selinux April 2005

selinux@lists.fedoraproject.org

55 participants
88 discussions

RE: Is there a SELinux tutorial for ISVs ?
by chanson＠TrustedCS.com 28 Apr '05

28 Apr '05

> > This string of messages brings up something I wanted to get a > conversation going on how to handle non OS Provided policy. > > We all know we need a better mechanism for handling "binary" > policy in > the future. ( I think the future is now.) > I see three people providing policy. > I agree, as an ISV we need a way to add custom policy to support our applications. We currently use a processed version to the policy to have source modules until the binary modules are part of Fedora. > 1. OS Provider with base policy. (It would also be nice if the base > policy got broken into several policies and only the policy > of the running service would be loaded. If we got to this state we > would need a new mechanism for restoring file context since > file_context might not meet the currently loaded policy. > > 2. Third Party application developers. As the use of targeted policy > has begun to take off, Third Party ISV have started to question > how they can play in this world. > Exactly, see statement above. > I see Tresys Stuff solving the problems of both of the above. > > 3 Local User customization and minor policies. Currently we > have people Along with local user policy, there needs to be local network policy customizations as well. This is required from an MLS perspective and I would think be useful for TE network restrictions as well.

2 1

RE: selinux_socket_bind hook
by Steve Brueckner 28 Apr '05

28 Apr '05

Stephen Smalley wrote: > On Thu, 2005-04-28 at 12:32 -0400, Steve Brueckner wrote: >> In trying to segment networking into two domains I seem to have >> overlooked that name_bind doesn't get enforced for ports within the >> machine's local port range (i.e. ports assigned by the kernel). I >> suppose I could try to hack the LSM selinux_socket_bind hook to >> enforce name_bind for all ports; would that be possible? I'd rather >> not, though, since I've never ventured deeper than SELinux policy, >> and delving into the mechanism scares me. Is it possible to somehow >> implement a boolean that would toggle whether name_bind was enforced >> for all ports or just for ports outside the local port range? > > That hook is only applied for explicit bind(2) calls by applications. > auto-binding of unbound sockets by the kernel (e.g. when sending on > an unbound socket) will never hit that hook at all. You would need > to modify udp_v4_get_port and tcp_v4_get_port to check permission and > keep scanning for another available port until one is allowed. Not > likely to make much headway upstream. Darn. But thank you for the clarification. - Steve Brueckner, ATC-NY

1 0

selinux_socket_bind hook
by Steve Brueckner 28 Apr '05

28 Apr '05

In trying to segment networking into two domains I seem to have overlooked that name_bind doesn't get enforced for ports within the machine's local port range (i.e. ports assigned by the kernel). I suppose I could try to hack the LSM selinux_socket_bind hook to enforce name_bind for all ports; would that be possible? I'd rather not, though, since I've never ventured deeper than SELinux policy, and delving into the mechanism scares me. Is it possible to somehow implement a boolean that would toggle whether name_bind was enforced for all ports or just for ports outside the local port range? Thanks, - Steve Brueckner, ATC-NY

2 1

hald_t self:unix_stream_socket connectto?
by Tom London 28 Apr '05

28 Apr '05

Running targeted/permissive; today's Rawhide. I get the following when inserting a USB device: Apr 28 08:04:02 localhost kernel: usb 3-2: new full speed USB device using uhci_hcd and address 4 Apr 28 08:04:02 localhost kernel: drivers/usb/class/usblp.c: usblp0: USB Bidirectional printer dev 4 if 0 alt 1 proto 2 vid 0x03F0 pid 0x1E11 Apr 28 08:04:03 localhost kernel: audit(1114700643.013:0): avc: denied { connectto } for path=@ /tmp/hald-local/dbus-DX2FiLUq6n scontext=system_u:system_r:hald_t tcontext=system_u:system_r:hald_t tclass=unix_stream_socket I get this running either permissive or enforcing. Is allow hald_t self:unix_stream_socket connectto; appropriate? tom -- Tom London

1 0

Is there a SELinux tutorial for ISVs ?
by Davide Bolcioni 27 Apr '05

27 Apr '05

Greetings, I was looking for directions about how would an ISV rool own policy for the packages it ships. A very basic and step-by-step tutorial, for tiny minds :-) Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

1 0

Policy for ntp using nonstandard clock device links
by Eric Paris 27 Apr '05

27 Apr '05

Some ntp clocks like the the wwvb1 which are configured with a line like server 127.127.4.1 minpoll 3 maxpoll 4 in ntp.conf will need to talk to a "clock device" at /dev/wwvb1. In reality the clock is connected to something like /dev/ttyS0 where ntpd would normally have permissions. But for these types of clocks we have to create a sym link ln -s /dev/ttyS0 /dev/wwvb1 because ntp recognizes the clock as being at /dev/wwvb1. We get denials like audit(1114388976.276:0): avc: denied { read } for pid=23691 exe=/usr/sbin/ntpd name=wwvb1 dev=tmpfs ino=148116 scontext=root:system_r:ntpd_t tcontext=root:object_r:device_t tclass=lnk_file which can be fixed with allow ntpd_t device_t:lnk_file read; It might also want write permission, I'm not sure right now. I'm looking for comments on the right way to fix this. Is adding this or maybe rw_file_perms the way we really should go about this? Eric

2 1

Policy files
by John Dean 27 Apr '05

27 Apr '05

I've been reading the FAQ for selinux, and it refers to policy files under /etc/selinux/policy/scr. Looking at the policy directory on my system, there is only one file under there called policy.18. I'm trying to get the squirrelmail module called change_passwd to work but not sure how too.

2 1

Re: Home Dir labels (manifested as a failed Flash install)
by Ivan Gyurdiev 27 Apr '05

27 Apr '05

> -rw-r--r-- smearp smearp user_u:object_r:user_home_t flashplayer.xpt > -rwxr-xr-x smearp smearp user_u:object_r:texrel_shlib_t This is correct, but it's not done automatically, because /home is entirely skipped when changing the contexts after a policy upgrade. Personally, I think this is a major problem, but Daniel Walsh points out that (1) automatic restorecon on /home presents a security risk of mislabeled files ( like gpg keys and such in the wrong place), and (2) automatic restorecon on /home might take a very long time. I think if we are to introduce more fine-grained labeling of "$HOME" in the future (which we should), this problem needs to be solved somehow. -- Ivan Gyurdiev <ivg2(a)cornell.edu> Cornell University

1 0

Rawhide update gone awry
by Steve Brueckner 26 Apr '05

26 Apr '05

I appear to have borked my SELinux installation. I wanted to experiment with the new name_connect permission, which I read was available with the latest rawhide kernel and selinux policy. So, in my first-ever attempt to use rawhide, I enabled my /etc/yum.repos.d/fedora-devel.repo file and then yum updated to the following: kernel.i686 2.6.11-1.1267_FC4 installed selinux-policy-targeted.noarch 1.23.12-4 installed selinux-policy-targeted-sources.noarch 1.23.12-4 installed selinux-policy-strict.noarch 1.23.12-4 installed selinux-policy-strict-sources.noarch 1.23.12-4 installed libselinux.i386 1.23.7-3 installed libselinux-devel.i386 1.23.7-3 installed libselinux-debuginfo.i386 1.23.7-3 installed libsepol.i386 1.5.5-2 installed policycoreutils.i386 1.23.6-1 installed checkpolicy.i386 1.23.1-1 installed setools.i386 2.1.0-2 installed selinux-doc.noarch 1.19.5-1 installed I then did a touch /.autorelabel; reboot, then after rebooting a make reload. I'm using the targeted policy in permissive mode (things freeze up when I setenforce 1). Policy version is 19. I get a lot of avc denied messages on boot; enough to make me think I did something wrong with my policy update or kernel update. Did I even go about this the right way? Is there anything obviously wrong with the steps I took? I'm running FC3, and I wasn't certain about updating to an FC4 kernel but yum seemed to think it was OK so I went for it. I get the same errors when I revert to 2.6.11-1.14_FC3. Thanks for any ideas. My boot log is included below, with anything non-SELinux related snipped out. - Steve Brueckner, ATC-NY $ dmesg Linux version 2.6.11-1.1267_FC4 (bhcompile(a)porky.build.redhat.com) (gcc version 4.0.0 20050423 (Red Hat 4.0.0-1)) #1 Mon Apr 25 19:22:44 EDT 2005 ... Security Framework v1.0.0 initialized SELinux: Initializing. SELinux: Starting in permissive mode selinux_register_security: Registering secondary module capability Capability LSM initialized as secondary ... audit: initializing netlink socket (disabled) audit(1114514592.659:0): initialized ... SELinux: Registering netfilter hooks ... security: 3 users, 6 roles, 684 types, 75 bools security: 55 classes, 126760 rules SELinux: Completing initialization. SELinux: Setting up existing superblocks. SELinux: initialized (dev dm-0, type ext3), uses xattr SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts SELinux: initialized (dev mqueue, type mqueue), not configured for labeling SELinux: initialized (dev hugetlbfs, type hugetlbfs), not configured for labeling SELinux: initialized (dev devpts, type devpts), uses transition SIDs SELinux: initialized (dev eventpollfs, type eventpollfs), uses genfs_contexts SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts SELinux: initialized (dev pipefs, type pipefs), uses task SIDs SELinux: initialized (dev sockfs, type sockfs), uses task SIDs SELinux: initialized (dev proc, type proc), uses genfs_contexts SELinux: initialized (dev bdev, type bdev), uses genfs_contexts SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts audit(1114514601.951:0): avc: denied { use } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=fd ... SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts ... SELinux: initialized (dev hda1, type ext3), uses xattr SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Adding 2031608k swap on /dev/VolGroup00/LogVol01. Priority:-1 extents:1 SELinux: initialized (dev binfmt_misc, type binfmt_misc), uses genfs_contexts ... audit(1114529038.066:0): avc: denied { read } for name=config dev=dm-0 ino=3837327 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:selinux_config_t tclass=file audit(1114529038.066:0): avc: denied { getattr } for path=/etc/selinux/config dev=dm-0 ino=3837327 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:selinux_config_t tclass=file audit(1114529038.092:0): avc: denied { execute } for name=restorecon dev=dm-0 ino=1802308 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:restorecon_exec_t tclass=file audit(1114529038.092:0): avc: denied { execute_no_trans } for path=/sbin/restorecon dev=dm-0 ino=1802308 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:restorecon_exec_t tclass=file audit(1114529038.092:0): avc: denied { read } for path=/sbin/restorecon dev=dm-0 ino=1802308 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:restorecon_exec_t tclass=file audit(1114529038.093:0): avc: denied { search } for name=contexts dev=dm-0 ino=3834258 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:default_context_t tclass=dir audit(1114529038.093:0): avc: denied { search } for name=files dev=dm-0 ino=3834262 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:file_context_t tclass=dir audit(1114529038.093:0): avc: denied { read } for name=file_contexts dev=dm-0 ino=3834260 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:file_context_t tclass=file audit(1114529038.093:0): avc: denied { getattr } for path=/etc/selinux/targeted/contexts/files/file_contexts dev=dm-0 ino=3834260 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:file_context_t tclass=file audit(1114529038.096:0): avc: denied { search } for name=/ dev=selinuxfs ino=232 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:security_t tclass=dir audit(1114529038.096:0): avc: denied { read write } for name=context dev=selinuxfs ino=5 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:security_t tclass=file audit(1114529038.096:0): avc: denied { check_context } for scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:security_t tclass=security audit(1114529038.479:0): avc: denied { use } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:named_t tcontext=system_u:system_r:kernel_t tclass=fdSELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts audit(1114529040.947:0): avc: denied { use } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:howl_t tcontext=system_u:system_r:kernel_t tclass=fd audit(1114529043.069:0): avc: denied { use } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:system_r:kernel_t tclass=fd ... audit(1114529047.672:0): avc: denied { read } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:restorecon_t tcontext=system_u:object_r:root_t tclass=file audit(1114529050.126:0): avc: denied { use } for path=/init dev=rootfs ino=8 scontext=system_u:system_r:getty_t tcontext=system_u:system_r:kernel_t tclass=fdaudit(1114529052.770:0): avc: denied { write } for name=etc dev=dm-0 ino=3833857 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=dir audit(1114529052.770:0): avc: denied { add_name } for name=.fstab.hal.S scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=dir audit(1114529052.770:0): avc: denied { create } for name=.fstab.hal.S scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file audit(1114529053.042:0): avc: denied { write } for name=media dev=dm-0 ino=8552449 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:mnt_t tclass=dir audit(1114529053.042:0): avc: denied { remove_name } for name=cdrecorder dev=dm-0 ino=8552450 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:mnt_t tclass=dir audit(1114529053.042:0): avc: denied { rmdir } for name=cdrecorder dev=dm-0 ino=8552450 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:mnt_t tclass=dir audit(1114529053.157:0): avc: denied { write } for path=/etc/.fstab.hal.S dev=dm-0 ino=3837358 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file audit(1114529053.157:0): avc: denied { remove_name } for name=.fstab.hal.S dev=dm-0 ino=3837358 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=dir audit(1114529053.157:0): avc: denied { rename } for name=.fstab.hal.S dev=dm-0 ino=3837358 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file audit(1114529053.157:0): avc: denied { unlink } for name=fstab dev=dm-0 ino=3834553 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:etc_t tclass=file audit(1114529053.179:0): avc: denied { write } for name=rhgb-socket dev=ramfs ino=4929 scontext=system_u:system_r:init_t tcontext=system_u:object_r:ramfs_t tclass=sock_file audit(1114529053.179:0): avc: denied { connectto } for path=/etc/rhgb/temp/rhgb-socket scontext=system_u:system_r:init_t tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket audit(1114529053.577:0): avc: denied { getattr } for path=/dev/VolGroup00/LogVol00 dev=tmpfs ino=5807 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:device_t tclass=lnk_file audit(1114529053.653:0): avc: denied { add_name } for name=cdrecorder scontext=system_u:system_r:hald_t tcontext=system_u:object_r:mnt_t tclass=dir audit(1114529053.654:0): avc: denied { create } for name=cdrecorder scontext=system_u:system_r:hald_t tcontext=system_u:object_r:mnt_t tclass=dir audit(1114529053.674:0): avc: denied { getattr } for path=/dev/mapper/VolGroup00-LogVol00 dev=tmpfs ino=1128 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:device_t tclass=blk_file audit(1114529053.674:0): avc: denied { getattr } for path=/dev/pts dev=devpts ino=1 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:devpts_t tclass=dir ... audit(1114529081.451:0): avc: denied { getattr } for path=/dev/pts dev=devpts ino=1 scontext=system_u:system_r:hald_t tcontext=system_u:object_r:devpts_t tclass=dir

3 4

proper samba labeling
by Farkas Levente 26 Apr '05

26 Apr '05

hi, we just upgrade some of our server to selinux enabled kernel. but the date files are on a raid array which just remounted. this samba server's files are also on that array and they are not labeled at all. what is the right labeling for samba shares? i look trough policy source files but i can't find any proper type for samba. or it's the right way to not label sabma files at all? yours. -- Levente "Si vis pacem para bellum!"

3 5

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2005