selinux December 2007

selinux@lists.fedoraproject.org

38 participants
66 discussions

ANN: SELinux Policy IDE (SLIDE) version 1.3
by David Sugar 13 Dec '07

13 Dec '07

Version 1.3 of the SELinux Policy IDE (SLIDE) from Tresys Technology is now available for download from the Tresys Open source website at http://oss.tresys.com. SLIDE is an Eclipse plug-in that integrates with the SELinux Reference Policy to provide a development environment for building SELinux policy. SLIDE Features: * A graphical user interface for policy development, including policy syntax highlighting, context suggestions, and integrated compilation. * Integration with SELinux Reference Policy, including quick lookup and documentation for interfaces and macros. * Wizards and easy to use templates to automate common tasks from creating a new SELinux policy to adding an interface into an existing module. * Integrated remote policy installation and audit log monitoring, to facilitate policy testing. * Integration with SETools to provide many analysis and auditing features. * Seamless integration with the power of standard Eclipse. Version 1.3 highlights: * Graphical interface for editing user and rolemap files. * Modified syntax coloring to include attributes, classes, permissions, roles, type and users. * Integration with SETools 3.3 to include some basic analysis features including TE Rule searching and Domain Transition Analysis. * Integration with audit2allow to provide quick and easy way to convert one or more audit denials into call to interfaces or allow rules. * New 'Open Module' dialog to quickly find and open any module based on name. * Improved documentation on the open source web site. * Updates to work with SETools version 3.3. * Fixed problems with the Console output. * Bugs fixed with undo/redo when toggling commenting on numerous lines of policy. If you would like to contribute, currently the best help would be to test and provide feedback on the SLIDE plugin and SLIDE Remote. Dave Sugar Tresys Technology, LLC

1 0

Re: adding only port 1186 to mysqld connect
by Johnny Tan 11 Dec '07

11 Dec '07

Eric Paris wrote: >> 1) Is there a better way to allow mysqld to connect to the >> cluster nodes besides just allowing mysqld to make any tcp >> connect? > > Maybe. But I don't know. Does name_connect/the socket controls pay > attention to rules set by SECMARK? If not, I don't know how to make > this work. Even if it will pay attention to labeling from SECMARK is > there some sort of iptables matching which would find this? I glanced over the secmark stuff at: http://james-morris.livejournal.com/11010.html Can't say I fully understand it, but right off the bat, I would say if I'm opening the ephemeral ports for mysqld_packet_t (is that right?) via iptables, then the main win for me is that it's not open for all the other ports, in particular, the privileged ports? >> 2) If this is changed to the correct behavior in the future, >> is this something that Red Hat would backport into existing >> RHELs, like RHEL-5? > > Dan might be willing to backport the first port change to RHEL5, I'm > not sure. I'd suggest opening a BZ against the policy. If SECMARK > solves your problem (hopefully while I sleep James will answer that > question) open up a BZ for RHEL5 iptables stating that secmark would > be a serious win for you (and if you have paid support open it there > as well) Assuming you do open the secmark BZ please let me know (off > list if you like) the BZ number. (and most/all of this would only > possibly be backported to RHEL5, not RHEL4) We're moving forward with allowing mysqld to make any tcp connect, just because we have to, for the moment. But I'm willing to continue working on this (I have a spare box I can dedicate to testing this), as it's important to me, and I think it's going to become more common and more important to others using SELinux with NDB (mysql clustering). I'll wait for James's reply first before opening BZ, because it's very possible secmark does what I need. johnn

1 0

Re: adding only port 1186 to mysqld connect
by Johnny Tan 11 Dec '07

11 Dec '07

Eric Paris wrote: > On 12/11/07, Johnny Tan <linuxweb(a)gmail.com> wrote: >> Stephen Smalley wrote: >>> On Mon, 2007-12-10 at 17:14 -0500, Johnny Tan wrote: >>>> Stephen Smalley wrote: >>>>>> Then I tried: >>>>>> semanage port -a -t mysqld_port_t -p tcp 1186 >>>>> What does semanage port -l | grep 1186 show afterward? >>>> # semanage port -l | grep 1186 >>>> mysqld_port_t tcp 1186, 3306 >>>> >>>> >>>>> What do you mean by "didn't work", i.e. same avc message repeated >>>>> afterward upon subsequent attempts to connect? >>>> type=AVC msg=audit(1197324654.830:1482): avc: denied { >>>> name_connect } for pid=20484 comm="mysqld" dest=54859 >>>> scontext=root:system_r:mysqld_t:s0 >>>> tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket >>>> type=SYSCALL msg=audit(1197324654.830:1482): arch=c000003e >>>> syscall=42 success=no exit=-13 a0=e a1=1972e194 a2=10 >>>> a3=4504aedc items=0 ppid=20385 pid=20484 auid=0 uid=27 >>>> gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 >>>> tty=pts1 comm="mysqld" exe="/usr/libexec/mysqld" >>>> subj=root:system_r:mysqld_t:s0 key=(null) >>> Hmm...that's a bug then - that should work, and seems to work for me on >>> Fedora 7. >> I can file a bugzilla. But do you know if these types of >> changes get backported into RHEL? They're technically not >> security exploits so I'm guessing "no". > > Actually, isn't that AVC saying the port you are connecting to is > 54859, not 1186? You're right. I just saw the name_connect and assumed it was 1186 again. It seems it only connects to the cluster manager on port 1186. Once that's successful (which it now is with the semanage rule above), it then makes a connection to every node in the cluster, using ports in the ephemeral port range. And it's those extra node connect attempts that are being denied. There's one denial for every single cluster node. (I didn't look closely, and thought those were simply multiple denials for the 1186 connect.) So, my two follow-up questions are: 1) Is there a better way to allow mysqld to connect to the cluster nodes besides just allowing mysqld to make any tcp connect? 2) If this is changed to the correct behavior in the future, is this something that Red Hat would backport into existing RHELs, like RHEL-5? johnn

1 0

mounting nfs as httpd_sys_content_t under selinux
by Johnny Tan 11 Dec '07

11 Dec '07

I have a NFS mount that I want apache to be able to serve files from. According to this doc: http://www.redhat.com/docs/manuals/enterprise/RHEL-5-manual/en-US/RHEL510/D… I should be able to mount it with a context that will allow apache to access it. But when I try the suggested command: [root@vm-37:~] mount -t nfs -o \ context=system_u:object_r:httpd_sys_content_t \ 192.168.1.100:/data/test /mnt/test It *does* mount, but when I do: [root@vm-37:~]# ls -lZ /mnt drwxr-xr-x 65534 65534 system_u:object_r:nfs_t test It doesn't show the correct context. (I don't know if it matters that I don't have a user with UID 65534, only the remote NFS server has that.) And sure enough, apache still can't serve from it. I see this in /var/log/messages: Dec 7 17:30:14 vm-37 kernel: audit(1197066614.787:240): avc: denied { search } for pid=18066 comm="httpd" name= "" dev=0:14 ino=4301717509 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir Dec 7 17:30:14 vm-37 kernel: audit(1197066614.787:241): avc: denied { getattr } for pid=18066 comm="httpd" name ="" dev=0:14 ino=4301717509 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir When I "setenforce 0", it works. But I want SELinux. Granted, I could do: allow httpd_t nfs_t:dir { search getattr }; Well, actually, I haven't tried it but I'm guessing that that will work. The problem is that I have other nfs directories that I don't want httpd to access, even accidentally if we ever point httpd at those directories. So... any ideas on the nfs mount with the context option? I'm running CentOS-5.1 with latest updates of everything. johnn

3 7

Re: adding only port 1186 to mysqld connect
by Stephen Smalley 11 Dec '07

11 Dec '07

On Tue, 2007-12-11 at 14:57 -0500, Eric Paris wrote: > On 12/11/07, Johnny Tan <linuxweb(a)gmail.com> wrote: > > Stephen Smalley wrote: > > > On Mon, 2007-12-10 at 17:14 -0500, Johnny Tan wrote: > > >> Stephen Smalley wrote: > > >>>> Then I tried: > > >>>> semanage port -a -t mysqld_port_t -p tcp 1186 > > >>> What does semanage port -l | grep 1186 show afterward? > > >> # semanage port -l | grep 1186 > > >> mysqld_port_t tcp 1186, 3306 > > >> > > >> > > >>> What do you mean by "didn't work", i.e. same avc message repeated > > >>> afterward upon subsequent attempts to connect? > > >> type=AVC msg=audit(1197324654.830:1482): avc: denied { > > >> name_connect } for pid=20484 comm="mysqld" dest=54859 > > >> scontext=root:system_r:mysqld_t:s0 > > >> tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket > > >> type=SYSCALL msg=audit(1197324654.830:1482): arch=c000003e > > >> syscall=42 success=no exit=-13 a0=e a1=1972e194 a2=10 > > >> a3=4504aedc items=0 ppid=20385 pid=20484 auid=0 uid=27 > > >> gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 > > >> tty=pts1 comm="mysqld" exe="/usr/libexec/mysqld" > > >> subj=root:system_r:mysqld_t:s0 key=(null) > > > > > > Hmm...that's a bug then - that should work, and seems to work for me on > > > Fedora 7. > > > > I can file a bugzilla. But do you know if these types of > > changes get backported into RHEL? They're technically not > > security exploits so I'm guessing "no". > > Actually, isn't that AVC saying the port you are connecting to is > 54859, not 1186? Ah, good catch, I missed that. In which case semanage and the kernel are working correctly. I doubt he wants to map that to mysqld_port_t though - since it comes from the local port range. So there's a question - should we be mapping everything in the local port range to a single type for name_connect checking? name_bind doesn't get checked against that range at all since the kernel internally allocates from it. Sounds like a job for secmark to control, but not sure how the port is originally conveyed to mysqld for use. -- Stephen Smalley National Security Agency

1 0

adding only port 1186 to mysqld connect
by Johnny Tan 11 Dec '07

11 Dec '07

I'm doing mysql clustering (aka NDB). It requires a mysqld client to connect to the cluster management node on port 1186. By default, SELinux disallows mysqld from making tcp connections (except to port 3306, I think?, not sure). To allow mysqld to connect to the management node, I ran audit2allow on the denials and got this: allow mysqld_t port_t:tcp_socket name_connect; But this rule seems *too* open. Ideally, I'd like it to only be able to connect on port 1186. Then I tried: semanage port -a -t mysqld_port_t -p tcp 1186 But this didn't work either. I think this just allows mysqld to bind to port 1186. (Or maybe not. Because, even without this rule, it's still able to bind to 1186 on the management nodes. So maybe this means something else.) How would I accomplish adding ONLY port 1186 to what mysqld can do a tcp connect to? p.s. Does this patch: http://www.redhat.com/archives/fedora-extras-commits/2007-November/msg00786… ... do what I'm trying to accomplish? I see 1186 is added to the mysqld network ports. But either way, since it's a recent commit against Fedora, I'm guessing it will be some time before it gets into RHEL-5. Actaully, do these types of SELinux targeted-policy commits even get backported into RHEL? It's not really a security patch, as such. johnn

2 4

home directory problems with Fedora 8
by Chris Howard 10 Dec '07

10 Dec '07

I have previously existing home directories under /u01/home. I did this because upgrading from FC6 to Fedora 7 caused me trouble and I want to avoid having to recreate my home directory. So I copied the whole system into /u01 before doing a fresh Fedora 8 install. I do not have a separate home-only partition. SELinux prevents me from making a symbolic link like this: /home--> /u01/home or like this /home/chris--> /u01/home/chris. If I setup a dummy user with home at /home/chris, then edit /etc/passwd to change the home to /u01/home/chris... that doesn't work either. nor if I create a new user like so: useradd -d /u01/home/pete pete Is there something magic about the string '/home' ? that keeps me from creating home directories anywhere else? I'd really love to keep from smashing /home on every OS reload. For now I have SELinux in Permissive mode so I can at least use the system.

4 5

[Question] How enforcing and permissive differ on start-up
by Shintaro Fujiwara 10 Dec '07

10 Dec '07

Hi, I have a question on differences between permissve and enforcing. I installed courier-imap from source (as always), and configured courier.te, courier.fc just to apply installation-path to souece installation. There are two say, daemons, courier_$1_t, i.e. courier_authdaemon_t, and I had to declair domain_auto_trans(initrc_t, courier_exec_t, courier_t) (courier_t was not declared in courier.te, so I did) as I declared starting script in /etc/rc.d/rc.local. I set selinux enforcing and found that courier_authdaemon_t started all-right, but courier_t not. When I set selinux permissive, it started all-right. How should I fix this problem ? Thanks in advance ! -- Shintaro Fujiwara segatex project (SELinux policy tool) http://sourceforge.net/projects/segatex/ Home page http://intrajp.no-ip.com/ Blog http://intrajp.no-ip.com/nucleus/ CMS http://intrajp.no-ip.com/xoops/ Wiki http://intrajp.no-ip.com/pukiwiki/

2 2

Adobe acroread
by John Griffiths 09 Dec '07

09 Dec '07

The Adobe acroread rpm from Adobe installs the plugin for firefox/mozilla with a context of system_u:object_r:lib_t nppdf.so. It will not run with that context because nppdf.so request text relocation, so selinux denies firefox to load nppdf.so. nppdf.so needs a context of system_u:object_r:textrel_shlib_t to run. Regards, John Griffiths

2 1

[Question: solved ] How enforcing and permissive differ on start-up
by Shintaro Fujiwara 09 Dec '07

09 Dec '07

I looked courier.fc again and found type courier_..._exec_t. I set proper type courier_pop_exec_t, and others, eliminated my own difinisitons. And courier started up all-right in enforcing. Thanks ! -- Shintaro Fujiwara segatex project (SELinux policy tool) http://sourceforge.net/projects/segatex/ Home page http://intrajp.no-ip.com/ Blog http://intrajp.no-ip.com/nucleus/ CMS http://intrajp.no-ip.com/xoops/ Wiki http://intrajp.no-ip.com/pukiwiki/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2007