selinux January 2006

selinux@lists.fedoraproject.org

54 participants
67 discussions

Re: /usr/share - self inflicted issue
by Paul Howarth 26 Jan '06

26 Jan '06

Craig White wrote: > On Thu, 2006-01-26 at 14:38 +0000, Paul Howarth wrote: > >>Craig White wrote: >> >>>My main desktop, I was trying to upgrade from FC-3 to FC-4. >>> >>>I was a little short of space in /usr partition so I moved /usr/share >>>to /home/share and symlinked it back. >>> >>>This seemed all and good but that does cause a cups issue. >>> >>>the only clues I ever get are... >>> >>>E [26/Jan/2006:07:02:22 -0700] LoadBanners: Unable to open banner >>>directory "/usr/share/cups/banners": Permission denied >>> >>>/var/log/cups/error_log >>>E [26/Jan/2006:07:02:22 -0700] LoadPPDs: Unable to open PPD directory >>>"/usr/share/cups/model": Permission denied >>> >>>but those directories **seem to be ok** >>> >>># ls -Zld /usr/share/cups/model /usr/share/cups/banners/ >>>drwxr-xr-x 2 system_u:object_r:cupsd_etc_t root root 4096 Jan 16 >>>18:29 /usr/share/cups/banners/ >>>drwxr-xr-x 2 system_u:object_r:cupsd_etc_t root root 4096 Jan 16 >>>18:29 /usr/share/cups/model >>> >>>on my CentOS-4 system...they are different >>># ls -Zld /usr/share/cups/model /usr/share/cups/banners/ >>>drwxr-xr-x 2 system_u:object_r:usr_t root root 4096 Dec 27 >>>07:12 /usr/share/cups/banners/ >>>drwxr-xr-x 2 system_u:object_r:usr_t root root 4096 Dec 27 >>>07:12 /usr/share/cups/model >> >>Everything under /usr/share/cups is system_u:object_r:cupsd_etc_t on my >>FC4 boxes. What are the actual AVCs you're getting? >> >># ausearch -m avc,selinux_err > > ---- > for the purposes of brevity, I will only paste in the first > record...there are probably as many returned as there are files in > the /usr/share/cups tree like this... > > time->Mon Jan 16 16:33:00 2006 > type=PATH msg=audit(1137454380.947:5): item=0 > name="/usr/share/printconf/util" flags=1 inode=2 dev=03:02 mode=040755 > ouid=0 ogid=0 rdev=00:00 > type=CWD msg=audit(1137454380.947:5): cwd="/" > type=SYSCALL msg=audit(1137454380.947:5): arch=40000003 syscall=195 > success=no exit=-13 a0=bfa5a5b6 a1=bfa5a9b8 a2=b1eff4 a3=b7ec890c > items=1 pid=1974 aui > d=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > comm="printconf-backe" exe="/usr/bin/python" > type=AVC msg=audit(1137454380.947:5): avc: denied { read } for > pid=1974 comm="printconf-backe" name="share" dev=hda2 ino=12 > scontext=system_u:system_r: > cupsd_config_t tcontext=system_u:object_r:usr_t tclass=lnk_file It seems to be having problems with your symlink. Could you try doing a bind mount instead: # mount --bind /home/share /usr/share Paul.

1 0

3rd party shared objects won't work without disabling SELinux
by Lonni J Friedman 26 Jan '06

26 Jan '06

Hello, I'm working on an application that requires 3rd party (outside of what ships with FC) shared libraries. With FC4, I'm not having any problems. Up until just a few days ago, everything was working in FC5-test2 as well. However it seems that some update suddenly broke things in such a way that unless I completely disable SELinux, I cannot load/access the shared objects that I installed. When I attempt to do so, I get the following error: cannot enable executable stack as shared object requires: Permission denied Can someone point out what SELinux foo I might be missing here? thanks, Lonni

3 3

Fedora C-4
by Doug 25 Jan '06

25 Jan '06

On Jan. 22, 2006 I wrote: After upgrading from Fedora core3 to core4 my Nero-linux would not open. I installed the selinux policy targeted update and the Nero-linux problem was fixed but a new problem arose, now my HP Device Manager will not open. I have reinstalled HPLIP, checked everything I can find documented that might cause this and have resorted to living with the problem. If anyone has a suggestion I would be grateful for the help. dougdavidson(a)direcway.com I have discovered through trial and error (not knowledge YET) my problem can be fixed, by doing the following. Select in order; System Settings, Security Level, Selinux, Modify Selinux Policy, Other, place a check in (box)HPLIP_Disable_Trans. Close and re-boot. Now HP Device Manager works and so does the Scanner. Does anyone know what the consequence of this action might be, if any? dougdavidson(a)direcway.com

2 1

invalid context root:sysadm_r:initrc_t?
by dragoran 25 Jan '06

25 Jan '06

hello I found this errors in dmesg on a FC4 system using selinux-policy-targeted-1.27.1-2.16: audit(1137825680.353:2): security_compute_sid: invalid context root:sysadm_r:initrc_t for scontext=root:sysadm_r:unconfined_t tcontext=system_u:object_r:initrc_exec_t tclass=process audit(1137825680.617:3): security_compute_sid: invalid context root:sysadm_r:initrc_t for scontext=root:sysadm_r:unconfined_t tcontext=system_u:object_r:initrc_exec_t tclass=process what are this errors? what does invalid context means?

2 1

new avcs
by Jason Dravet 24 Jan '06

24 Jan '06

After todays rawhide updates avahi and hal no longer start. Here are the messages in the audit.log. I am running selinux-policy-targeted-2.2.2-1 in enforcing mode. The other software is avahi-0.6.4-4 and hal-0.5.6-2. Thanks, Jason ---- time->Tue Jan 24 07:19:01 2006 type=PATH msg=audit(1138108741.041:9): item=0 name="/etc/blkid.tab" flags=401 inode=2098656 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 type=CWD msg=audit(1138108741.041:9): cwd="/" type=SYSCALL msg=audit(1138108741.041:9): arch=40000003 syscall=33 success=no exit=-13 a0=9676f08 a1=2 a2=98a164 a3=805cdc0 items=1 pid=1966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="mount" exe="/bin/mount" type=AVC msg=audit(1138108741.041:9): avc: denied { write } for pid=1966 comm="mount" name="blkid.tab" dev=dm-0 ino=2098656 scontext=system_u:system_r:mount_t:s0 tcontext=root:object_r:etc_t:s0 tclass=file ---- time->Tue Jan 24 07:19:05 2006 type=PATH msg=audit(1138108745.294:10): item=0 flags=1 inode=1212726 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 type=SOCKETCALL msg=audit(1138108745.294:10): nargs=3 a0=c a1=bf9e107a a2=21 type=SOCKADDR msg=audit(1138108745.294:10): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 type=AVC_PATH msg=audit(1138108745.294:10): path="/var/run/dbus/system_bus_socket" type=SYSCALL msg=audit(1138108745.294:10): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf9e1040 a2=f555d4 a3=1f items=1 pid=2096 auid=4294967295 uid=70 gid=70 euid=70 suid=70 fsuid=70 egid=70 sgid=70 fsgid=70 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon" type=AVC msg=audit(1138108745.294:10): avc: denied { connectto } for pid=2096 comm="avahi-daemon" name="system_bus_socket" scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- time->Tue Jan 24 07:19:11 2006 type=PATH msg=audit(1138108751.178:11): item=0 flags=1 inode=1212726 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 type=SOCKETCALL msg=audit(1138108751.178:11): nargs=3 a0=3 a1=bfd631ca a2=21 type=SOCKADDR msg=audit(1138108751.178:11): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 type=AVC_PATH msg=audit(1138108751.178:11): path="/var/run/dbus/system_bus_socket" type=SYSCALL msg=audit(1138108751.178:11): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfd63190 a2=9d85d4 a3=1f items=1 pid=2127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option" type=AVC msg=audit(1138108751.178:11): avc: denied { connectto } for pid=2127 comm="hald-add-selinu" name="system_bus_socket" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- time->Tue Jan 24 07:19:11 2006 type=PATH msg=audit(1138108751.310:12): item=0 flags=1 inode=1212726 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 type=SOCKETCALL msg=audit(1138108751.310:12): nargs=3 a0=3 a1=bf93bcba a2=21 type=SOCKADDR msg=audit(1138108751.310:12): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 type=AVC_PATH msg=audit(1138108751.310:12): path="/var/run/dbus/system_bus_socket" type=SYSCALL msg=audit(1138108751.310:12): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf93bc80 a2=65f5d4 a3=1f items=1 pid=2129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option" type=AVC msg=audit(1138108751.310:12): avc: denied { connectto } for pid=2129 comm="hald-add-selinu" name="system_bus_socket" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- time->Tue Jan 24 07:19:11 2006 type=PATH msg=audit(1138108751.894:13): item=0 flags=1 inode=1212726 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 type=SOCKETCALL msg=audit(1138108751.894:13): nargs=3 a0=3 a1=bfa2b4fa a2=21 type=SOCKADDR msg=audit(1138108751.894:13): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 type=AVC_PATH msg=audit(1138108751.894:13): path="/var/run/dbus/system_bus_socket" type=SYSCALL msg=audit(1138108751.894:13): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfa2b4c0 a2=1805d4 a3=1f items=1 pid=2136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option" type=AVC msg=audit(1138108751.894:13): avc: denied { connectto } for pid=2136 comm="hald-add-selinu" name="system_bus_socket" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- time->Tue Jan 24 07:19:12 2006 type=PATH msg=audit(1138108752.022:14): item=0 flags=1 inode=1212726 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 type=SOCKETCALL msg=audit(1138108752.022:14): nargs=3 a0=d a1=bfaf0aba a2=21 type=SOCKADDR msg=audit(1138108752.022:14): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 type=AVC_PATH msg=audit(1138108752.022:14): path="/var/run/dbus/system_bus_socket" type=SYSCALL msg=audit(1138108752.022:14): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfaf0a80 a2=2e65d4 a3=1f items=1 pid=2107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="hald" exe="/usr/sbin/hald" type=AVC msg=audit(1138108752.022:14): avc: denied { connectto } for pid=2107 comm="hald" name="system_bus_socket" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket

2 2

Opening keynote annouce for SELinux Symposium
by Frank Mayer 24 Jan '06

24 Jan '06

For those of you planning to attend the SELinux Symposium, we just annouced the opening keynote speaker. I've attached the press release below. Frank -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Opening Keynote Speaker Announced for the Second Security-Enhanced Linux Symposium and Developer Summit Baltimore, MD - (January 23, 2006) - Steve Walker, President of Steve Walker & Associates and Managing Partner of Walker Ventures, will be the opening keynote speaker for the second annual Security-Enhanced Linux (SELinux) Symposium scheduled for February 27-March 3, 2006 in Baltimore, Maryland. Mr. Walker has the unique experience of having participated in the evolution of computer security over the past 35 years from its early research within the U.S. Department of Defense (DoD) through its explosion into today's world-wide products and services business. He is a 22-year veteran of the DoD at the National Security Agency, the Advanced Research Projects Agency and the Office of the Secretary of Defense. Mr. Walker was one of the elite members of a team responsible for the development of the ARPAnet, the legendary breakthrough messaging system that allowed the birth of the Internet as we know it today. He is also nationally recognized for his pioneering work on the DoD Computer Security Initiative and establishment of the National Computer Security Center within the U.S. In addition, Mr. Walker was the President and Chief Executive Officer of Trusted Information Systems, Inc. (TIS), which he founded in 1983. Before its purchase by Network Associates, TIS had become a publicly traded company, employed more than 350 people, and had offices throughout the world. Having its foundation in network security advanced research and development, TIS was responsible for creating revolutionary technologies including the world's most secure firewall, Gauntlet, and the first fully exportable encryption, RecoverKey. Currently, Mr. Walker serves as President of Steve Walker & Associates and Managing Partner of Walker Ventures, a venture capital fund investing in early-stage technology companies. Mr. Walker will present a keynote address entitled "The Road to Practical Mandatory Security in Mainstream Operating Systems - an historical perspective." In this address, Mr. Walker will share his insights on the technological, political, and business challenges that have been overcome the past 30+ years on the road to the practical mandatory access control features SELinux brings to the mainstream. About the SELinux Symposium The Security-Enhanced Linux (SELinux) Symposium is an annual exchange of ideas, technology, and research involving SELinux. SELinux is technology that adds flexible, strong mandatory access control security to Linux. The Second Symposium is scheduled for February 27-March 3, 2006 in Baltimore, Maryland and is sponsored by Hewlett-Packard, IBM, Red Hat, Tresys Technology, and Trusted Computer Solutions. The event brings together experts from business, government, and academia to share research, development, and application experiences using SELinux. For information on registration and sponsorship opportunities, see www.selinux-symposium.org or info(a)selinux-symposium.org.

1 0

Latest rawhide: boot issue with avahi/hald/... ?
by Tom London 23 Jan '06

23 Jan '06

Running latest rawhide, targeted/permissive: (only --excude=totem\*) Get the following from audit.log: allow NetworkManager_t initrc_t:unix_stream_socket { acquire_svc connectto }; allow avahi_t initrc_t:unix_stream_socket connectto; allow cupsd_config_t initrc_t:unix_stream_socket { acquire_svc connectto send_msg }; allow dhcpc_t initrc_t:unix_stream_socket { acquire_svc connectto }; allow hald_t initrc_t:unix_stream_socket { acquire_svc connectto }; Seems to be problems accessing /var/run/dbus/system_bus_socket: avc's imply file is initrc_t, but ls -lZ yields: srwxrwxrwx root root system_u:object_r:system_dbusd_var_run_t system_bus_socket 'messagebus' service did move earlier in startup sequence over the weekend, but didn't seem to affect this. Here are a few complete entries from audit.log type=PATH msg=audit(01/23/2006 06:58:02.423:10) : item=0 flags=follow inode=2142247 dev=fd:00 mode=socket,777 ouid=root ogid=root rdev=00:00 type=SOCKETCALL msg=audit(01/23/2006 06:58:02.423:10) : nargs=3 a0=c a1=bf80d3aa a2=21 type=SOCKADDR msg=audit(01/23/2006 06:58:02.423:10) : saddr=local /var/run/dbus/system_bus_socket type=AVC_PATH msg=audit(01/23/2006 06:58:02.423:10) : path=/var/run/dbus/system_bus_socket type=SYSCALL msg=audit(01/23/2006 06:58:02.423:10) : arch=i386 syscall=socketcall(connect) success=yes exit=0 a0=3 a1=bf80d370 a2=4d55d4 a3=1f items=1 pid=2646 auid=unknown(4294967295) uid=avahi gid=avahi euid=avahi suid=avahi fsuid=avahi egid=avahi sgid=avahi fsgid=avahi comm=avahi-daemon exe=/usr/sbin/avahi-daemon type=AVC msg=audit(01/23/2006 06:58:02.423:10) : avc: denied { connectto } for pid=2646 comm=avahi-daemon name=system_bus_socket scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- type=PATH msg=audit(01/23/2006 06:58:02.879:15) : item=0 flags=follow inode=2142247 dev=fd:00 mode=socket,777 ouid=root ogid=root rdev=00:00 type=SOCKETCALL msg=audit(01/23/2006 06:58:02.879:15) : nargs=3 a0=3 a1=bfbe580a a2=21 type=SOCKADDR msg=audit(01/23/2006 06:58:02.879:15) : saddr=local /var/run/dbus/system_bus_socket type=AVC_PATH msg=audit(01/23/2006 06:58:02.879:15) : path=/var/run/dbus/system_bus_socket type=SYSCALL msg=audit(01/23/2006 06:58:02.879:15) : arch=i386 syscall=socketcall(connect) success=yes exit=0 a0=3 a1=bfbe57d0 a2=2835d4 a3=1f items=1 pid=2658 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=cups-config-dae exe=/usr/bin/cups-config-daemon type=AVC msg=audit(01/23/2006 06:58:02.879:15) : avc: denied { connectto } for pid=2658 comm=cups-config-dae name=system_bus_socket scontext=system_u:system_r:cupsd_config_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket ---- tom -- Tom London

2 4

Re: Re: su, context(selinux?) 2nd prompt
by Rex Dieter 23 Jan '06

23 Jan '06

Maciej Żenczykowski wrote: >>> Weird, I'm not seeing this... >> >> Are using an selinux-enabled CentOS 4.2 (or RHEL4U2) box? > > Yes, an up2date Centos 4.2 box with selinux at the default targeted value. > > However: > $ su - > Password: > # selinuxenabled; echo $? > 0 > # getenforce > Enforcing Interesting. All our boxes that show this behavior were installed originally CentOS 4.1, and upgraded to 4.2. Further, my personal box is only using selinux in permissive mode (too much breakage), but I still see the second prompt. -- Rex

1 0

AVC funny msgs!
by Sebastián A. La Spina 23 Jan '06

23 Jan '06

This is an important avc? Im currently running my SE on permisive mode, im not very sure to run it on enforcing . :( audit(1138026282.862:2): avc: denied { compute_user } for pid=2166 comm="crond" scontext=system_u:system_r:crond_t tcontext=system_u:object_r:security_t tclass=security audit(1138026302.050:4): avc: denied { compute_user } for pid=2533 comm="gdm-binary" scontext=system_u:system_r:unconfined_t tcontext=system_u:object_r:security_t tclass=security audit(1138026456.531:6): avc: denied { compute_relabel } for pid=2702 comm="sshd" scontext=system_u:system_r:unconfined_t tcontext=system_u:object_r:security_t tclass=security Sorry for my litle English... Good luck for all of yours! Sebastián

1 0

MCS article
by James Morris 20 Jan '06

20 Jan '06

If anyone wants to play with MCS, have a look at this article I just posted: "Getting Started with Multi-Category Security (MCS)" http://james-morris.livejournal.com/8228.html Feedback, suggestions etc. welcome. - James -- James Morris <jmorris(a)namei.org>

4 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2006