selinux January 2006

selinux@lists.fedoraproject.org

54 participants
67 discussions

selinux patch breaks sudo NOEXEC capability
by Gene Czarcinski 20 Jan '06

20 Jan '06

This problem has been reported as https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178429 against fc5test1/development although it exists in FC4 also (the sudo NOEXEC capability was not available in FC3). In sudo 1.6.8p8 and later (maybe a bit earlier too) adds a NOEXEC option. The NOEXEC option is an important security feature since it suppresses a user's ability to "shell out" of a program such as vi to get general root access. When NOEXEC is working, you can use "sudo vi xxx" to edit file xxx but you cannot shell out (e.g., ":!bash") from vi. If the selinux patch to the sudo package is applied, then you get the message: /usr/sbin/sesh: Error execing /bin/vi: Permission denied and you cannot run vi (or anything) under sudo (when "Defaults noexec" is specified in the /etc/sudoers file). A very quick look at the code says that this will not be easy to fix since sudo implements NOEXEC by dummying out the "exec" functions for the program run by sudo. With the selinux patch applied, sudo invokes /usr/sbin/sesh before invoking your program and sesh is using the dummied-out exec function. Gene

2 1

amrestore problem, still
by Stephen Walton 19 Jan '06

19 Jan '06

Hi, Running FC4 pretty much out of the box. If you look at https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168136, you'll see a bug I filed some time ago about conflicts with SELinux and amrecover. The last comment there says "Fixed in selinux-policy-*-1.27.1-2.1" which is true for that specific bug, but one still can't use amrecover because of some problem with the index server amindexd. I've attached the audit log below. The on disk copy of amindexd has context system_u:object_r:amanda_inetd_exec_t. Do I need to file another bug report on bugzilla? type=AVC msg=audit(1137440126.806:65011): avc: denied { read write } for pid=30860 comm="amindexd" name="[39498626]" dev=sockfs ino=39498626 scontext=system_u:system_r:amanda_t tcontext=system_u:system_r:inetd_t tclass=tcp_socket type=SYSCALL msg=audit(1137440126.806:65011): arch=40000003 syscall=11 success=yes exit=0 a0=8a39640 a1=8a39ab8 a2=8a3ee88 a3=bfe6b964 items=2 pid=30860 auid=4294967295 uid=33 gid=6 euid=33 suid=33 fsuid=33 egid=6 sgid=6 fsgid=6 comm="amindexd" exe="/usr/lib/amanda/amindexd" type=AVC_PATH msg=audit(1137440126.806:65011): path="socket:[39498626]" type=CWD msg=audit(1137440126.806:65011): cwd="/" type=PATH msg=audit(1137440126.806:65011): item=0 name="/usr/lib/amanda/amindexd" flags=101 inode=776533 dev=fd:03 mode=0100755 ouid=33 ogid=6 rdev=00:00 type=PATH msg=audit(1137440126.806:65011): item=1 flags=101 inode=89458 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 type=AVC msg=audit(1137440126.862:65012): avc: denied { getattr } for pid=30860 comm="amindexd" laddr=127.0.0.1 lport=10082 faddr=127.0.0.1 fport=521 scontext=system_u:system_r:amanda_t tcontext=system_u:system_r:inetd_t tclass=tcp_socket type=SYSCALL msg=audit(1137440126.862:65012): arch=40000003 syscall=102 success=yes exit=0 a0=7 a1=bf9f4110 a2=aea498 a3=0 items=0 pid=30860 auid=4294967295 uid=33 gid=6 euid=33 suid=33 fsuid=33 egid=6 sgid=6 fsgid=6 comm="amindexd" exe="/usr/lib/amanda/amindexd" type=SOCKETCALL msg=audit(1137440126.862:65012): nargs=3 a0=0 a1=bf9f4254 a2=bf9f4268

2 1

Stopping SELinux
by Timothy Murphy 19 Jan '06

19 Jan '06

Sorry to be a bore, but how does one stop selinux running? Is it sufficient to set "SELINUX=disabled" in /etc/selinux/config ? [I'm afraid since I started running selinux I've been having problems with my WiFi network - quite likely nothing to do with SELinux, but all the same I'd like to make sure it is not running during diagnostics. I have made the setting above, but still seem to get messages about selinux in /var/log/messages . Is there any process I should kill ?] -- Timothy Murphy e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

3 6

SELinux Symposium WiPs, BoFs, and Case Studies Reminder
by Joshua Brindle 18 Jan '06

18 Jan '06

This is a reminder to submit WiPs, BoFs, and Case Studies for the 2006 SELinux symposium. If you have interesting information about SELinux that is not already part of the agenda, please consider submitting something. The deadline for case studies and WiPs is February 1. The deadline for BoFs is February 15. There is limited space for all three. Accepted presenters will be notified by email and the final schedule will be placed on the website and posted at the conference. SELinux Case Studies Case studies are an opportunity to present lessons-learned and success stories about deployed, SELinux-based enterprise solutions and/or SELinux-based products. There is time for 2-3 case studies with presentations of 20-30 minutes with no formal paper required. Interested parties can submit case studies to chair(a)selinux-symposium.org. Please include a title, no more than one-page description of the case study, participating organizations, and contact information for the presenters. Work-in-Progress Reports (WiPs) WiPs are an opportunity to present emerging projects and technologies to the community in short presentations. The presentations usually cover works-in-progress, new results, status updates, or timely topics. There is time for 6-8 WiPs with presentations of 10 - 15 minutes with no formal paper required. Speakers should submit the title of the presentation, a one paragraph abstract, and a brief speaker bio to chair(a)selinux-symposium.org. Birds-of-a-Feather Sessions (BoFs) BoFs are an opportunity to have an informal gathering of community members interested in a particular topic. BoFs often include a brief presentation or demonstration followed by discussion. There is time for 4 BoFs of 45 minutes each. BoFs will be scheduled during the Symposium reception. Interested parties can submit suggestions for BoFs to chair(a)selinux-symposium.org. Please include a title, brief description of the topic, and contact information for the organizer.

1 0

[ANN] SELinux Policy Editor 1.3.1
by Yuichi Nakamura 17 Jan '06

17 Jan '06

Hi. SELinux Policy Editor 1.3.1 has been released. About SELinux Policy Editor, visit http://seedit.sourceforge.net/ (1) Notice This release includes Simplified Policy only. GUI is not included, it will be re-developped. It is development version, may be unstable. And tested only in Fedora Core4. (2) Changes * audit2spdl utility It works like audit2allow, generates simplified policy from log. You do not have to remember detail of simplified policy syntax. * Detailed permission for files support For users who want more security, new permission a(Append),t(seTattr), c(Create), e(Erace),o(Overwrite) can be used. * Documentation Documentation about what permissions are integrated, unsupported by simplified policy is prepared. Verifying security of Simplified Policy has become easier. See http://seedit.sourceforge.net/doc/permission_integrate/ * Generation of above document using XML/Python (3) How to use First get seedit-converter-1.3.1-1.i386.rpm and seedit-policy-1.3.1-FC4.noarch.rpm from http://sourceforge.net/project/showfiles.php?group_id=135756 How to install is the same as 1.2, see http://seedit.sourceforge.net/doc/install/INSTALL.html For detail, see manual at http://seedit.sourceforge.net/doc_devel/simplified_policy_manual/ (4) Plan - XML support to be handled easily by UI tools - New GUI - Review security of simplified policy, prepare document If you have question, comment, suggestion and others, please feel free to send me e-mail(ynakam(a)gwu.edu). ----- Yuichi Nakamura Japan SELinux Users Group(JSELUG) SELinux Policy Editor: http://seedit.sourceforge.net/

1 0

rawhide avcs...(hostname, restorecon)
by Tom London 17 Jan '06

17 Jan '06

Avcs from today's rawhide (selinux-policy-targeted-2.1.10-1) (enforcing): >From /var/log/messages: Jan 14 09:27:16 localhost kernel: SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts Jan 14 09:27:16 localhost kernel: audit(1137230757.160:2): avc: denied { read write } for pid=400 comm="hostname" name="console" dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file Jan 14 09:27:16 localhost kernel: audit(1137230757.160:3): avc: denied { read write } for pid=400 comm="hostname" name="console" dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file Jan 14 09:27:16 localhost kernel: audit(1137230757.160:4): avc: denied { read write } for pid=400 comm="hostname" name="console" dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file Jan 14 09:27:16 localhost kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts Jan 14 09:27:16 localhost kernel: audit(1137230758.780:5): avc: denied { write } for pid=413 comm="restorecon" name="[987]" dev=pipefs ino=987 scontext=system_u:system_r:restorecon_t:s0 tcontext=system_u:system_r:restorecon_t:s0 tclass=fifo_file Jan 14 09:27:16 localhost kernel: audit(1137230758.780:6): avc: denied { read } for pid=412 comm="restorecon" name="[987]" dev=pipefs ino=987 scontext=system_u:system_r:restorecon_t:s0 tcontext=system_u:system_r:restorecon_t:s0 tclass=fifo_file Jan 14 09:27:16 localhost kernel: hw_random hardware driver 1.0.0 loaded -- Tom London

2 1

Denied { search } mingetty and can't log in
by Emeric Maschino 16 Jan '06

16 Jan '06

Hi, I've just installed a clean Fedora Core development IA-64 (Itanium systems) on the second HDD of my hp workstation zx6000. During the installation of selinux-policy-targeted 2.1.7-3, the following messages are recorded in the logs. I don't know if they're relevant to my problem with mingetty however (see below): libsemanage.dbase_policydb_list: out of memory libsemanage.semanage_exec_prog: Child process /usr/sbin/genhomedircon did not exit cleanly. libsemanage.semanage_install_sandbox: genhomedircon returned error code -1. semodule: Failed! Forcing reinstall or trying to install a different policy (e.g. selinux- policy-mls) gives the same result. At reboot, I can't log in to my system because of something going wrong with mingetty. The following line is repeated a huge number of times: avc: denied { search } for pid=553 comm="mingetty" name="/" dev=tmpfs ino=977 scontext=system_u:system_r:getty_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir Relabeling the whole file system with touch /.autorelabel or fixfiles relabel didn't help. Sure, I can log in in permissive mode. I can't see the message regarding mingetty, but I'm getting a few other denials. If it can help understanding what's going wrong, here they are: avc: denied { execmod } for pid=380 comm="rc.sysinit" name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execmod } for pid=389 comm="awk" name="gawk" dev=dm-0 ino=3371818 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file avc: denied { execmod } for pid=409 comm="start_udev" name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:udev_t:s0-s0:c0.c255 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execmod } for pid=412 comm="awk" name="gawk" dev=dm-0 ino=3371818 scontext=system_u:system_r:udev_t:s0-s0:c0.c255 tcontext=system_u:object_r:bin_t:s0 tclass=file avc: denied { execmod } for pid=559 comm="sh" name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execmod } for pid=1519 comm="S10network" name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execmod } for pid=1607 comm="awk" name="gawk" dev=dm-0 ino=3371818 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file avc: denied { execmod } for pid=1728 comm="dhclient-script" name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execmod } for pid=1741 comm="awk" name="gawk" dev=dm-0 ino=3371818 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file I'm running kernel 2.6.15-1.1826.2.5_FC5 with the following SELinux components: checkpolicy 1.28-4, libselinux 1.29.4-1, libsepol 1.11.7-1, libsetrans 0.1.15-1, selinux-policy 2.1.7-3 and selinux-policy-targeted 2.1.7-3 (hope I don't forget one). If I can try something to help correct these problems on the IA-64 architecture, just let me know. Thanks, Émeric

1 1

Selinux Audit in FC 4
by symphony 13 Jan '06

13 Jan '06

Hi, i'm beginner in Selinux and FC4. I read in the FAQ of the site of the fedora that needs to qualify the audit in kernel, somebody I can say me as to make this? Exists some tools that it tests the eficiencia of the SELinux in the FC4? Thanks

1 0

logwatch avcs
by Tom London 13 Jan '06

13 Jan '06

Running latest rawhide (selinux-policy-targeted-2.1.9-2), targeted/enforcing. Should sbin_t:lnk_file included in corecmd_read_sbin_file(), ....? type=PATH msg=audit(01/13/2006 07:39:38.361:43) : item=0 name=/selinux flags=follow inode=327 dev=00:0d mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/13/2006 07:39:38.361:43) : cwd=/ type=AVC_PATH msg=audit(01/13/2006 07:39:38.361:43) : path=/selinux type=SYSCALL msg=audit(01/13/2006 07:39:38.361:43) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=8afdf68 a1=8aa20c8 a2=ae8ff4 a3=8afdf68 items=1 pid=3926 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=perl exe=/usr/bin/perl type=AVC msg=audit(01/13/2006 07:39:38.361:43) : avc: denied { getattr } for pid=3926 comm=perl name=/ dev=selinuxfs ino=327 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=dir ---- type=PATH msg=audit(01/13/2006 07:39:40.729:44) : item=0 name=/usr/sbin/ntpd flags=follow inode=135413 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/13/2006 07:39:40.729:44) : cwd=/ type=AVC_PATH msg=audit(01/13/2006 07:39:40.729:44) : path=/usr/sbin/ntpd type=SYSCALL msg=audit(01/13/2006 07:39:40.729:44) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=9c7bf68 a1=9c200c8 a2=ae8ff4 a3=9c7bf68 items=1 pid=4198 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=perl exe=/usr/bin/perl type=AVC msg=audit(01/13/2006 07:39:40.729:44) : avc: denied { getattr } for pid=4198 comm=perl name=ntpd dev=dm-0 ino=135413 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:ntpd_exec_t:s0 tclass=file ---- type=PATH msg=audit(01/13/2006 07:39:41.081:45) : item=0 name=/usr/sbin/sendmail flags=follow,open inode=130890 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/13/2006 07:39:41.081:45) : cwd=/ type=SYSCALL msg=audit(01/13/2006 07:39:41.081:45) : arch=i386 syscall=execve success=no exit=-13(Permission denied) a0=8057d63 a1=87d3604 a2=bfa400c8 a3=87d3604 items=1 pid=4213 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=mail exe=/bin/mail type=AVC msg=audit(01/13/2006 07:39:41.081:45) : avc: denied { read } for pid=4213 comm=mail name=sendmail dev=dm-0 ino=138949 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:sbin_t:s0 tclass=lnk_file -- Tom London

1 0

Adjusting FC4 targetted policy to fix avc errors on bugzilla cgi scripts?
by Graham King 13 Jan '06

13 Jan '06

Please can you help with my first, naive, attempt to fix an selinux problem? Following a recent yum update of a Fedora Core 4 machine, bugzilla no longer works. audit.log contained: avc: denied { execute_no_trans } for pid=811 comm="httpd" name="index.cgi" dev=dm-3 ino=227397 scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_sys_content_t tclass=file sestatus outputs: ... httpd_enable_cgi active ... But ls -Z /var/www/html/bugzilla-2.18.3/index.cgi showed that file to be of type httpd_sys_content_t, so I inferred that it needed to be changed to httpd_sys_script_exec_t. In order for the change to persist across relabelling events, I first tried to alter the policy by adding the following line to /etc/linux/targetted/src/policy/file_contexts/file_contexts: /var/www/html/bugzilla-[^/]*/[^/]*\.cgi -- system_u:object_r:httpd_sys_script_exec_t and then ran: cd /etc/linux/targetted/src/policy make reload make relabel ( first with setenforce 1, then with setenforce 0 ) The ls -Z output was unchanged, so I then ran: chcon -t httpd_sys_script_exec_t /var/www/html/bugzilla-2.18.3/index.cgi audit.log is however still showing the same error (adjusted for the new tcontext type). What am I doing wrong? kind regards -- Graham King

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2006