selinux January 2005

selinux@lists.fedoraproject.org

50 participants
68 discussions

quota files oddity...
by Valdis.Kletnieks＠vt.edu 20 Jan '05

20 Jan '05

Running FC from the devel tree as of last night, and a 2.6.10-mm1-RT kernel. OK.. So I go and put user and group quotas on all the R/W file systems (it's a lot quicker to run 'repquota /full.fs' than to run 'du' and similar when you're sitting at 99%.. ;) Then quite some time later I run setfiles because I was pretty sure that I had a lot of files that hadn't been installed by rpm and thus didn't have the right contexts on them, and I get: /usr/sbin/setfiles: relabeling /aquota.user from system_u:object_r:quota_db_t to system_u:object_r:default_t /aquota.user: Operation not permitted /usr/sbin/setfiles: unable to relabel /aquota.user to system_u:object_r:default_t /usr/sbin/setfiles: relabeling /aquota.group from system_u:object_r:quota_db_t to system_u:object_r:default_t /aquota.group: Operation not permitted /usr/sbin/setfiles: unable to relabel /aquota.group to system_u:object_r:default_t /usr/sbin/setfiles: relabeling /boot/aquota.user from system_u:object_r:quota_db_t to system_u:object_r:boot_t /boot/aquota.user: Operation not permitted /usr/sbin/setfiles: unable to relabel /boot/aquota.user to system_u:object_r:boot_t /usr/sbin/setfiles: relabeling /boot/aquota.group from system_u:object_r:quota_db_t to system_u:object_r:boot_t /boot/aquota.group: Operation not permitted /usr/sbin/setfiles: unable to relabel /boot/aquota.group to system_u:object_r:boot_t /usr/sbin/setfiles: relabeling /usr/aquota.user from root:object_r:quota_db_t to system_u:object_r:usr_t /usr/aquota.user: Operation not permitted /usr/sbin/setfiles: unable to relabel /usr/aquota.user to system_u:object_r:usr_t /usr/sbin/setfiles: relabeling /usr/aquota.group from system_u:object_r:quota_db_t to system_u:object_r:usr_t /usr/aquota.group: Operation not permitted /usr/sbin/setfiles: unable to relabel /usr/aquota.group to system_u:object_r:usr_t Is there any way to express: $MOUNTPOINT/aquota\.(user|group)$ -- system_u:object_r:quota_db_t in the .fc files, or do we need to settle for '/.*/aquota\.(user|group)' as the regexp? (And no, I have no idea how I ended up with 'root:object_r:quota_db_t' on /usr/aquota.user, but the other ones were system_u....)

1 0

PHP 5.0.3 ldap.so extension denied
by Robert L Cochran 19 Jan '05

19 Jan '05

I compiled PHP version 5.0.3 from source obtained from php.net on a Pentium 4 system running Fedora Core 3 and this message appears in /var/log/messages after httpd starts: audit(1106189173.206:0): avc: denied { execute } for pid=3999 path=/usr/lib/20041030/ldap.so dev=dm-0 ino=3129353 scontext=user_u:system_r:httpd_t tcontext=root:object_r:lib_t tclass=file /usr/lib/20041030/ldap.so is a PHP "extension". How can I fix this problem and allow the extension execute permission? Any help gratefully accepted! Thanks a lot, Bob Cochran Greenbelt, Maryland

2 3

Keynote speaker announced for SELinux symposium
by Frank Mayer 19 Jan '05

19 Jan '05

For those of you planning to attend the SELinux symposium in March, we just announced the keynote speaker: Dan Wolf, Director of the Information Assurance Directorate at NSA. You can see the full announcement at www.selinux-symposium.org. Just a friendly reminder, if you are planning to attend, early discounted registration end Feb 5. Regards, Frank

3 2

dhcpd targeted policy
by Rogelio J. Baucells 19 Jan '05

19 Jan '05

Hi, I am running a FC3 computer with the latest targeted policy (selinux-policy-targeted-1.17.30-2.68) and I am getting the following messages at the time dhcpd starts: ----------------------------------------------------------------- audit(1105547723.050:0): avc: denied { net_admin } for pid=6247 exe=/usr/sbin/dhcpd capability=12 scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=capability audit(1105547723.244:0): avc: denied { read } for pid=6247 exe=/usr/sbin/dhcpd name=cacert.org.pem dev=hdc2 ino=230129 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:usr_t tclass=file ----------------------------------------------------------------- I looked at the configuration file (dhcpd.conf) and I do not see any place where I am referencing the cacert.org cert file. I use that file for other services and it is located at (/usr/share/ssl/certs). Is there any information on how to resolve this errors? Thanks RJB

2 2

mysql-server-3.23.58-14 on FC3 x86
by Tolan Blundell 19 Jan '05

19 Jan '05

Hi, I just did a yum upgrade and it's killed MySQL, the problem seems to be with selinux.. When I try to start mysqld it fails, and I get the following in /var/log/messages: [...] Jan 7 20:33:17 thome kernel: audit(1105129997.241:0): avc: denied { associate } for pid=6221 exe=/usr/libexec/mysqld name=mysql.sock scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:fs_t tclass=filesystem Jan 7 20:33:27 thome mysqld: Starting MySQL: failed [...] I see from the changelog that there have been some changes to the selinux config in this package [...] * Wed Jan 05 2005 Tom Lane <tgl(a)redhat.com> 3.23.58-14 - work around SELinux restriction that breaks mysql_install_db (bug #141062) - Add a restorecon to keep the mysql.log file in the right context (bz#143887) - Fix init script to not need a valid username for startup check (bz#142328) - Don't assume /etc/my.cnf will specify pid-file (bz#143724) [...] Any suggestions gratefully received :) Tolan.

2 1

Getting PostgreSQL working again
by Ian Pilcher 19 Jan '05

19 Jan '05

I just returned from 5 weeks out of the country, and one of the updates that rolled out in that time is preventing PostgreSQL from starting. The exact error message is: Jan 16 16:57:53 home kernel: audit(1105916273.121:0): avc: denied { read } for pid=7164 exe=/usr/bin/postgres name=PG_VERSION dev=md1 ino=296800 scontext=root:system_r:postgresql_t tcontext=user_u:object_r:var_lib_t tclass=file I found one thread about this problem, but it did not seem to contain a solution. (Unlike that poster, my database is in my root filesystem.) I'm all for a theoretical discussion about why this happened, but I would also really appreciate anyone who can tell me how to get things working again. Thanks! -- ======================================================================== Ian Pilcher i.pilcher(a)comcast.net ========================================================================

2 2

FEDORA CORE 3.0 MANUAL
by Debasis_Ghosh_-_Indal_Kolkata_Library＠adityabirla.com 19 Jan '05

19 Jan '05

I would like to know whether any online reference manual or a list of useful commands and interpretations for Fedora Core is available. I would be grateful for any good help. Regards Debasis Ghosh ghoshd(a)adityabirla.com Disclaimer: The information contained in this communication is intended solely for the individual or entity to which it is addressed. It may contain confidential and/or legally privileged information. Any review, retransmission, dissemination or other use of, or taking any action in reliance on the contents of this information by persons or entities other than the intended recipient is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by responding to this email and then delete it from your system. Aditya Birla Group Companies attempts to sweep e-mails and attachments for viruses, it does not guarantee that either are virus free and that we accept no liability for any damage sustained as a result of viruses.

1 0

systrace + selinux + fedora core 4ish?
by Justin Conover 18 Jan '05

18 Jan '05

http://www.systrace.org/ http://www.citi.umich.edu/u/provos/systrace/linux.html Anybody, seen/use systrace on FC? What are your thoughts about using/adding it to FC? >From reading a bit about it, looks to be a very good/useful tool and was wondering what others thought about it?

4 3

SELinux on CentOS 3.4?
by Justin Conover 18 Jan '05

18 Jan '05

Does anyone know if it is possible to install SELinux on CentOS? I thought Dan Walsh used to have a rhel 3.0 script that would add a yum.repo and install the packages, but I don't see it. ftp://people.redhat.com/dwalsh/SELinux/ Could I simply grab/rebuild the srpms and install those on to it or would that be a dep nightmare. ftp://people.redhat.com/dwalsh/SELinux/srpms/ thx,

2 1

more 'modules_object_t' stuff... udev_t?
by Tom London 17 Jan '05

17 Jan '05

Running strict/enforcing, latest rawhide. I happened to boot with the KVM set to another computer. When I set the KVM to point to 'this' machine, I 'reset' the mouse by unplugging/plugging it back into the KVM'. (Yeah, I know, but it seems to be the only thing that makes the wheel work on this computer. Works fine on other systems....) Anyway, doing this produced the following: Jan 17 09:32:16 fedora hal.hotplug[3737]: DEVPATH is not set Jan 17 09:32:16 fedora hal.hotplug[3746]: DEVPATH is not set Jan 17 09:32:16 fedora kernel: audit(1105983136.436:0): avc: denied { search } for pid=3747 exe=/bin/bash name=modules dev=hda2 ino=3178500 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:modules_object_t tclass=dir Jan 17 09:32:16 fedora kernel: input: PS2++ Logitech Wheel Mouse on isa0060/serio1 Jan 17 09:32:16 fedora kernel: audit(1105983136.756:0): avc: denied { search } for pid=3755 exe=/bin/bash name=modules dev=hda2 ino=3178500 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:modules_object_t tclass=dir Jan 17 09:32:16 fedora kernel: audit(1105983136.861:0): avc: denied { search } for pid=3763 exe=/bin/bash name=modules dev=hda2 ino=3178500 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:modules_object_t tclass=dir Jan 17 09:32:19 fedora kernel: psmouse.c: Wheel Mouse at isa0060/serio1/input0 lost synchronization, throwing 2 bytes away. Does udev_t need r_dir_file(udev_t, module_object_t) or allow udev_t module_object_t:dir r_dir_perms; ? tom -- Tom London

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2005