selinux April 2005

selinux@lists.fedoraproject.org

55 participants
88 discussions

'cannot relabel' miscue on shutdown ....
by Tom London 05 Apr '05

05 Apr '05

Running targeted/enforcing, latest rawhide. Each time I halt/reboot, I seem to get a message like the following (the 'funny text' varies): Apr 3 11:58:51 localhost su[3659]: Warning! Could not relabel ,\uffff\uff7f\u0661\uffff with user_u:object_r:devpts_t, not relabeling. But the system shuts down (or reboots) normally. Typically, I have an 'su -' window open, and typically I enter 'halt' or 'reboot' there (instead of using the gnome menu 'logout'. The 'funny' name seems troubling. Anything to be concerned about? tom -- Tom London

2 1

invalid context root:object_r:httpd_sysadm_content_t
by David Hampton 04 Apr '05

04 Apr '05

I've started getting this error message recently when I updated from the rawhide strict policy. I've tried a bunch of policy tweaks to no avail, and I'm at a loss for how to fix it. I even went as far as deleting my /etc/selinux/strict/src directory and reinstalling both the policy and policy-sources rpms. That I still have the problem implies that it wasn't caused by any of my local modifications. Any suggested solutions or things for me to try? Thanks. David

2 2

Re: Setting SELinux context of loop-mounted ISO filesystem
by Stephen Smalley 04 Apr '05

04 Apr '05

On Mon, 2005-04-04 at 11:44 -0400, Deron Meranda wrote: > I was, though, expecting ls -Z to show the applied label. So the filesystem > context is being applied, but you can't see it via ls -Z? I guess that makes > sense now that I think about it, but it was a little surprising. I > kind of expected > the context= option to work somewhat like the uid= and gid= options as far > as it's visibility to ls. Unfortunately, no. ls -Z ultimately calls getxattr on the inode, and unless the filesystem implementation provides a getxattr method, you can't get that information. There has been discussion of putting a transparent redirect in the VFS so that if the filesystem implementation doesn't provide getxattr/setxattr on the security namespace, the VFS will automatically redirect the request to the security module (i.e. SELinux) and let it handle it based on the incore inode security context. > Also I think context= is what I want, versus fscontext=, since this is > an ISO9660 > filesystem that doesn't support extended attributes (xattr). Otherwise Apache > could see the filesystem, but not the individual files inside it. > Isn't that correct? I think for iso9660 they are effectively equivalent. It would make a difference for filesystems that have native xattr support. -- Stephen Smalley <sds(a)tycho.nsa.gov> National Security Agency

1 0

restorecon and targeted policy
by Russell Coker 04 Apr '05

04 Apr '05

It seems that restorecon needs to be handled in the targeted policy in the same way as udev. I've just been working on setting up kickstart installs for FC4T1 machines with strict policy. I use lokkit in the kickstart %post to convert it to strict policy before the first boot. When it boots up the rc.sysinit calls to restorecon fail if unlimitedRC is not defined (IE a more strict than default config of the strict policy). We probably don't need to actually define types for this, just adding appropriate typealias rules should do as long as the .fc file is there. The same applies to fsadm and mount. It will also apply to anything else that can be run before all file systems are mounted. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

Re: Setting SELinux context of loop-mounted ISO filesystem
by Stephen Smalley 04 Apr '05

04 Apr '05

On Mon, 2005-04-04 at 11:02 -0400, Deron Meranda wrote: > I'm trying to mount some ISO files using the loop device. However > I can't seem to get the context= option on the mount to work. As > such the mounted files have no SELinux context set. In particular > I'm trying the following, > > mount -t iso9660 \ > -o context=system_u:object_r:httpd_sys_content_t,loop,ro,noexec,nodev,nosuid > \ > /path/to/file.iso /mountpoint > > I'm running in enforcing mode with selinux-policy-targeted-1.17.30-2.93 > > How can one mount an ISO image file and force all files to appear > to have a particular SELinux context? What makes you think it isn't working? ls -Z isn't going to work regardless, as iso9660 doesn't provide extended attribute handlers. But the context= option should set the security context that is applied internally by SELinux to the incore inodes, so that they will be access controlled accordingly. BTW, fscontext= may be more suitable here than context=. -- Stephen Smalley <sds(a)tycho.nsa.gov> National Security Agency

1 0

dhclient and restorecon
by Russell Coker 04 Apr '05

04 Apr '05

Why do we have restorecon being called from /sbin/dhclient-script? In the latest strict policy in rawhide dhcpc_t is not permitted to execute restorecon and a cursory glance at the targeted policy suggests that it can't execute it there either. dhcpc_t can only create files of types dhcpc_var_run_t, net_conf_t, dhcpc_tmp_t, and dhcpc_state_t. Of those the type net_conf_t is specified by the domain_auto_trans() rule for files created under /etc. I can't work out how dhclient could create a file with the wrong type to the call to restorecon seems redundant. We don't want to use the policy domain_auto_trans(dhcpc_t, restorecon_exec_t, restorecon_t) because restorecon_t is a highly privileged domain that we want to limit access to (every domain that has such a transition should ideally have it's main programs audited). We don't want to use the policy can_exec(dhcpc_t, restorecon_exec_t) as that will require allowing dhcpc_t to read the policy source which may be regarded as secret (and therefore something that we don't want to give to a program that is always running and has network access). I think it would be best if dhclient-script did not call restorecon at all. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 1

nscd with selinux with ssl
by Farkas Levente 04 Apr '05

04 Apr '05

hi, i try to use nscd with ldap and tls. in this case you should define a cacert, cert and key file for nss. but afaik there is no default palce to put these file and there is no default policy to allow nscd to read any kind of pem file(s). it'd be useful to define a standard place for these cert files and allow nscd to read these files. yours. -- Levente "Si vis pacem para bellum!"

2 10

Problems with firmware loader and selinux
by Dmitry Torokhov 01 Apr '05

01 Apr '05

Ahem, with the proper subject this time around... Hi, Apologies if this is not the proper mailing list... I have a FC3 with day-before-yesterday pull from Linus and selinux-policy-targeted installed from rawhide. Everything seems to be working fine ecxept for my wireless card (prism54), which can't get it's firmware loaded. It looks like selinux policy prevents firmware loader to create "firmware" class device. I get avc denied search message for process /sbin/ip (which is ifconfig_t) and tcontext is sysfs_t. It looks like the rights are inherited from "ip" markings whereas I would say that firmware loader is should operate in completely different context. Anyone have any pointers? Thank you in advance, Dmitry P.S. I would appreciate if you CC me as I am not subscribed to the list.

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2005