selinux May 2007

selinux@lists.fedoraproject.org

32 participants
36 discussions

Re: audit2allow broken?
by Stephen Smalley 09 May '07

09 May '07

On Wed, 2007-05-09 at 16:07 -0400, Karl MacMillan wrote: > On Wed, 2007-05-09 at 14:53 -0400, Stephen Smalley wrote: > > On Wed, 2007-05-09 at 13:47 -0500, Hongwei Li wrote: > > > Hi, > > > > > > I have a fc6 linux box: kernel-2.6.20-1.2944.fc6, selinux-policy-2.4.6-62.fc6 > > > and selinux-policy-targeted-2.4.6-62.fc6, audit-1.4.2-5.fc6. > > > The system works and I was trying to add some settings to the selinux policy > > > by running audit2allow. It was okay before noon: > > > > > > # audit2allow -M local < /var/log/audit/audit.log > > > # semodule -i local.pp > > > > > > The new modules were added and it works. However, later, I can't do it again, > > > but always get error: > > > > > > # audit2allow -M local < /var/log/audit/audit.log > > > compilation failed: > > > (unknown source)::ERROR 'syntax error' at token '' on line 6: > > > > > > /usr/bin/checkmodule: error(s) encountered while parsing configuration > > > /usr/bin/checkmodule: loading policy configuration from local.te > > > > > > and the file local.te has only one line: > > > > > > module local 1.0; > > > > > > not like before. Can somebody tell what is wrong? "on line 6" of what file? > > > I reboot the system, still the same. > > > > What version of policycoreutils? > > > > The implication is that there were no avc denials > > in /var/log/audit/audit.log, and thus the generated module was empty. > > How did the old audit2allow handle this? Presumably a message saying > that there are no messages would be preferable. ./audit2allow -M local < /dev/null Generating type enforcment file: local.te ./audit2allow: No AVC messages found. -- Stephen Smalley National Security Agency

1 0

apache 4.1 & SELinux on FC6
by Philip 09 May '07

09 May '07

List, I'm performing a bit of an experiment setting up some software on FC6 and confining it in an SELinux domain. In taking a survey of potential obstacles, I've run into something that I'm hoping y'all can provide some guidance on. The application I'm setting up was initially deployed on RHEL4 (SELinux disabled) and thus depends on MySQL (version 4.1). In developing policy I'd really like to use the most up to date modular policy from FC6 (anticipating our transition to RHEL5), but the MySQL packaged in FC6 is 5.0. From my perspective, my options are: (1) try using MySQL 5.0 and hope the application doesn't break (cross your fingers) (2) install MySQL 4.1 (from source / older package) and try to use the FC6 policy for MySQL 5.0 and hope that works. I'm not really sure which is the best choice (though option 1 does seem like higher risk) so I thought I'd ask for some advice. Has anyone used the FC6 MySQL policy with older versions of MySQL? Am I nuts for even trying this? There's another team working to bring this software up to date for deployment on RHEL5 but naturally our efforts are in parallel so I can't benefit from their work just yet (nor can I, or do I want to monkey around in their Java code). I could always develop my policy on the older RHEL4 platform and use our standard build but when integration begins that would put me way behind the ball as (from what I understand) the policy in RHEL5 is vastly improved / different, which is why I'm trying to use FC6 in my initial tests. Any help / guidance / insight would be much appreciated. TIA, - Philip

1 1

problems switching between roles (newrole)
by Philip 07 May '07

07 May '07

Hello List, Question about managing roles: I'm trying to setup my user to have access to both the unprivileged user_r role and the administrative role sysadm_r. My system is FC6 using the latest policy from yum: <sestatus> SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 21 Policy from config file: strict </sestatus> I've created new SELinux user: semanage user -a -R sysadm_r -R user_r -P user MyUser_u I've associated a Linux user with my SELinux user: semanage login -a -s MyUser_u MyUser When I login with my new user I see ... <shell> [MyUser@test ~]$ id -Z MyUser_u:user_r:user_t [MyUser@test ~]$ newrole -r sysadm_r -t sysadm_t Authenticating MyUser. Password: failed to exec shell : Permission denied [MyUser@test ~]$ </shell> The initial role is user_r which I like. But when MyUser attempts to change to the new role (sysadm_r through use of newrole)... they cannot. <avc> type=AVC msg=audit(1178544785.335:2418): avc: denied { transition } for pid=13798 comm="newrole" name="bash" dev=hda3 ino=162298 scontex=MyUser_u:user_r:newrole_t:s0 tcontext=MyUser_u:sysadm_r:sysadm_t:s0 tclass=process </avc> The contexts in the avc denied message seem right: MyUser is running the newrole command and has successfully transitioned into the newrole_t domain. The problem seems to be that newrole cannot kick off a shell in the target context (MyUser_u:sysadm_r:sysadm_t). A similar problem seems to arise when associating Linux users with user_r, staff_r and sysadm_r. The user will login with the default staff_r, will be able to newrole up to the sysadm_r role, but cannot change their role to user_r through similar means (newrole -r user_r -t user_t). I'd assume it's a fairly standard practice to make an SELinux user with the user_r and sysadm_r roles, much like using an unprivileged Linux user and only performing admin tasks using root. I'm guessing I missed a step somewhere along the line ... would someone mind pointing out where I went wrong or what I might try to resolve this? Cheers, - Philip

2 2

Re: dump/restore (or "star") and SELinux problems
by Matej Cepl 04 May '07

04 May '07

["Followup-To:" header set to gmane.linux.redhat.fedora.selinux.] On 2007-05-04, 20:05 GMT, Peter Smith wrote: > Kayvan, did you ever look at using resize2fs? I successfully > used this recently on a Redhat AS 5 system (with SELinux.) > I even used the rescue-cd mode of the AS 5 disk. While > I understand that dump and/or star were giving you trouble, and > you wanted to migrate the FS to LVM, I think you could have > gotten the intended results by using resize2fs. It worked pretty well for me until today -- you should be very careful to make partition (with LVM or whatever) slightly bigger than the filesystem on it. Just to be scrooge I made LVM logical volume of the same number of 4k blocks as filesystem, and ... there is still yum upgrade running on my system, recovering it to at least slightly similar configuration as it was this morning ;-) (it was root partition I was resizing). Oh well, Matej

1 0

RE: trouble using runcon
by Stephen Smalley 02 May '07

02 May '07

On Tue, 2007-05-01 at 15:38 -0700, Clarkson, Mike R (US SSA) wrote: > Stephen, > > You were right. Adding selinux_validate_context(datalabeler_t) got me > past the problem and I started getting some useful acv denial messages > in the audit log. I can now successfully run my script using runcon as > follows: > "runcon -u root -r system_r -t datalabeler_t -l s0-s15:c0.c255 > java mls.SimulatedImport.SimulatedDataLabeler $argv[*]" > > However, if I try to specify a different mls level in the runcon > statement it doesn't work. It looks like it fails to kick off the java > process, or at least I can't see the java process running using ps. > > The command I'm trying to use is this: > "runcon -u root -r system_r -t datalabeler_t -l s1 java > mls.SimulatedImport.SimulatedDataLabeler $argv[*]" > > I'm not getting meaningful acv messages in the audit log. Audit2allow is > telling me I need to add allow statements to my policy that I already > have. I think that I'm probably violating some MLS constraint (I find > that audit2allow does not give me useful messages when the problem is > that an MLS constraint is being violated). > > Do either of you have any ideas on what constraint I might be violating? > I already have "mls_process_set_level(datalabeler_t)" in my policy, and > "semanage user -l" and "semanage login -l" both show that root has the > mls range of s0-s15:c0.c255. (re-added fedora-selinux-list to cc line) audit2allow -a -l should only process avc messages since your last policy reload. Is that runcon command running in the datalabeler_t domain already or in a different domain (the caller domain)? If the former, why are you specifying -r system_r -t datalabeler_t at all to runcon (vs. just the components that are changing)? If the latter, then the caller domain needs mls_process_set_level(). Also, you'd have to deal with other MLS-related issues, e.g. if you want that java process to be able to write to your tty (at s0), you'd need to give it mls_fd_use_all_levels() to inherit stdin/stdout/stderr and mls_file_write_down() to write to the tty. But ideally you'd be using newrole -l s1 instead and let it relabel the tty for you properly. You may want to take further follow-ups to redhat-lspp list for MLS-specific issues. -- Stephen Smalley National Security Agency

1 0

trouble using runcon
by Clarkson, Mike R (US SSA) 02 May '07

02 May '07

Whenever I use runcon in my script, I get the error "root:system_r:datalabeler_t:s0-s15:c0.c255 is not a valid context", regardless of the user, role, type, and mls level that I specify with the runcon command. Infact, even when I specify the context that I'm already running in with the runcon statement, I get the above error. So for instance, if I run the script WITHOUT the runcon command, it runs fine with the following security context (verified with a ps -efZ command): root:system_r:datalabeler_t:s0-s15:c0.c255. But if I run the script with a runcon statement that specifies the exact same user, role, type, and mls level I get the error shown above. My script runs in a domain named datalabeler_t (I don't have the problem when running a similar script in the unconfined_t domain). It kicks off a java process with the following line: java mls.SimulatedImport.SimulatedDataLabeler $argv[*] When I add the runcon statement, I get the above error: runcon -u root -r system_r -t datalabeler_t java mls.SimulatedImport.SimulatedDataLabeler $argv[*] I am using an selinux policy that I built as an mls policy off the targeted policy. Ultimately what I'd like to be able to do is to use the runcon statement to specify an mls level, but I need to get past this first. Any help would be appreciated. Thanks

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2007