selinux May 2005

selinux@lists.fedoraproject.org

47 participants
63 discussions

How to add a new application in targeted
by James Z. Li 24 May '05

24 May '05

I wrote some policy files for sendmail, say /etc/selinux/targeted/src/policy/file_contexts/program/sendmail.fc /etc/selinux/targeted/src/policy/domain/program/sendmail.te I compiled them using 'make load' but it looks like selinux does not check against my policy files. I was wondering if there is a checklist where I could add 'sendmail' to let selinux know sendmail is now one of the targeted applications. Or should I put my sendmail.fc and sendmail.te in local.fc and local.te respectively? Thanks, James

3 3

php+mysql under httpd in fc3
by Stanislav Malyshev 24 May '05

24 May '05

I run FC3 with targeted policies (default install). I have a problem running connecting to mysql server from php under apache - the problem is that httpd/php is denied write access to mysql.sock, something like this: fc3 kernel: audit(1116843116.146:0): avc: denied { write } for pid=7281 exe=/usr/sbin/httpd name=mysql.sock dev=dm-0 ino=375162 scontext=root:system_r:httpd_t tcontext=user_u:object_r:var_lib_t tclass=sock_file Now, I have seen various modifications to policy sources that would allow it to work, but what I am asking is if it possible to do it without rebuilding policy from sources. The reason for this is that we need to make our ptoduce to install mysql & certain modules using it on user servers, and we can not count on policy sources being installed there. Also, the security of mysqld itself does not matter in this particular case and it is OK for us to run it unrestricted (it's separate server for this application only without network connection). The only problem is to allow restricted httpd to connect to that particular Unix socket. I see that default system sources (apache.te) seem to include various types that seem to allow this, but I have no success in using them. If I try to use mysqld_var_run_t chcon gives me "Invalid argument", same with mysqld_db_t. Also, I see that httpd_php_t has can_unix_connect() rule, while httpd_t does not, however I did not find any documentation on what these types are, what's teh difference and how one can use httpd_php_t. I see httpd is running now under httpd_t according to ps -eZ. I tries also to set mysql.sock into tmp_t, then write error disappears, and this one appears instead: fc3 kernel: audit(1116844521.972:0): avc: denied { connectto } for pid=7275 exe=/usr/sbin/httpd path=/var/lib/mysql/mysql.sock scontext=root:system_r:httpd_t tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket I am rather new to all SELinux concepts, so if anyone can give me some explanations about this or point me to some docs that describe these things it will be appreciated. TIA, -- Stanislav Malyshev, Zend Products Engineer stas(a)zend.com http://www.zend.com/ +972-3-6139665 ext.115

3 2

domains/misc/kernel.te
by Tom London 24 May '05

24 May '05

domains/misc/kernel.te has the following lines: # Use capabilities. allow kernel_t self:capability *; allow kernel_t sysfs_t:dir search; allow kernel_t { usbfs_t usbdevfs_t sysfs_t }:dir search; # Run init in the init_t domain. Search for sysfs_t is in twice. Also, I'm getting avc's for kernel_t for getattr/read for sysfs_t: May 22 10:04:32 fedora kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied { getattr } for path="/sys/class/input/mouse1" dev=sysfs ino=1850 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t tclass=dir May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied { getattr } for path="/sys/class/input/mouse1/dev" dev=sysfs ino=2090 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t tclass=file May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied { read } for name=dev dev=sysfs ino=2090 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t tclass=file Would it be right to replace allow kernel_t sysfs_t:dir search; allow kernel_t { usbfs_t usbdevfs_t sysfs_t }:dir search; with r_dir_file(kernel_t, sysfs_t) allow kernel_t { usbfs_t usbdevfs_t }:dir search; tom -- Tom London

2 1

allow_write_xhm ?
by Tom London 24 May '05

24 May '05

Running strict/enforcing, latest rawhide. During boot, I get an error complaining about boolean 'allow_write_xhm'. /etc/selinux/strict/booleans has allow_write_xhm=1 as last line. Should this be: allow_write_xshm=1 Is this something I did locally, or .... ? tom -- Tom London

3 3

rhgb and /usr
by Tom London 23 May '05

23 May '05

Running strict/enforcing, today's rawhide. Booting, get these avc from rhgb: May 21 13:06:45 fedora smartd[2314]: Device: /dev/hda, opened May 21 13:06:45 fedora kernel: SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts May 21 13:06:45 fedora kernel: audit(1116680781.182:0): avc: denied { read } for name=index.theme dev=hda2 ino=4523023 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680781.513:0): avc: denied { getattr } for path="/usr/share/themes/Clearlooks/gtk-2.0/gtkrc" dev=hda2 ino=4592143 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680781.687:0): avc: denied { read } for name=large-computer.png dev=hda2 ino=4126600 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680781.869:0): avc: denied { getattr } for path="/usr/share/vte/termcap/xterm" dev=hda2 ino=4459308 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680784.842:0): avc: denied { read } for name=index.theme dev=hda2 ino=4523023 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680784.842:0): avc: denied { read } for name=index.theme dev=hda2 ino=4523023 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680784.962:0): avc: denied { read } for name=index.theme dev=hda2 ino=4523023 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680784.964:0): avc: denied { read } for name=system-logo.png dev=hda2 ino=4112422 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file May 21 13:06:45 fedora kernel: audit(1116680784.973:0): avc: denied { read } for name=throbber-anim.png dev=hda2 ino=4114138 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t tclass=file What's right here, dontaudit or allow? (System appears to boot just fine.) tom -- Tom London

3 3

Auditd & Strict Policy 1.19
by George J. Jahchan 20 May '05

20 May '05

On a Bastilled FC3 latest kernel and with the strict SE Linux policy (1.19), if not in permissive mode, the auditd daemon refuses to start with the following error messages in /var/log/messages: ... Unable to set audit pid, exiting. ... Error sending failure mode request (Operation not permitted). Once the daemon starts in permissive mode, it is not a problem to revert SE Linux back to enforcing mode, the daemon stays up (and performs as expected). Have started Fedora with audit=1 kernel option and enabled the noisy events in SE Linux (make enableaudit & make load in the strict policy source directory), auditd-related denials have all been explicitly allowed in our custom.te policy under domains/misc. Auditd daemon still fails to start in enforcing mode, and no selinux denials are generated when we try to start it. Using the above method, we have been able to get the system to boot in enforcing mode and run all the programs & daemons we needed to run (with no selinux denials, except attempts to access shadow_t which is protected by an assertion in the strict policy), except for auditd. Any hints on how to resolve this issue?

2 1

cupsd & targeted....
by Tom London 20 May '05

20 May '05

Running targeted/enforcing, latest rawhide. I get the following avc from cupsd on startup and during use of an HP USB printer: May 19 06:22:51 localhost kernel: audit(1116508971.985:0): avc: denied { read } for name=printconf.pickle dev=dm-0 ino=2158741 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:var_t tclass=file May 19 06:23:48 localhost kernel: audit(1116509028.008:0): avc: denied { write } for name=printconf.pickle dev=dm-0 ino=2158741 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:var_t tclass=file May 19 07:06:39 localhost kernel: audit(1116511599.151:0): avc: denied { read } for name=printconf.pickle dev=dm-0 ino=2158741 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:var_t tclass=file May 19 07:06:48 localhost kernel: audit(1116511608.606:0): avc: denied { signal } for scontext=system_u:system_r:hald_t tcontext=system_u:system_r:cupsd_config_t tclass=process May 19 07:06:52 localhost kernel: audit(1116511612.418:0): avc: denied { write } for name=printconf.pickle dev=dm-0 ino=2158741 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:var_t tclass=file Some read/write avcs are for /var/foomatic/printconf.pickle. Is there an appropriate type for this (other than var_t)? Should hald.te have: ifdev(`cups.te', ` allow hald_t cupsd_config_t:process signal; ') Other? tom -- Tom London

3 5

vsftpd with selinux on FC3
by James Z. Li 19 May '05

19 May '05

Hi there, I am configuring Selinux to protect vsftpd on my FC3 box. I follow the procedure of Chapter 8 Cutermizing and Writing Policy in Red Hat Enterprise Linux SELinux Guide. Step1: i created a file called /etc/selinux/targeted/src/policy/domains/program/vsftpd.te the cotents are ################################# # # Rules for the vsftpd_t domain. # daemon_domain(vsftpd) the security context of this file was root:object_r:policy_src_t I changed it by using chcon -u system_u vsftpd.te Step2: create /etc/selinux/targeted/src/policy/file_contexts/program/vsftpd.fc contents are /usr/sbin/vsftpd -- system_u:object_r:vsftpd_exec_t /var/run/vsftpd.pid -- system_u:object_r:vsftpd_var_run_t /etc/vsftpd/vsftpd.conf -- system_u:object_r:vsftpd_conf_t chcon -u system_u vsftpd.fc At this moment, the security context of /etc/vsftpd and vsftpd.conf are: # ls -dZ /etc/vsftpd drwxr-xr-x root root system_u:object_r:etc_t /etc/vsftpd ls -Z /etc/vsftpd/vsftpd.conf -rw------- root root system_u:object_r:etc_t /etc/vsftpd/vsftpd.conf Step3: #make load Error message: ... Validating file_contexts ... /usr/sbin/setfiles -q -c /etc/selinux/targeted/policy/policy.18 /etc/selinux/tar geted/contexts/files/file_contexts /usr/sbin/setfiles: invalid context system_u:object_r:vsftpd_conf_t on line num ber 785 make: *** [install] Error 1 Could anyone help me on this? Thanks a lot! Btw, should I set the security context of /etc/vsftpd/vsftpd.conf to vsftpd_conf_t or vsftpd_etc_t? I am confused about some existing context, such as #ls -dZ /etc/httpd/ drwxr-xr-x root root system_u:object_r:httpd_config_t /etc/httpd/ #ls -Z /etc/httpd/conf/httpd.conf -rw-r--r-- root root system_u:object_r:httpd_config_t /etc/httpd/conf/httpd.conf BUT, # ls -dZ /etc/snmp/ drwxr-xr-x root root system_u:object_r:etc_t /etc/snmp/ # ls -Z /etc/snmp/snmpd.conf -rw-r--r-- root root system_u:object_r:snmpd_etc_t /etc/snmp/snmpd.conf Thanks, James

3 4

need advice
by pi 19 May '05

19 May '05

I have a few users on /home/ on hda and a few on /home2/ wich resides on hdb. i have httpd serving webpages without problem from (hda) /home/~/public_html but when adding users to home2/~/public_html on hdb, webpages doesnt work. Can this be caused by selnux? I ran the selinux-commands without succes, and i have done what´s expected from http://fedora.redhat.com/docs/selinux-faq-fc3/index.html#id2825658 When i first installed FC3, hdb was already formatted and made no changes on it. the install went right down on hda. Is it possible to make it work by merging the 2 partition together perhaps? /pi

3 2

Problems running postgresql
by Richard E Miles 18 May '05

18 May '05

I have been trying to start up the postgresql postmaster server to a database which have all failed. The following are a list of avc: denied messages from /var/log/messages: May 13 13:20:32 localhost kernel: audit(1116015632.155:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 13 13:20:32 localhost last message repeated 7 times May 13 13:20:32 localhost kernel: audit(1116015632.156:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 13 13:20:32 localhost last message repeated 3 times May 13 13:20:32 localhost kernel: audit(1116015632.157:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 13 13:20:32 localhost last message repeated 32 times May 13 13:20:32 localhost kernel: audit(1116015632.158:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 13 13:20:32 localhost last message repeated 34 times May 13 13:20:32 localhost kernel: audit(1116015632.159:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir Why am I getting write denials? I am running FC3 with targetted policy. -- Richard E Miles Federal Way WA. USA registered linux user 46097

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2005