selinux June 2006

selinux@lists.fedoraproject.org

45 participants
61 discussions

Re: FC5 - problems setting context
by Paul Howarth 14 Jun '06

14 Jun '06

Hello, On Tue, 2006-06-13 at 16:44 -0400, Sandra Julieta Rueda Rodriguez wrote: > Hello, > > About my previous message: > > Paul: Your idea was really effective, FC5 requires the additional field. > The command works fine now, Thanks. > > Does this behavior have to do with the fact that FC5 have the mcs/mls > option enabled by default? Is it possible to disable it? You shouldn't need to supply the extra field; there is a translation facility in libselinux that can supply a default value for it. It looks like a similar issue in setkey to the one I found in mount: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186915 I think it's worth raising a bug on ipsec-tools. Paul.

1 0

New installation of FC5 with strict policy
by Stefan 13 Jun '06

13 Jun '06

Hi, I did a fresh installation of FC5 and upgraded to the strict policy. After creating a new user via "adduser" I get the following avc denials when I try to login via ssh. audit(1150198407.761:2862): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process audit(1150198411.552:2863): avc: denied { getattr } for pid=3717 comm="sshd" name="stefan" dev=hda2 ino=58667 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir audit(1150198411.624:2864): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=process audit(1150198411.624:2865): avc: denied { execute_no_trans } for pid=3721 comm="sshd" name="bash" dev=hda2 ino=29283 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file audit(1150198411.628:2866): avc: denied { execute } for pid=3721 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.628:2867): avc: denied { read } for pid=3722 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.628:2868): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.628:2869): avc: denied { execute_no_trans } for pid=3723 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.632:2870): avc: denied { execute } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.632:2871): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=process audit(1150198411.632:2872): avc: denied { execute_no_trans } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.632:2873): avc: denied { read } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.636:2874): avc: denied { execute } for pid=3721 comm="bash" name="colorls.sh" dev=hda2 ino=175700 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file audit(1150198411.636:2875): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.640:2876): avc: denied { read } for pid=3721 comm="bash" name="stefan" dev=hda2 ino=58667 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir audit(1150198411.640:2877): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.644:2878): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.644:2879): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.648:2880): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.652:2881): avc: denied { read } for pid=3721 comm="bash" name=".bash_profile" dev=hda2 ino=58595 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=file audit(1150198411.652:2882): avc: denied { getattr } for pid=3721 comm="bash" name=".bash_profile" dev=hda2 ino=58595 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=file audit(1150198411.656:2883): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.660:2884): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process I know that the strict policy is quiet not perfect but I thought a ssh login should went fine, shouldn't it? My question is, is this the default behaviour or did I something wrong? I get also a lot of avc denials after a reboot with the strict policy. Shouldn't the strict policy work quiet fine with a default installation (I know it's not perfect but ... ;-))? Best regards, Stefan

1 0

AVC's and Xen
by Gawain Lynch 13 Jun '06

13 Jun '06

I have turned on selinux on my dom0 and relabelled my file system but am getting the following avc's that are causing me grief: audit(1150199625.630:325): avc: denied { search } for pid=7068 comm="python" name="data" dev=dm-0 ino=720897 scontext=system_u:system_r:xend_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir audit(1150200957.379:95): avc: denied { use } for pid=4853 comm="xm" name="console" dev=tmpfs ino=838 scontext=system_u:system_r:xm_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fd In the first one, I presume "data" is the /data mount point which was crated before the relabel. Any ideas how to fix? Take care, Gawain

1 0

FC5 - problems setting context
by Sandra Rueda 12 Jun '06

12 Jun '06

Hello, I am new with selinux and I have a problem: My system: Fedora Core 5, FC5 - 2.6.16-1.2122 SMP I am trying to set communication policies between two machines and I am using the set of commands implemented by ipsec-tools. I am running the command: setkey -v -f set.conf Contents of the file set.conf (it had more things at the beginning but I reduced it while looking for the cause of the error): flush; spdflush; spdadd src dest any -ctx 1 1 "user_u:object_r:user_t" -P out ipsec esp/transport//require ; I always receive the same output at the end: "Invalid Argument". sadb_msg{ version=2 type=9 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=9 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=19 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=19 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=14 errno=0 satype=0 len=16 reserved=0 seq=0 pid=16090 sadb_ext{ len=4 type=18 } sadb_x_policy{ type=2 dir=2 id=0 priority=2147483648 } { len=16 proto=50 mode=1 level=2 reqid=0 } sadb_ext{ len=3 type=5 } sadb_address{ proto=255 prefixlen=32 reserved=0x0000 } sockaddr{ len=16 family=2 port=0 82cb2034 } sadb_ext{ len=3 type=6 } sadb_address{ proto=255 prefixlen=32 reserved=0x0000 } sockaddr{ len=16 family=2 port=0 82cb2035 } sadb_ext{ len=4 type=24 } sadb_x_sec_ctx{ doi=1 alg=1 length=23, context:user_u:object_r:user_t} sadb_msg{ version=2 type=14 errno=22 satype=0 len=2 reserved=0 seq=0 pid=16090 The result of line 4: Invalid argument. I followed the procedure and it looks like the problem is not related to ipsec-tools but to something in the kernel, because it returns errno=22. Running the same command without the ctx extension works fine. Does anyone have any idea? Thanks, Sandra

2 1

semanage translation -a is not working
by omok 11 Jun '06

11 Jun '06

Dear, Folks, My environment is; FC5 (yum updated on 6/12/2006 JST) policycoreutils-1.30.10-1.fc5 libselinux-python-1.30-1.fc5 selinux-policy-2.2.40-1.fc5 libselinux-1.30-1.fc5 libselinux-devel-1.30-1.fc5 selinux-policy-2.2.38-1.fc5 selinux-policy-targeted-2.2.40-1.fc5 When I try to add additional translations to my FC5 in permissive mode, I got error messages as follow; ---------------------------------------------------------------- [root@vmfc5omo ~]# semanage translation -a -T blahblahblah s0:c6 Traceback (most recent call last): File "/usr/sbin/semanage", line 239, in ? OBJECT.add(target, setrans) File "/usr/lib/python2.4/site-packages/seobject.py", line 180, in add self.save() File "/usr/lib/python2.4/site-packages/seobject.py", line 198, in save fd.write(self.out()) AttributeError: 'int' object has no attribute 'write' ---------------------------------------------------------------- and can't add any lines on setrans.conf. "-l" option seems working correctly; ---------------------------------------------------------------- [root@vmfc5omo ~]# semanage translation -l Level Translation s0 s0-s0:c0.c255 SystemLow-SystemHigh s0:c0.c255 SystemHigh ---------------------------------------------------------------- I checked "How do I add additional translations to my MCS/MLS system?" on http://fedora.redhat.com/docs/selinux-faq-fc5/#id2964683. Is this a bug? Regards, -- Kazuki Omo: omok(a)honto.info LIDS Japanese Information: Japanese: http://www.selinux.gr.jp/LIDS-JP/index.html English: http://www.selinux.gr.jp/LIDS-JP/LIDS_en/index.html

1 0

vsftpd problems
by CodeHeads 11 Jun '06

11 Jun '06

Hello all, I have a problem getting vsftpd working with SELinux. I opened up ports 20 and 21 on the firewall, plus disabled the firewall to see if that was the problem and it still did not work. I am not using home directories, is that part of the problem??? I tried google but that really did not turn anything up that I wanted. Thanks, Will

2 1

proftpd and ftpdctl
by Paul Howarth 09 Jun '06

09 Jun '06

The recent update of proftpd in Extras to 1.3.0 has introduced a new feature, an "ftpdctl" program allowing some run-time control of the FTP daemon, somewhat akin to rndc with named. This needs new policy. Below is what's working for me: ===== proftpd.if ===== ## <summary>FTP Daemon Control Program.</summary> ######################################## ## <summary> ## Execute the ftpdctl program in the ftpdctl domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`ftpdctl_domtrans',` gen_require(` type ftpdctl_t, ftpdctl_exec_t; ') corecmd_search_bin($1) domain_auto_trans($1, ftpdctl_exec_t, ftpdctl_t) allow $1 ftpdctl_t:fd use; allow ftpdctl_t $1:fd use; allow ftpdctl_t $1:fifo_file rw_file_perms; allow ftpdctl_t $1:process sigchld; ') ===== proftpd.fc ===== /usr/bin/ftpdctl -- gen_context(system_u:object_r:ftpdctl_exec_t,s0) ===== proftpd.te ===== policy_module(proftpd, 0.4.0) ######################################## # # Declarations # require { type ftpd_t; type ftpd_var_run_t; type xferlog_t; }; # run ftpdctl in its own domain type ftpdctl_t; type ftpdctl_exec_t; init_system_domain(ftpdctl_t,ftpdctl_exec_t) role system_r types ftpdctl_t; # ftpdctl control sockets have their own domain # When ftpdctl is run, it creates a socket in /tmp and then binds it # to the control socket for the running proftpd server, usually at # /var/run/proftpd/proftpd.sock type ftpdctl_tmp_t; files_tmp_file(ftpdctl_tmp_t) ######################################## # # Local policy # # Temporary sockets created by ftpdctl are ftpdctl_tmp_t files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, { sock_file }) # Fixed in selinux-policy 2.2.29-6 #allow ftpd_t xferlog_t:dir { getattr search }; # Allow proftpd to read the routing table allow ftpd_t self:netlink_route_socket { r_netlink_socket_perms }; # Allow proftpd to create and use a control socket (/var/run/proftpd/proftpd.sock) allow ftpd_t self:unix_stream_socket listen; allow ftpd_t ftpd_var_run_t:sock_file { create setattr unlink }; # Allow proftpd to remove temporary communications sockets created by ftpdctl allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink }; # Transition to ftpdctl_t from unconfined_t ftpdctl_domtrans(unconfined_t) libs_use_ld_so(ftpdctl_t) libs_use_shared_libs(ftpdctl_t) term_use_generic_ptys(ftpdctl_t) # Allow ftpdctl to read config files files_read_etc_files(ftpdctl_t) # Allow ftpdctl to create and use temporary sockets allow ftpdctl_t ftpdctl_tmp_t:sock_file { create setattr }; # Allow ftpdctl to talk to ftpd over a socket connection allow ftpdctl_t ftpd_t:unix_stream_socket connectto; allow ftpdctl_t ftpd_var_run_t:dir search; allow ftpdctl_t ftpd_var_run_t:sock_file write; Paul.

2 2

Re: httpd can't execute bash?
by Jouni Viikari 09 Jun '06

09 Jun '06

On Tue, 6 Jun 2006, James Antill wrote: > On Mon, 2006-05-29 at 19:47 +0300, Jouni Viikari wrote: >> On Sun, 2006-05-28 at 10:58 +0100, Paul Howarth wrote: >>> On Sun, 2006-05-28 at 12:43 +0300, Jouni Viikari wrote: >>>> I have the same problem: >>>> >>>> type=AVC msg=audit(1148808793.986:30189): avc: denied { execute } for >>>> pid=18644 comm="httpd" name="bash" dev=dm-0 ino=3440979 >>>> scontext=user_u:system_r:httpd_t:s0 >>>> tcontext=system_u:object_r:shell_exec_t:s0 tclass=file > [...] >> It is a php-script doing basically ugly 'system("cat xyz");' >> >> #ls -Z >> system_u:object_r:httpd_sys_content_t >> >> This is just a testing_something.php where I happened to notice a change >> in a behavior. > > See "man httpd_selinux" ... summary is you need at least: > > chcon -t httpd_sys_exec_t Yeah, I thought the context might not be rigth. Anyway the behaviour has changed. However, there seems not to be httpd_sys_exec_t (trying above gives "Invalid argument"). If I try httpd_sys_script_exec_t it does not work either. Biggest problem I just found out is that I can not send mail any more from SquirrelMail (standard FC5 package): type=AVC msg=audit(1149674474.840:81196): avc: denied { execute } for pid=20207 comm="httpd" name="bash" dev=dm-0 ino=3440979 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file -Jouni

2 2

setsebool generates error message....
by Tom London 08 Jun '06

08 Jun '06

Running today's rawhide, targeted/enforcing: [root@localhost files]# setsebool allow_execmem=1 libsemanage.semanage_install_active: setfiles returned error code 1. libsemanage.semanage_install_active: setfiles returned error code 1. Could not change policy booleans [root@localhost files]# Appears that boolean has changed: [root@localhost files]# getsebool -a | grep exec allow_execheap --> off allow_execmem --> on allow_execmod --> off allow_execstack --> on allow_java_execstack --> on httpd_ssi_exec --> off httpd_suexec_disable_trans --> off [root@localhost files]# tom -- Tom London

2 1

FC5/SELinux: Possibilty to enforce an "second set of eyes" method for admins?
by Michael Decker 08 Jun '06

08 Jun '06

Hi! I wonder, if I can setup this kind of scenario: An admin has to change e.g. some SELinux policies. But if an admin can change all SELinux policies, he could change his own or others in a way, so he can do anything. So a second admin/user has to allow that action. Is there a way to setup that? Thanks... -- Michael Decker Michael.Decker(a)tesis.de TESIS SYSware GmbH http://www.tesis.de Baierbrunnerstr. 15 * 81379 Muenchen * Tel. +49 89 747377-0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2006