selinux July 2007

selinux@lists.fedoraproject.org

35 participants
45 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

[RFC] policy about nas sound server
by NZzi 16 Aug '07

16 Aug '07

hi all, i write module for Network Audio System (NAS) in fedora rawhide. firstly, i think there is not policy for nas, so i write from scratch, but after finishing, i found there is a soundserver module in policy, so i ported my nas policy into this module. i am not familiar with nas, so i just make some tests for new soundserver policy, especially some tools in nas package, including: audemo, audial, auinfo, aupanel, auplay...... IMHO, it seems to work well, and there was not any errors about nas in audit messages. -(:16:13:$)-> rpm -q nas nas-1.9-2.fc7.i386 -(yangshao@Nerazzurri:pts/2)--------------------------------------(~/workBench/selinux/soundserver)-(5/5)- -(:16:13:$)-> ps axZ|grep nas system_u:system_r:soundd_t 2322 ? S 0:00 nasd -b -local system_u:system_r:unconfined_t 4329 pts/2 S+ 0:00 egrep --color -r --exclude=*.svn* nas -(yangshao@Nerazzurri:pts/2)--------------------------------------(~/workBench/selinux/soundserver)-(5/5)- -(:16:13:$)-> rpm -q selinux-policy-targeted selinux-policy-targeted-3.0.4-1.fc8.noarch please review this patch.

2 3

Re: Containing vmware player 2.0.0 with SELINUX
by Louis Lam 31 Jul '07

31 Jul '07

Hi, Thanks for the reply. My conclusion is that not I'm not sure where to place the domain_auto_trans() statement. If I can't place it in the vmware.if file(since it will not be read during module compilation ) where can I put this statement? All i need to do now is to make the vmware executable run in its own domain e.g. vmware_t. But it seems more difficult than I thought. Can you point me to resources to how to develop modules? Can someone help me with this problem? Thanks & Regards, Louis ----- Original Message ---- From: Ken YANG <spng.yang(a)gmail.com> To: Louis Lam <lshoujun(a)yahoo.com> Cc: Daniel J Walsh <dwalsh(a)redhat.com>; fedora-selinux-list(a)redhat.com Sent: Monday, July 30, 2007 6:53:17 AM Subject: Re: Containing vmware player 2.0.0 with SELINUX Louis Lam wrote: > Hi, > > I think i'm having a policy compilation problem here > > I've moved the domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) statement to vmware.if. I was following the domain_auto_trans rules for other apps such as mozilla. The syntax error problem went away. > > But the problem is that the domain transition didn't take place. My vmplayer is still running in unconfined state. > > I'm doing compilation of the vmware.pp module using make -f /usr/share/selinux/devel/Makefile. I've tried to purposely introduce errors into vmware.if to see if the compilation is effective: > > e.g. domain_auto_trans($2, $2, $1_t, vmware_exec_t, $1_vmware_t) > > But the make process didn't detect any errors and the compilation still went on. I did a diff between the vmware.pp at the /etc/selinux/targeted/modules/active/modules/vmware.pp and the development directory (where I do all my compilation), but there are no differences. > > Does it mean if the vmware.if file is modified it will not affect the make? as i infer (i'm not sure): the interface will not be checked, unless someone invoke it, because if there are not invokes, the parameter can not be determined. when you build vmware module, you will not use your own interface in own module, so build process will not detect error. > > How do you ensure that the changes at vmware.if effective? (well at least cause some compilation errors?) > > > > Thanks, > Louis > > > > > > ----- Original Message ---- > From: Ken YANG <spng.yang(a)gmail.com> > To: Louis Lam <lshoujun(a)yahoo.com> > Cc: Daniel J Walsh <dwalsh(a)redhat.com>; fedora-selinux-list(a)redhat.com > Sent: Saturday, July 28, 2007 5:28:25 PM > Subject: Re: Containing vmware player 2.0.0 with SELINUX > > > Louis Lam wrote: >> My mistakes, apologies for the confusion, under part 2, I was trying to do domain_auto_trans instead of doman_entry_file, so... >> >> 2. Created a domain transition so that the vmware user programs e.g. >> /usr/lib/vmplayer script, /usr/lib/vmware/bin/vmplayer that are >> labelleled system_u:object_r:vmware_exec_t will transit to >> system_u:object_r:vmware_t when executed. I put it also in vmware.te: >> >> domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) >> >> but >> on making the vmware.pp module I get this warning and error: >> >> 'syntax error' at token '1' on line 81143: >> #line 13 >> allow $1_t vmware_exec_t: file {getattr read execute}; > > this rule is generated by domain_auto_trans, so i think the > syntax error should be caused by other rules. > > you may check other rules in your policy. > >> Thanks in advance, >> Louis >> >> >> ----- Original Message ---- >> From: Louis Lam <lshoujun(a)yahoo.com> >> To: Daniel J Walsh <dwalsh(a)redhat.com> >> Cc: fedora-selinux-list(a)redhat.com >> Sent: Friday, July 27, 2007 5:05:05 AM >> Subject: Re: Containing vmware player 2.0.0 with SELINUX >> >> Thanks Daniel for the information, hi everyone >> >> I've tried to make the following changes: >> >> 1. Defined the vmware_t type in vmware.te: >> type vmware_t; >> >> I need to do this since I'm trying to let the vmware user program run under vmware_t domain but this is not defined. In terms of overall code compliance is it correct to define here? or should be at the vmware.if? > > type definition should be in vmware.te > > Send instant messages to your online friends http://uk.messenger.yahoo.com Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Guideline for RPM packages
by KaiGai Kohei 30 Jul '07

30 Jul '07

>>> If I remember correctly, someone posted a guideline to make >>> a RPM package which contains binary security policy, several >>> weeks ago. >>> >>> If you know the URL, would you tell me the location? >> There is a draft guide at: >> http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules > > Thanks, so much! I have a comment for the Policy Module Packaging Guideline. The document says every *.pp files should be installed for any sort of policies (targeted, strict, mls) in the %post section. However, it can cause a problem when a part of policies are not installed yet. When we try to install an application including policy package on the system which has only targeted policy, installation of *.pp files for strict/mls will be failed no need to say. If we want to install selinux-policy-strict or -mls later, the oraphan *.pp files are not linked automatically because "/usr/bin/semodule -i" is not invoked. It will cause a simple problem, but a bit difficult to find out. I have an idea that uses "%triggerin" to invoke "/use/bin/semodule -i" to link orphan *.pp files on instllation of selinux-policy-* packages later, as follows: ---------------- %triggerin -- selinux-policy-targeted if [ $0 -eq 1 ]; then /usr/sbin/semodule -s targeted -i %{_datadir}/selinux/targeted/mymodule.pp &> /dev/null || : fi %triggerin -- selinux-policy-strict if [ $0 -eq 1 ]; then /usr/sbin/semodule -s strict -i %{_datadir}/selinux/strict/mymodule.pp &> /dev/null || : fi %triggerin -- selinux-policy-mls if [ $0 -eq 1 ]; then /usr/sbin/semodule -s mls -i %{_datadir}/selinux/mls/mymodule.pp &> /dev/null || : fi ---------------- If the application is installed on the system which already has selinux-policy-strict, "%triggerin -- selinux-policy-strict" will be invoked just when the application is installed, so there is no degrading. Thanks, -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai(a)ak.jp.nec.com>

3 3

Re: Containing vmware player 2.0.0 with SELINUX
by Louis Lam 30 Jul '07

30 Jul '07

Hi, I think i'm having a policy compilation problem here I've moved the domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) statement to vmware.if. I was following the domain_auto_trans rules for other apps such as mozilla. The syntax error problem went away. But the problem is that the domain transition didn't take place. My vmplayer is still running in unconfined state. I'm doing compilation of the vmware.pp module using make -f /usr/share/selinux/devel/Makefile. I've tried to purposely introduce errors into vmware.if to see if the compilation is effective: e.g. domain_auto_trans($2, $2, $1_t, vmware_exec_t, $1_vmware_t) But the make process didn't detect any errors and the compilation still went on. I did a diff between the vmware.pp at the /etc/selinux/targeted/modules/active/modules/vmware.pp and the development directory (where I do all my compilation), but there are no differences. Does it mean if the vmware.if file is modified it will not affect the make? How do you ensure that the changes at vmware.if effective? (well at least cause some compilation errors?) Thanks, Louis ----- Original Message ---- From: Ken YANG <spng.yang(a)gmail.com> To: Louis Lam <lshoujun(a)yahoo.com> Cc: Daniel J Walsh <dwalsh(a)redhat.com>; fedora-selinux-list(a)redhat.com Sent: Saturday, July 28, 2007 5:28:25 PM Subject: Re: Containing vmware player 2.0.0 with SELINUX Louis Lam wrote: > My mistakes, apologies for the confusion, under part 2, I was trying to do domain_auto_trans instead of doman_entry_file, so... > > 2. Created a domain transition so that the vmware user programs e.g. > /usr/lib/vmplayer script, /usr/lib/vmware/bin/vmplayer that are > labelleled system_u:object_r:vmware_exec_t will transit to > system_u:object_r:vmware_t when executed. I put it also in vmware.te: > > domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) > > but > on making the vmware.pp module I get this warning and error: > > 'syntax error' at token '1' on line 81143: > #line 13 > allow $1_t vmware_exec_t: file {getattr read execute}; this rule is generated by domain_auto_trans, so i think the syntax error should be caused by other rules. you may check other rules in your policy. > > Thanks in advance, > Louis > > > ----- Original Message ---- > From: Louis Lam <lshoujun(a)yahoo.com> > To: Daniel J Walsh <dwalsh(a)redhat.com> > Cc: fedora-selinux-list(a)redhat.com > Sent: Friday, July 27, 2007 5:05:05 AM > Subject: Re: Containing vmware player 2.0.0 with SELINUX > > Thanks Daniel for the information, hi everyone > > I've tried to make the following changes: > > 1. Defined the vmware_t type in vmware.te: > type vmware_t; > > I need to do this since I'm trying to let the vmware user program run under vmware_t domain but this is not defined. In terms of overall code compliance is it correct to define here? or should be at the vmware.if? type definition should be in vmware.te Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Help requried on SELinux
by Sathish Raman 30 Jul '07

30 Jul '07

Hi all, I am beginner in SELinux. Please let me know if any documents available for basic administration, writing policies and how to edit targeted policies. thanks & regards, Sathish Kumar =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 1

Novice problem with apol/ policy.conf
by Andrey Markelov 30 Jul '07

30 Jul '07

Hello, I am novice in SELinux. For policy analysis I compiled policy.conf from selinux-policy-2.4.6-30.el5.src.rpm on RHEL5. When I tried to open policy.21 with apol (GUI version 3.0 libapol version 3.0.0) it was ok. But when i opened policy.conf i received the following error: The selected file does not appear to be a valid SELinux Policy. Error opening policy: Input/output error. And in console tmp/rolemap.conf:624:ERROR 'syntax error' at token 'ntfs-3g' on line 1563798: genfscon ntfs-3g / system_u:object_r:dosfs_t genfscon msdos / system_u:object_r:dosfs_t What is the possible reason? ____ Andrey Markelov Plus Communications Phone: +7(495)777-0-111 ext.533

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2007