selinux September 2006

selinux@lists.fedoraproject.org

42 participants
52 discussions

AVCs with USB scanner and xsane
by Tom London 14 Sep '06

14 Sep '06

Running Rawhide, targeted/enforcing. Get these when running xsane on a USB scanner. Seems to occur during 'scanning for devices' type=AVC msg=audit(1158241690.244:23): avc: denied { dac_override } for pid=3158 comm="hpiod" capability=1 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:system_r:hplip_t:s0 tclass=capability type=SYSCALL msg=audit(1158241690.244:23): arch=40000003 syscall=5 success=no exit=-13 a0=b750e71c a1=2 a2=1 a3=b750e71c items=0 ppid=1 pid=3158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="hpiod" exe="/usr/sbin/hpiod" subj=system_u:system_r:hplip_t:s0 key=(null) type=AVC msg=audit(1158241690.244:24): avc: denied { dac_override } for pid=3158 comm="hpiod" capability=1 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:system_r:hplip_t:s0 tclass=capability type=AVC msg=audit(1158241690.244:24): avc: denied { dac_read_search } for pid=3158 comm="hpiod" capability=2 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:system_r:hplip_t:s0 tclass=capability type=SYSCALL msg=audit(1158241690.244:24): arch=40000003 syscall=5 success=no exit=-13 a0=b750e71c a1=0 a2=1 a3=b750e71c items=0 ppid=1 pid=3158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="hpiod" exe="/usr/sbin/hpiod" subj=system_u:system_r:hplip_t:s0 key=(null) tom -- Tom London

1 0

Unable to update/install packages
by Tobias 14 Sep '06

14 Sep '06

Hi, i've a little problem with my FC5. All at once i can't install or update any packages. I have not played with SELinux and at all this is a default installation: kernel-2.6.17-1.2157_FC5 libselinux-1.30.3-4.fc5 selinux-policy-2.3.3-8.fc5 libselinux-python-1.30.3-4.fc5 selinux-policy-targeted-2.3.3-8.fc5 Examples of my problem: # yum install dhcp Loading "installonlyn" plugin Setting up Install Process Setting up repositories [...] Total download size: 653 k Is this ok [y/N]: y [...] Running Transaction /etc/selinux/targeted/contexts/files/file_contexts: line 1378 has invalid regex ^/sbin/ftpwho$: Memory exhausted /etc/selinux/targeted/contexts/files/file_contexts: line 1379 has invalid regex ^/mkreiserfs$: Memory exhausted /etc/selinux/targeted/contexts/files/file_contexts: line 1380 has invalid regex ^/spool/voice$: Memory exhausted [...] /etc/selinux/targeted/contexts/files/file_contexts.homedirs: line 30 is missing fields, skipping /etc/selinux/targeted/contexts/files/file_contexts.homedirs: line 31 is missing fields, skipping /etc/selinux/targeted/contexts/files/file_contexts.homedirs: line 32 is missing fields, skipping Installing: dhcp [1/1]warning: /etc/dhcpd.conf created as /etc/dhcpd.conf.rpmnew Segmentation fault # yum install binutils Loading "installonlyn" plugin Setting up Install Process Setting up repositories [...] Total download size: 3.4 M Is this ok [y/N]: y [...] Running Transaction /etc/selinux/targeted/contexts/files/file_contexts: line 1364 has invalid regex ^/dbus-daemon$: Memory exhausted /etc/selinux/targeted/contexts/files/file_contexts: line 1365 has invalid regex ^/sbin/amdump$: Memory exhausted /etc/selinux/targeted/contexts/files/file_contexts: line 1366 has invalid regex ^/sbin/amplot$: Memory exhausted *** glibc detected *** /usr/bin/python: double free or corruption (!prev): 0x097b09a8 *** [...] Any idea how to fix this ? TIA Tobias -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

1 0

2007 SELinux Symposium dates and call for papers
by Joshua Brindle 13 Sep '06

13 Sep '06

The Security Enhanced Linux (SELinux) Symposium announces that its third annual Symposium is scheduled for March 12-16, 2007, at the Wyndham Hotel, Baltimore, Maryland, USA. The Symposium also announces the opening of its call for papers. The event is the only of its kind to examine SELinux and the power of the flexible mandatory access control security it brings to Linux. The first two years of this annual event were a tremendous success providing the SELinux development and user community the opportunity to discuss related research results, development plans, and applications. The call for papers is open until October 9, 2006. Paper requirements and topics of interest are available on the Symposium web site at www.selinux-symposium.org.

1 1

post update label checking script
by Steve G 11 Sep '06

11 Sep '06

Hi, I just wanted to let everyone know that I'm making another test script available to help people testing fedora rawhide updates. What this script does is look at your yum logs to see if you've updated the system today. If so it makes the list of rpms and sends that to fixfiles to see if the update has caused any files to be mislabled. This can happen when post install scriptlets do the wrong thing. You can find it here: http://people.redhat.com/sgrubb/files/testing/selinux-check-new-rpms You can run the script after doing yum update on rawhide. you can also pass the script a date but it must be the same format that the yum logs uses. Example, "Sep 03" would be valid in my locale. There were some bug fixes needed to make the script work and hopefully they will be backported to FC5 sometime soon. Feedback and updates are welcome. -Steve __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

How to apply new policy exactly?
by Benjamin Tsai 11 Sep '06

11 Sep '06

Dear all: I've downloaded refpolicy source from tresys's website and tried to install it on my FC5 box. However, there're some problems I'm not able to fix it so far. According to online documents, I first setenforce 0. In build.conf I enabled DISTRO=redhat, then make install-src under /etc/selinux/refpolicy make conf; make policy; make install; make load under /etc/selinux/refpolicy/src/policy 1. While executing make load, it replied that policy file argument policy.20 is no longer supported, The next line showed "continue..." I was so confused here that it looked like refpolicy is not loaded yet. So how do I feed it a "supported policy file"? 2. Besides, is there any way I can check if the policy is loaded? My guess is sestatus. 3. If I neglected the "loading-policy-thing" and make relabel directly, then I'll got Relabeling filesystem types: ext2 ext3 xfs jfs /usr/sbin/setfiles /etc/selinux/refpolicy/contexts/files/file_contexts / /boot /etc/selinux/refpolicy/contexts/files/file_contexts: line 79 has invalid context system_u:object_r:quota_db_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 121 has invalid context system_u:object_r:svc_svc_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 139 has invalid context system_u:object_r:ipsec_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 147 has invalid context system_u:object_r:ipsec_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 153 has invalid context system_u:object_r:ipsec_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 189 has invalid context system_u:object_r:ipsec_mgmt_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 213 has invalid context system_u:object_r:ipsec_mgmt_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 214 has invalid context system_u:object_r:ipsec_exec_t /etc/selinux/refpolicy/contexts/files/file_contexts: line 245 has invalid context system_u:object_r:portage_exec_t Exiting after 10 errors. make: *** [relabel] Error 1 Though, I believe this error comes after the unmatched running policy. Please give me some instructions to fix up problems listed above. Thank you guys :-) Best Regards, Benjamin Tsai

2 1

Restrict Users to view own processes
by Stefan "SeNtiX" Scicluna 10 Sep '06

10 Sep '06

Is it possible using SELinux to restrict a user to view only his own processes? Because I need to give access to this machine to other users, and I want them to be able to view only their processes when using "ps aux" "top" "pstree" and other things which show running processes

1 0

A bit of packaging help is needed for suphp
by Andreas Thienemann 10 Sep '06

10 Sep '06

Hi, I'm currently preparing an update for mod_suphp in FE. suphp works similar to suexec for the apache httpd, only that it is designed with php scripts in mind. The execution works similar to suexec: A php-script on the webserver is accessed, for which the mod_suphp module is configured. The modules executes /usr/sbin/suphp, which drops privileges to the user owning the file and executes the php-cgi binary, feeding the generated content back to the server. I want this to work with the targeted selinux policy. Right now, the httpd error log shows: [Sat Sep 09 06:05:36 2006] [error] [client 127.0.0.1] (13)Permission denied: couldn't create child process: /usr/sbin/suphp for /home/andreas/public_html/test.php I tried relabeling the suphp binary with httpd_suexec_exec_t but this doesn't seem to help at all. Strangely, I'm not seeing anything related in the audit.log. A helpful user added a preliminary selinux policy to bugzilla for mod_suphp. <https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=135912> It'd be great, if someone knowledgable could take a look at it and comment. bye, andreas

2 1

problems with latest mls policy
by Stefan 10 Sep '06

10 Sep '06

Hi, I did an update of the mls policy last night (the version before was 1,5 months old) and know cron can't change its context to logrotate. Only two modules seem to be installed in /usr/share/selinux/mls: base.pp and enableaudit.pp If I install the strict policy there are a lot of policy modules installed even logrotate.pp. Someone any ideas? The following packages are installed: selinux-policy-2.3.7-2.fc5 selinux-policy-mls-2.3.7-2.fc5 selinux-policy-devel-2.3.7-2.fc5 Best regards, Stefan PS: Here is a list of all the avc denials: allow user_crond_t NetworkManager_var_run_t:dir getattr; allow user_crond_t acct_data_t:dir { getattr search }; allow user_crond_t acct_data_t:file getattr; allow user_crond_t alsa_etc_rw_t:dir getattr; allow user_crond_t apmd_log_t:file getattr; allow user_crond_t auditd_log_t:dir getattr; allow user_crond_t avahi_var_run_t:dir getattr; allow user_crond_t bin_t:dir { add_name remove_name write }; allow user_crond_t bin_t:file { create relabelfrom relabelto rename setattr unlink write }; allow user_crond_t binfmt_misc_fs_t:dir getattr; allow user_crond_t bluetooth_conf_t:dir getattr; allow user_crond_t boot_t:dir getattr; allow user_crond_t cert_t:dir { getattr read search }; allow user_crond_t crack_db_t:dir getattr; allow user_crond_t cron_spool_t:dir { getattr search }; allow user_crond_t cvs_data_t:dir getattr; allow user_crond_t data_t:dir { getattr read search }; allow user_crond_t dbusd_etc_t:dir { getattr search }; allow user_crond_t default_context_t:dir { getattr read search }; allow user_crond_t default_t:dir getattr; allow user_crond_t devlog_t:sock_file write; allow user_crond_t devpts_t:dir getattr; allow user_crond_t dhcpc_state_t:dir getattr; allow user_crond_t dhcpd_state_t:dir { getattr read search }; allow user_crond_t etc_mail_t:dir getattr; allow user_crond_t etc_runtime_t:dir getattr; allow user_crond_t etc_t:dir { add_name remove_name write }; allow user_crond_t etc_t:file { create rename setattr unlink write }; allow user_crond_t file_context_t:dir { getattr read search }; allow user_crond_t firstboot_rw_t:dir { getattr search }; allow user_crond_t fonts_t:dir getattr; allow user_crond_t home_root_t:dir read; allow user_crond_t httpd_config_t:dir { getattr search }; allow user_crond_t httpd_log_t:dir { getattr read search }; allow user_crond_t httpd_log_t:file { getattr read }; allow user_crond_t httpd_modules_t:dir { getattr read search }; allow user_crond_t httpd_modules_t:file { getattr read }; allow user_crond_t httpd_sys_content_t:dir { getattr read search }; allow user_crond_t httpd_sys_script_exec_t:dir getattr; allow user_crond_t httpd_var_lib_t:dir getattr; allow user_crond_t hwdata_t:dir { getattr search }; allow user_crond_t initrc_tmp_t:dir getattr; allow user_crond_t ipsec_conf_file_t:dir { getattr search }; allow user_crond_t ipsec_exec_t:file { relabelto rename unlink }; allow user_crond_t ipsec_key_file_t:dir getattr; allow user_crond_t ipsec_var_run_t:dir getattr; allow user_crond_t lib_t:dir { add_name remove_name write }; allow user_crond_t lib_t:file { create relabelfrom relabelto rename setattr unlink write }; allow user_crond_t locate_var_lib_t:dir { add_name getattr read remove_name search write }; allow user_crond_t locate_var_lib_t:file { create getattr read rename setattr unlink write }; allow user_crond_t logrotate_var_lib_t:file { getattr read write }; allow user_crond_t logwatch_cache_t:dir { add_name create getattr read remove_name rmdir search write }; allow user_crond_t logwatch_cache_t:file { create getattr ioctl read unlink write }; allow user_crond_t lost_found_t:dir getattr; allow user_crond_t lvm_etc_t:dir { getattr search }; allow user_crond_t lvm_lock_t:dir getattr; allow user_crond_t lvm_metadata_t:dir getattr; allow user_crond_t mail_spool_t:dir { getattr read }; allow user_crond_t mail_spool_t:lnk_file read; allow user_crond_t man_t:dir { getattr read search setattr }; allow user_crond_t man_t:file { getattr read setattr write }; allow user_crond_t mdadm_var_run_t:dir getattr; allow user_crond_t mnt_t:dir { getattr search }; allow user_crond_t modules_object_t:dir { getattr read search }; allow user_crond_t mqueue_spool_t:dir getattr; allow user_crond_t mrtg_etc_t:dir getattr; allow user_crond_t mrtg_lock_t:dir getattr; allow user_crond_t mrtg_var_lib_t:dir getattr; allow user_crond_t named_cache_t:dir getattr; allow user_crond_t named_conf_t:dir { getattr read search }; allow user_crond_t named_var_run_t:dir { getattr read search }; allow user_crond_t named_zone_t:dir { getattr read search }; allow user_crond_t net_conf_t:file { getattr read }; allow user_crond_t netif_t:netif { rawip_recv rawip_send }; allow user_crond_t netutils_exec_t:file { relabelto rename unlink }; allow user_crond_t nmbd_t:process signal; allow user_crond_t nmbd_var_run_t:file { getattr read }; allow user_crond_t node_t:node { rawip_recv rawip_send }; allow user_crond_t nscd_var_run_t:dir { getattr search }; allow user_crond_t ntp_drift_t:dir { getattr read search }; allow user_crond_t pam_var_console_t:dir getattr; allow user_crond_t pam_var_run_t:dir getattr; allow user_crond_t policy_config_t:dir { getattr read search }; allow user_crond_t postfix_etc_t:dir { getattr search }; allow user_crond_t postfix_etc_t:file { getattr read }; allow user_crond_t postfix_private_t:dir getattr; allow user_crond_t postfix_public_t:dir { getattr search }; allow user_crond_t postfix_public_t:fifo_file { getattr write }; allow user_crond_t postfix_spool_bounce_t:dir getattr; allow user_crond_t postfix_spool_flush_t:dir getattr; allow user_crond_t postfix_spool_maildrop_t:dir { add_name getattr read remove_name search write }; allow user_crond_t postfix_spool_maildrop_t:file { create getattr rename setattr write }; allow user_crond_t postfix_spool_t:dir { getattr read search }; allow user_crond_t pppd_etc_t:dir { getattr search }; allow user_crond_t pppd_var_run_t:dir getattr; allow user_crond_t prelink_log_t:file { append getattr write }; allow user_crond_t print_spool_t:dir getattr; allow user_crond_t radvd_var_run_t:dir getattr; allow user_crond_t rpm_exec_t:file { relabelto rename unlink }; allow user_crond_t rpm_log_t:file { append getattr read write }; allow user_crond_t rpm_var_lib_t:dir { getattr read search write }; allow user_crond_t rpm_var_lib_t:file { getattr lock read write }; allow user_crond_t samba_etc_t:dir getattr; allow user_crond_t samba_log_t:dir { add_name getattr read remove_name search write }; allow user_crond_t samba_log_t:file { create getattr read rename setattr write }; allow user_crond_t samba_var_t:dir { getattr read search }; allow user_crond_t saslauthd_exec_t:file { relabelto rename unlink }; allow user_crond_t saslauthd_var_run_t:dir getattr; allow user_crond_t sbin_t:dir { add_name remove_name write }; allow user_crond_t sbin_t:file { create relabelfrom relabelto rename setattr unlink write }; allow user_crond_t security_t:dir read; allow user_crond_t semanage_store_t:dir { getattr search }; allow user_crond_t sendmail_log_t:dir getattr; allow user_crond_t shlib_t:file { relabelto rename unlink }; allow user_crond_t smbd_t:process signal; allow user_crond_t smbd_var_run_t:file { getattr read }; allow user_crond_t src_t:dir getattr; allow user_crond_t staff_home_dir_t:dir { getattr search }; allow user_crond_t staff_home_ssh_t:dir getattr; allow user_crond_t stunnel_etc_t:dir getattr; allow user_crond_t sysadm_home_ssh_t:dir getattr; allow user_crond_t sysadm_home_t:dir { getattr read search }; allow user_crond_t sysctl_fs_t:dir { getattr search }; allow user_crond_t sysfs_t:dir getattr; allow user_crond_t syslogd_t:unix_dgram_socket sendto; allow user_crond_t system_cron_spool_t:dir getattr; allow user_crond_t system_dbusd_var_run_t:dir getattr; allow user_crond_t tdm2_etc_t:dir { getattr search }; allow user_crond_t tmp_t:dir { add_name read remove_name setattr write }; allow user_crond_t tmp_t:file { append create getattr ioctl read unlink write }; allow user_crond_t tmpfs_t:dir getattr; allow user_crond_t self:capability { chown fowner fsetid setgid setuid }; allow user_crond_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; allow user_crond_t self:process { setfscreate setrlimit }; allow user_crond_t self:tcp_socket { connect create read write }; allow user_crond_t self:udp_socket { create ioctl read write }; allow user_crond_t var_lib_nfs_t:dir { getattr read search }; allow user_crond_t var_lib_t:dir { getattr read search }; allow user_crond_t var_lib_t:file { getattr write }; allow user_crond_t var_lock_t:dir { add_name getattr read remove_name search write }; allow user_crond_t var_lock_t:file { create unlink write }; allow user_crond_t var_log_t:dir read; allow user_crond_t var_log_t:file { getattr read }; allow user_crond_t var_run_t:dir { add_name remove_name write }; allow user_crond_t var_run_t:file { create getattr unlink write }; allow user_crond_t var_spool_t:dir read; allow user_crond_t var_spool_t:file { read setattr write }; allow user_crond_t var_t:dir read; allow user_crond_t var_t:file { setattr write }; allow user_crond_t var_yp_t:dir getattr; allow user_crond_t winbind_var_run_t:dir getattr; allow user_crond_t wtmp_t:file getattr;

2 2

no avc denial for httpd_tty_comm checks ???
by Zing 09 Sep '06

09 Sep '06

Is it normal for no avc denial to happen if the httpd_tty_comm disallows httpd to grab the tty? I ask, because I just setup a key for apache on core 5 and httpd_tty_comm will deny apache tty access by default. That's fine, but the first thing I checked was "aureport --failed -a" and it was silent about anything failing... this doesn't seem intuitively correct, but I'm just a selinux beginner. thanks.

2 3

procmail with nfs home dirs
by Matthew Gillen 08 Sep '06

08 Sep '06

Hi, I'm new to SELinux, and I was having some problems with procmail not working correctly for me with NFS (via NIS-based autofs) home directories on FC5. There seemed to be a discussion about a similar issue a while back: http://www.redhat.com/archives/fedora-list/2006-May/msg03265.html but the solutions there didn't solve my problem. In any event, I managed to get it working for myself using the following policy module. The 'autofs_t:dir search' part seemed to be needed to find my .procmailrc file, and the rest looks like it is needed to write messages into my maildirs under $HOME/Mail/ If anyone has suggestions on how to improve this I'd be happy to hear them. Thanks, Matt -------------------------------------- module procmailnfs 1.0; require { class dir { getattr search write }; class file { append getattr read }; type autofs_t; type default_t; type procmail_t; role system_r; }; allow procmail_t autofs_t:dir search; allow procmail_t default_t:dir { getattr search write }; allow procmail_t default_t:file { append getattr read }; --------------------------------------

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2006