selinux January 2006

selinux@lists.fedoraproject.org

54 participants
67 discussions

List of operations
by Göran Uddeborg 17 Oct '06

17 Oct '06

Maybe this is a FAQ, but I haven't found it answered in any of the FAQ:s I've looked through: Is there some kind of documentation list over the available classes and operations (permissions)? Other concepts, like types and roles are defined in the policy, with some luck together with a comment. In some cases there are even manual pages, like httpd_selinux. But the list of available classes and operations must be defined by the kernel module if I understand things correctly. I could extract a list from the flask/access_vectors file. But I would have liked something with a sentence or so of explanation. Some names may be self-explanatory, but many are not obvious. I'm imagining some kind of list like the appendices of the O'Reilley book, but updated for the current version. Does such a list exist somewhere? Or is it just in my imagination? :-)

4 4

Error sending status request (Operation not permitted)
by Bruce Ecroyd 23 Feb '06

23 Feb '06

I recently switched from FC4 targeted (enforcing) to strict (permissive) using selinux-policy-strict-1.27.1-2.16.noarch.rpm. I did a touch /.autorelabel before rebooting. I see this: [bruce@BorgCube ~]$ su - Password: Error sending status request (Operation not permitted) [root@BorgCube ~]# The last part of the /var/log/audit/audit.log shows: type=SYSCALL msg=audit(1138247001.111:13162965): arch=40000003 syscall=5 success=yes exit=3 a0=866125b a1=c2 a2=180 a3=3a8083 items=1 pid=8250 auid=4294967295 uid=501 gid=100 euid=0 suid=0 fsuid=0 egid=100 sgid=100 fsgid=100 comm="su" exe="/bin/su" type=AVC msg=audit(1138247001.111:13162965): avc: denied { create } for pid=8250 comm="su" name=.xauthVpNVFy scontext=user_u:user_r:user_t tcontext=user_u:object_r:sysadm_home_dir_t tclass=file type=AVC msg=audit(1138247001.111:13162965): avc: denied { add_name } for pid=8250 comm="su" name=.xauthVpNVFy scontext=user_u:user_r:user_t tcontext=root:object_r:sysadm_home_dir_t tclass=dir type=AVC msg=audit(1138247001.111:13162965): avc: denied { write } for pid=8250 comm="su" name=root dev=dm-0 ino=11392129 scontext=user_u:user_r:user_t tcontext=root:object_r:sysadm_home_dir_t tclass=dir type=SYSCALL msg=audit(1138247001.111:13162967): arch=40000003 syscall=207 success=yes exit=0 a0=3 a1=0 a2=0 a3=0 items=0 pid=8250 auid=4294967295 uid=501 gid=100 euid=0 suid=0 fsuid=0 egid=100 sgid=100 fsgid=100 comm="su" exe="/bin/su" type=AVC msg=audit(1138247001.111:13162967): avc: denied { setattr } for pid=8250 comm="su" name=.xauthVpNVFy dev=dm-0 ino=11392172 scontext=user_u:user_r:user_t tcontext=user_u:object_r:sysadm_home_dir_t tclass=file type=USER msg=audit(1138247001.325:13165423): user pid=8250 uid=501 auid=4294967295 msg='PAM session open: user=root exe=/bin/su (hostname=?, addr=?, terminal=pts/2 result=Success)' Any ideas? If I change to strict, enforcing, will this prevent me from su to root? Bruce

2 1

Curious Behavior doing routine redirection of ping output to file...
by selinux.funchords＠spameater.org 22 Feb '06

22 Feb '06

I'm not exactly a "newbie," but I'm diving a lot deeper than I ever have. This one has me a little wrapped around the axel, and if someone could help clear the fog, I'd appreciate it. The short version: I'm trying to redirect the output of ping to a file. I get a 0 byte file as a result. Where I am now: When selinux is permissive, it works as I expect it to. When this started, I had no idea that selinux was running or even what it was, exactly (I've been running this system for about two weeks). I've learned a lot since then. But I haven't figured out how to do anything other than flip bits on existing boolean rules and change the sestatus mode. For example, how do I fix the above problem? Current version: 2.6.14-1.1653_FC4 with selinux in targeted/enforced. When this began, I posted a message to www.fedoraforum.org ( http://www.fedoraforum.org/forum/showthread.php?t=88238 ) with the title, "BASH: How to redirect ping output to file?" Later, I found this from from /var/log/audit/audit.log ... type=AVC msg=audit(1134599953.748:32): avc: denied { write } for pid=5503 comm="ping" name="pingoutput2" dev=dm-0 ino=916895 scontext=root:system_r:ping_t tcontext=root:object_r:user_home_t tclass=file type=SYSCALL msg=audit(1134599953.748:32): arch=40000003 syscall=11 success=yes exit=0 a0=8d64360 a1=8d56400 a2=8d51520 a3=1 items=2 pid=5503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="ping" exe="/bin/ping" type=AVC_PATH msg=audit(1134599953.748:32): path="/root/pingoutput2" type=CWD msg=audit(1134599953.748:32): cwd="/root" type=PATH msg=audit(1134599953.748:32): item=0 name="/bin/ping" flags=101 inode=5499653 dev=fd:00 mode=0104755 ouid=0 ogid=0 rdev=00:00 type=PATH msg=audit(1134599953.748:32): item=1 flags=101 inode=5892482 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 ... and I discovered the commands audit2why and audit2allow, which has this example in the audit2allow man pages ... $ cd /etc/selinux/$(SELINUXTYPE)/src/policy $ /usr/bin/audit2allow -i < /var/log/audit/audit.log >> domains/misc/local.te <review domains/misc/local.te and customize as desired> $ make load ... and that's where my zero-byte stack blows. I have no src directory under /etc/selinux/targeted, nor do I have anything at all on my system named domains. Still, I tried to follow the advice by mdkir'ing the necessary directories and creating a local.te file with the recommended "allow ping_t user_home_t:file write;" line in it. Then I typed 'make load' and I really think I actually heard something laugh at me. This is the way I learn best, and this isn't anything more than a curiousity to me. But from what I've told you so far, can you point me into the right direction? I did search the archive for this list, as well as the FC3 (which also seemed to point to these directories that I don't have). Thanks! Robb Topolski robb(at)funchords(dot)com http://www.funchords.com

7 9

dbus error message
by Srinivasa Ds 09 Feb '06

09 Feb '06

Hi Iam getting selinux dbus error message on my RHEL4 machine This is different from earlier dbus error messages which is there earlier and selinux-policy-targeted-1.17.30-2.117.noarch.rpm(from Daniel walsh) has fixed it. This one looks different from that and it doesn't have "denied send_msg" message which has security class fields and helped in debugging. Error messages looks like this ================================================================= Jan 17 17:02:07 x330b dbus: Can't send to audit system: USER_AVC pid=7704 uid=81 loginuid=0 message=avc: received policyload notice (seqno=16) Jan 17 17:02:07 x330b dbus: Can't send to audit system: USER_AVC pid=7704 uid=81 loginuid=0 message=avc: 0 AV entries and 0/512 buckets used, longest chain length 0 Jan 17 17:02:24 x330b dbus: Can't send to audit system: USER_AVC pid=7704 uid=81 loginuid=0 message=avc: received setenforce notice (enforcing=1) =================================================================== I just wanted to know,why this error message is getting generated and how to fix it out. Is it due to lack of send_msg permission? Looking for reply Srinivasa DS

2 5

Problem with interbase (firebird-1.5) on FC4 box, httpd-2.0.54, php-interbase-5.0.4-10.5
by Daniel Paul 06 Feb '06

06 Feb '06

Hello there, because I need interbase (firebird) support in php, I recompiled the actual php-5.0.4-10.5 package with interbase support (--with-interbase=shared). When I start httpd there is the following message in error_log: PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/interbase.so' - object requires: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0 phpinfo() shows that php has read the interbase.ini file which contains a reference to the interbase.so module, but interbase support is disabled (nothing shows up regarding interbase). With selinux set to permissive mode (instead of enforcing), there is no such message and phpinfo() shows me, that interbase support is enabled. audit.log shows the following: type=AVC msg=audit(1138630853.033:10): avc: denied { execstack } for pid=1886 comm="httpd" scontext=root:system_r:httpd_t tcontext=root:system_r:httpd_t tclass=process type=SYSCALL msg=audit(1138630853.033:10): arch=40000003 syscall=125 success=no exit=-13 a0=bf8a3000 a1=1000 a2=1000007 a3=d5a000 items=0 pid=1886 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="httpd" exe="/usr/sbin/httpd" Any help would be truly appreciated. Thanks in advance, Daniel

2 4

rawhide selinux-policy-strict whoopsage...
by Valdis.Kletnieks＠vt.edu 03 Feb '06

03 Feb '06

Ran yum, it tried to install selinux-policy-strict-2.2.5-1 and died a horrid death: Updating : selinux-policy-strict ####################### [13/24] libsepol.verify_module_requirements: Module acct's global requirements were not met: type/attribute sysadm_home_dir_t libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! libsepol.verify_module_requirements: Module alsa's global requirements were not met: type/attribute devlog_t libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! libsepol.verify_module_requirements: Module amanda's global requirements were not met: type/attribute sysadm_home_dir_t libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! .... (skipping scads of similar errors..) libsepol.verify_module_requirements: Module xserver's global requirements were not met: type/attribute logfile libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! libsepol.verify_module_requirements: Module zebra's global requirements were not met: type/attribute direct_init libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! Running strict/permissive. Any suggestions?

3 7

extras package that require changes in selinux-policy (initng)
by dragoran 02 Feb '06

02 Feb '06

Hello. I am working on selinux support in initng, which is in review for extras now [1]. But it seems that initng requires a policy to work (just tested in targeted mode) Using the default context (sbin_t) lets all apps that are started from initng run as kernel_t. Relabling /sbin/initng to init_exec_t (same as init) fixes this and the processes run as init_t and udev_t for udev, but some issues still remain. hald,httpd, etc. also run as init_t which is *wrong* they have to get into their own domain. How is this handled in sysvinit? After reading the code I havn't found anything about it. The patch I wrote can be found here: http://bugzilla.initng.thinktux.net/show_bug.cgi?id=365 Did I do something wrong? Did I miss something? After fixing this we will run into an other problem. Every time the filesystem gots relabled initng will become sbin_t which will break it. To fix this we need to modify the selinux-policy. What should be done if a package in extras requires to change a core package? Should I just fill a bug against it and hope that it will be released as an update for FC4, and gets into rawhide too? Was unable to find anything about it in the wiki. 1: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173459

3 7

Re: Spamassassin emails have wrong perms -- CC'ed to selinux list
by Justin Willmert 01 Feb '06

01 Feb '06

Justin Willmert wrote: > I am hoping somebody can help me solve a problem I am having with > procmail and spamassassin (specifically spamd). When spamassassin has > marked a message as spam, it gets sorted to a Junk folder, but the > problem is that it is owned by root:mail when it should be owned by > the user. When this happens, dovecot will not serve the email to the > user. I sort other emails into folders with simple matching rules and > those work fine. Spamassassin is the only rule that is piped out to a > program. > > Here is the relevant portion my procmailrc file: > > DROPPRIV=yes # Make this run as a normal user. If > you need > # root privileges for something, do > it before > # this line. > # Send mail through spamassassin > :0fw > | spamc -u $LOGNAME > > # Now that we've tagged the spam, put in the appropriate folder > :0 > * ^X-Spam-Status: Yes > .Junk/ > > I've tried taking the -u $LOGNAME portion out too and that doesn't > work. Following is a maillog sample. > > Jan 29 17:47:11 netserv sendmail[19847]: k0TNlAig019847: Milter add: > header: X-Virus-Scanned: ClamAV 0.88/1257/Sun Jan 29 09:15:47 2006 > on mydomain.com > Jan 29 17:47:11 netserv sendmail[19847]: k0TNlAig019847: Milter add: > header: X-Virus-Status: Clean > Jan 29 17:47:11 netserv spamd[19654]: connection from mydomain.com > [127.0.0.1] at port 57905 > Jan 29 17:47:11 netserv spamd[19654]: handle_user: unable to find > user 'justin'! > Jan 29 17:47:11 netserv spamd[19654]: Still running as root: user > not specified with -u, not found, or set to root. Fall back to > nobody. > Jan 29 17:47:11 netserv spamd[19654]: processing message > <BAY107-F2792E57045186E9EED3A038A160(a)phx.gbl> for justin:99. > Jan 29 17:47:11 netserv spamd[19654]: cannot write to > /etc/mail/bayes/bayes_journal, Bayes db update ignored: Permission > denied > Jan 29 17:47:13 netserv spamd[19654]: clean message (1.7/5.0) for > justin:99 in 1.5 seconds, 1076 bytes. > Jan 29 17:47:13 netserv spamd[19654]: result: . 1 - > BAYES_50,DNS_FROM_RFC_POST,MSGID_FROM_MTA_HEADER > > scantime=1.5,size=1076,mid=<BAY107-F2792E57045186E9EED3A038A160(a)phx.gbl>,bayes=0.499999999735837,autolearn=no > > Jan 29 17:47:13 netserv sendmail[19849]: k0TNlAig019847: > to=<justin(a)mydomain.com>, delay=00:00:02, xdelay=00:00:02, > mailer=local, pri=30995, dsn=2.0.0, stat=Sent > > As you can see, I've also got a problem with not being able to access > the bayes_journal. I've put it in it's own directory and made them > owned by nobody:staff and still nothing. Anyway, here is my local.cf > file: > > # These values can be overridden by editing > ~/.spamassassin/user_prefs.cf > # (see spamassassin(1) for details) > > # How many hits before a message is considered spam. The lower the > number, the > # more sensitive it is. > required_hits 5 > > # Encapsulate spam in an attachment (0=No, 1=Yes in message/rfc822, > # 2=Yes in text/plain) > report_safe 0 > > # Text to prepend to subject of spam > rewrite_header Subject [SPAM] > > # Enable the Bayes System > use_bayes 1 > > # Enable Bayes auto-learning > bayes_auto_learn 1 > > # Mail using languages used in these country codes will not be > marked as being > # possibly spam in a foreign language. > ok_languages en > > I'd be happy to send along any other information you need. Thanks for > help in advance. > > Justin Willmert > I'm cc-ing this to the fedora-selinux-list. I think some of the problems may be applicable there. OK, after some more testing, when I disable SELinux, many of the errors go away. First of all, I get rid of the error message saying user can not be found and with it the 'still running as root' error. Second, it is able to access the bayes_journal file (as long as normal unix permissions are right, which I've figured out). So I guess the problem is an SELinux issue which I can't solve. I'd attach some avc error messages, but I can't seem to find any. I've looked in maillog, secure, and messages, but nothing.

3 5

Problems with snmpd following update.
by J. David Rye of Roadtech 01 Feb '06

01 Feb '06

Have run in to a problem on a couple of servers that I have updated in the last week or so. snmpd does not start after a reboot, the following log extract is from /var/log/messages on server f4. Jan 31 17:26:54 f4 acpid: acpid startup succeeded Jan 31 17:26:54 f4 kernel: audit(1138728414.530:2): avc: denied { execmem } fo r pid=5278 comm="snmpd" scontext=user_u:system_r:snmpd_t tcontext=user_u:system _r:snmpd_t tclass=process Jan 31 17:26:54 f4 snmpd: /usr/sbin/snmpd: error while loading shared libraries: libbeecrypt.so.6: cannot enable executable stack as shared object requires: Per mission denied Jan 31 17:26:54 f4 snmpd: snmpd startup failed Running execstack -q /usr/lib/libbeecrypt.so.6 gives X /usr/lib/libbeecrypt.so.6 So the library is explisitly marked as requiring an executable stack. looking at the obvious rpms yields the following kernel-2.6.12-1.1381_FC3 was kernel-2.6.11-1.14_FC3 net-snmp-5.2.1.2-FC3.1 unchanged net-snmp-libs-5.2.1.2-FC3.1 unchanged selinux-policy-targeted-1.17.30-3.19 was selinux-policy-targeted-1.17.30-2.96 libselinux-1.19.1-8 unchanged beecrypt-3.1.0-6 unchanged Any suggestions appreciated. -- J. David Rye http://www.roadrunner.uk.com http://www.rha.org.uk mailto://d.rye@roadtech.co.uk

3 4

SElinux and firestarter
by Jonathan Underwood 01 Feb '06

01 Feb '06

Hi, There appears to be issues with SElinux and the firestarter package available from fedora-extras. I have attached the errors from /var/log/messages upon boot to this email. I suspect it may be related to either dhcpd or kernel module loading upon boot, but I'm rather clueless about SElinux. If someone could give me some pointers on how to proceed with debugging this it would be really appreciated. I have reported the bug here: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179248 This is with kernel 2.6.14-1.1656_FC4, libselinux-1.23.10-2, selinux-policy-targeted-1.27.1-2.16. I realize that I have probably not given enough information to debug this, but I am not sure what else would be useful. Many thanks, Jonathan

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2006