selinux April 2007

selinux@lists.fedoraproject.org

28 participants
32 discussions

RE : fedora-selinux-list Digest, Vol 38, Issue 17
by sonie darabe 25 Apr '07

25 Apr '07

--> answer in your mail body! fedora-selinux-list-request(a)redhat.com a écrit : Send fedora-selinux-list mailing list submissions to fedora-selinux-list(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/fedora-selinux-list or, via email, send a message with subject or body 'help' to fedora-selinux-list-request(a)redhat.com You can reach the person managing the list at fedora-selinux-list-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of fedora-selinux-list digest..." Today's Topics: 1. using runcon -l s1 (Clarkson, Mike R (US SSA)) 2. Re: using runcon -l s1 (Daniel J Walsh) 3. Re: Helper program for a daemon (Al Pacifico) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 Apr 2007 10:22:11 -0700 From: "Clarkson, Mike R $US SSA$" Subject: using runcon -l s1 To: Message-ID: Content-Type: text/plain; charset="us-ascii" I am trying to figure out how to get "runcon -l s1" to work while having selinux in enforcing mode. So far, I can only use the runcon command successfully with selinux in permissive mode. Here is the error I get when in enforcing mode: >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk execvp: Permission denied --> you should know that enforcing mode makes that SELinux will be fully activated that meens policies are respected ans as a user you have a role and this role will assign to you specific permissions!!! that's why you get this message your role doesn't give you access to this permission. this the principal way for protection of SELinux. My shell is running as root in the unconfined_t domain. Here is the output of id -Z: root:system_r:unconfined_t:s0-s15:c0.c255 -->this context is assigned to root as défault context. you can modify it with newrole The executable that I'm trying to run with runcon is "SimulatedImport". This is a very simple program which simply creates a small text file. I have created a domain named "import_t" for this program. I have an selinux policy that I built as an mls policy off the targeted policy. When I run audit2allow I get the following: audit2allow -i /var/log/audit/audit.log -l -v -r require { class dir search; class file { getattr read }; class process transition; type auditd_log_t; type unconfined_t; role system_r; }; allow unconfined_t auditd_log_t:dir search; #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" NAME="audit" : search #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit" : search allow unconfined_t auditd_log_t:file { getattr read }; #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" NAME="audit.log" : getattr #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit.log" : read allow unconfined_t self:process transition; #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" NAME="SimulatedImport" : transition Adding "allow unconfined_t self:process transition;" to my "import" module seems to have no effect. -->i think you should use allow for transition from a domain to another so i don't thik that this rule you added is right. Any help would be appreciated. Thanks, Mike -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-selinux-list/attachments/20070423/f6… ------------------------------ Message: 2 Date: Tue, 24 Apr 2007 08:31:49 -0400 From: Daniel J Walsh Subject: Re: using runcon -l s1 To: "Clarkson, Mike R (US SSA)" Cc: fedora-selinux-list(a)redhat.com Message-ID: <462DF8B5.5060301(a)redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Clarkson, Mike R (US SSA) wrote: > > I am trying to figure out how to get runcon l s1 to work while > having selinux in enforcing mode. So far, I can only use the runcon > command successfully with selinux in permissive mode. Here is the > error I get when in enforcing mode: > > >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk > > execvp: Permission denied > > My shell is running as root in the unconfined_t domain. Here is the > output of id Z: > > root:system_r:unconfined_t:s0-s15:c0.c255 > > The executable that Im trying to run with runcon is > SimulatedImport. This is a very simple program which simply creates > a small text file. I have created a domain named import_t for this > program. > > I have an selinux policy that I built as an mls policy off the > targeted policy. > > When I run audit2allow I get the following: > > audit2allow -i /var/log/audit/audit.log -l -v -r > > require { > > class dir search; > > class file { getattr read }; > > class process transition; > > type auditd_log_t; > > type unconfined_t; > > role system_r; > > }; > > allow unconfined_t auditd_log_t:dir search; > > #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" > NAME="audit" : search > > #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" > NAME="audit" : search > > allow unconfined_t auditd_log_t:file { getattr read }; > > #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" > NAME="audit.log" : getattr > > #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" > NAME="audit.log" : read > > allow unconfined_t self:process transition; > > #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" > NAME="SimulatedImport" : transition > > Adding allow unconfined_t self:process transition; to my import > module seems to have no effect. > I think you are being prevented by a constraint of MLS As a guess I would suggest trying: mls_process_set_level(unconfined_t) > > > Any help would be appreciated. > > Thanks, > > Mike > > ------------------------------------------------------------------------ > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list ------------------------------ Message: 3 Date: Tue, 24 Apr 2007 08:36:01 -0700 From: "Al Pacifico" Subject: Re: Helper program for a daemon To: fedora-selinux-list(a)redhat.com Cc: Daniel J Walsh Message-ID: <5d3cd4150704240836q7d6627a0qc931aa67461f9082(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" On 4/19/07, Daniel J Walsh wrote: > > Al Pacifico wrote: > > I (a greenhorn with selinux) am writing a policy for a daemon that > > streams music files over my home network to a music player client (a > > Slimdevices Squeezebox). My OS is FC5. > > > > The main daemon (/usr/sbin/slimserver) is a perl script that serves > > the music files and is started with an init script. My questions have > > to do with a secondary program (/usr/sbin/slimserver-scanner, also a > > perl script) that scans the music on the server, reading mp3 tags and > > such, and generates a database of stored music that is stored in a > > MySQL database. /usr/sbin/slimserver-scanner is invoked by the > > /usr/sbin/slimserver daemon and might be invoked by the user (although > > I can't recall ever doing so in several years of owning a Squeezebox). > > > > I've been following the example posted by Dan Walsh in a blog at > > http://danwalsh.livejournal.com/8707.html?thread=39171 which has been > > extremely helpful. > > > > My (2) questions: > > 1. What is the appropriate file context for the scanner program? > > system_u:object_r:sbin_t? > > system_u:object_r:slimserver_t? > > system_u:object_r:slimserver_exec_t? > > > That depends on your security goals. If you want the slimserver-scanner > to have the same privs as slimserver you would label it sbin_t and allow > slimserver to corecmd_exec_sbin(). If you want to go with least privs, > you would create a new policy for slimserver-scanner > (slimserver_scanner_t with file context of slimserver_scanner_exec_t) > and then add a rule to slimserver_t to domtrans > slimserver_scanner_domtrans(slimserver_t) I'm a little confused about this. I want to limit privileges of slimserver and slimserver-scanner to accessing only certain files. If I label slimserver-scanner as 'sbin_t', when a user executes slimserver-scanner, won't he/she have more privileges than slimserver then? > The generated slimserver.fc file contains: > > # slimserver executable will have: > > # label: system_u:object_r:slimserver_exec_t > > # MLS sensitivity: s0 > > # MCS categories: > > > > /usr/sbin/slimserver -- > > gen_context(system_u:object_r:slimserver_exec_t,s0) > > /var/run/slimserver.pid > > gen_context(system_u:object_r:slimserver_var_run_t,s0) > > /var/log/slimserver > > gen_context(system_u:object_r:slimserver_var_log_t,s0) > > > > and the slimserver.if file contains: > > interface(`slimserver_domtrans',` > > gen_require(` > > type slimserver_t, slimserver_exec_t; > > ') > > > > domain_auto_trans($1,slimserver_exec_t,slimserver_t) > > > > allow $1 slimserver_t:fd use; > > allow slimserver_t $1:fd use; > > allow slimserver_t $1:fifo_file rw_file_perms; > > allow slimserver_t $1:process sigchld; > > ') > > > > 2. There is no reason to add the scanner program be added to > > slimserver.fc that was generated by policygentool, is there? > Only if you are creating a context for slimserver_scanner_exec_t, > otherwise just let it be labeled sbin_t. > > The file itself just needs to be labeled appropriately, right? Or does > > that file play some role in policy compilation in a step that I did > > not explicitly executed when I invoked 'make -f > > /usr/share/selinux/devel/Makefile'? > > > > Thanks in advance. > > -al > > -- > > Al Pacifico > > Seattle, WA > > ------------------------------------------------------------------------ > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > -- Al Pacifico Seattle, WA -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-selinux-list/attachments/20070424/4e… ------------------------------ -- fedora-selinux-list mailing list fedora-selinux-list(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list End of fedora-selinux-list Digest, Vol 38, Issue 17 *************************************************** --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 0

using runcon -l s1
by Clarkson, Mike R (US SSA) 24 Apr '07

24 Apr '07

I am trying to figure out how to get "runcon -l s1" to work while having selinux in enforcing mode. So far, I can only use the runcon command successfully with selinux in permissive mode. Here is the error I get when in enforcing mode: >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk execvp: Permission denied My shell is running as root in the unconfined_t domain. Here is the output of id -Z: root:system_r:unconfined_t:s0-s15:c0.c255 The executable that I'm trying to run with runcon is "SimulatedImport". This is a very simple program which simply creates a small text file. I have created a domain named "import_t" for this program. I have an selinux policy that I built as an mls policy off the targeted policy. When I run audit2allow I get the following: audit2allow -i /var/log/audit/audit.log -l -v -r require { class dir search; class file { getattr read }; class process transition; type auditd_log_t; type unconfined_t; role system_r; }; allow unconfined_t auditd_log_t:dir search; #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" NAME="audit" : search #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit" : search allow unconfined_t auditd_log_t:file { getattr read }; #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" NAME="audit.log" : getattr #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit.log" : read allow unconfined_t self:process transition; #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" NAME="SimulatedImport" : transition Adding "allow unconfined_t self:process transition;" to my "import" module seems to have no effect. Any help would be appreciated. Thanks, Mike

2 1

labeling files for multiple daemons
by Thomas Vander Stichele 23 Apr '07

23 Apr '07

I have two particular cases I want to make possible: a) have a tree under /home/mirror that can be offered both by httpd and over nfs. How should I label these files ? I assume default file contexts are either/or, so maybe I need to create a custom context type and load custom policy to tell httpd and nfs about it ? Or is there an easier way ? b) Suppose I have /home/file where users can upload files through ftp and webdav, and I again want to export these files over NFS. So, variant on case a) Any help appreciated, Thomas

1 0

Squid cachemgr.cgi AVC denied
by Lamont R. Peterson 23 Apr '07

23 Apr '07

On RHEL5 and FC6, I'm seeing an AVC denied message when trying to use cachemgr.cgi: type=AVC msg=audit(1177002702.300:787): avc: denied { search } for pid=18199 comm="cachemgr.cgi" name="squid" dev=hda5 ino=346594 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_conf_t:s0 tclass=dir If I'm reading this correctly, the problem is that the policy doesn't allow cachmgr.cgi to get it's /etc/squid/cachemgr.conf file because the /etc/squid/ directory (and the cachemgr.conf) file are labeled: # ll -Zd /etc/squid/ drwxr-xr-x root root system_u:object_r:squid_conf_t /etc/squid/ # ll -Z /etc/squid/cachemgr.conf -rw-r--r-- root squid system_u:object_r:squid_conf_t /etc/squid/cachemgr.conf Shall I file a bug for this or is it already known, fixed, work-around-is-available? -- Lamont Peterson <lamont(a)gurulabs.com> Senior Instructor Guru Labs, L.C. [ http://www.GuruLabs.com/ ] NOTE: All messages from this email address should be digitally signed with my 0xDC0DD409 GPG key. It is available on the pgp.mit.edu keyserver as well as other keyservers that sync with MIT's.

2 3

Backing out of changes to file contexts specification
by Al Pacifico 23 Apr '07

23 Apr '07

This is related to the daemon question I asked earlier. I created a problem using policygentool by specifying that a log file is written to by two different binaries with different policies. My thread about "Helper program for a daemon" provides some context (no pun intended). I didn't realize that installing the policy would change the file context specification database (although it makes perfect sense in retrospect). Now, I've inadvertently specified that /var/log/slimserver be labelled under two different contexts in /etc/selinux/targeted/contexts/files/file_contexts and wish to remove the second set of entries. Output of setfiles -n /etc/selinux/targeted/contexts/files/file_contexts $filename includes several messages of the form: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /var/log/slimserver (system_u:object_r:slimserver_scanner_var_log_t and system_u:object_r:slimserver_var_log_t). My policy module didn't install correctly because of this error, but the file contexts specification is now incorrect. What is the best way to correct this? 1. Just use sed or vi to eliminate the second specification? 2.Remove both installed policies that I wrote (which are the only non-stock policy modules installed on my FC5 box) using semodule and restore /etc/selinux/targeted/contexts/files/file_contexts from the rpm package file? Keep in mind I'm doing this over ssh to a box with no GUI, so I must use the command line, vi, etc. -al -- Al Pacifico Seattle, WA

3 4

MySQL custom datadir location - other daemons too
by Florin Andrei 22 Apr '07

22 Apr '07

I'm building a log analysis server that's running a big MySQL database. Logs are imported in the database and then are processed for statistical analysis and stuff like that. The system is running CentOS5 64bit (almost identical to RHEL 5). I'm keeping the database on a separate RAID array, for obvious reasons. So I mounted that array as /db and then moved the MySQL datadir via /etc/my.cnf: datadir=/db/mysql tmpdir=/db/tmp/ basedir=/db I made sure to move /var/lib/mysql to /db/mysql in such a way as to preserve all the attributes, including SELinux. But, of course, MySQL fails to run: type=AVC msg=audit(1177025497.442:254): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir type=SYSCALL msg=audit(1177025497.442:254): arch=c000003e syscall=87 success=no exit=-13 a0=7fff6ee35150 a1=0 a2=0 a3=3 items=0 ppid=7417 pid=7453 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mysqld" exe="/usr/libexec/mysqld" subj=root:system_r:mysqld_t:s0 key=(null) type=AVC msg=audit(1177025497.442:255): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir type=SYSCALL msg=audit(1177025497.442:255): arch=c000003e syscall=2 success=no exit=-13 a0=7fff6ee35350 a1=42 a2=1b6 a3=3 items=0 ppid=7417 pid=7453 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mysqld" exe="/usr/libexec/mysqld" subj=root:system_r:mysqld_t:s0 key=(null) type=AVC msg=audit(1177025497.442:256): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir Now, I can definitely customize the policy, I guess the first rule would be like this and I'll keep tweaking it until it works: allow mysqld_t file_t:dir search; But this seems like a hack. I mean, moving the datadir to a different location is probably something that MySQL admins do all the time when building big servers (or maybe even not that big). I wish there was a SELinux variable, or a place where I can tell SELinux that the datadir has moved, that XYZ is the new location, and just let me use it (provided that the SELinux attributes are OK within the MySQL datadir per se). Same thing happens with many servers when moving their default data locations. Examples that I had issues with: Cyrus-IMAPd, Squid. Sure, one can customize the policy the "normal", step-by-step way, but that doesn't seem the right thing. I'm strictly speaking from the sysadmin's perspective. It just looks like a natural thing to be able to customize SELinux via a simple variable or something, and make it "aware" (sort of) that, hey, I only moved the data dir to a new location, stop panicking about that. Thanks, -- Florin Andrei http://florin.myip.org/

3 8

Denied despite permissive mode?
by Andrew Ziem 21 Apr '07

21 Apr '07

Hi, 1. Should I be getting denied in permissive mode? 2. How do I get ntpd working? (Also, smartd has the same problem, but they both used to work some months ago.) [root@z ~]# getsebool -a | grep exec allow_execheap --> on allow_execmem --> on allow_execmod --> on allow_execstack --> on allow_java_execstack --> off httpd_ssi_exec --> on httpd_suexec_disable_trans --> off [root@z ~]# getenforce Permissive [root@z ~]# /sbin/service ntpd start Starting ntpd: SELinux denied execmem. [FAILED] [root@z ~]# cat /etc/fedora-release Fedora Core release 5 (Bordeaux) [root@z ~]# uname -a Linux z.localdomain 2.6.20-1.2312.fc5 #1 Tue Apr 10 15:09:44 EDT 2007 i686 athlon i386 GNU/Linux Andrew

2 2

vlc x86 libs requires text relocation.
by Nicolas Chauvet 20 Apr '07

20 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello! I would like to solve the Selinux context issue with vlc x86 It is supposed to do the same purpose as mplayer do with 32bit codecs dll if there are present on the end-user system. This affect vlc for Fedora release 5, 6 and devel only for x86 (not ppc or x86_64) from https://bugzilla.livna.org/show_bug.cgi?id=1404 - ---- SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. I'm not sure if this can be fixed in the vlc package or if it would need to be fixed in the selinux policy package. I'll attach the saved output from setroubleshoot for these denials. - ---- libdmo_plugin denial - ----- Summary SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. Detailed Description The /usr/bin/vlc application attempted to load /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The http://people.redhat.com/drepper/selinux-mem.html web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/lib/vlc/codec/libdmo_plugin.so to use relocation as a workaround, until the library is fixed. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Allowing Access If you trust /usr/lib/vlc/codec/libdmo_plugin.so to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t /usr/lib/vlc/codec/libdmo_plugin.so" The following command will allow this access: chcon -t textrel_shlib_t /usr/lib/vlc/codec/libdmo_plugin.so Additional Information: Source Context: user_u:system_r:unconfined_t Target Context: system_u:object_r:lib_t Target Objects: /usr/lib/vlc/codec/libdmo_plugin.so [ file ] Affected RPM Packages: vlc-0.8.6a-1.lvn6.1 [application]vlc-0.8.6a-1.lvn6.1 [target] Policy RPM: selinux-policy-2.4.6-27.fc6 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.allow_execmod Host Name: rusharri-lnx2 Platform: Linux rusharri-lnx2 2.6.19-1.2895.fc6 #1 SMP Wed Jan 10 19:28:18 EST 2007 i686 i686 Alert Count: 1 Line Numbers: Raw Audit Messages: avc: denied { execmod } for comm="vlc" dev=dm-0 egid=162433 euid=162433 exe="/usr/bin/vlc" exit=-13 fsgid=162433 fsuid=162433 gid=162433 items=0 name="libdmo_plugin.so" path="/usr/lib/vlc/codec/libdmo_plugin.so" pid=10856 scontext=user_u:system_r:unconfined_t:s0 sgid=162433 subj=user_u:system_r:unconfined_t:s0 suid=162433 tclass=file tcontext=system_u:object_r:lib_t:s0 tty=pts1 uid=162433 - -------- librealaudio_plugin denial - -------- Summary SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. Detailed Description The /usr/bin/vlc application attempted to load /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The http://people.redhat.com/drepper/selinux-mem.html web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/lib/vlc/codec/librealaudio_plugin.so to use relocation as a workaround, until the library is fixed. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Allowing Access If you trust /usr/lib/vlc/codec/librealaudio_plugin.so to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t /usr/lib/vlc/codec/librealaudio_plugin.so" The following command will allow this access: chcon -t textrel_shlib_t /usr/lib/vlc/codec/librealaudio_plugin.so Additional Information: Source Context: user_u:system_r:unconfined_t Target Context: system_u:object_r:lib_t Target Objects: /usr/lib/vlc/codec/librealaudio_plugin.so [ file ] Affected RPM Packages: vlc-0.8.6a-1.lvn6.1 [application]vlc-0.8.6a-1.lvn6.1 [target] Policy RPM: selinux-policy-2.4.6-27.fc6 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.allow_execmod Host Name: rusharri-lnx2 Platform: Linux rusharri-lnx2 2.6.19-1.2895.fc6 #1 SMP Wed Jan 10 19:28:18 EST 2007 i686 i686 Alert Count: 1 Line Numbers: Raw Audit Messages: avc: denied { execmod } for comm="vlc" dev=dm-0 egid=162433 euid=162433 exe="/usr/bin/vlc" exit=-13 fsgid=16243 - ---------- Thx for your advices: Nicolas (kwizart) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFGJSfBlNdbIlsB+AERAgqAAKCAe3oBN3TvicHhQCVkJGpclzNNPwCdFIRv BfH3xDwe78OSJyOwd/rQ6Yk= =8pOY -----END PGP SIGNATURE-----

2 1

SELinux is preventing /usr/sbin/semodule (semanage_t) "getattr" to / (security_t).
by Antonio Olivares 19 Apr '07

19 Apr '07

Dear list(s), currently running Rawhide and setroubleshoot browser fires up with a denial Summary SELinux is preventing /usr/sbin/semodule (semanage_t) "getattr" to / (security_t). Detailed Description SELinux denied access requested by /usr/sbin/semodule. It is not expected that this access is required by /usr/sbin/semodule and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context user_u:system_r:semanage_t Target Context system_u:object_r:security_t Target Objects / [ filesystem ] Affected RPM Packages policycoreutils-2.0.2-3.fc7 [application]filesystem-2.4.2-1.fc7 [target] Policy RPM selinux-policy-2.5.4-1.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall Host Name localhost Platform Linux localhost 2.6.20-1.2949.fc7 #1 SMP Mon Feb 26 18:37:35 EST 2007 i686 athlon Alert Count 1 First Seen Wed 04 Apr 2007 06:46:19 AM CDT Last Seen Wed 04 Apr 2007 06:46:19 AM CDT Local ID 32e2ac76-301c-4f3f-b971-e8b7da4fff73 Line Numbers Raw Audit Messages avc: denied { getattr } for comm="semodule" dev=selinuxfs egid=0 euid=0 exe="/usr/sbin/semodule" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="/" pid=8883 scontext=user_u:system_r:semanage_t:s0 sgid=0 subj=user_u:system_r:semanage_t:s0 suid=0 tclass=filesystem tcontext=system_u:object_r:security_t:s0 tty=pts1 uid=0 Summary SELinux is preventing /usr/sbin/useradd (useradd_t) "read write" to faillog (var_log_t). Detailed Description SELinux denied access requested by /usr/sbin/useradd. It is not expected that this access is required by /usr/sbin/useradd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for faillog, restorecon -v faillog If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context user_u:system_r:useradd_t Target Context system_u:object_r:var_log_t Target Objects faillog [ file ] Affected RPM Packages shadow-utils-4.0.18.1-13.fc7 [application] Policy RPM selinux-policy-2.5.12-5.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name localhost Platform Linux localhost 2.6.20-1.3088.fc7 #1 SMP Wed Apr 18 15:12:44 EDT 2007 i686 athlon Alert Count 1 First Seen Thu 19 Apr 2007 06:19:42 PM CDT Last Seen Thu 19 Apr 2007 06:19:42 PM CDT Local ID 2eacf14b-bf35-4d12-bb8e-13e35aeaaf6a Line Numbers Raw Audit Messages avc: denied { read, write } for comm="useradd" dev=dm-0 egid=0 euid=0 exe="/usr/sbin/useradd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="faillog" pid=3370 scontext=user_u:system_r:useradd_t:s0 sgid=0 subj=user_u:system_r:useradd_t:s0 suid=0 tclass=file tcontext=system_u:object_r:var_log_t:s0 tty=pts0 uid=0 Thanks for any help/suggestions on this. Regards, Antonio __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

packaging selinux modules into rpms ?
by Jan-Frode Myklebust 19 Apr '07

19 Apr '07

I've been building RPMs for syslog-ng and argus, that needs to contain selinux-modules to work on enforcing RHEL5. Are there any recommendations for how to package these with RPM? In http://tanso.net/yum/repodata/repoview/syslog-ng-0-2.0.3-1.el5.html I build the module by checkmodule/semodule_package/semodule -i in the rpm %post, but maybe I should have done this in the source-rpm, and just installed the .pp in the binary-rpm %post ? -jf

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2007