selinux December 2007

selinux@lists.fedoraproject.org

38 participants
66 discussions

Re: selinux preventing clamd and amavisd even in Permissive
by John Griffiths 03 Dec '07

03 Dec '07

I think I figured it out. I had not configured freshclam yet. Even though clamav had the default virus databases from clamav-data.i386, clamav system would not start until freshclam had updated the databases. I configured freshclam before I went out. Apparently, when cron updated the virus databases, clamav started normally and opened the missing socket and the email system started working properly. At least this is my best deduction. I don't remember having to have freshclam configured for updates prior to email working in Fedora 7. Guess this is a question for a different list, but I just wanted to put things to rest. Regards, John

2 2

allow_daemons_dump_core doesn't work?
by Chuck Anderson 03 Dec '07

03 Dec '07

I've been having issues with BIND so I set up the named process to dump core and enabled allow_daemons_dump_core. However, it would not create any core file until I put SELinux into permissive mode. I also didn't get any audit messages related to the failed core dump. Why is that? The CWD of the process is /var/named which is where the core dump got written after I put SELinux in permissive mode.

2 1

CGI can't read public_html files
by Alexander Slesarev 03 Dec '07

03 Dec '07

Hello! I want to access public_html files from CGI script, but can't do it - got AVC error during reading README file from public_html dir: ----------------------------------------------------------------------- [root@elc6002s nuald]# tail /var/log/messages | grep setroubleshoot -m 1 Nov 29 13:42:51 elc6002s setroubleshoot: #012 SELinux is preventing the format.cgi from using potentially mislabeled files <Unknown> (unconfined_home_dir_t).#012 For complete SELinux messages. run sealert -l 69519bd7-3e77-46d9-b845-7f066c4515e6 ----------------------------------------------------------------------- I have only one item with unconfined_home_dir_t type in the path to README file: ----------------------------------------------------------------------- [nuald@elc6002s public_html]$ ls -Z `pwd`/README && pushd . > /dev/null && while [[ `pwd` != '/' ]]; do ls -Zd `pwd` && cd ..; done && popd > /dev/null -rw-rw-r-- nuald nuald system_u:object_r:httpd_user_content_t:s0 /home/nuald/public_html/README drwxrwxr-x nuald nuald system_u:object_r:httpd_user_content_t:s0 /home/nuald/public_html drwx--x--x nuald nuald unconfined_u:object_r:unconfined_home_dir_t:s0 /home/nuald drwxr-xr-x root root system_u:object_r:home_root_t:s0 /home ----------------------------------------------------------------------- So, only my home dir have unconfined_home_dir_t type. But I do not want to change it to httpd_sys_content_t type and I don't like this solution. The CGI script itself works fine either it have httpd_user_content_t type now: ----------------------------------------------------------------------- [nuald@elc6002s cgi-bin]$ ls -Z `pwd`/format.cgi && pushd . > /dev/null && while [[ `pwd` != '/' ]]; do ls -Zd `pwd` && cd ..; done && popd > /dev/null -rwxr-xr-x nuald nuald system_u:object_r:httpd_user_content_t:s0 /home/nuald/public_html/cgi-bin/format.cgi drwxr-xr-x nuald nuald system_u:object_r:httpd_user_content_t:s0 /home/nuald/public_html/cgi-bin drwxrwxr-x nuald nuald system_u:object_r:httpd_user_content_t:s0 /home/nuald/public_html drwx--x--x nuald nuald unconfined_u:object_r:unconfined_home_dir_t:s0 /home/nuald drwxr-xr-x root root system_u:object_r:home_root_t:s0 /home ----------------------------------------------------------------------- So the script only can't read files in public_html folder. What is right way to fix it? The script itself is below and used as http://localhost/~nuald/cgi-bin/format.cgi?file=README <http://localhost/%7Enuald/cgi-bin/format.cgi?file=README> ----------------------------------------------------------------------- [nuald@elc6002s cgi-bin]$ cat format.cgi #!/usr/bin/perl -wT use strict; use CGI qw/:standard/; use IO::File; use File::Spec; use Cwd 'realpath'; print header; my $filename = param('file') or die "Can be executed only as CGI"; my $updir = File::Spec->updir(); my $rel_path = File::Spec->catfile($updir, $filename); my $path = realpath($rel_path) ; my $file = IO::File->new($path,"<") or die "Can't open file $path"; my $text = join "", <$file>; $file->close or die "Can't close file"; print $text; ----------------------------------------------------------------------- Thanks in advance. -- Best regards, Alex Slesarev.

2 1

usbfs, updpwd_t, gdm (xdm_t) avcs with today's rawhide
by Tom London 03 Dec '07

03 Dec '07

Today's gdm is finally runnable for me, and with gcc-4.1.2-33, I can compile newest kernel (2.6.24-0.61.rc3.git5.local.fc9). However, a bunch of AVCs: #============= mount_t ============== allow mount_t usbfs_t:dir { read ioctl }; #============= updpwd_t ============== allow updpwd_t tty_device_t:chr_file { read write }; #============= xdm_t ============== allow xdm_t gconfd_exec_t:file { read execute execute_no_trans }; allow xdm_t inotifyfs_t:dir getattr; allow xdm_t self:netlink_selinux_socket { read bind create }; allow xdm_t system_dbusd_exec_t:file { read execute execute_no_trans }; allow xdm_t system_dbusd_t:dbus acquire_svc; allow xdm_t var_lib_t:file { rename unlink append }; allow xdm_t var_log_t:file write; The mount_t/usbfs_t ones come early in boot. Without adding rules for the xdm_t ones (at least some of them), graphical login fails with 'X respawn too fast' messages. I attach the AVCs from /var/log/messages and /var/log/audit/audit.log tom -- Tom London

1 1

Problem with existing user directories on F*
by Tony Molloy 03 Dec '07

03 Dec '07

Hi, After an install of F8 I have a problem with pre-existing user directories. I did a full install of F8 with SELinux in enforcing mode and kept my existing user directories in /users. At the end of the install I did a "fixfiles relabel". Now when I try to login to my account I'm told that my home directory does not exist. It does. The problem appears to be SELinux because when I disable it everything works. Some info: ls -al| /home/testacc ( account created during the install ) drwx------ testacc testacc system_u:object_r:user_home_dir_t . drwxr-xr-x root root system_u:object_r:home_root_t .. -rw-r--r-- testacc testacc system_u:object_r:user_home_t .bash_logout .... ls -alZ /users/molloyt ( my home directory ) drwx------ molloyt csstaff system_u:object_r:default_t . drwxr-xr-x root root system_u:object_r:default_t .. -rw-r--r-- molloyt csstaff user_u:object_r:default_t 3rd-monday .... The SELinux permissions on the home directory, the owing directory and the contents of the home directory are wrong. So two questions: 1. how can I reset the permissions. 2. was the problem caused by the "fixfiles relabel" which I did at the end of the install. If I had unmounted the /users partition before I did that would I have been OK. Thanks, Tony

2 1

selinux out smarted itself. "Multiple different specifications" One FILE But two types labled ------------- (system_u:object_r:home_root_t:s0 and system_u:object_r:boot_t:s0).
by Roger Salisbury 03 Dec '07

03 Dec '07

----------- a challenge for selinux------------ Hi fellow selinux uses ... How can you fix labeling when the selinux tools don't allow you to. Selinux commands complain & refuse to work. Tradition selinux commands don't work. IE chcon, restorecon , fixfiles, setfiles etc..I Need an *expert* here, .......... PROBLEM is : my /boot directory has : :boot_t: and :home_root_t: .......... together labled --- see below. and I can't fix it. do we have to edit the "inode" directly?? Having two types on one file I believe should *never* happen but -- it has. Should be one ":boot_t:" or the other ":home_root_t:" but never *both*! I think I know how it happened -- but that's not the issue right now -- how do you fix it?? The security of selinux normaly is designed to prevent adhoc changes --- so this is why it is difficult... but with root password their would be a solution somehow. Thx Roger Salisbury Below is the setfiles display: /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /boot/lost\+found/.*. /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /boot (system_u:object_r:home_root_t:s0 and system_u:object_r:boot_t:s0). /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /boot/\.journal. /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /boot/lost\+found. setfiles: labeling files under /boot setfiles: labeling files under /boot matchpathcon_filespec_eval: hash table stats: 28 elements, 28/65536 buckets used, longest chain length 1 setfiles: Done.

2 1

policy compile error
by Clarkson, Mike R (US SSA) 03 Dec '07

03 Dec '07

I just downloaded the policy source from redhat (serefpolicy-2.4.6) and attempted to build a strict-mls loadable module policy and got the following compile error: Compiling mls base module /usr/bin/checkmodule -M base.conf -o tmp/base.mod /usr/bin/checkmodule: loading policy configuration from base.conf policy/modules/kernel/domain.te:174:ERROR 'unknown type ipsec_spd_t' at token ';' on line 10298: allow domain ipsec_spd_t:association polmatch; #line 174 /usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/base.mod] Error 1 Here is the offending portion of domain.te: ifdef(`enable_mls',` tunable_policy(`allow_netlabel',` kernel_raw_recvfrom_unlabeled(domain) kernel_tcp_recvfrom_unlabeled(domain) kernel_udp_recvfrom_unlabeled(domain) ') tunable_policy(`allow_ipsec_label',` ipsec_labeled(domain) ') ') Since domain is a base module and ipsec is a loadable module, doesn't the call to the ipsec_labeled interface need to be wrapped in an optional_policy statement? Since nesting conditional statements aren't supported, I had to comment out the tunable_policy statement to get this to compile: #tunable_policy(`allow_ipsec_label',` optional_policy(` ipsec_labeled(domain) ') #') What's the right fix for this?

2 1

Re: permission issue with bugzilla
by Daniel J Walsh 03 Dec '07

03 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ritesh Trivedi wrote: > Hi, > > After accidental reboot of one of our servers, I started getting avc > denial messages when bugzilla tries to connect to local mysql > instance. > > At first I was seeing httpd_sys_script_ro_t vs httpd_sys_script_t > denial messages. I fixed that by issuing chcon httpd_sys_script_rw_t > on the mysql directory. But now I am seeing unix socket denial error > (see following...) > > Any help will be highly appreciated. Also please reply directly to me > at this email address if possible. > > Nov 26 18:05:09 nbprod2 kernel: audit(1196129109.301:3152): avc: > denied { connectto } for pid=5900 comm="index.cgi" name="mysql.sock" > scontext=root:system_r:httpd_sys_script_t:s0 > tcontext=root:system_r:unconfined_t:s0-s0:c0.c255 > tclass=unix_stream_socket You have mysql running ad unconfined_t? It should be running as mysql_t, if you execute service mysql restart does it fix the problem? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFHVCTPrlYvE4MpobMRAv0EAJ4oO8HfPjfwNEtqRRfzhoEyUtY1eQCguBxw mlf4XXGOKjIfzHwibvVkbQA= =HfB/ -----END PGP SIGNATURE-----

1 0

Qustion regarding: selinux / perl-cgi / iptables
by Paul McAvoy 03 Dec '07

03 Dec '07

Hi, I was wondering if anyone has information or can direct me to more details on the following: I have been using a perl cgi script on a personal web-server of mine to control access to SSH. Essentially, it is a knock-knock system. I would go to a specific URL with the cgi, enter some information, and the perl script would add my ip address to the allowed list for SSH in the fire-wall. I have been working on learning the details with SElinux, and trying to come up with some rules to allow the script to work correctly. There appears to be some kind of conflict either related to the script itself, or being run through httpd and getting access to the IPTables command tools. The CGI script (written in perl) is SUID root. Httpd runs the script. The script will run the iptables command line tools to examine the table (to see if the ip address is already allowed), and also to add a new ip address to the allowed list. My current method of trying to create the appropriate policy is to continue testing the cgi-script, watching the audit log, and running audit2allow on the selected audit messages. My current policy is: ... require { type modules_conf_t; type modules_dep_t; type sysctl_modprobe_t; type boot_t; type httpd_sys_script_t; type modules_object_t; class capability net_raw; class dir { getattr search }; class file { read getattr }; class rawip_socket { getopt create }; } #============= httpd_sys_script_t ============== allow httpd_sys_script_t boot_t:dir getattr; allow httpd_sys_script_t modules_conf_t:file { read getattr }; allow httpd_sys_script_t modules_dep_t:file read; allow httpd_sys_script_t modules_object_t:dir search; allow httpd_sys_script_t self:capability net_raw; allow httpd_sys_script_t self:rawip_socket { getopt create }; ... So, my question boils down to this: (I'm running Fedora Core 7) Do I just continue running the audit2allow repeatedly to create a policy to do what I want? Is there a better way to solve this problem? I am concerned that just creating a policy to allow my script to run will create other more substantial holes. I am also open to creating a tool to update my iptables some other way. Maybe perl-cgi is not the best method? Thanks in advance for any information! - Paul -- Paul McAvoy <paulmcav(a)queda.net> http://www.queda.net

3 2

AVCs whilst installing latest F8 update batch
by Paul Howarth 03 Dec '07

03 Dec '07

Got a bunch of AVCs whilst installing these updates today: Nov 22 07:50:15 Updated: bind-libs - 32:9.5.0-18.a7.fc8.x86_64 Nov 22 07:50:17 Updated: pilot-link - 2:0.12.2-7.fc8.x86_64 Nov 22 07:50:20 Updated: bind - 32:9.5.0-18.a7.fc8.x86_64 Nov 22 07:50:22 Updated: smolt - 1.0-1.fc8.noarch Nov 22 07:50:25 Updated: system-config-firewall-tui - 1.0.11-1.fc8.noarch Nov 22 07:50:25 Updated: bind-utils - 32:9.5.0-18.a7.fc8.x86_64 Nov 22 07:50:29 Updated: system-config-firewall - 1.0.11-1.fc8.noarch Nov 22 07:50:29 Updated: smolt-firstboot - 1.0-1.fc8.noarch Nov 22 07:50:35 Updated: bind-chroot - 32:9.5.0-18.a7.fc8.x86_64 Nov 22 07:50:37 Updated: setroubleshoot-plugins - 1.10.4-1.fc8.noarch Nov 22 07:50:38 Updated: libao - 0.8.8-2.fc8.x86_64 Nov 22 07:50:40 Updated: pilot-link - 2:0.12.2-7.fc8.i386 Piping the AVCs into audit2allow -R yielded: require { type named_conf_t; type setfiles_t; type proc_t; class lnk_file relabelfrom; class dir relabelfrom; class file relabelfrom; class filesystem associate; } #============= named_conf_t ============== allow named_conf_t proc_t:filesystem associate; #============= setfiles_t ============== allow setfiles_t self:dir relabelfrom; allow setfiles_t self:file relabelfrom; allow setfiles_t self:lnk_file relabelfrom; kernel_getattr_core_if(setfiles_t) kernel_getattr_message_if(setfiles_t) kernel_read_device_sysctls(setfiles_t) kernel_read_kernel_sysctls(setfiles_t) kernel_read_net_sysctls(setfiles_t) kernel_read_software_raid_state(setfiles_t) kernel_read_vm_sysctls(setfiles_t) As far as I can see, the updates installed OK. I can post the raw audit messages if it's useful. Paul.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2007