selinux March 2005

selinux@lists.fedoraproject.org

64 participants
70 discussions

targeted policy clashes CGI program under apache
by Ben 22 Mar '05

22 Mar '05

I'm attempted to use the latest targeted policy under FC3, and while it generally works well, we're running into some problems when it comes time to pipe data from PHP into a complex CGI we have. The error we see is this: Mar 21 22:17:11 blingbling kernel: audit(1111472231.280:0): avc: denied { getsched } for pid=405 exe=/var/www/test/cgi-bin/clip scontext=user_u:system_r:httpd_sys_script_t tcontext=user_u:system_r:httpd_sys_script_t tclass=process Apache's error log shows this: GThread-ERROR **: file gthread-posix.c: line 135 (): error 'Operation not permitted' during 'pthread_getschedparam (pthread_self(), &policy, &sched)'aborting... My CGI does use glib threads; is that a bad thing? I would like to use SELinux, but there's "like" and "need", and right now I need to get this working. So, if there's no quick fix, is there a way to disable SELinux on just this one CGI, do I have to disable it for all of apache?

3 4

forkbombs?
by Justin Conover 20 Mar '05

20 Mar '05

I'm sure many people have read this by now: http://www.securityfocus.com/columnists/308 Many people probably already know about it and how you need to set limits. Is there something that can be done with selinux or a kernel module to stop it with out the user or admin to have to know they should set something? I ran this on a rawhide box as my user and it killed the box: http://home.tiscali.cz:8080/~cz210552/forkbomb.html I was wondering if something like this should be implemented at the kernel level: http://rexgrep.tripod.com/rexfbd.htm Or if there is something similiar already in the kernel? thx,

2 1

Questions about Apache and SELinux context inheritance
by Christofer C. Bell 17 Mar '05

17 Mar '05

I have a question about how context inheritance works in SELinux. The correct file context is already defined in /etc/selinux/targeted/contexts/files/file_contexts as: /home/[^/]+/((www)|(web)|(public_html))(/.+)? system_u:object_r:httpd_user_content_t However, this context is not inherited when creating a public_html directory as a user or as root in a user home directory. In otherwords, when creating a public_html directory, this is what you get: drwxrwxr-x cbell cbell user_u:object_r:user_home_t public_html (I must admit some confusion about the initial user_u user context since this is not defined in file_contexts). Here you see that the user context is set to user_u, the role is set to object_r, and the type is set to user_home_t. This is (in)correctly inherited from the /home directory's context. Simply running restorecon -v -R /home/ (as a user or root) will fix it to read thusly: drwxrwxr-x cbell cbell system_u:object_r:httpd_user_content_t public_html At anyrate, the user label is correctly set to system_u, the role is unchanged with object_r, and the type is changed to http_user_content_t. This is the context I'd like public_html directories to automatically assume when created. Is this possible? Further puzzles: When creating files in this public_html directory (after resetting the directory to the correct context) yields more puzzling results: [cbell@circe public_html]$ touch test [cbell@circe public_html]$ ls -Z -rw-rw-r-- cbell cbell user_u:object_r:httpd_sys_content_t test Note that in this case, the file has been set to user context user_u, role object_r, and type httpd_sys_content_t. This is the type that's supposedly reserved for the machine's public web directories: (from file_contexts) /var/www(/.*)? system_u:object_r:httpd_sys_content_t Again, one must run restorecon to correctly set the context on this file to: -rw-rw-r-- cbell cbell system_u:object_r:httpd_user_content_t test So my questions are fourfold: o How can one cause the correct httpd_user_content_t type to be automatically assigned to user public_html directories (and subdirectories)? o How can one cause the correct httpd_user_content_t type to be automatically assigned to user content (files) in user public_html directores? o Why are files initially receiving a user context of user_u rather than system_u ? And one file, slightly unrelated question: o When I installed this server and restored user data to it, the user context on all the files was set to root rather than user_u (and why not system_u?). I've reset everything to the correct user context with chcon, but I'd like to know why this happened. Thank you all for your insight! -- Chris "Build a man a fire and he will be warm for the rest of the night. Set a man on fire and he will be warm for the rest of his life." -- Unknown

4 4

Re: fedora-selinux-list Digest, Vol 13, Issue 16
by Ryan Gall 16 Mar '05

16 Mar '05

> > #Context for the driver configuration files > > /etc/ndiswrapper/ -- system_u:object_r:loadndis_content_t > > you probably want this: > > /etc/ndiswrapper(/.*)? system_u:object_r:loadndis_content_t > > so you can label all of the driver stuff tha'ts stored under that > directory and it's subdirectories. I don't think your pattern will > match anything. > Actually everything does get the correct labels here. I guess it is setting the label on the ndiswrapper directory and then all the child directories and files are inheriting that context. > > # Filename: loadndis.te > > > #Rules for devices > > allow loadndis_t device_t:dir { rw_dir_perms }; > > allow loadndis_t device_t:chr_file { read create unlink ioctl }; > > allow loadndis_t null_device_t:chr_file { rw_file_perms }; > > allow loadndis_t console_device_t:chr_file { rw_file_perms }; > > It would be better for the device node to have its own type, and type > transition the chr_file, that way loadndis_t can only read very specific > device nodes: > > type loadndis_device_t, device_type, dev_fs; > file_type_auto_trans(loadndis_t,device_t,loadndis_device_t,chr_file) > > Or if you really want to go least privilege, you could probably use > these rules instead of the above file_type_auto_trans: > > allow loadndis_t device_t:dir { search write add_name remove_name }; > allow loadndis_t loadndis_device_t:chr_file { read create unlink ioctl }; > type_transition loadndis_t device_t:chr_file loadndis_device_t; Thanks for the tip. I am assuming here that these transitions cause the created device to be relabeled to the new loadndis_device_t, which would then prevent it from messing around with other devices in device_t? > > > #Capabilities > > allow loadndis_t self:capability { sys_tty_config }; > > allow loadndis_t self:capability { mknod }; > > Just for readability, it would be best to merge these into one line. > Just a little nitpick. :) DOH! > > > #Rules for proc filesystem > > allow loadndis_t proc_t:dir { r_dir_perms }; > > allow loadndis_t proc_t:file { r_file_perms }; > > Another readability thing, you don't need the braces around r_dir_perms > and r_file_perms, as these are macros, and they already provide braces. > So the ones you have are redundant. Thanks for the help Chris. Ryan > > -- > Chris PeBenito > Tresys Technology, LLC > (410) 290-1411 x150 >

2 1

Fedora Project Mailing Lists reminder
by Elliot Lee 16 Mar '05

16 Mar '05

This is a reminder of the mailing lists for the Fedora Project, and the purpose of each list. You can view this information at http://fedora.redhat.com/participate/communicate/ When you're using these mailing lists, please take the time to choose the one that is most appropriate to your post. If you don't know the right mailing list to use for a question or discussion, please contact me. This will help you get the best possible answer for your question, and keep other list subscribers happy! Mailing Lists Mailing lists are email addresses which send email to all users subscribed to the mailing list. Sending an email to a mailing list reaches all users interested in discussing a specific topic and users available to help other users with the topic. The following mailing lists are available. To subscribe, send email to <listname>-request(a)redhat.com (replace <listname> with the desired mailing list name such as fedora-list) with the word subscribe in the subject. fedora-announce-list - Announcements of changes and events. To stay aware of news, subscribe to this list. fedora-list - For users of releases. If you want help with a problem installing or using , this is the list for you. fedora-test-list - For testers of test releases. If you would like to discuss experiences using TEST releases, this is the list for you. fedora-devel-list - For developers, developers, developers. If you are interested in helping create releases, this is the list for you. fedora-extras-list - For users and developers of Fedora Extras fedora-docs-list - For participants of the docs project fedora-desktop-list - For discussions about desktop issues such as user interfaces, artwork, and usability fedora-config-list - For discussions about the development of configuration tools fedora-tools-list - For discussions about the toolchain (gcc, gdb, etc...) within Fedora fedora-devel-java-list - For discussions about Java-related Fedora development fedora-patches-list - For submitting patches to Fedora maintainers, and used in line with BugWeek fedora-legacy-announce - For announcements about the Fedora Legacy Project fedora-legacy-list - For discussions about the Fedora Legacy Project fedora-selinux-list - For discussions about the Fedora SELinux Project fedora-marketing-list - For discussions about marketing and expanding the Fedora user base fedora-de-list - For discussions about Fedora in the German language fedora-es-list - For discussions about Fedora in the Spanish language fedora-ja-list - For discussions about Fedora in the Japanese language fedora-i18n-list - For discussions about the internationalization of Fedora Core fedora-trans-list - For discussions about translating the software and documentation associated with the Fedora Project German: fedora-trans-de French: fedora-trans-fr Spanish: fedora-trans-es Italian: fedora-trans-it Brazilian Portuguese: fedora-trans-pt_br Japanese: fedora-trans-ja Korean: fedora-trans-ko Simplified Chinese: fedora-trans-zh_cn Traditional Chinese: fedora-trans-zh_tw

1 0

Tweaks to the dovecot policy
by David Hampton 16 Mar '05

16 Mar '05

I've added support to the dovecot policy to allow authentication against a dovecot private password file, and added a couple of tweaks that I hope tighten up the security of dovecot a little bit. They make the dovecot configuration file into a unique type, and add a type that can be used to distinguish mail stored by dovecot from other mail stored on the system. David P.S. These diffs are based on the files from the selinux-policy-strict- sources-1.22.1-2 rpm on my FC3 system.

1 0

SELinux policy for ndiswrapper
by Ryan Gall 15 Mar '05

15 Mar '05

I wrote a policy to get ndiswrapper running in my FC3 strict policy SELinux system. This is the first policy I have created. I would greatly appreciate any pointers or feedback anyone would like to share. This policy is specifically used to allow the kernel_t domain to use the loadndisdriver executable to update the ndiswrapper module with configuration information. With this policy I can now successfully insmod ndiswrapper v1.1 ################################################# # # Define default file contexts for ndis tools # Filename: loadndis.fc # Assumptions: This file assumes that the # loadndisdriver executable is # found under /sbin and the # config files are all under # /etc/ndiswrapper. # # Author: Ryan Gall <rrcoot(a)verizon.net> # #File context for the loadndisdriver executable /sbin/loadndisdriver -- system_u:object_r:loadndis_exec_t #Context for the driver configuration files /etc/ndiswrapper/ -- system_u:object_r:loadndis_content_t ################################################## # # Policy to create a domain for the # loadndisdriver executable # Filename: loadndis.te # Purpose: To isolate the executable to # some normal application stuff # and the loadndisdriver configuration # files. Ultimately allow successful # completion of `insmod ndiswrapper` # in an enforcing strict SELinux # policy. # # Author: Ryan Gall <rrcoot(a)verizon.net> # #Declare our loadndis domain type loadndis_t, domain, privlog; #Let system_r access this new domain role system_r types loadndis_t; #Set up the file contexts for loadndis executable and content type loadndis_exec_t, file_type, sysadmfile; type loadndis_content_t, file_type, sysadmfile; #Transition execution to loadndis domain when executed domain_auto_trans(kernel_t, loadndis_exec_t, loadndis_t) #Needs to be able to search root of filesystem allow loadndis_t root_t:dir search; #Rules for devices allow loadndis_t device_t:dir { rw_dir_perms }; allow loadndis_t device_t:chr_file { read create unlink ioctl }; allow loadndis_t null_device_t:chr_file { rw_file_perms }; allow loadndis_t console_device_t:chr_file { rw_file_perms }; #Capabilities allow loadndis_t self:capability { sys_tty_config }; allow loadndis_t self:capability { mknod }; #Rules for proc filesystem allow loadndis_t proc_t:dir { r_dir_perms }; allow loadndis_t proc_t:file { r_file_perms }; #Sysfs rule allow loadndis_t sysfs_t:dir { search }; #Allow logging allow loadndis_t devlog_t:sock_file { write }; #Create a unix datagram socket allow loadndis_t self:unix_dgram_socket { create_socket_perms }; #Let it access common configuration directories and libraries uses_shlib(loadndis_t) read_locale(loadndis_t) #Finally allow access to our content allow loadndis_t loadndis_content_t:file { r_file_perms }; allow loadndis_t loadndis_content_t:dir { r_dir_perms };

2 1

OpenVPN
by Florin Andrei 14 Mar '05

14 Mar '05

I've seen some effort going into creating SELinux rules for OpenVPN: http://www.nsa.gov/selinux/list-archive/0407/7704.cfm Does anyone know what's the status of that? Usable? Non-usable? -- Florin Andrei http://florin.myip.org/

1 0

[newbie] setenforce 1 breaks ~user
by Peter George 13 Mar '05

13 Mar '05

I recently upgraded to FC3 + Apache 2.0. from RH7.3 + Apache 1.3. Currently running ext3 filesystem. /home/*/public_html/ files do not have SELinux extended attributes therefore I cannot change the security context on files. I cannot see www.domain/~user with # /usr/sbin/setenforce 1 it has to be /usr/sbin/setenforce 0 I know I can force file lelabelling to include extended attributes (forgotten the url with the helpful command just now) with a reboot, and then follow the '# chcon' directives at http://fedora.redhat.com/docs/selinux-apache-fc3/sn-user-homedir.html i.e. # chcon -Rt httpd_sys_content_t /home/*/public_html/ # /usr/sbin/setenforce 1 Any web references or advice appreciated. P -- Peter George CIW CI Training Manager Net Resources Ltd 26 Palmerston Place, Edinburgh, EH12 5AL T: 0131 477 7127 F: 0131 477 7126 http://www.netresources.co.uk

3 2

Why is --replacepkgs needed?
by susan_geller＠speakeasy.net 11 Mar '05

11 Mar '05

I was having some trouble with various audit messages after I upgraded to a newer version of the selinux-policy-targeted rpm. I did rpm --verify selinux-policy-targeted and found that several of the files didn't correspond to what is in the rpm. So I did rpm -Uvh --replacepkgs ... and everything magically works. Why can't the rpm packages be made so that the --replacepkgs flag is not needed? Thanks, Susan

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2005