selinux January 2006

selinux@lists.fedoraproject.org

54 participants
67 discussions

execmem
by Jason Dravet 12 Jan '06

12 Jan '06

When execstack was turned off on December 9 and execmem and execmod were turned off on December 10 several programs broke and I opened bugzilla issues for them. Now one of the programmers has contacted me about this, but now the program works. I am pretty sure the program was not fixed (I have not updated it) as suggested by http://people.redhat.com/drepper/selinux-mem.html. I think the selinux policy changed and allows the exec* access again. How can I turn off this access so the program can be fixed properly? I tried the following command: setsebool -P allow_execmem=0 allow_execmod=0 allow_execheap=0 and this is what I got: libsemanage.dbase_llist_set: record not found in the database libsemanage.dbase_llist_set: could not set record value Could not change policy booleans I am running selinux-policy-targeted-2.1.8-3 and selinux-policy-2.1.8-3 in enforcing mode on Fedora rawhide. Thanks, Jason

5 11

more on readahead/hal
by Tom London 12 Jan '06

12 Jan '06

Today's rawhide, targeted/enforcing. [Reporting this since build log indicated fixes for hal/readahead. Sorry if I am jumping the gun....] hal issues: ---- type=PATH msg=audit(01/10/2006 07:18:22.011:13) : item=0 name=/media/disk/.created-by-hal flags=follow inode=2289300 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:22.011:13) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:22.011:13) : path=/media/disk/.created-by-hal type=SYSCALL msg=audit(01/10/2006 07:18:22.011:13) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=870f008 a1=bf9ee1b8 a2=25cff4 a3=870f5a8 items=1 pid=2512 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor exe=/bin/bash type=AVC msg=audit(01/10/2006 07:18:22.011:13) : avc: denied { getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal dev=dm-0 ino=2289300 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/10/2006 07:18:22.027:14) : item=0 name=/media/disk-1/.created-by-hal flags=follow inode=2289302 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:22.027:14) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:22.027:14) : path=/media/disk-1/.created-by-hal type=SYSCALL msg=audit(01/10/2006 07:18:22.027:14) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=870f588 a1=bf9ee1b8 a2=25cff4 a3=870f008 items=1 pid=2512 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor exe=/bin/bash type=AVC msg=audit(01/10/2006 07:18:22.027:14) : avc: denied { getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal dev=dm-0 ino=2289302 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/10/2006 07:18:22.059:15) : item=0 name=/media/disk-2/.created-by-hal flags=follow inode=2289314 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:22.059:15) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:22.059:15) : path=/media/disk-2/.created-by-hal type=SYSCALL msg=audit(01/10/2006 07:18:22.059:15) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=870f688 a1=bf9ee1b8 a2=25cff4 a3=870f008 items=1 pid=2512 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor exe=/bin/bash type=AVC msg=audit(01/10/2006 07:18:22.059:15) : avc: denied { getattr } for pid=2512 comm=hal-system-stor name=.created-by-hal dev=dm-0 ino=2289314 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/10/2006 07:18:24.972:16) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:24.972:16) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:24.972:16) : path=/boot type=SYSCALL msg=audit(01/10/2006 07:18:24.972:16) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce a1=bff4844c a2=258ff4 a3=303 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:18:24.972:16) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/10/2006 07:18:25.076:17) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:25.076:17) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:25.076:17) : path=/boot type=SYSCALL msg=audit(01/10/2006 07:18:25.076:17) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce a1=bff4844c a2=258ff4 a3=302 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:18:25.076:17) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/10/2006 07:18:25.228:18) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:25.228:18) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:25.228:18) : path=/boot type=SYSCALL msg=audit(01/10/2006 07:18:25.228:18) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff484ce a1=bff4844c a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:18:25.228:18) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/10/2006 07:18:31.368:20) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:18:31.368:20) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:18:31.368:20) : path=/boot type=SYSCALL msg=audit(01/10/2006 07:18:31.368:20) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:18:31.368:20) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/10/2006 07:19:16.279:31) : item=0 name=/media/disk-3/.created-by-hal flags=parent,open,create inode=2289282 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:19:16.279:31) : cwd=/ type=SYSCALL msg=audit(01/10/2006 07:19:16.279:31) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=bfc0b888 a1=8941 a2=1b6 a3=8941 items=1 pid=2837 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch exe=/bin/touch type=AVC msg=audit(01/10/2006 07:19:16.279:31) : avc: denied { create } for pid=2837 comm=touch name=.created-by-hal scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/10/2006 07:19:22.523:32) : item=0 name=/media/disk-3/.created-by-hal flags=parent,open,create inode=2289282 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:19:22.523:32) : cwd=/ type=SYSCALL msg=audit(01/10/2006 07:19:22.523:32) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=bfdad851 a1=8941 a2=1b6 a3=8941 items=1 pid=2850 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch exe=/bin/touch type=AVC msg=audit(01/10/2006 07:19:22.523:32) : avc: denied { create } for pid=2850 comm=touch name=.created-by-hal scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/10/2006 07:19:22.531:33) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:19:22.531:33) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:19:22.531:33) : path=/boot type=SYSCALL msg=audit(01/10/2006 07:19:22.531:33) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:19:22.531:33) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/10/2006 07:19:22.531:34) : item=0 name=/media/disk-3 flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/10/2006 07:19:22.531:34) : cwd=/ type=AVC_PATH msg=audit(01/10/2006 07:19:22.531:34) : path=/media/disk-3 type=SYSCALL msg=audit(01/10/2006 07:19:22.531:34) : arch=i386 syscall=stat64 success=no exit=-13(Permission denied) a0=bff4864e a1=bff485cc a2=258ff4 a3=301 items=1 pid=2507 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/10/2006 07:19:22.531:34) : avc: denied { getattr } for pid=2507 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- Still have problems with readahead. From /var/log/messages: Jan 10 07:18:01 localhost kernel: audit(1136906246.537:4): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir Jan 10 07:18:01 localhost kernel: audit(1136906246.537:5): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir Jan 10 07:18:01 localhost kernel: audit(1136906246.537:6): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir Jan 10 07:18:01 localhost kernel: audit(1136906254.213:7): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir Jan 10 07:18:01 localhost kernel: audit(1136906254.213:8): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir Jan 10 07:18:01 localhost kernel: audit(1136906254.213:9): avc: denied { search } for pid=1570 comm="readahead" name="/" dev=ramfs ino=4195 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=dir -- Tom London

2 2

FC3 nscd AVC denied
by Lamont R. Peterson 11 Jan '06

11 Jan '06

All, Here's the setup ... Using authconfig to turn on nscd and setup TLS encrypted LDAP authentication & user information, the LDAP server's "server.crt" file has been copied to /etc/openldap/ on the client and the /etc/openldap/ldap.conf file got the line "TLS_CACERT /etc/openldap/server.crt" added to it. I'm using the latest nscd package for FC3 (which fixed another bug related to LDAP). Starting nscd produces these three avc denied messages (from /var/log/messages): Jan 11 09:56:52 station13 nscd: 27993 Access Vector Cache (AVC) started Jan 11 09:56:52 station13 nscd: nscd startup succeeded Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied { read } for pid=27993 exe=/usr/sbin/nscd name=cert.pem dev=sda2 ino=738049 scontext=root:system_r:nscd_t tcontext=system_u:object_r:usr_t tclass=lnk_file Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied { read } for pid=27993 exe=/usr/sbin/nscd name=urandom dev=tmpfs ino=935 scontext=root:system_r:nscd_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file Jan 11 09:56:53 station13 kernel: audit(1136998613.032:0): avc: denied { read } for pid=27993 exe=/usr/sbin/nscd name=random dev=tmpfs ino=934 scontext=root:system_r:nscd_t tcontext=system_u:object_r:random_device_t tclass=chr_file Also, in this configuration, logins to LDAP accounts fail; the username is unrecognized. If I shut down nscd, then LDAP account logins work again. Running "setsebool -P nscd_disable_trans 1" and then restarting nscd (i.e. "/etc/init.d/nscd restart") fixes the login problem. It appears that nscd will only attempts to open file handles to /usr/share/ssl/cert.pem which is a symlink to certs/ca-bundle.crt (both have the label system_u:object_r:usr_t) and /dev/random & /dev/urandom at startup. Examining /etc/selinux/targeted/src/policy/domains/program/nscd.te (that is the right file, yes?) in the latest selinux-policy-targeted-sources for FC3 looks like nscd_t should have access to both urandom_device_t & random_device_t: 75: allow nscd_t { urandom_device_t random_device_t }:chr_file { getattr read}; which is a little different from the originally shipped policy: 85: allow nscd_t uransom_device_t:chr_file { getattr read }; It also looks like nscd.te used to have: 86: r_dir_file(nscd_t, usr_t) but the newest policy has no lines referencing usr_t. I'm not certain that nscd actually needs to read /usr/share/ssl/cert.pem in order for TLS to work, but I can understand the need to access /dev/random and/or /dev/urandom. OK. So, I haven't done much writing of SELinux policy, and most of that was a while ago, but It looks like the original policy shouldn't have been causing these problems to begin with. What am I missing here? Oh, and BTW, this configuration works fine on a RHEL4 client without updates. which made me think that updating the FC3 selinux-policy-targeted package could fix the issue. Nope; it didn't. Thanks for all your hard work on SELinux and policy. -- Lamont R. Peterson <lamont(a)gurulabs.com> Senior Instructor Guru Labs, L.C. [ http://www.GuruLabs.com/ ]

1 0

Postfix virtual and Dovecot
by Karyl F. Stein 09 Jan '06

09 Jan '06

Any ideas on how I can get the Postfix virtual transport to deliver to a maildir and have Dovecot pick it up? I can get one or the other to work, but not both. The maildirs are in /srv/mirror/mail. If I make that directory have the postfix_spool_t context, Postfix writes there fine, but Dovecot can't access it. If I make the directory have mail_spool_t, then Dovecot can access it, but Postfix can't. As far as I can tell, there doesn't seem to be a common context. I'm running FC4 with the targeted policy. Thanks, Karyl

4 6

need help getting initng works with selinux
by dragoran 09 Jan '06

09 Jan '06

after hacking the initng source code I got it to load the policy but still have one problem: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173459#c166 /sbin/ining is labeled as init_exec_t whats wrong with it?

2 1

FC4 documentation for apache + selinux ?
by Timothy Murphy 09 Jan '06

09 Jan '06

Is there any documentation about the interaction of selinux and apache under Fedora-4? I looked at "Understanding and Customizing the Apache HTTP SELinux Policy" at <http://fedora.redhat.com/docs/selinux-apache-fc3/index.html>, but the changes between FC3 and FC4 seemed to make much of this irrelevant. Is there a corresponding document for FC4? -- Timothy Murphy e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

6 14

Today's avcs....(readahead, hald)
by Tom London 07 Jan '06

07 Jan '06

Running today's rawhide(selinux-policy-targeted-2.1.7-3), targeted/enforcing, got some avcs in messages and audit.log. I rebooted in permissive mode and: Get this in /var/log/messages (before auditd starts, I guess): ---- type=PATH msg=audit(01/07/2006 11:44:46.028:12) : item=0 name=/media/ flags=follow,directory,open inode=2289281 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:44:46.028:12) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:44:46.028:12) : arch=i386 syscall=open success=yes exit=3 a0=9233228 a1=18800 a2=261158 a3=92331e8 items=1 pid=2532 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hal-system-stor exe=/bin/bash type=AVC msg=audit(01/07/2006 11:44:46.028:12) : avc: denied { read } for pid=2532 comm=hal-system-stor name=media dev=dm-0 ino=2289281 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:44:50.152:13) : item=0 name=/boot flags=follow inode=2 dev=03:02 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:44:50.152:13) : cwd=/ type=AVC_PATH msg=audit(01/07/2006 11:44:50.152:13) : path=/boot type=SYSCALL msg=audit(01/07/2006 11:44:50.152:13) : arch=i386 syscall=stat64 success=yes exit=0 a0=bfd80ede a1=bfd80e5c a2=359ff4 a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/07/2006 11:44:50.152:13) : avc: denied { getattr } for pid=2527 comm=hald name=/ dev=hda2 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:44:50.152:14) : item=0 name=/proc/sys/fs/binfmt_misc flags=follow inode=4808 dev=00:13 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:44:50.152:14) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:44:50.152:14) : arch=i386 syscall=stat64 success=yes exit=0 a0=bfd80ed9 a1=bfd80e5c a2=359ff4 a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/07/2006 11:44:50.152:14) : avc: denied { search } for pid=2527 comm=hald name=fs dev=proc ino=-268435429 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:44:50.152:15) : item=0 name=/var/lib/nfs/rpc_pipefs flags=follow inode=5930 dev=00:14 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:44:50.152:15) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:44:50.152:15) : arch=i386 syscall=stat64 success=yes exit=0 a0=bfd80edb a1=bfd80e5c a2=359ff4 a3=303 items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/07/2006 11:44:50.152:15) : avc: denied { search } for pid=2527 comm=hald name=nfs dev=dm-0 ino=2142222 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:45:00.837:17) : item=0 name=/var/lib/nfs/rpc_pipefs flags=follow inode=5930 dev=00:14 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:00.837:17) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:45:00.837:17) : arch=i386 syscall=stat64 success=yes exit=0 a0=bfd8105b a1=bfd80fdc a2=359ff4 a3=bfd8105e items=1 pid=2527 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=hald exe=/usr/sbin/hald type=AVC msg=audit(01/07/2006 11:45:00.837:17) : avc: denied { search } for pid=2527 comm=hald name=nfs dev=dm-0 ino=2142222 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:45:40.036:25) : item=1 flags=follow,open inode=327257 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 type=PATH msg=audit(01/07/2006 11:45:40.036:25) : item=0 name=/usr/bin/skype flags=follow,open inode=145693 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:40.036:25) : cwd=/home/tbl type=SYSCALL msg=audit(01/07/2006 11:45:40.036:25) : arch=i386 syscall=execve success=yes exit=0 a0=9126db0 a1=bffa9740 a2=9114078 a3=0 items=2 pid=2857 auid=unknown(4294967295) uid=tbl gid=tbl euid=tbl suid=tbl fsuid=tbl egid=tbl sgid=tbl fsgid=tbl comm=skype exe=/usr/bin/skype type=AVC msg=audit(01/07/2006 11:45:40.036:25) : avc: granted { execmem } for pid=2857 comm=skype scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=AVC msg=audit(01/07/2006 11:45:40.036:25) : avc: granted { execmem } for pid=2857 comm=skype scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process ---- type=PATH msg=audit(01/07/2006 11:45:41.792:26) : item=0 name=/media/disk flags=parent inode=2289281 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:41.792:26) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:45:41.792:26) : arch=i386 syscall=mkdir success=yes exit=0 a0=bfa31919 a1=1ff a2=804e1b8 a3=bfa31919 items=1 pid=2871 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=mkdir exe=/bin/mkdir type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied { create } for pid=2871 comm=mkdir name=disk scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied { add_name } for pid=2871 comm=mkdir name=disk scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir type=AVC msg=audit(01/07/2006 11:45:41.792:26) : avc: denied { write } for pid=2871 comm=mkdir name=media dev=dm-0 ino=2289281 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir ---- type=PATH msg=audit(01/07/2006 11:45:41.868:27) : item=0 name=/media/disk/.created-by-hal flags=parent,open,create inode=2289299 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:41.868:27) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:45:41.868:27) : arch=i386 syscall=open success=yes exit=0 a0=bff77909 a1=8941 a2=1b6 a3=8941 items=1 pid=2872 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch exe=/bin/touch type=AVC msg=audit(01/07/2006 11:45:41.868:27) : avc: denied { create } for pid=2872 comm=touch name=.created-by-hal scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/07/2006 11:45:41.868:28) : item=0 name=/proc/self/fd/0 flags=follow inode=2289300 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:41.868:28) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:45:41.868:28) : arch=i386 syscall=utimes success=yes exit=0 a0=bff772c0 a1=0 a2=8ecff4 a3=0 items=1 pid=2872 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=touch exe=/bin/touch type=AVC msg=audit(01/07/2006 11:45:41.868:28) : avc: denied { write } for pid=2872 comm=touch name=.created-by-hal dev=dm-0 ino=2289300 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file ---- type=PATH msg=audit(01/07/2006 11:45:42.136:29) : item=0 name=/media/disk flags=parent inode=2289281 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 type=CWD msg=audit(01/07/2006 11:45:42.136:29) : cwd=/ type=SYSCALL msg=audit(01/07/2006 11:45:42.136:29) : arch=i386 syscall=rmdir success=no exit=-39(Directory not empty) a0=bffe1919 a1=0 a2=804c80c a3=bffe1919 items=1 pid=2877 auid=unknown(4294967295) uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root comm=rmdir exe=/bin/rmdir type=AVC msg=audit(01/07/2006 11:45:42.136:29) : avc: denied { rmdir } for pid=2877 comm=rmdir name=disk dev=dm-0 ino=2289299 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir type=AVC msg=audit(01/07/2006 11:45:42.136:29) : avc: denied { remove_name } for pid=2877 comm=rmdir name=disk dev=dm-0 ino=2289299 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir ---- type=SYSCALL msg=audit(01/07/2006 11:45:46.992:30) : arch=i386 syscall=mprotect success=yes exit=0 a0=bfcd5000 a1=1000 a2=1000007 a3=fffff000 items=0 pid=2862 auid=unknown(4294967295) uid=tbl gid=tbl euid=tbl suid=tbl fsuid=tbl egid=tbl sgid=tbl fsgid=tbl comm=gaim exe=/usr/bin/gaim type=AVC msg=audit(01/07/2006 11:45:46.992:30) : avc: granted { execmem } for pid=2862 comm=gaim scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process tom -- Tom London

1 1

hald avcs
by Steve G 06 Jan '06

06 Jan '06

Hi, I just updated to current rawhide and I am now getting a lot of avcs from hald. You can recreate this by running: aureport -a --failed -Steve AVC Report ============================================== # date time comm subj syscall action obj event ============================================== 1. 01/06/2006 09:23:25 AM hald system_u:system_r:hald_t:s0 execve execute system_u:object_r:usr_t:s0 denied 54 2. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 55 3. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 56 4. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 57 5. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 58 6. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 59 7. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 60 8. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 61 9. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 62 10. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 63 11. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 64 12. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 65 13. 01/06/2006 09:23:27 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 66 14. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 67 15. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 68 16. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 69 17. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 70 18. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 71 19. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 72 20. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat getattr system_u:object_r:boot_t:s0 denied 73 21. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:var_log_t:s0 denied 74 22. 01/06/2006 09:23:28 AM hald system_u:system_r:hald_t:s0 stat search system_u:object_r:sysctl_fs_t:s0 denied 75 __________________________________________ Yahoo! DSL Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com

1 0

libselinux bug or not
by William Xiong 06 Jan '06

06 Jan '06

when I use pam system to program, I invoke pam_chauthtok function to change passwd, If I put this piece of code in the main thread of a process, then everything is ok, but if i put the code into a child thread, then it will return failed status. when i trace the code, I found the pam system use selinux, the pam system will invoke setfscreatecon() function. the implemention of setfscreatecon() use below code to change fscreate stat: fd = open("/proc/self/attr/fscreate", O_RDWR); but, if the thread invode setfscreatecon() is a child thread in a process, then, the /proc/self will point the main thread of the process, not the child thread's own proc subdir. then the following code will fail. can some find the same problem?

3 2

Mozilla Firefox and Fedora selinux Core 4
by Dan Jallits 04 Jan '06

04 Jan '06

Okay I have searched the filesystem and still can find the path, but where is the Mozilla/plugins directory. Come on guys help the Noobie out here! -- Best regards, Daniel C. Jallits 100 E. Oneida Avenue Elmhurst, Illinois 60126-4465 United States of America T: 630.279.2798 | M: 630.670.3775 Email - jallits(a)gmail.com Weblog - http://jallits.wordpress.com Del.icio.us - http://del.icio.us/rss/jallits Technorati - http://www.technorati.com/profile/jallits

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2006