selinux May 2005

selinux@lists.fedoraproject.org

47 participants
63 discussions

Start a nNew thread

(no subject)
by charlie cross 13 May '05

13 May '05

1 0

OpenOffice.org 1.9.100
by Aurelien Bompard 13 May '05

13 May '05

Hi, Just so that you know, the OpenOffice 1.9.100 rpms from www.openoffice.org won't run on FC3 because of SELinux: audit(1115968252.998:0): avc: denied { execmod } for pid=9833 comm=soffice.bin path=/opt/openoffice.org1.9.100/program/libicudata.so.26.0.1 dev=sda2 ino=308509 scontext=user_u:system_r:unconfined_t tcontext=system_u:object_r:usr_t tclass=file What should we tell the upstream rpm maintainters so that their packages work on FC3 ? The packages used to work in an earlier version (1.9.73 I think). It's also possible that a policy update caused it, I'm not sure, I didn't use them very often. Is there something we can do to fix it, or is it only in the hands of the upstream maintainers ? Thanks Aurélien -- http://gauret.free.fr ~~~~ Jabber : abompard(a)jabber.fr I am the "ILOVEGNU" signature virus. Just copy me to your signature. This email was infected under the terms of the GNU General Public License.

5 7

Re: Untrusted content domain
by Ivan Gyurdiev 11 May '05

11 May '05

On Mon, 2005-05-09 at 14:04 +0100, Mike Hearn wrote: > Hi Ivan, > > I saw your work on the restricted $HOME SELinux policy and this > interests me a great deal (both with my Codeweavers hat and my > autopackage hat on). > > I'd like to discuss this in a more public forum. Is the Fedora SELinux > list a good place to talk about this sort of lockdown? Ok. Basically my plan is to see how SELinux can be used to confine all applications, including various "desktop" programs - content handlers and such. I dislike how so many things that are completely unrelated are marked ROLE_home_t under /home, and a lot of things are marked ROLE_tmp_t under /tmp. I think there should be better labeling of /home, and /tmp. As part of this, I have suggested various changes, including: - per domain labeling of ORBit sockets in /tmp, so apps don't have to access ROLE_tmp_t - confining various GNOME daemons to make use of this - starting with GConf, and gnome-vfs-daemon - labeling of the various GNOME hidden folders in /home with a more specific context than ROLE_home_t - restricting mozilla and other programs that interact with the web to writing ROLE_untrusted_content_t, as opposed to ROLE_home_t (or something stranger, like ROLE_mozilla_home_t, which is the current behavior) - labeling per/user fonts, and .desktop files, and writing macros to make those work - in the future, content-specific types such as ROLE_media_content_t, that content handlers can access. I have a bug tracking this here: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=155800 although right now this is just one large patch, not nearly where it should be, and unsuitable for merging. I have sent Daniel Walsh several smaller patches to begin implementing this - I need to update the bug to reflect that, since the large patch is a bit out of date. =========================== The untrusted_content part of this is a proposal for a type to be used to mark things downloaded from the Internet that cannot be trusted (hence..untrusted). The idea is that various web browsers, p2p clients, etc. will use this type to store content. Then the user would have to perform some sort of action to interact with this type, to make it accessible by other programs. This would be simply to relabel the file to a different type to begin with, but in the future an automated mechanism could be used to do this, or selinux integration with nautilus could be used to relabel the files. There were also suggestions of a virus scan before such content type would be made accessible. Basically, for starters I just want better labeling of content downloaded by mozilla, because ROLE_mozilla_home_t is just wrong - it's the same type as is used for internal mozilla settings (.mozilla). Then after the type exists, we can figure out what to do with it. To make this work I wanted there to be a folder in /home called downloads or something like that created by default. Then things stored there would automatically get the right type. I suggested that the GNOME team create such a folder, and integrate it with the Places menu, but I don't think there was a lot of interest on the Usability list - in any case people disagree about what it should be called, or whether it's important to have such a folder. I haven't decided what to do about this - currently my patch simply labels downloads and ".*Downloads" as ROLE_untrusted_content_t, if they are present. It also changes the type of files saved by mozilla in tmp to ROLE_untrusted_content_t.

3 11

targeted/cups.te - unconfined_t send_msg....
by Tom London 11 May '05

11 May '05

Running targeted/enforcing, latest rawhide. I get the following avc during login: May 11 06:18:09 localhost dbus: avc: denied { send_msg } for msgtype=method_call interface=com.redhat.CupsDriverConfig member=MatchDriver dest=com.redhat.CupsDriverConfig spid=3675 tpid=3019 scontext=user_u:system_r:unconfined_t tcontext=system_u:system_r:cupsd_config_t tclass=dbus Does this make sense? --- cups.te 2005-05-02 13:18:00.000000000 -0700 +++ /tmp/cups.te 2005-05-11 07:38:05.000000000 -0700 @@ -258,5 +258,5 @@ can_unix_connect(cupsd_t, initrc_t) allow cupsd_t initrc_t:dbus send_msg; allow initrc_t cupsd_t:dbus send_msg; -allow cupsd_t unconfined_t:dbus send_msg; +allow { cupsd_t cupsd_config_t } unconfined_t:dbus send_msg; ') tom -- Tom London

2 3

Re: using selinux to control user access to files
by Steve G 11 May '05

11 May '05

>I take it that even if I fire up auditd on RHEL4 today, and attempt to >play with auditctl, it isn't going to work until there is updated kernel >(or I patch/recompile existing kernel)? Right. There's roughly 20-30 patches against the RHEL4 kernel at this point. Some of which are experimental and not accepted upstream and therefore likely to change. FC4 has everything in it that is currently accepted upstream. It would be easier to experiment with FC4 at this point. -Steve __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail

1 0

Re: using selinux to control user access to files
by Steve G 11 May '05

11 May '05

>In my work environmnt, we work with some sensitive data, and we must have audit >trail whenever some types of files are touched (or we would fail external audits, >which translates to lost jobs, simple as that). Problem with using Linux so far >was lack of good auditing tools. This is all in work. The 0.7.4 audit package has some information about setting file watches (auditctl -w -p ). However, you need to have a kernel that's patched for it. We are still peer reviewing this capability. I think we have just a few more locking issues to solve and then it will be sent to lkml. I have put the tools into FC4 so that when the file system auditing patch does go upstream & you do a kernel update, everything starts working. -Steve Grubb __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail

2 1

Re: using selinux to control user access to files
by Steve G 11 May '05

11 May '05

>A bit missing in documentation on RHEL4, however I fetched sources from rawhide >(that have some documentation). At the time tha RHEL4 shipped, the audit framework had a lot of work to go. It couldn't really be documented since the utilities didn't really exist. It is slated for inclusion in U2. Also, FC4 has a respectable piece of the audit subsystem in it. >Is Audit Framework part of SELinux, used by SELinux, or something totally >unrelated? Its a separate entity with a different control interface. SE Linux uses it to send AVC messages. The audit system determines whether an audit daemon is in use. If so the messages go to the audit daemon. If not, they go to syslog. If you want to experiment with the audit system, try out FC4. I'll probably start writing tutorials and howto's once the audit system gets closer to completion. -Steve Grubb __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail

1 0

nss_ldap's tls_key file permission
by Farkas Levente 10 May '05

10 May '05

hi, if we'd like to use nss_ldap with tls certificzte files than we have to use a least 644 permission even on the key file. it's not a good security concern. it's better than without tls, but local user still too powerful in this case:-( is there any way to prevent this? i mean to be able to change the file permission to root:root 640 and use nss_ldap too? usualy in this case a small portion of the progam run as setuid root, but of course in this case it can't help since it's a library and the whole nss philosophy are different from this. what can i do? or currently there is no solution for this? thanks in advance. yours. -- Levente "Si vis pacem para bellum!"

2 1

CGI on user directory
by Yuichi Nakamura 10 May '05

10 May '05

On FC4 test2 with targeted policy(selinux-policy-targeted-1.23.14-2), I tried to run CGI on user home directory. After checked it run on permissive mode, chcon like following. chcon -R system_u:object_r:httpd_sys_script_exec_t ~/public_html/cgi-bin/ I found it does not work on enforcing mode. After I add "allow httpd_suexec_t user_home_t:dir { read };" it worked. Please add it to apache.te --- Yuichi Nakamura

2 5

Re: gpg through apache and php?
by brett 09 May '05

09 May '05

> > If you organize your /var/www > tree in a conventional manner, then it should work fairly smoothly. > Problems arise when people put CGIs all over the place (not just in cgi- > bin), and don't use any conventions in separating files that should be > read-only vs. read-write. OK, you are selling me on the /var/www tree. What is "a conventional manner." Needless to say you don't have to explain it all to me, perhaps you can point me to a resource that describes what you are talking about. For example, where do user PHP scripts live in this tree? Are they readable\writable by others? > Simplest thing to do is just to install policy sources and just allow > the permissions you want, e.g. > yum install selinux-policy-targeted-sources > cd /etc/selinux/targeted/src/policy > repeat: > audit2allow -d >> domains/misc/local.te > make load > <retry operation> > <goto repeat if it fails> > > Might be quicker to switch to permissive mode (setenforce 0), run your > CGI via apache, then run audit2allow once, as that will then collect > _all_ of the audit messages that would have been denied in enforcing > mode. So selinux-policy-targeted-sources is something that lets me change policy? And audit2allow is something that monitors what processes are open and "allows" them to pass through SELinux? Thanks, -brett

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2005