selinux October 2005

selinux@lists.fedoraproject.org

52 participants
53 discussions

trying to use MCS
by Gene Czarcinski 29 Oct '05

29 Oct '05

OK, I have "current" development installed and now I want to start playing with MCS. I have figured out that running targeted is also running MCS ... good so far. As root, I can change categories with chcon and chcat. Defining some "test" categories in setrans.conf takes effect immediately and that works ... as root. BUT, as a "regular user", I cannot seem to do anything. How do I define what users can use what categories? Sorry if I am a bit dense but I could find nothing about this searching this or other related mailing lists. Gene

1 1

procmail is not allowed to talk to spamassassin
by Nicolas Mailhot 28 Oct '05

28 Oct '05

Hi, Looking at audit logs I see several : type=AVC msg=audit(1130513065.226:40): avc: denied { execute } for pid=2935 comm="procmail" name="spamc" dev=dm-0 ino=3349141 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file Shouldn't procmail be allowed to talk to spamassassin ? it's a common enough usage pattern. (system is up-to-date rawhide, selinux-policy-targeted-1.27.2-8) Regards, -- Nicolas Mailhot

2 8

Getting "Inappropriate ioctl" :during initrd stage of booting.
by Aggarwal, VikasX 28 Oct '05

28 Oct '05

Hi, Please tell if there is a way to turn off the selinux after full installation but before first boot. I have a daemon which needs to do ioctl during initrd. daemon + related-driver is already inserted into a new-initrd. Daemon can do ioctl during normal operation of a running machine, but will get "Inappropriate ioctl for device /dev/iscsictl" if built into initrd. Its just a control interface to a software iscsi driver and daemon needs to pass some handler during initrd stage. I already tried passing selinux=0, enforcing=0, disable=1. But looks the selinux policy to disallow ioctl during initrd is built in kernel. I have little knowledge in this area. Will appreciate any ideas for workaround. thanks -vikas

2 1

Port to use in MTA when communicating with mail filter ?
by Nicolas Mailhot 28 Oct '05

28 Oct '05

Hi, I'm using postfix with the amavid-new spam/virus mail filter. In this type of configuration the MTA sends every processed mail to the filter daemon on one port, and receives the result of the filtering on another. The online documentation is not too clear, but the commonly used ports seem to be on the 10024-10026 range. In my setup the MTA listens on port 10026 and the filter on port 10025. Unfortunately that means the selinux policy in Raw Hide blocks postfix startup: Oct 23 11:56:21 rousalka postfix/master[2076]: fatal: bind 127.0.0.1 port 10026: Permission denied Therefore, I'd like to know: 1. if a port has already been allocated in the Fedora Devel targeted policy for MTA <- filter communication 2. if yes which one is it so I make my installation conformant 3. if not would it be possible to add it? I'm ready to poll the postfix/amavisd-new lists to find out what the canonical port to use would be. Regards, -- Nicolas Mailhot

2 2

Re: fedora-selinux-list Digest, Vol 20, Issue 18
by Jayendren Anand Maduray 28 Oct '05

28 Oct '05

Greetings fellow travellers. Could someone please help me with the following errors: *audit(1129788324.500:0): avc: denied { execute } for pid=3105 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.501:0): avc: denied { execute } for pid=3106 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.507:0): avc: denied { execute } for pid=3107 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.510:0): avc: denied { execute } for pid=3108 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.514:0): avc: denied { execute } for pid=3109 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.517:0): avc: denied { execute } for pid=3110 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.521:0): avc: denied { execute } for pid=3111 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.522:0): avc: denied { execute } for pid=3112 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.528:0): avc: denied { execute } for pid=3113 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file audit(1129788324.529:0): avc: denied { execute } for pid=3114 exe=/usr/sbin/squid name=squidclamav dev=hda8 ino=185872 scontext=user_u:system_r:squid_t t context=root:object_r:usr_t tclass=file* These errors are from dmesg, and occured after compiling and installing squidclam from source. Here is the output of selinuxconf: [*root@shiva jay]# selinuxconfig selinux state="enforcing" policypath="/etc/selinux/targeted" default_type_path="/etc/selinux/targeted/contexts/default_type" default_context_path="/etc/selinux/targeted/contexts/default_contexts" default_failsafe_context_path="/etc/selinux/targeted/contexts/failsafe_context" binary_policy_path="/etc/selinux/targeted/policy/policy" user_contexts_path="/etc/selinux/targeted/contexts/users/" contexts_path="/etc/selinux/targeted/contexts"* Output of uname -a: *[root@shiva jay]# uname -a Linux shiva 2.6.9-1.667smp #1 SMP Tue Nov 2 14:59:52 EST 2004 i686 i686 i386 GNU/Linux* Any help would be greatly appreciated. God bless. fedora-selinux-list-request(a)redhat.com wrote: >Send fedora-selinux-list mailing list submissions to > fedora-selinux-list(a)redhat.com > >To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/fedora-selinux-list >or, via email, send a message with subject or body 'help' to > fedora-selinux-list-request(a)redhat.com > >You can reach the person managing the list at > fedora-selinux-list-owner(a)redhat.com > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of fedora-selinux-list digest..." > > >Today's Topics: > > 1. Re: mailman cgi-bin denied search (Tim Fenn) > 2. Preserving Context with tar (W. Scott wilburn) > 3. Re: mailman cgi-bin denied search (Daniel J Walsh) > 4. Re: Preserving Context with tar (Daniel J Walsh) > 5. Re: mailman cgi-bin denied search (Tim Fenn) > 6. Re: Preserving Context with tar (Stephen Smalley) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Wed, 19 Oct 2005 13:49:47 -0700 >From: Tim Fenn <fenn(a)stanford.edu> >Subject: Re: mailman cgi-bin denied search >To: Daniel J Walsh <dwalsh(a)redhat.com> >Cc: fedora-selinux-list(a)redhat.com >Message-ID: <20051019204947.GC6466(a)stanford.edu> >Content-Type: text/plain; charset=us-ascii > >On Wed, Oct 19, 2005 at 09:57:07AM -0400, Daniel J Walsh wrote: > > >>Tim Fenn wrote: >> >> >>>I recently installed mailman on my FC3 box (using the redhat based >>>RPMs), and it seems to be working just fine, except for the numerous >>>avc messages it cranks out whenever I run one of the cgi scripts >>>associated with mailman (e.g. via the web interface): >>> >>>Oct 19 00:34:21 agora kernel: audit(1129707261.236:212): avc: denied >>>{ search } for pid=18761 comm="listinfo" name="run" dev=sda1 >>>ino=1294372 scontext=root:system_r:mailman_cgi_t tcontext=system_ >>>u:object_r:var_run_t tclass=dir >>> >>> >>> >>Why would mailman listinfo be searching /var/log directory? >> >> >> > >Well, I get the same errors with mailmanctl: > >./mailmanctl status > >yields no output, and the following errors: >Oct 19 13:22:39 agora kernel: audit(1129753359.647:314): avc: denied >{ read write } for pid=20837 comm="mailmanctl" name="3" dev=devpts >ino=5 scontext=root:system_r:mailman_mail_t >tcontext=root:object_r:devpts_t tclass=chr_file >Oct 19 13:22:39 agora kernel: audit(1129753359.694:318): avc: denied >{ search } for pid=20837 comm="mailmanctl" name="run" dev=sda1 >ino=1294372 scontext=root:system_r:mailman_mail_t >tcontext=system_u:object_r:var_run_t tclass=dir >Oct 19 13:22:39 agora kernel: audit(1129753359.802:322): avc: denied >{ setgid } for pid=20837 comm="mailmanctl" capability=6 >scontext=root:system_r:mailman_mail_t >tcontext=root:system_r:mailman_mail_t tclass=capability > >However, if I comment out: > >from Mailman.Logging.Syslog import syslog > >in the mailmanctl script, all is well: > ># ./mailmanctl status >mailman (pid 17677) is running... > >and no error messages. I would assume the same is true with the >cgi-bin scripts, such as listinfo. Should I file a bugzilla report? > >Regards, >Tim > > > >------------------------------ > >Message: 2 >Date: Wed, 19 Oct 2005 15:56:06 -0600 >From: "W. Scott wilburn" <wilburn(a)lanl.gov> >Subject: Preserving Context with tar >To: fedora-selinux-list(a)redhat.com >Message-ID: <20051019215606.GE4717(a)wilburn.lanl.gov> >Content-Type: text/plain; charset=us-ascii > >Sorry to be asking such a simple question. Is it possible to preserve >file contexts using tar? I would have thought -p would do this, but >it appears no, atleast on RHEL4 and FC4. > >The reason to do this is a use tar to install modified config files on >new machines. Having to relabel after doing this is somewhat slow. >Perhaps there is a better solution? > >Thanks, >Scott Wilburn > > > >------------------------------ > >Message: 3 >Date: Wed, 19 Oct 2005 22:31:36 -0400 >From: Daniel J Walsh <dwalsh(a)redhat.com> >Subject: Re: mailman cgi-bin denied search >To: Daniel J Walsh <dwalsh(a)redhat.com>, fedora-selinux-list(a)redhat.com >Message-ID: <43570188.5060201(a)redhat.com> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Tim Fenn wrote: > > >>On Wed, Oct 19, 2005 at 09:57:07AM -0400, Daniel J Walsh wrote: >> >> >> >>>Tim Fenn wrote: >>> >>> >>> >>>>I recently installed mailman on my FC3 box (using the redhat based >>>>RPMs), and it seems to be working just fine, except for the numerous >>>>avc messages it cranks out whenever I run one of the cgi scripts >>>>associated with mailman (e.g. via the web interface): >>>> >>>>Oct 19 00:34:21 agora kernel: audit(1129707261.236:212): avc: denied >>>>{ search } for pid=18761 comm="listinfo" name="run" dev=sda1 >>>>ino=1294372 scontext=root:system_r:mailman_cgi_t tcontext=system_ >>>>u:object_r:var_run_t tclass=dir >>>> >>>> >>>> >>>> >>>Why would mailman listinfo be searching /var/log directory? >>> >>> >>> >>> >>Well, I get the same errors with mailmanctl: >> >>./mailmanctl status >> >>yields no output, and the following errors: >>Oct 19 13:22:39 agora kernel: audit(1129753359.647:314): avc: denied >>{ read write } for pid=20837 comm="mailmanctl" name="3" dev=devpts >>ino=5 scontext=root:system_r:mailman_mail_t >>tcontext=root:object_r:devpts_t tclass=chr_file >>Oct 19 13:22:39 agora kernel: audit(1129753359.694:318): avc: denied >>{ search } for pid=20837 comm="mailmanctl" name="run" dev=sda1 >>ino=1294372 scontext=root:system_r:mailman_mail_t >>tcontext=system_u:object_r:var_run_t tclass=dir >>Oct 19 13:22:39 agora kernel: audit(1129753359.802:322): avc: denied >>{ setgid } for pid=20837 comm="mailmanctl" capability=6 >>scontext=root:system_r:mailman_mail_t >>tcontext=root:system_r:mailman_mail_t tclass=capability >> >>However, if I comment out: >> >>from Mailman.Logging.Syslog import syslog >> >>in the mailmanctl script, all is well: >> >># ./mailmanctl status >>mailman (pid 17677) is running... >> >>and no error messages. I would assume the same is true with the >>cgi-bin scripts, such as listinfo. Should I file a bugzilla report? >> >>Regards, >>Tim >> >> >> >Yes. submit a bug. Although generating these in FC4 would be far more >interesting. Also do these AVC messages cause problems or are they just >being reported. No output from the script is fixed in FC4. > > > > > -- Jayendren Anand Maduray Microsoft Certified Professional Network Plus IT Administrator Perinatal HIV Research Unit Old Potch Road Chris Hani Baragwanath Hospital Soweto South Africa Tel: +27 11 989 9776 Tel: +27 11 989 9999 Fax: +27 11 938 3973 Cel: 082 22 774 94 Alternate email address: jayendren(a)mweb.co.za

2 11

avahi - needs transition?
by Tom London 27 Oct '05

27 Oct '05

Running targeted/enforcing, latest rawhide. The avahi-daemon fails to start: Oct 27 14:47:39 localhost avahi-daemon[2279]: Found user 'avahi' (UID 70) and group 'avahi' (GID 70). Oct 27 14:47:39 localhost avahi-daemon[2279]: Successfully dropped root privileges. Oct 27 14:47:39 localhost avahi-daemon[2279]: avahi-daemon 0.5.2 starting up. Oct 27 14:47:39 localhost avahi-daemon[2279]: dbus_bus_get(): Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory Works OK in permissive mode, but 'ps -Z' shows the daemon is running in initrc_t. Shouldn't there be a transition to something like howl_t or some such? tom -- Tom London

1 0

AWStats
by Mickey Hill 27 Oct '05

27 Oct '05

Hi all, I have installed awstats (an httpd log file analyzer) from Extras and am having some SELinux issues. I've gotten the same results on FC4 and Rawhide, using current packages and unchanged config files. Below are the steps I went through to get it working. Could someone more knowledgeable provide some feedback on this, or point me in the right direction? Is there a better or more correct way to do this? Is this something that could or should be added to the policy? /usr/share/awstats/wwwroot/cgi-bin/awstats.pl is run as a CGI script by httpd, but is denied. # ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:usr_t awredir.pl -rwxr-xr-x root root system_u:object_r:usr_t awstats.pl Changing the type gets the script running: # chcon -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin/* # ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awredir.pl -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awstats.pl However, the script reports an error. Error: AWStats database directory defined in config file by 'DirData' parameter (/var/lib/awstats) does not exist or is not writable. # ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:var_lib_t awstats ... Changing the type allows the script to run: # chcon -t httpd_sys_script_rw_t /var/lib/awstats # ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:httpd_sys_script_rw_t awstats ... Any thoughts? Thanks, -- Mickey Hill <mickey(a)mickeyhill.com>

4 6

Exporting NTFS filesystems over NFS
by Göran Uddeborg 26 Oct '05

26 Oct '05

The policy apparently does not allow exporting an NTFS filesystem over NFS. I can't see any obvious reason for this choice, but maybe there is something I miss. Is this intentional, or is it a mistake? Or in other words, should I bugzilla or only figure out how to change it for myself? The error message I get trying to export an NTFS fileystem is included below. (If I go into permissive mode everything works as expected.) type=AVC msg=audit(1130008471.475:403): avc: denied { getattr } for pid=9034 comm="exportfs" name="/" dev=sda1 ino=5 scontext=root:system_r:nfsd_t tcontext=system_u:object_r:dosfs_t tclass=dir type=SYSCALL msg=audit(1130008471.475:403): arch=40000003 syscall=196 success=no exit=-13 a0=ffffb80b a1=ffffb76c a2=f7fc2ff4 a3=8052712 items=1 pid=9034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="exportfs" exe="/usr/sbin/exportfs" type=AVC_PATH msg=audit(1130008471.475:403): path="/mnt/remote/teddi" type=CWD msg=audit(1130008471.475:403): cwd="/etc/selinux/strict/contexts/users" type=PATH msg=audit(1130008471.475:403): item=0 name="/mnt/remote/teddi" flags=0 inode=5 dev=08:01 mode=040555 ouid=0 ogid=0 rdev=00:00

2 8

Red Hat Government Users Conference.
by Daniel J Walsh 26 Oct '05

26 Oct '05

FYI: James and I will be speaking on SELinux next week at the Red Hat Government Users Conference in Washington DC. http://www.dlt.com/rhguc/ I will be giving an overview of SELinux talk and a James and I will be running BOF on SELinux. If you are at the conference stop by and say hello. Dan --

1 0

SElinux activation on FC3 to FC4 update
by Daniel Paul 26 Oct '05

26 Oct '05

Hello, I recently upgraded on of our FC3 boxes to FC3 via the normal update procedure. Despite of the FC3 installation wizard the FC4 wizard didn't ask me if I wanted to activate the SElinux feature. What is the preferred way to activate the SElinux layer on a normal FC4 system? Do I simply install the selinux-policy-targeted package? Thank you in advance, Daniel Paul

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2005