selinux April 2007

selinux@lists.fedoraproject.org

28 participants
32 discussions

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

apache 4.1 & SELinux on FC6
by Philip 09 May '07

09 May '07

List, I'm performing a bit of an experiment setting up some software on FC6 and confining it in an SELinux domain. In taking a survey of potential obstacles, I've run into something that I'm hoping y'all can provide some guidance on. The application I'm setting up was initially deployed on RHEL4 (SELinux disabled) and thus depends on MySQL (version 4.1). In developing policy I'd really like to use the most up to date modular policy from FC6 (anticipating our transition to RHEL5), but the MySQL packaged in FC6 is 5.0. From my perspective, my options are: (1) try using MySQL 5.0 and hope the application doesn't break (cross your fingers) (2) install MySQL 4.1 (from source / older package) and try to use the FC6 policy for MySQL 5.0 and hope that works. I'm not really sure which is the best choice (though option 1 does seem like higher risk) so I thought I'd ask for some advice. Has anyone used the FC6 MySQL policy with older versions of MySQL? Am I nuts for even trying this? There's another team working to bring this software up to date for deployment on RHEL5 but naturally our efforts are in parallel so I can't benefit from their work just yet (nor can I, or do I want to monkey around in their Java code). I could always develop my policy on the older RHEL4 platform and use our standard build but when integration begins that would put me way behind the ball as (from what I understand) the policy in RHEL5 is vastly improved / different, which is why I'm trying to use FC6 in my initial tests. Any help / guidance / insight would be much appreciated. TIA, - Philip

1 1

trouble using runcon
by Clarkson, Mike R (US SSA) 02 May '07

02 May '07

Whenever I use runcon in my script, I get the error "root:system_r:datalabeler_t:s0-s15:c0.c255 is not a valid context", regardless of the user, role, type, and mls level that I specify with the runcon command. Infact, even when I specify the context that I'm already running in with the runcon statement, I get the above error. So for instance, if I run the script WITHOUT the runcon command, it runs fine with the following security context (verified with a ps -efZ command): root:system_r:datalabeler_t:s0-s15:c0.c255. But if I run the script with a runcon statement that specifies the exact same user, role, type, and mls level I get the error shown above. My script runs in a domain named datalabeler_t (I don't have the problem when running a similar script in the unconfined_t domain). It kicks off a java process with the following line: java mls.SimulatedImport.SimulatedDataLabeler $argv[*] When I add the runcon statement, I get the above error: runcon -u root -r system_r -t datalabeler_t java mls.SimulatedImport.SimulatedDataLabeler $argv[*] I am using an selinux policy that I built as an mls policy off the targeted policy. Ultimately what I'd like to be able to do is to use the runcon statement to specify an mls level, but I need to get past this first. Any help would be appreciated. Thanks

2 2

portcon in a policy module?
by Rob Myers 30 Apr '07

30 Apr '07

hello- i tried to assign a port type in a policy module like so: portcon tcp 1521 system_u:object_r:oracle_port_t:s0; which fails unless i rebuild as a monolithic policy. should this fail or have i got something wrong? i have found that using "semanage port -a -t oracle_port_t -p tcp 1521" in the rpm post install script works. what is the proper way to assign a port in a policy module? thanks for any clues! rob.

3 2

getcon/setcon
by Clarkson, Mike R (US SSA) 30 Apr '07

30 Apr '07

getcon and all of its variants as well as setcon do not seem to be installed on my RHEL5 system. Are these commands part of a separate rpm that I need to install?

3 2

service and system-config-services restart daemons in incorrect type under mls policy
by Joe Nall 27 Apr '07

27 Apr '07

I'm running an mls/permissive policy on FC6 and service and system- config-services start daemons in the user's selinux context rather than those in /etc/selinux/mls/contexts/initrc_context. Since our policies use init_daemon_domain to establish domain transitions, they are not transitioning into the correct domain on user initiated (re) starts. "run_init service <service> restart" - works, but leaves us in a situation where documentation doesn't match experience. What is the right approach to getting the transitions to work properly? Patch service and friends? Write a more generic transition? joe

3 5

What is special about /home?
by Forrest Taylor 27 Apr '07

27 Apr '07

I have a .fc file that contains: /home/dir(/.*)? system_u:object_r:tmp_t:s0 When I create the directory, it gets user_home_dir_t and files in the directory get user_home_t. After I load the module, restorecon will not change the permissions on the directory or files. So, what is special about those types? I thought at first that they may be customizable types, but they aren't listed in the file. semanage fcontext doesn't show them either. Any clues? Thanks, Forrest

2 3

Helper program for a daemon
by Al Pacifico 25 Apr '07

25 Apr '07

I (a greenhorn with selinux) am writing a policy for a daemon that streams music files over my home network to a music player client (a Slimdevices Squeezebox). My OS is FC5. The main daemon (/usr/sbin/slimserver) is a perl script that serves the music files and is started with an init script. My questions have to do with a secondary program (/usr/sbin/slimserver-scanner, also a perl script) that scans the music on the server, reading mp3 tags and such, and generates a database of stored music that is stored in a MySQL database. /usr/sbin/slimserver-scanner is invoked by the /usr/sbin/slimserver daemon and might be invoked by the user (although I can't recall ever doing so in several years of owning a Squeezebox). I've been following the example posted by Dan Walsh in a blog at http://danwalsh.livejournal.com/8707.html?thread=39171 which has been extremely helpful. My (2) questions: 1. What is the appropriate file context for the scanner program? system_u:object_r:sbin_t? system_u:object_r:slimserver_t? system_u:object_r:slimserver_exec_t? The generated slimserver.fc file contains: # slimserver executable will have: # label: system_u:object_r:slimserver_exec_t # MLS sensitivity: s0 # MCS categories: <none> /usr/sbin/slimserver -- gen_context(system_u:object_r:slimserver_exec_t,s0) /var/run/slimserver.pid gen_context(system_u:object_r:slimserver_var_run_t,s0) /var/log/slimserver gen_context(system_u:object_r:slimserver_var_log_t,s0) and the slimserver.if file contains: interface(`slimserver_domtrans',` gen_require(` type slimserver_t, slimserver_exec_t; ') domain_auto_trans($1,slimserver_exec_t,slimserver_t) allow $1 slimserver_t:fd use; allow slimserver_t $1:fd use; allow slimserver_t $1:fifo_file rw_file_perms; allow slimserver_t $1:process sigchld; ') 2. There is no reason to add the scanner program be added to slimserver.fcthat was generated by policygentool, is there? The file itself just needs to be labeled appropriately, right? Or does that file play some role in policy compilation in a step that I did not explicitly executed when I invoked 'make -f /usr/share/selinux/devel/Makefile'? Thanks in advance. -al -- Al Pacifico Seattle, WA

3 7

bind-chroot selinux problems on log file
by Thomas Vander Stichele 25 Apr '07

25 Apr '07

I want to take this particular bug as a way of figuring out how to "fix" bigs and provide patches. On FC5, with bind-chroot installed, /var/named/chroot/var/log is labeled as S_Context: system_u:object_r:named_conf_t This causes audit messages like: audit(1177506082.955:23904): avc: denied { getattr } for pid=2781 comm="named" name="debug.log" dev=dm-0 ino=2850829 scontext=root:system_r:named_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file and the log files aren't being written to. When I manually change files: chcon -R system_u:object_r:var_log_t log/ it works. Of course, a restorecon resets to named_conf_t. Is the best way to fix this, straight in the selinux source policy ? Or should I create an add-on .te and load it to override ? Thomas

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2007