selinux September 2006

selinux@lists.fedoraproject.org

42 participants
52 discussions

x86_64 question
by LC Bruzenak 06 Sep '06

06 Sep '06

Question(s): Installed FC6T2 from DVD on a 64-bit machine. Selected only "software development" checkbox option. Left it in "enforcing" mode. Prior to doing anything else, checked to see what was installed. There are many instances of both the i386 and the x86_64 versions there. I guess that is OK - the 64 bit version will override or it is always installed last? Is there a easy way to scrub the duplicate .386 names out of the db so that they will not show up if not actually in use (like the "--justdb" option in the rpm -freshen command)? # yum list installed | grep libse libselinux.i386 1.30.19-5 installed libselinux.x86_64 1.30.19-5 installed libselinux-devel.x86_64 1.30.19-5 installed libselinux-devel.i386 1.30.19-5 installed libselinux-python.x86_64 1.30.19-5 installed libsemanage.x86_64 1.6.12-2 installed libsepol.i386 1.12.19-1.1 installed libsepol.x86_64 1.12.19-1.1 installed -- LC Bruzenak lenny(a)bruzenak.com

3 2

service start/stop test script
by Steve G 06 Sep '06

06 Sep '06

Hello, I just wanted to let everyone know that I'm making a test script available to help policy writers (and everyone doing selinux testing). The script will go though /etc/rc.d/init.d and make a list of services installed. It filters out some that you'd really not want to run (like halt). Then it checks the service to see if its running. If so, it stops and starts the service. Otherwise it starts then stops the service. After each service cycle, it scans the audit logs to look for avcs. If any are found they are run through audit2allow and output. The script can be found here: http://people.redhat.com/sgrubb/files/testing/service-avc-test Feedback and updates are welcome. -Steve __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

invalid context message from today's updates....
by Tom London 06 Sep '06

06 Sep '06

Running rawhide, targeted/enforcing. Got this during today's updates: Updating : fedora-logos ########## [39/86]file_contexts: invalid context system_u:object_r:firstboot_rw_t:s0 Updating : fedora-logos ####################### [39/86] Fedora-logos got updated after update to selinux-policy-targeted. This appears in /var/log/messages: Sep 6 06:58:10 localhost Updated: caching-nameserver.i386 30:9.3.2-40.fc6 Sep 6 06:58:26 localhost kernel: security: 3 users, 6 roles, 1528 types, 158 bools, 1 sens, 256 cats Sep 6 06:58:26 localhost kernel: security: 58 classes, 45425 rules Sep 6 06:58:26 localhost kernel: security: invalidating context system_u:object_r:firstboot_rw_t:s0 Sep 6 06:58:26 localhost dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?) Sep 6 06:58:27 localhost dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=2) : exe="/bin/dbus-daemon" (sauid=500, hostname=?, addr=?, terminal=?) Sep 6 06:58:29 localhost Updated: selinux-policy-targeted.noarch 2.3.12-1 Timing? tom -- Tom London

1 0

audit2allow -l is unusable in FC5
by Yuichi Nakamura 05 Sep '06

05 Sep '06

Hi, I yum updated today and found audit2allow -l is unusable in FC5. There is no log saying "avc granted load_policy", instead, there is audit log "audit(1157498697.581:88): policy loaded auid=4294967295 ". I am teaching people audit2allow "-l" is useful and to use -l, many people are using -l option. Are you going to prepare new option for audit2allow, or fix poilcy(auditallow load_policy again), or fix avc.py? Yuichi Nakamura

2 2

xen avcs....
by Tom London 05 Sep '06

05 Sep '06

Running latest rawhide, targeted/enforcing. See the following when running xen enabled kernel, xenguest-install, ... type=AVC msg=audit(1157437064.863:54): avc: denied { search } for pid=3123 comm="python" name="root" dev=dm-0 ino=2883585 scontext=system_u:system_r:xend_t:s0 tcontext=root:object_r:user_home_dir_t:s0 tclass=dir type=SYSCALL msg=audit(1157437064.863:54): arch=40000003 syscall=33 success=no exit=-13 a0=8ed9a00 a1=4 a2=474c48e4 a3=b711fa4c items=0 ppid=2789 pid=3123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:xend_t:s0 key=(null) type=ANOM_PROMISCUOUS msg=audit(1157437099.990:55): dev=vif7.0 prom=256 old_prom=0 auid=4294967295 type=SYSCALL msg=audit(1157437099.990:55): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9ab5e0 a3=1 items=0 ppid=5236 pid=5319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c255 key=(null) type=AVC msg=audit(1157437100.910:56): avc: denied { name_bind } for pid=5238 comm="xen-vncfb" src=5900 scontext=system_u:system_r:xend_t:s0 tcontext=system_u:object_r:vnc_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1157437100.910:56): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfdc5d00 a2=5 a3=bfdc5d2c items=0 ppid=2792 pid=5238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="xen-vncfb" exe="/usr/lib/xen/bin/xen-vncfb" subj=system_u:system_r:xend_t:s0 key=(null) Xen an interesting case here, or should I defer reporting such.... tom -- Tom London

2 1

semanage changes
by Michael Thomas 05 Sep '06

05 Sep '06

I'm trying to make modifications to semanage so that it's easier to delete all ports for a given context, ie: # semanage port -d -t crossfire_port_t # semanage port -d -t crossfire_port_t -d tcp However, I'm a little confused by the workings of the semanage python modules. /usr/sbin/semange makes the following call to delete the ports: OBJECT = seobject.portRecords() ... OBJECT.delete(target, proto) Where 'target' is the port number to delete, and proto is the protocol (tcp or udp). OBJECT is an array of selinux objects on which to operate. Presumably, either the OBJECT list contains only the selinux objects that match the input context (such as crossfire_port_t), or the delete() method has some magic to filter only the matching contexts. Since I couldn't find any code to support the latter, I suspect the former. Can someone explain how this OBJECT array gets filtered to only contain matching contexts? It's not obvious how this happens when the OBJECT array is created with seobject.portRecords(). Thanks, --Mike

2 1

Re: install of selinux-policy-targeted-2.3.11-1 chokes a bit....
by Paolo D. 03 Sep '06

03 Sep '06

Good evening Tom, for my experience, I suggest you to download updated libsepol and libsemanage packages from NSA download site (http://www.nsa.gov/selinux/code/download5.cfm), extract them, and build them in order, with a simple "make install" from extracted directories. It should function. Paolo De Nictolis _______________________ Ing. Paolo De Nictolis Tel.: +393389511681 E-mail: borzoi(a)caltanet.it Running rawhide, targeted enforcing. Yum installing today's packages (including selinux-policy-targeted-2.3.11-1) generates: Updating : selinux-policy-targeted ##################### [ 40/108] libsepol.context_from_record: type firstboot_rw_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:firstboot_rw_t:s0 to sid /etc/selinux/targeted/contexts/files/file_contexts: line 1573 has invalid context system_u:object_r:firstboot_rw_t:s0 libsemanage.semanage_install_active: setfiles returned error code 1. /usr/sbin/load_policy: Can't load policy: Invalid argument libsemanage.semanage_reload_policy: load_policy returned error code 2. semodule: Failed!

2 1

install of selinux-policy-targeted-2.3.11-1 chokes a bit....
by Tom London 02 Sep '06

02 Sep '06

Running rawhide, targeted enforcing. Yum installing today's packages (including selinux-policy-targeted-2.3.11-1) generates: Updating : selinux-policy-targeted ##################### [ 40/108] libsepol.context_from_record: type firstboot_rw_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:firstboot_rw_t:s0 to sid /etc/selinux/targeted/contexts/files/file_contexts: line 1573 has invalid context system_u:object_r:firstboot_rw_t:s0 libsemanage.semanage_install_active: setfiles returned error code 1. /usr/sbin/load_policy: Can't load policy: Invalid argument libsemanage.semanage_reload_policy: load_policy returned error code 2. semodule: Failed! tom -- Tom London

1 0

setroubleshootd message.....cool!
by Tom London 01 Sep '06

01 Sep '06

During update of today's rawhide, I get this in /var/log messages (and a nice icon in the tray): Sep 1 08:18:44 localhost Updated: kexec-tools.i386 1.101-51.fc6 Sep 1 08:19:14 localhost /usr/sbin/setroubleshootd: SELinux is preventing /usr/sbin/lvm (lvm_t) "getattr" to /dev/nvram (unlabeled_t). See audit.log for complete SELinux messages. id = 1fbf1f44-8ff6-4eb2-96dd-cdfe9ea35829 Sep 1 08:19:22 localhost Installed: kernel.i686 2.6.17-1.2608.fc6 Here's the associated AVC: type=AVC msg=audit(1157123951.753:51): avc: denied { getattr } for pid=7465 comm="lvs" name="nvram" dev=tmpfs ino=3418 scontext=user_u:system_r:lvm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=chr_file type=SYSCALL msg=audit(1157123951.753:51): arch=40000003 syscall=195 success=no exit=-13 a0=8611ef8 a1=bfc3281c a2=c4fff4 a3=8611ef8 items=0 ppid=7464 pid=7465 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="lvs" exe="/usr/sbin/lvm" subj=user_u:system_r:lvm_t:s0 key=(null) type=AVC_PATH msg=audit(1157123951.753:51): path="/dev/nvram" On reboot, /dev/nvram seems to be labeled properly. [tbl@localhost ~]$ ls -lZ /dev/nvram crw-rw---- root root system_u:object_r:nvram_device_t /dev/nvram [tbl@localhost ~]$ Anyway, setroubleshoot is neat..... tom -- Tom London

2 1

Re: suggest an icon for selinux (e.g. setroubleshoot)
by John Griffiths 01 Sep '06

01 Sep '06

> > Let's do a straw poll vote: > > A) Star fish inscribed in a circle (pentagon) > > B) Golden key inscribed in a pentagon > > C) Mousetrap > > D) Gecko in a trench coat with the collar turned up > > E) Crossed swords Gecko might be a problem with GEICO insurance. John

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2006