selinux March 2005

selinux@lists.fedoraproject.org

64 participants
70 discussions

Selinux under FC-4 ?
by Timothy Murphy 31 Mar '05

31 Mar '05

Will I be able to turn off selinux under FC-4 ? Life is hard enough without inventing problems ... -- Timothy Murphy e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

3 6

using tmpfs for /tmp and selinux
by dragoran 31 Mar '05

31 Mar '05

Is it possible to use tmpfs for /tmp with selinux (targeted) ... I tryed but got many avcs (tmp_t becomes tmpfs_t) for all files in /tmp

4 15

vmware/vmnet:
by Tom London 30 Mar '05

30 Mar '05

Running targeted/enforcing, latest rawhide. Notice the following AVC generated by VMware init sequence: Mar 30 06:33:35 localhost kernel: audit(1112193215.505:0): avc: denied { search } for pid=3690 exe=/sbin/ifconfig name=net dev=sysfs ino=225 scontext=user_u:system_r:ifconfig_t tcontext=system_u:object_r:sysfs_t tclass=dir Mar 30 06:33:35 localhost kernel: vmnet8: failed sysfs registration (-13) This seems to imply: allow ifconfig_t sysfs_t:dir search; ifconfig.te has domain_auto_trans(initrc_t, ifconfig_exec_t, ifconfig_t) So, should ifconfig_t be allowed the same access to sysfs_t as initrc_t, such as r_dir_file(ifconfig_t, sysfs_t) thanks, tom -- Tom London

2 1

selinux-policy-targeted-1.17.30-2.90 troubles. (FC3)
by Omri Schwarz 30 Mar '05

30 Mar '05

A machine installed as FC3 got its update from up2date yesterday and now will no longer allow logins on the console, nor the X console, and will no longer allow the sudoers to sudo. Touching /.autorelabel and rebooting has not fixed the problem. The sudo problem only leaves this message to the console: root:system_r:unconfined_t is not a valid context And this in the logs: Mar 29 18:19:55 HOST sudo: omri : TTY=pts/0 ; PWD=/nfs/newline/h1/omri ; USER=root ; COMMAND=/bin/su root The attempt to log to the X console leaves this in the logs: Mar 29 18:36:22 HOST gdm-binary[5538]: pam_krb5[5538]: authentication succeeds for 'omri' (omri@KRB5REALM) Mar 29 18:36:22 HOST gdm(pam_unix)[5538]: session opened for user omri by (uid=0) Mar 29 18:36:22 HOST gdm[5135]: gdm_cleanup_children: child 5538 crashed of signal 6 Mar 29 18:36:22 HOST gdm[5135]: gdm_cleanup_children: Slave crashed, killing its children Logging in as root leaves what might be slightly more useful: Mar 29 18:43:56 HOST gdm(pam_unix)[6206]: session opened for user root by (uid=0) Mar 29 18:43:56 HOST dbus-daemon-1: avc: could not determine enforcing mode Meanwhile, I can SSH in and su to root without a problem. I am very much an SELinux newbie, and was hoping to learn about this system by installing the targeted policy and seeing it in action, but here I am mystified. None of the messages are enough for me to figure out what needs chcon'ing. So I would be much obliged for any help you could offer.

2 1

httpd controls ?
by Jeremy Ardley 30 Mar '05

30 Mar '05

Hi, I am experimenting with cgi-bin perl scripts to set specific user's passwords. The scripts correctly generate passwords when run from the bash prompt but silently do nothing when invoked on the web page. I assume this is a selinux issue and would like some pointers. 1.Is letting a cgi script change passwords a good idea? 2. If it is safe, how do I persuade selinux to let it happen? Thanks Jeremy

5 8

Everything got broken. selinux-policy-targeted-1.17.30-2.90
by Omri Schwarz 30 Mar '05

30 Mar '05

(Sorry if I break the threading, but my subscription has not kicked in.) Stephen Smalley says: On Wed, 2005-03-30 at 00:56 -0500, Omri Schwarz wrote: >> Right now I have a machine that is using selinux-policy-targeted-1.17.30-2.9 0.n >> oarch.rpm, and I suffer from the same errors: > >> # /usr/sbin/getenforce >> getenforce: getenforce() failed > >> ]# /usr/sbin/getsebool -a >> getsebool: booleans.c:48: security_get_boolean_names: Assertion `selinux_mnt' >> failed. >> Aborted > >> # cat /selinux/enforce >> 1 >What does 'id' show? What is in your /etc/selinux/config file? % more /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=Enforcing # SELINUXTYPE= can take one of these two values: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection. SELINUXTYPE=targeted % id uid=10204(omri) gid=101(cdrecording) groups=0(root),48(apache),101(cdrecording) context=user_u:system_r:unconfined_t >> Mar 30 00:55:15 HOST kernel: audit(1112162115.873:0): avc: denied { search } >> for pid=6178 exe=/sbin/portmap name=etc dev=hda3 ino=229377 >> scontext=root:system_r:portmap_t tcontext=system_u:object_r:home_root_t >> tclass=dir >/etc certainly shouldn't be labeled home_root_t. /sbin/fixfiles restore? Done. Afterwards: % ls -lZ / drwxr-xr-x root root system_u:object_r:bin_t bin drwxr-xr-x root root system_u:object_r:boot_t boot drwxr-xr-x root root system_u:object_r:device_t dev drwxr-xr-x root root system_u:object_r:home_root_t etc drwxr-xr-x root root system_u:object_r:home_root_t home drwxr-xr-x root root system_u:object_r:root_t initrd drwxr-xr-x root root system_u:object_r:lib_t lib drwx------ root root system_u:object_r:lost_found_t lost+found drwxr-xr-x root root system_u:object_r:mnt_t media drwxr-xr-x root root system_u:object_r:default_t misc drwxr-xr-x root root system_u:object_r:mnt_t mnt drwxr-xr-x root root nfs drwxr-xr-x root root system_u:object_r:usr_t opt dr-xr-xr-x root root proc drwxr-x--- root root root:object_r:user_home_dir_t root drwxr-xr-x root root system_u:object_r:sbin_t sbin drwxr-xr-x root root selinux drwxr-xr-x root root system_u:object_r:default_t srv drwxr-xr-x root root sys drwxr-xr-x root root system_u:object_r:default_t tftpboot drwxrwxrwt root root system_u:object_r:tmp_t tmp drwxr-xr-x root root system_u:object_r:usr_t usr drwxr-xr-x root root system_u:object_r:var_t var

3 11

Everything got broken. selinux-policy-targeted-1.17.30-2.90
by Omri Schwarz 30 Mar '05

30 Mar '05

Hi, everyone. Until two days ago, when I ran up2date, I had a machine running FC3 with SELinux targeted, user homedirs coming in over NFS, Apache running and segregated into httpd_t land, and so on and so forth. I ran up2date. And it all went to hell. The upgrade to selinux-policy-targeted-1.17.30-2.90 prevented console logins, use of sudo, and startups from messagebus and httpd. It allowed, however for SSH logins, and use of 'su'. Right now I have a machine that is using selinux-policy-targeted-1.17.30-2.90.n oarch.rpm, and I suffer from the same errors: # /usr/sbin/getenforce getenforce: getenforce() failed ]# /usr/sbin/getsebool -a getsebool: booleans.c:48: security_get_boolean_names: Assertion `selinux_mnt' failed. Aborted # cat /selinux/enforce 1 # cd /selinux/booleans # ls allow_ypbind mysqld_disable_trans squid_disable_trans dhcpd_disable_trans named_disable_trans syslogd_disable_trans httpd_disable_trans named_write_master_zones use_nfs_home_dirs httpd_enable_cgi nscd_disable_trans use_samba_home_dirs httpd_enable_homedirs ntpd_disable_trans use_syslogng httpd_ssi_exec portmap_disable_trans winbind_disable_trans httpd_tty_comm postgresql_disable_trans ypbind_disable_trans httpd_unified snmpd_disable_trans # cat * 1 10 00 01 11 11 10 01 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 ]# cat policyvers 18 Now, for the many multifarious wierdnesses that have sprung up on me: I cannot log in to the console. TTY logins fail silently and X logins leave this in the syslog: Mar 29 18:43:42 HOST gdm(pam_unix)[5945]: session opened for user root by (uid=0) Mar 29 18:43:42 HOST gdm[5135]: gdm_cleanup_children: child 5945 crashed of signal 6 Mar 29 18:43:42 HOST gdm[5135]: gdm_cleanup_children: Slave crashed, killing its children Clearly something is denied a resource by selinux, causing a crash that ends the login session. I cannot sudo: % sudo su root Password: root:system_r:unconfined_t is not a valid context Doing a sudo leaves this in /var/log/secure: Mar 30 00:47:29 HOST sudo: omri : TTY=pts/1 ; PWD=/nfs/newline/h1/omri ; USER=root ; COMMAND=/bin/su root And this in /var/log/messages: Mar 30 00:47:29 HOST sudo(pam_unix)[6028]: authentication failure; logname=omri uid=0 euid=0 tty=pts/1 ruser= rhost= user=omri Mar 30 00:47:29 HOST sudo[6028]: pam_krb5[6028]: authentication succeeds for 'omri' (omri(a)SPACE.MIT.EDU) I can SSH in, but this gets left in the logs: Mar 30 00:43:48 HOST sshd[5941]: error: Failed to set exec security context omri:system_r:unconfined_t for omri. Continuing in permissive mode I can su just fine, which is what lets me play around with these things. The portmapper has its own difficulties: Mar 30 00:55:15 HOST kernel: audit(1112162115.873:0): avc: denied { search } for pid=6178 exe=/sbin/portmap name=etc dev=hda3 ino=229377 scontext=root:system_r:portmap_t tcontext=system_u:object_r:home_root_t tclass=dir Obviously, it's the console logins that I want to solve first and foremost. Any help would be most appreciated.

4 4

Desktop apps interoperability
by Ivan Gyurdiev 29 Mar '05

29 Mar '05

Okay, mozilla's handling of saved files is a problem. Here's what it does - files saved under ROLE_home_dir_t, or ROLE_home_t directories turn to ROLE_mozilla_home_t via file_type_auto_trans. Here's what gift does by default - it has a download folder where it puts stuff. The downloaded files turn to ROLE_gift_home_t (context of parent folder, which is ~/.giFT/completed or something). Here's what mencoder does - it saves stuff as ROLE_mplayer_home_t via file_type_auto_trans. ============== This is bad for interoperability. Using the home_domain macro, the user has access to the home_domain type of an application. However one app has no access to the home_domain type of another app. Basically I can never play (mplayer) a movie that I just downloaded, whether or not it was via mozilla, or gift. Alternatively, there could be a common data type - ROLE_home_t. However none of those apps can save its data directly under /home/username as ROLE_home_t, because all of them have a home_domain, and that's where the file_type_auto_trans rule is used. There can't be more than one file_type_auto_trans on the same folder type (right?). Furthermore this seems to be explicitly avoided for mozilla (it does not write to ROLE_home_t for security reasons - overwriting .bashrc?). ============ Ok, here Fundamentally, what I want to know is: 1) Do desktop apps need to be confined? Is it a good idea to confine them? 2) If so, a shared data type is needed for interoperability. Is ROLE_home_t acceptable for that purpose. 3) 0) No 1) Shared data type is needed for interoperability 2) Keeping both application settings, and user data in the same folder is a problem

8 28

selinux with gosa
by Farkas Levente 29 Mar '05

29 Mar '05

hi, is anyone try to use gosa with selinux? since gosa try to write into /var/spool/gosa directory which has var_spool_t type and by default it can write into this directory. what is the prefered why to enable write for gosa into this directory? should i simple change /var/spool/gosa to httpd_sys_script_rw_t? it's working but i don't know what is the right solution. another question how can i add this attrib to the gosa rpm for /var/spool/gosa? yours. -- Levente "Si vis pacem para bellum!"

2 3

different md5sums for files on /dev/cdrom
by matousu＠volny.cz 29 Mar '05

29 Mar '05

Hi, I have encountered strange problem while reading my files from CDROM. I am still troubleshooting this, so I apreciate any help or notice to the problem I am describing below. HW: ASUS Pundit-R with Intel Prescott, Seagate ST3200822AS as hdc and hda: HL-DT-STDVDRRW GWA-4161B, ATAPI CD/DVD-ROM drive hda: ATAPI 40X DVD-ROM DVD-R CD-R/RW drive, 2048kB Cache, UDMA(33) SW: # uname -a Linux pundit 2.6.10-1.741_FC3smp #1 SMP Thu Jan 13 16:53:16 EST 2005 i686 i686 i386 GNU/Linux - W2k installed on another partition. PROBLEM: I have cdrom A with a file, let say the file is named file.cdrom-fc3, when mounted on fc3 linux. On fc3 linux hdc6 I have file, let say file.w2k-to-fc3, which I have previously read from cdrom A in Windows 2k and saved on shared vfat and transfered to hdc6 after my fc3 linux boot. There is nothing wrong with this file. I have another linux on another machine, dell latitude with RH9 and kernel 2.4.20. Let say the file on cdrom A When I mount the cdrom in this linuxbox become file.rh9 So now we have three files, all of them should have the same md5sum, as the files are based on the same source, and here they are: 0fed8b1345de558c18c5c9fa164b192a file.w2k-to-fc3 ---> OK a1a4a1174be8579bee5c83caa5f696aa file.cdrom-fc3 !!!!! BAD 0fed8b1345de558c18c5c9fa164b192a file.rh9 ---> OK So, the fc3 kernel driver handling the cdrom badly affects the files. This is valid for any cdrom and any file. The main efect is that mpeg or jpeg files are not or are badly readable in fc3. For instance mplayer gives messages like [msmpeg4 @ 0x84e4bc8]Error at MB: 644 [msmpeg4 @ 0x84e4bc8]concealing 2147483647 errors. with artefacts during the playback. But the sideefect within the app is not important now. I have disabled selinux and the behavior of jpeg files is better now, I can read most of them, but still not OK, as visible also from md5sums. I can say, the cdrom drive is OK because it works well in w2k. Also the file on cdrom is OK and healthy. It works in another OSes. So I am suspecting these systems: o kernel driver o cdrom drive hdparameters - I am using default fc3 settings o some another part of kernel sitting over devices, like selinux ? I realy need to solve this so I apreciate _ANY_ info. At least, if i write to wrong list, send me the email to people which are able to help to find the reason of this problem, and advice a solution. Thanks in advance, Petr

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2005