selinux January 2007

selinux@lists.fedoraproject.org

38 participants
45 discussions

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

Mail problems...
by melaina＠libero.it 06 Feb '07

06 Feb '07

Hello! I have just started playing a bit with SELinux in permissive mode on my system. I have qmail with spamassassin installed; the only AVC denied messages I get (after I relabeled the system and fixed domains on a couple of log files), is the following: Jan 30 20:23:13 drake kernel: audit(1170210193.998:8): avc: denied { read } for pid=11862 comm="sendmail" name="RsmVLSTr" dev=loop0 ino=20 scontext=user_u: system_r:system_mail_t tcontext=user_u:object_r:httpd_sys_script_rw_t tclass=fil e Jan 30 20:23:13 drake kernel: audit(1170210193.998:9): avc: denied { read wr ite } for pid=11862 comm="sendmail" name="jk-runtime-status" dev=hda5 ino=49827 49 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.019:10): avc: denied { ioctl } for pid=11863 comm="qmail-scanner-q" name="error_log" dev=hda5 ino=4984894 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tcla ss=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:11): avc: denied { read } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 scontext= user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:12): avc: denied { getatt r } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 sconte xt=user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=f ile Jan 30 20:23:15 drake kernel: audit(1170210195.204:13): avc: denied { append } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 s context=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcl ass=file Jan 30 20:23:15 drake kernel: audit(1170210195.204:14): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcla ss=file Jan 30 20:23:15 drake kernel: audit(1170210195.205:15): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.206:16): avc: denied { read } for pid=11863 comm="perl5.8.5" name="qmail-scanner-queue-version.txt" dev=hda5 ino=5130273 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:v ar_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.208:17): avc: denied { write } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=5195094 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:18): avc: denied { add_na me } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772118 63" scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_ t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:19): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.409:20): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:21): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:22): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com11702101957721186 3" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:o bject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.414:23): avc: denied { write } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.418:24): avc: denied { link } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.419:25): avc: denied { remove _name } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772 11863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=syst em_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.419:26): avc: denied { unlink } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:ob ject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.424:27): avc: denied { read w rite } for pid=11864 comm="sh" name="tty" dev=tmpfs ino=1804 scontext=user_u:sy stem_r:system_mail_t tcontext=system_u:object_r:devtty_t tclass=chr_file Jan 30 20:23:15 drake kernel: audit(1170210195.431:28): avc: denied { read } for pid=11865 comm="sh" name="drake.mydomain.com117021019577211863" dev=hda 5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:va r_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.434:29): avc: denied { write } for pid=11865 comm="reformime" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.434:30): avc: denied { add_na me } for pid=11865 comm="reformime" name="1170210195.11865-0.drake.mydomain. com" scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.739:31): avc: denied { read } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.755:32): avc: denied { read } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=4980740 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:var_t tclass=lnk_file Jan 30 20:23:15 drake kernel: audit(1170210195.795:33): avc: denied { execut e } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=us er_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.796:34): avc: denied { execut e_no_trans } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=fi le Jan 30 20:23:15 drake kernel: audit(1170210195.796:35): avc: denied { read } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:36): avc: denied { search } for pid=11867 comm="find" name="selinux" dev=hda5 ino=557257 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.798:37): avc: denied { read } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u:sy stem_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:38): avc: denied { getatt r } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u :system_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.860:39): avc: denied { read } for pid=11871 comm="rm" name="qscan" dev=hda5 ino=5130256 scontext=user_u:syst em_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.860:40): avc: denied { remove _name } for pid=11871 comm="rm" name="1170210195.11865-0.drake.mydomain.com" dev=hda5 ino=5408222 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.861:41): avc: denied { rmdir } for pid=11871 comm="rm" name="drake.mydomain.com117021019577211863" dev=hd a5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:v ar_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.873:42): avc: denied { sigchl d } for pid=1 comm="init" scontext=user_u:system_r:system_mail_t tcontext=user_ u:system_r:unconfined_t tclass=process Any directions to fix this? Thanks! ------------------------------------------------------ Mutuo da 200.000 ? Tassi ridotti da 4.25%. Solo per richieste online. Mutuionline.it http://click.libero.it/mutuionline31ge07

2 1

Crossover
by Göran Uddeborg 06 Feb '07

06 Feb '07

Crossover installs under /opt/cxoffice by default. The rules for wine-style programs does not seem to cover that hierarchy, and just trying to run things gives a lot of denied execmods. I assume just mirroring the settings for regular wine is fine for Crossover too: /opt/cxoffice/lib/wine/.+\.so system_u:object_r:textrel_shlib_t:s0 /opt/cxoffice/bin/wine system_u:object_r:wine_exec_t:s0 I changed the files (only directly with chcon) and it appears to work. At least so far, we have not used this too much yet. Does this make sense? Do you want a bugzilla about it?

2 1

Selinux is ignoring me
by Ronald 30 Jan '07

30 Jan '07

My problem can be viewed here: http://forums.fedoraforum.org/showthread.php?p=734545#post734545 No one answered on the forums. Can someone help me on the mailinglist? I'm trying to understand the system, so I can hopefully write a manual (or HOWTO) for the forums. Can anybody help me with my problem? And some good links will be appreciated as well. The ones from google give hits that rever to non-existing files...

2 1

PAM problems
by Anne Wilson 29 Jan '07

29 Jan '07

From logwatch: **Unmatched Entries** userhelper[20994]: PAM [error: /lib/security/lib/security/pam_permit.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_rootok.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_stack.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_timestamp.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_xauth.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_permit.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_rootok.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_stack.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_timestamp.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_xauth.so: 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_permit.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_rootok.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_stack.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_timestamp.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_xauth.so): 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_permit.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_rootok.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_stack.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_timestamp.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_xauth.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_permit.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_rootok.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_stack.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_timestamp.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_xauth.so: 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_permit.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_rootok.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_stack.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_timestamp.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_xauth.so): 1 Time(s) What's happening? Anne

3 6

SELinux Policy/Flask Classes from scratch
by bx 29 Jan '07

29 Jan '07

Hello, Let me apologize if this is the wrong place to ask this question, but I figure that those well versed in SELinux can help me. I have been reading a ton about SELinux and Flask, and I haven't found anything that answered my question. I am working on creating a security policy from scratch and followed the tutorial the IBM published ( http://www-128.ibm.com/developerworks/linux/library/l-selinux.html). After taking a look at the bare bones policy.conf file it generated, it got me thinking- I don't need to have something as granular as SELinux allows me to be. In fact it would simplify things if I could change the granularity. How would SELinux be affected if I were to remove some of the class definitions and took anything that referred to those classes out of my policy? Would SELinux just not enforce anything on those types of objects, would SELinux completely disallow all use of those objects or would it just break SELinux? Thank you for your time and help, Rebecca

3 5

httpd and tcp_connect
by Michael Thomas 26 Jan '07

26 Jan '07

I'm receiving the following avc denial from a game package that's under review[1]: Jan 21 10:55:49 localhost kernel: audit(1169405749.338:3): avc: denied { name_connect } for pid=2661 comm="httpd" dest=19382 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket The package includes a php-based web application and a python daemon backend. The php webapp communicates with the python daemon through tcp sockets. From the avc denial it appears that this communication fails because httpd is not allowed to establish tcp connections. This seems like a valid security restriction, except in this case I do want to allow it. How can I configure the httpd policy to allow tcp connections, but only to localhost and only on the python daemon's ports (19380-19383)? --Wart [1] https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219972

2 3

script executables
by Michael Thomas 26 Jan '07

26 Jan '07

I'm working on selinux protection for a python script daemon that is started inside of an init.d script. Inside the init.d script the python daemon is invoked as: python myscript.py --daemon --pid=... --log=... I'd like to have this process run under its own domain. The worst thing I could do is to relabel python with that domain, but that would just be really bad and sloppy, and not really an option. Another option that I've gotten to work is to use a wrapper shell script to invoke the python commands. The init.d script invokes the wrapper script, which is labeled with the desired domain. But I was wondering of there was another way to get myscript.py to run under a specific domain without using an application-specific wrapper. Something like 'sedomainexec myappd_t python myscript.py --daemon ...' Is the wrapper script my only option? --Wart

2 7

ANN: SELinux Policy IDE (SLIDE)
by David Sugar 25 Jan '07

25 Jan '07

Version 1.0 of the SELinux Policy IDE (SLIDE) from Tresys is now available for download from the Tresys Open Source website at http://oss.tresys.com. SLIDE is an Eclipse plug-in that integrates with the SELinux Reference Policy to provide a development environment for building SELinux policy. SLIDE features: * A graphical user interface for policy development, including policy syntax highlighting, context suggestions, and integrated compilation. * Integration with SELinux Reference Policy, including quick lookup and documentation for interfaces. * Wizards and easy to use templates to automate common tasks from creating a new SELinux policy to adding an interface into an existing module. * Integrated remote policy installation and audit log monitoring, to facilitate policy testing. * Seamless integration with the power of standard Eclipse. Version 1.0 highlights: * Integration of online help into the SLIDE plugin. * Display of distinct icon for disabled modules. * Improved documentation on the open source web site. If you would like to contribute, currently the best help would be to test and provide feedback on the SLIDE plugin and SLIDE Remote.

1 0

chcat problem
by pandalists＠free.fr 25 Jan '07

25 Jan '07

Hi, I am currently trying teach myself SELinux on a Fedora FC6 box (VMware), configured with the strict policy running in permissive mode. I followed the instructions provided on http://james-morris.livejournal.com/8228.html to play with MCS functions, but I get an error when I try to assign a category "Public" to an unprivileged user "foo" with the chcat command (as root, with sysadm role) ----------------------------------------------- # chcat -l -- +Public foo libsemanage.validate_handler: MLS range s0-s0:c0 for Unix user foo exceeds allow ed range s0 for SELinux user user_u libsemanage.validate_handler: seuser mapping [foo -> (user_u, s0-s0:c0)] is inva lid libsemanage.dbase_llist_iterate: could not iterate over records ----------------------------------------------- Other techniques to achieve the same result (e.g. trying to assign this category with semanage) leads the same error. ----------------------------------------------- # semanage login -l __default__ user_u s0 foo user_u s0 root root SystemLow-SystemHigh system_u system_u SystemLow-SystemHigh # semanage user -l root sysadm s0 SystemLow-SystemHigh system_r sy sadm_r staff_r staff_u staff s0 SystemLow-SystemHigh sysadm_r st aff_r sysadm_u sysadm s0 SystemLow-SystemHigh sysadm_r system_u user s0 SystemLow-SystemHigh system_r user_u user s0 s0 user_r ----------------------------------------------- My setrans.conf file contains : s0:c0=Public s0:c1=Confidential s0:c2=Secret s0:c3=TopSecret Any idea? Apart from that, setting a category on a non-existing file leads to a segmentation fault : # chcat -- +Public doesnotexist.txt Segmentation fault Thanks for your help, Ben

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2007