selinux May 2005

selinux@lists.fedoraproject.org

47 participants
63 discussions

mozilla mail not starting under strict policy
by Richard Hally 18 May '05

18 May '05

when running strict policy on a fully updated rawhide, mozilla mail will not start when in enforcing mode of the strict policy. Doing a setenforce 0 allows it to start. (Note that the avc denied messages are only produce when in premissive mode) Below are the AVC denied messages: May 17 12:46:45 new2 kernel: audit(1116348405.108:0): avc: granted { setenforce } for scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security May 17 12:46:45 new2 dbus: avc: received setenforce notice (enforcing=0) May 17 12:46:45 new2 dbus: avc: received setenforce notice (enforcing=0) May 17 12:46:56 new2 kernel: audit(1116348416.169:0): avc: denied { name_connect } for dest=110 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:pop_port_t tclass=tcp_socket May 17 12:46:56 new2 kernel: audit(1116348416.902:0): avc: denied { getattr } for name=/ dev=dm-0 ino=2 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:fs_t tclass=filesystem May 17 12:47:45 new2 kernel: audit(1116348465.718:0): avc: granted { setenforce } for scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security May 17 12:47:45 new2 dbus: avc: received setenforce notice (enforcing=1) May 17 12:47:45 new2 dbus: avc: received setenforce notice (enforcing=1) HTH Richard Hally

3 2

/etc/ld.so.cache and FC4T3
by Russell Coker 18 May '05

18 May '05

I am seeing /etc/ld.so.cache getting type etc_t for an initial install of FC4T3. Is anyone else seeing this? At this stage I'm not sure whether I messed up my install process or whether it's a more general thing. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

8 23

Mysql setsched
by Emek TUZUN 18 May '05

18 May '05

What is SETSCHED fuction of MySql? I am getting these logs but mysql works normal... What are these setsched denials? May 16 01:39:04 xstream kernel: audit(1116243944.356:0): avc: denied { setsched } for pid=18216 exe=/usr/sbin/mysqld scontext=root:system_r:mysqld_t tcontext=root:system_r:mysqld_t tclass=process May 16 01:39:18 xstream kernel: audit(1116243958.654:0): avc: denied { setsched } for pid=18228 exe=/usr/sbin/mysqld scontext=root:system_r:mysqld_t tcontext=root:system_r:mysqld_t tclass=process May 16 01:39:30 xstream kernel: audit(1116243970.083:0): avc: denied { setsched } for pid=18229 exe=/usr/sbin/mysqld scontext=root:system_r:mysqld_t tcontext=root:system_r:mysqld_t tclass=process Thanks in advance, Emek

3 2

dhcpd and nscd bug
by Farkas Levente 18 May '05

18 May '05

hi, it seems that during startup dhcpd server try to read nscd's pid files (i don't know why?): ----------------------------------------------- May 15 00:20:32 atom kernel: audit(1116109232.315:0): avc: denied { search } for pid=7400 exe=/usr/sbin/dhcpd name=nscd dev=md0 ino=3777358 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:nscd_var_run_t tclass=dir May 15 00:20:32 atom kernel: audit(1116109232.316:0): avc: denied { search } for pid=7400 exe=/usr/sbin/dhcpd name=nscd dev=md0 ino=3777358 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:nscd_var_run_t tclass=dir ----------------------------------------------- and inode 3777358 is /var/run/nscd directory. so it'd be useful to add this rule to the dhcpd policy: allow dhcpd_t nscd_var_run_t:dir search; yours. -- Levente "Si vis pacem para bellum!"

4 3

Re: nVidia drivers and xorg
by Stephen Smalley 18 May '05

18 May '05

On Wed, 2005-05-18 at 07:32 +0100, Paul wrote: > One interesting thing on the logs... > > audit(1116372981.492:0): avc: denied {execmod} for > path=/usr/lib/tls/libnvidia-tls.so.1.0.7174 dev=hda5 ino=263999 > scotext=system_u:system_r:initrc_t tcontext=root:object_r:lib_t > tclass=file > > Is SELinux objecting to it and if it is, how do I fix it? I have SELinux > set to Permissive - Targetted. chcon -t texrel_shlib_t /usr/lib/tls/libnvidia-tls.so.1.0.7174 This marks the shared object as requiring text relocation, and thus allows it to happen in the policy (if allow_execmod boolean is active; /usr/sbin/getsebool allow_execmod). Looks like the policy needs to be updated as the existing regex for nvidia in types.fc doesn't cover this case (it seems to assume that they live in a nvidia subdirectory). -- Stephen Smalley National Security Agency

1 0

/tmp/gconfd-* : wrong type after 'augmenting' user
by Tom London 18 May '05

18 May '05

Running strict/enforcing, latest rawhide. I changed an existing user to a 'sysadm' user by adding to local.users, rebuilt/installed new policy, and did a 'restorecon -v -R' of home directory, /etc, /tmp, .... On reboot, logging shows that the preexisting /tmp/gconfd-XXX remained labeled as 'user_u:....'. Removing it (and several 'aumix*' files that were similarly labeled), and rebooting 'fixed' this. Is this the best, or does it make sense to considering adding 'per user' rules for such files? tom -- Tom London

3 2

postgresql postmaster denied write access
by Richard E Miles 16 May '05

16 May '05

I am running FC3 with targetted policy. When I try to start the postgresql server I get avc: denied { write } messages in the system log. ie: May 16 14:07:23 localhost kernel: audit(1116277643.114:0): avc: denied { write } for pid=13355 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 16 14:07:23 localhost kernel: audit(1116277643.115:0): avc: denied { write } for pid=13355 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 16 14:07:23 localhost last message repeated 34 times May 16 14:07:23 localhost kernel: audit(1116277643.116:0): avc: denied { write } for pid=13355 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 16 14:07:23 localhost last message repeated 37 times May 16 14:07:23 localhost kernel: audit(1116277643.117:0): avc: denied { write } for pid=13355 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir May 16 14:07:23 localhost last message repeated 27 times May 16 14:07:24 localhost pam_timestamp_check: pam_timestamp: `/' owner UID != 0 Is there a problem with the tagetted policy that prevents me from using postgresql? Thank you -- Richard E Miles Federal Way WA. USA registered linux user 46097

1 0

files without SE Linux labels on a default install - no Anaconda labeling
by Russell Coker 16 May '05

16 May '05

On an SE Linux system barring file system corruption and quota issues every file on a regular file system (Ext3 etc) should have a SE Linux label. As a test I did a default install of FC4T3 in the "Personal Workstation" configuration and checked this. Below is the relevant output from setfiles -v when relabelling the root file system. It seems to me that /usr/share/apps/ksplash, /usr/share/apps/ksplash/Themes, /usr/share/anaconda, /usr/share/anaconda/pixmaps, /usr/lib/anaconda-runtime, /usr/lib/anaconda-runtime/boot, and the install logs are created by Anaconda which doesn't apply SE Linux labels. Would it be possible to get Anaconda changed to apply labels to files and directories that it creates? I have no idea why the Portuguese Brazilian language file didn't get a label when all the other language files did. I have attached a list of all the files which aren't correctly labeled after a default targeted install which I haven't dealt with in other messages. NB this includes /etc/shadow... setfiles: relabeling /usr/share/apps/ksplash from system_u:object_r:file_t to system_u:object_r:usr_t setfiles: relabeling /usr/share/apps/ksplash/Themes from system_u:object_r:file_t to system_u:object_r:usr_t setfiles: relabeling /usr/share/anaconda from system_u:object_r:file_t to system_u:object_r:usr_t setfiles: relabeling /usr/share/anaconda/pixmaps from system_u:object_r:file_t to system_u:object_r:usr_t setfiles: relabeling /usr/lib/anaconda-runtime from system_u:object_r:file_t to system_u:object_r:lib_t setfiles: relabeling /usr/lib/anaconda-runtime/boot from system_u:object_r:file_t to system_u:object_r:lib_t setfiles: relabeling /usr/X11R6/lib/X11/locale/pt_BR.UTF-8 from system_u:object_r:file_t to system_u:object_r:lib_t setfiles: relabeling /root/install.log from system_u:object_r:file_t to root:object_r:user_home_t setfiles: relabeling /root/install.log.syslog from system_u:object_r:file_t to root:object_r:user_home_t -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

AVC messages and auditctl
by Russell Coker 16 May '05

16 May '05

Recently the AVC messages have been changed to not include the name of the executable as this is stored in the audit system. However a consequence of this is that in the early stages of boot we can't find out which program caused a message. This probably isn't a problem for the typical Fedora user (who uses targeted policy and has most of the boot scripts running in unconfined_t), but will cause problems for people who use the strict policy in it's most strict configuration and for people who want to develop an entirely new policy. What's the recommended solution to this? Can we get the audit functionality enabled through printk early in the boot process (IE in the first few lines of rc.sysinit)? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 1

(no subject)
by charlie cross 13 May '05

13 May '05

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2005