kernel: audit(1106927722.757:0): avc: denied { execmod } for pid=3650 comm=hxplay.bin path=/usr/lib/helix/plugins/vorbisrend.so dev=hda2 ino=4376655 scontext=user_u:user_r:user_t tcontext=system_u:object_r:shlib_t tclass=file

3 10

other Raw Hide avc messages
by Joe Orton 01 Feb '05

01 Feb '05

selinux-policy-targeted-1.21.5-1 kernel-2.6.10-1.1115_FC4 one lot of: type=KERNEL msg=audit(1107189317.896:165031): avc: denied { create } for pid= 3061 exe=/usr/sbin/htt_server name=.iiimp-unix scontext=user_u:system_r:i18n_inp ut_t tcontext=user_u:object_r:i18n_input_var_run_t tclass=dir and many times: type=KERNEL msg=audit(1107189602.159:494563): avc: denied { transition } for pid=3596 exe=/usr/sbin/crond path=/bin/bash dev=hda3 ino=1933320 scontext=user_u :system_r:crond_t tcontext=system_u:system_r:unconfined_t tclass=process which seems to mean that all cron scripts are failing and I am getting a execl: couldn't exec `/bin/sh' execl: Permission denied message from crond every couple of minutes. joe

2 3

Squirrelmail, MySQL-change password and SELinux
by Roger Grosswiler 01 Feb '05

01 Feb '05

Hi, tried successfully installing squirrelmail with mysql authentication. After installting the change_mysql-plugin, i got the following message in /var/log/messages: > Jan 31 22:21:53 frodo kernel: audit(1107206513.281:0): avc: denied { write } for pid=12823 exe=/usr/sbin/httpd name=mysql.sock dev=dm-0 ino=360554 scontext=root:system_r:httpd_t tcontext=root:object_r:var_lib_t tclass=sock_file > Jan 31 22:22:07 frodo kernel: audit(1107206527.169:0): avc: denied { write } for pid=12825 exe=/usr/sbin/httpd name=mysql.sock dev=dm-0 ino=360554 scontext=root:system_r:httpd_t tcontext=root:object_r:var_lib_t tclass=sock_file while squirrel's plugin meant, that the database is busy. If i understand the above right, selinux didn't let the plugin write the new password in the mysql-database. What can i do (except disabling selinux)? Thanks, Roger

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2005