selinux August 2006

selinux@lists.fedoraproject.org

41 participants
41 discussions

file_contexts.local install error...
by Tom London 14 Aug '06

14 Aug '06

Running latest rawhide, targeted/enforcing. Today's 'yumex' produced: libsemanage.semanage_install_active: Non-fatal error: Could not copy /etc/selinux/targeted/modules/active/file_contexts.local to /etc/selinux/targeted/contexts/files/file_contexts.local. Is this similar to what happened with 'netfilter_contexts' (i.e., need to run update in permissive mode)? tom -- Tom London

3 6

Who Watches Over Coverity?
by Benjy Grogan 14 Aug '06

14 Aug '06

Hello: Is Red Hat worried about Coverity or other such bug/security hole searching private ventures? There are probably 1000s of critical security holes in any given Linux distro and the only problem is that there doesn't exist sophisticated enough tools yet to discover them. Companies like Coverity are attempting to develop them, and for what seems like the greater good of Linux distros. Nevertheless, with Red Hat having invested so much into SELinux is there also considerable thought put into developing a Coverity-like project to get to those lingering security threats first? Benjy

3 2

dbus/wine and selinux problems
by dragoran 12 Aug '06

12 Aug '06

Hello I am working on a opengl wrapper that displays some data on hud in games. It uses dbus in a thread to get the data. The wrapper is loaded using LD_PRELOAD. The problem is when a game is started using wine (a windows game) dbus does not work because selinux is blocking it. setenforce 0 fixes it but isn't a solution. so how can I allow wine_exec_t to connect to dbus?

2 3

AVCs from today's updates.... (stroke 2)
by Tom London 11 Aug '06

11 Aug '06

Resending with <100K text to avoid moderator ..... Today's update generated some AVCs (actually lots of them). Here is audit2allow output: allow bootloader_t rpm_t:tcp_socket { read write }; allow bootloader_t rpm_var_lib_t:file { read write }; allow depmod_t rpm_t:tcp_socket { read write }; allow depmod_t rpm_var_lib_t:file { read write }; allow depmod_t var_t:file read; Here are clippings from /var/log/audit/audit.log: type=AVC msg=audit(1155307887.872:40): avc: denied { read write } for pid=4770 comm="depmod" name="[51427]" dev=sockfs ino=51427 scontext=system_u:system_r:depmod_t:s0 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket type=AVC msg=audit(1155307887.872:40): avc: denied { read write } for pid=4770 comm="depmod" name="__db.000" dev=dm-0 ino=2786034 scontext=system_u:system_r:depmod_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file type=AVC msg=audit(1155307887.872:40): avc: denied { read } for pid=4770 comm="depmod" name="kernel-2.6.17-1.2548.fc6.i686.rpm" dev=dm-0 ino=2818553 scontext=system_u:system_r:depmod_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file type=SYSCALL msg=audit(1155307887.872:40): arch=40000003 syscall=11 success=yes exit=0 a0=8858430 a1=884a5c8 a2=884d8a0 a3=8858760 items=0 ppid=4762 pid=4770 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=system_u:system_r:depmod_t:s0 key=(null) type=AVC_PATH msg=audit(1155307887.872:40): path="/var/cache/yum/development/packages/kernel-2.6.17-1.2548.fc6.i686.rpm" type=AVC_PATH msg=audit(1155307887.872:40): path="/var/lib/rpm/__db.000" type=AVC_PATH msg=audit(1155307887.872:40): path="socket:[51427]" <<<<< many, many of the above, various socket #s>>>>>> <<<<< many, many of the below, various socket #s>>>>>> type=AVC msg=audit(1155307888.860:41): avc: denied { read write } for pid=4771 comm="mkinitrd" name="[54546]" dev=sockfs ino=54546 scontext=system_u:system_r:bootloader_t:s0 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket type=AVC msg=audit(1155307888.860:41): avc: denied { read write } for pid=4771 comm="mkinitrd" name="[51427]" dev=sockfs ino=51427 scontext=system_u:system_r:bootloader_t:s0 tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket type=AVC msg=audit(1155307888.860:41): avc: denied { read write } for pid=4771 comm="mkinitrd" name="__db.000" dev=dm-0 ino=2786034 scontext=system_u:system_r:bootloader_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1155307888.860:41): arch=40000003 syscall=11 success=yes exit=0 a0=8857f58 a1=884a5c8 a2=884d8a0 a3=8858470 items=0 ppid=4762 pid=4771 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="mkinitrd" exe="/bin/bash" subj=system_u:system_r:bootloader_t:s0 key=(null) type=AVC_PATH msg=audit(1155307888.860:41): path="/var/lib/rpm/__db.000" type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[51427]" type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[54546]" type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[55152]" type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[48873]" <<<< many, many of the above, various socket #s >>>>> tom -- Tom London

2 1

FC2 useradd in chroot on FC5 host with SELinux
by Paul Howarth 11 Aug '06

11 Aug '06

I use mock to build packages for old distributions in a chroot-ed environment on my FC5 box. I've pretty well got this working for all old distributions now apart from FC2 (see http://www.fedoraproject.org/wiki/Legacy/Mock). On FC2, the process gets off to quite a good start, installing the following packages into the chroot: ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: buildsys-build noarch 0.5-1.CF.fc2 groups 1.8 k Installing for dependencies: SysVinit i386 2.85-25 core 96 k basesystem noarch 8.0-3 core 2.7 k bash i386 2.05b-38 core 1.5 M beecrypt i386 3.1.0-3 core 64 k binutils i386 2.15.90.0.3-5 core 2.8 M buildsys-macros noarch 2-2.fc2 groups 2.1 k bzip2 i386 1.0.2-12.1 core 48 k bzip2-libs i386 1.0.2-12.1 core 32 k chkconfig i386 1.3.9-1.1 core 99 k coreutils i386 5.2.1-7 core 2.8 M cpio i386 2.5-6 core 45 k cpp i386 3.3.3-7 core 1.4 M cracklib i386 2.7-27.1 core 26 k cracklib-dicts i386 2.7-27.1 core 409 k db4 i386 4.2.52-3.1 core 1.5 M dev i386 3.3.13-1 core 3.6 M diffutils i386 2.8.1-11 core 205 k e2fsprogs i386 1.35-7.1 core 728 k elfutils-libelf i386 0.95-2 core 36 k ethtool i386 1.8-3.1 core 48 k fedora-release i386 2-4 core 92 k file i386 4.07-4 core 242 k filesystem i386 2.2.4-1 core 18 k findutils i386 1:4.1.7-25 core 102 k gawk i386 3.1.3-7 core 1.5 M gcc i386 3.3.3-7 core 3.8 M gcc-c++ i386 3.3.3-7 core 2.0 M gdbm i386 1.8.0-22.1 core 26 k glib i386 1:1.2.10-12.1.1 core 134 k glib2 i386 2.4.8-1.fc2 updates-released 477 k glibc i686 2.3.3-27.1 updates-released 4.9 M glibc-common i386 2.3.3-27.1 updates-released 14 M glibc-devel i386 2.3.3-27.1 updates-released 1.9 M glibc-headers i386 2.3.3-27.1 updates-released 530 k glibc-kernheaders i386 2.4-8.44 core 697 k grep i386 2.5.1-26 core 168 k gzip i386 1.3.3-12.2.legacy updates-released 88 k info i386 4.7-4 updates-released 147 k initscripts i386 7.55.2-1 updates-released 906 k iproute i386 2.4.7-14 core 591 k iputils i386 20020927-13 core 92 k less i386 382-3 core 85 k libacl i386 2.2.7-5 core 15 k libattr i386 2.4.1-4 core 8.6 k libgcc i386 3.3.3-7 core 33 k libselinux i386 1.11.4-1 core 45 k libstdc++ i386 3.3.3-7 core 240 k libstdc++-devel i386 3.3.3-7 core 1.3 M libtermcap i386 2.0.8-38 core 12 k make i386 1:3.80-3 core 337 k mingetty i386 1.07-2 core 18 k mktemp i386 2:1.5-7 core 12 k modutils i386 2.4.26-16 core 395 k ncurses i386 5.4-5 core 1.5 M net-tools i386 1.60-25.1 updates-released 311 k pam i386 0.77-40 core 1.9 M patch i386 2.5.4-19 core 61 k pcre i386 4.5-2 core 59 k perl i386 3:5.8.3-18 core 11 M perl-Filter i386 1.30-5 core 68 k popt i386 1.9.1-0.4.1 updates-released 61 k procps i386 3.2.0-1.2 updates-released 176 k psmisc i386 21.4-2 core 41 k redhat-rpm-config noarch 8.0.28-1.1.1 core 41 k rpm i386 4.3.1-0.4.1 updates-released 2.2 M rpm-build i386 4.3.1-0.4.1 updates-released 437 k sed i386 4.0.8-4 core 116 k setup noarch 2.5.33-1 core 29 k shadow-utils i386 2:4.0.3-55 updates-released 671 k sysklogd i386 1.4.1-16 core 65 k tar i386 1.13.25-14 core 351 k termcap noarch 11.0.1-18.1 core 237 k tzdata noarch 2005f-1.fc2 updates-released 449 k unzip i386 5.50-37 core 139 k util-linux i386 2.12-19 updates-released 1.5 M which i386 2.16-2 core 21 k words noarch 2-22 core 137 k zlib i386 1.2.1.2-0.fc2 updates-released 44 k After installing all of these packages successfully, the next thing that happens is: Executing /usr/sbin/mock-helper chroot /var/lib/mock/fedora-2-i386-core/root /bin/su - root -c "/usr/sbin/useradd -m -u 500 -d /builddir mockbuild" and at that point the "useradd" process just hangs indefinitely. I'm told that if SELinux is disabled (I've tried permissive mode and that doesn't help), this works. I can't see any AVCs in the logs. Any ideas what might be causing this and how it might be fixed? Paul.

3 15

sendmail aliases context
by Paul Howarth 10 Aug '06

10 Aug '06

Upstream sendmail has aliases in /etc/mail/aliases(.db)? rather than /etc/aliases(.db)? I therefore suggest adding the following contexts to policy for the benefit those of us rolling our own sendmail packages: /etc/mail/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/mail/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0) Paul,

1 0

un
by Icebarron 08 Aug '06

08 Aug '06

unsubscribe

1 0

setroubleshoot: Import error....
by Tom London 08 Aug '06

08 Aug '06

Running latest rawhide (setroubleshoot-0.18-1), targeted/enforcing. Get this in /var/log/setroubleshoot/setroubleshoot.log (repeated several times): 2006-08-08 06:59:23,081 [avc.ERROR] Traceback (most recent call last): File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py", line 152, in HandleAVCS analyze_thread = Analyze(analyze_queue, sigHandler) File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py", line 23, in __init__ self.plugins = LoadPlugins() File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line 299, in LoadPlugins imp.load_module(pluginBase, *imp.find_module(pluginBase, [pluginRoot])) ImportError: No module named plugins Traceback (most recent call last): File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py", line 152, in HandleAVCS analyze_thread = Analyze(analyze_queue, sigHandler) File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py", line 23, in __init__ self.plugins = LoadPlugins() File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line 299, in LoadPlugins imp.load_module(pluginBase, *imp.find_module(pluginBase, [pluginRoot])) ImportError: No module named plugins tom -- Tom London

3 9

Setroubleshoot question
by Jay Cliburn 08 Aug '06

08 Aug '06

Is it a bug that setroubleshoot_dispatcher continues to run even when setroubleshoot is shut off? [[root@osprey ~]# rpm -q setroubleshoot setroubleshoot-0.16-1 root@osprey ~]# service setroubleshoot status setroubleshoot is stopped [root@osprey ~]# ps -ef | grep setrou root 1783 1770 0 20:55 ? 00:00:00 python /usr/lib/audit/setroubleshoot_dispatcher root 2558 2523 0 21:29 pts/0 00:00:00 grep setrou [root@osprey ~]# tail -100 /var/log/messages | grep setrouble Aug 4 20:56:12 osprey setroubleshoot: 2006-08-04 20:56:12,711 [ipc.ERROR] exiting after [Errno 2] No such file or directory, socket AlertClient: socket=/var/run/setroubleshoot/setroubleshoot_server user=None Thanks, Jay

2 1

[ANN]segatex2.02 released !!
by shintaro_fujiwara 07 Aug '06

07 Aug '06

Hi,all. I made a simple GUI tool, which generates .te file from /var/log/audit/audit.log. It checks all .if files and generates .te with raw permissions which had not been found in .if files. You can download source from https://sourceforge.net/projects/segatex/ It needs C++ Boost library and Qt. Thank you.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2006