selinux May 2007

selinux@lists.fedoraproject.org

32 participants
36 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

RPM with seperate selinux package
by Jan-Frode Myklebust 20 Jun '07

20 Jun '07

I've been building syslog-ng RPMs, with the needed selinux module as a separate sub-package following the instructions at: http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules but there's a problem with the logics of having the selinux package "Requires: main package", as then the main package will get installed and started before there is a working policy installed. So, is there any way of re-ordering this, without having the main package depend on the selinux package? i.e. I want to allow someone to install only the syslog-ng-2.0.4-12.i386.rpm if they don't want the selinux module, but I want the selinux module to be installed first if both are installed in the same operation. My current srpm --> http://tanso.net/yum/packages/syslog-ng-2.0.4-12.src.rpm -jf

2 1

SELinux Permission Documentation
by mantaray_1 08 Jun '07

08 Jun '07

What can be sent and received as rawip to and from kernel_t, and what are the limitations of what can be done with the data? I am interested in understanding the security implications of this (and other) SELinux permissions. Is there anyone who can direct me to reference materials that explain the security implications of allowing various SELinux permissions?

2 3

VGScan and LVScan writing to tmp files
by Ian Lists 31 May '07

31 May '07

I am running into an issue on several RHEL5 servers when installing a Veritas ECC agent. It appears that the agent is trying to use LVM commands to write to a temp file and SELinux is preventing it. Does anyone have any ideas on how to resolve this issue. Thanks, Ian type=AVC_PATH msg=audit(05/31/2007 15:28:24.750:1074) : path=/usr/ecc/exec/MLR520/Out_file_1.tmp type=AVC_PATH msg=audit(05/31/2007 15:28:24.750:1074) : path=/usr/ecc/exec/MLR520/Err_file_2.tmp type=AVC_PATH msg=audit(05/31/2007 15:28:24.750:1074) : path=/usr/ecc/exec/MLR520/Out_file_1.tmp type=AVC_PATH msg=audit(05/31/2007 15:28:24.750:1074) : path=/usr/ecc/exec/MLR520/Err_file_2.tmp type=SYSCALL msg=audit(05/31/2007 15:28:24.750:1074) : arch=i386 syscall=execve success=yes exit=0 a0=8191df0 a1=8191e48 a2=8191ea0 a3=8191e48 items=0 ppid=18497 pid=18518 auid=imarks uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 comm=vgscan exe=/sbin/lvm.static subj=user_u:system_r:lvm_t:s0 key=(null) type=AVC msg=audit(05/31/2007 15:28:24.750:1074) : avc: denied { write } for pid=18518 comm=vgscan name=Err_file_2.tmp dev=dm-4 ino=382125 scontext=user_u:system_r:lvm_t:s0 tcontext=user_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(05/31/2007 15:28:24.750:1074) : avc: denied { write } for pid=18518 comm=vgscan name=Out_file_1.tmp dev=dm-4 ino=382124 scontext=user_u:system_r:lvm_t:s0 tcontext=user_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(05/31/2007 15:28:24.750:1074) : avc: denied { write } for pid=18518 comm=vgscan name=Err_file_2.tmp dev=dm-4 ino=382125 scontext=user_u:system_r:lvm_t:s0 tcontext=user_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(05/31/2007 15:28:24.750:1074) : avc: denied { write } for pid=18518 comm=vgscan name=Out_file_1.tmp dev=dm-4 ino=382124 scontext=user_u:system_r:lvm_t:s0 tcontext=user_u:object_r:usr_t:s0 tclass=file type=SYSCALL msg=audit(05/31/2007 15:32:17.305:1121) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=8440c70 a1=8042 a2=1ff a3=8042 items=0 ppid=18962 pid=18997 auid=imarks uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 comm=lvm exe=/usr/sbin/lvm subj=user_u:system_r:lvm_t:s0 key=(null) type=AVC msg=audit(05/31/2007 15:32:17.305:1121) : avc: denied { write } for pid=18997 comm=lvm name=.cache dev=dm-0 ino=7003 scontext=user_u:system_r:lvm_t:s0 tcontext=root:object_r:lvm_etc_t:s0 tclass=file

2 3

Error spew from today's rawhide....
by Tom London 30 May '07

30 May '07

Got this with today's rawhide: Updating : selinux-policy-targeted ##################### [ 51/150] usage: /sbin/setfiles [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname... usage: /sbin/setfiles -c policyfile spec_file usage: /sbin/setfiles -s [-dnqvW] [-o filename ] spec_file libsemanage.semanage_install_active: setfiles returned error code 1. libsepol.sepol_genbools_array: boolean httpd_can_sendmail no longer in policy usage: /sbin/setfiles [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname... usage: /sbin/setfiles -c policyfile spec_file usage: /sbin/setfiles -s [-dnqvW] [-o filename ] spec_file libsemanage.semanage_install_active: setfiles returned error code 1. semodule: Failed! Updating : logwatch ##################### [ 52/150] This was updating to 2.6.5-2.fc8 tom -- Tom London

1 0

setroubleshootd AVC denials???
by Matej Cepl 30 May '07

30 May '07

Hi, I am afraid, my notebook got to some unrecognized state -- even setroubleshootd gets AVC denials and sealert cannot get connection! I tried relabelling but not much has changed. Yes, it is the same notebook as in https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215722#c15 and I have put my audit.log on http://www.ceplovi.cz/matej/tmp/audit.log.bz2 Is there any hope in getting my notebook back into being 100% free of AVC denials? Thanks for any reply, Matej

3 4

avc denial using runuser from initrc_exec_t
by Philip 30 May '07

30 May '07

I'm trying to fix up an init scrip to play nice with SELinux (strict policy 2.6.6-69.fc6). Digging through mailing list archives I found recommendations to replace the use of su with /sbin/runuser for the change from root to a lesser privileged user. My problem comes when calling /sbin/runuser. I get 2 avcs: type=AVC msg=audit(blah): avc: denied { search } for pid=XXXX comm="runuser" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:local_login_ts0-s0:c0.c1023 tclass=key type=AVC msg=audit(blah): avc: denied { create } for pid=XXXX comm="runuser" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=netlink_audit_socket Every daemon on my system seems to set its own uid (has allow X_t self:capability { ... setuid setgid ...}) so I've been unable to find an example of an init script (initrc_exec_t) that uses runuser. From what I've gathered this would require adding some permissions to the initrc_t domain, so either I'm doing something wrong (the likely case) or if runuser is intended to be used from init scripts (it is used in /etc/init.d/functions) then initrc_t should have these privileges ... any thoughts? TIA, - Philip

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2007