selinux September 2007

selinux@lists.fedoraproject.org

37 participants
47 discussions

lost+found labeling
by Stephanos Manos 08 Sep '07

08 Sep '07

Hi I'm in the proses of building a hole server and i was wondering what is the correct way of labeling the lost+found directory of various file systems that will be mounted under the /srv. I have labeled /srv as public_content_rw_t with semanage fcontext -a -t public_content_rw_t '/srv(/.*)?' but that results to lost+found being labeled as public_content_rw_t so i also run semange fcontext -a -f -d -t lost_found_t '/srv/(.*/)lost\+found' my question is: in /etc/selinux/targeted/contexts/files/file_contexts i see two lines for /lost+found a. /lost\+found/.* <<none>> b. /lost\+found -d system_u:object_r:lost_found_t:s0 the second is created with the above mentioned command who do i create the first or i don't needed? Regards Stephanos Manos

2 5

Postfix (FC7)
by "Stanisław T. Findeisen" 07 Sep '07

07 Sep '07

Hello Hopefully you Fedora/SELinux developers already know that Postfix does not work correctly by default in Fedora Core 7? audit(1189079035.093:14): avc: denied { append } for pid=2573 comm="local" name="stf" dev=sda1 ino=5881977 scontext=system_u:system_r:postfix_local_t:s0 tcontext=root:object_r:mail_spool_t:s0 tclass=file This used to happen to me when I tried (as an ordinary user) to send email to myself. The file that Postfix was trying to append to was my own mail file (/var/spool/mail/stf). I had to add this rule: allow postfix_local_t mail_spool_t:file append; What's more, it turned out that checkmodule (policy language compiler) is not present, so I had to install one from Fedora Core 6. -- "Serce medrcow jest w domu zaloby, a serce glupcow w domu wesela." (Koh 7:4)

3 6

polyinstantiation of the /tmp dir
by Clarkson, Mike R (US SSA) 06 Sep '07

06 Sep '07

I'm trying to set up polyinstantiation of the /tmp directory using RHEL5. The /etc/security/namespace.conf file shows the following line as needing to be uncommented out: /tmp /tmp-inst/ level root,adm The /usr/share/doc/pam-0.99.6.2/txts/README.pam_namespace file describes the format of the /etc/security/namespace.conf file, and the allowable values. For the <method> entry it lists the following valid values: "user", "context", "both". It doesn't list "level" as a valid value. However, "level" is the only value that I can get to work. With "user", "context", or "both", I get the following error when I attempt to use newrole to change the level of my shell: "pam_open_session failed with Cannot make/remove an entry for the specified session" Any ideas as to why? And what other values are valid other than "level" Thanks

3 3

gitweb
by Andy Green 06 Sep '07

06 Sep '07

Hi folks - I have migrated a dedicated server from "FC4" (a very strange FC4 with lilo, xfs-formatted partitions, no selinux, and a Debian kernel) provided by a 1&1 to F7 with only one outstanding minor selinux problem. (The adventures of converting it are documented at http://warmcat.com/_wp/?p=35 if anyone is interested). gitweb no longer works properly with selinux in targeted/enforcing mode. Sep 5 13:23:37 warmcat kernel: audit(1188995017.593:84): avc: denied { read } for pid=3649 comm="gitweb.cgi" name="cgi-bin" dev=md7 ino=5079272 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_sys_script_exec_t:s0 tclass=dir dev=md7 is /var, it seems the inode in question is /var/www/cgi-bin # ll -Zd /var/www/cgi-bin drwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t /var/www/cgi-bin # ll -Z /var/www/cgi-bin -rw-r--r-- root apache system_u:object_r:httpd_sys_content_t git-favicon.png -rw-r--r-- root apache system_u:object_r:httpd_sys_content_t git-logo.png drwxr-xr-x root apache system_u:object_r:httpd_sys_script_exec_t gitweb -rwxr-xr-x root apache system_u:object_r:httpd_sys_script_exec_t gitweb.cgi -rw-r--r-- root apache system_u:object_r:httpd_sys_content_t gitweb.css -rwxr-xr-x root apache system_u:object_r:httpd_sys_script_exec_t gitweb_defaults.pl -rwxr-xr-x root apache system_u:object_r:httpd_sys_script_exec_t gitweb.perl -rw-r--r-- root apache system_u:object_r:httpd_sys_script_exec_t projects.list Does anyone have any advice about the right way to resolve this? -Andy

1 1

Re: gallery2 policy
by John Griffiths 02 Sep '07

02 Sep '07

>> allow httpd_sys_script_t file { getattr read }; >> > > Not sure about this one. What are the httpd_tmp_t files that gallery is > trying to read? > > Gallery2 watermark plugin uses graphic packages such as NetPbm, ImageMagick, Dcraw, ffmpeg, GD to convert graphic files and re-write them with a watermark image superimposed on them. The typical AVC for getattr and read are: Aug 25 18:06:46 gei kernel: audit(1188079606.937:995): avc: denied { getattr } for pid=19252 comm="composite" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file . . . Aug 25 19:07:04 gei kernel: audit(1188083224.885:1066): avc: denied { read } for pid=19870 comm="pngtopnm" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file The kohokan.com.png is a watermark file that is uploaded through the web interface. >> #============= httpd_t ============== >> allow httpd_t public_content_rw_t:dir { write remove_name >> add_name }; allow httpd_t public_content_rw_t:file unlink; >> > > Setting the allow_httpd_anon_write boolean should remove the need for > these rules. > Thanks. Rules removed and boolean set. > Paul.

2 4

setroubleshootd using excessive memory
by Martin Ebourne 02 Sep '07

02 Sep '07

Just noticed a problem with my laptop fully using swap and a major culprit seems to be setroubleshootd. From top it appeared to be using excessive vsize: 1881 root 20 0 611m 1484 524 S 0.0 0.1 0:21.17 setroubleshootd So I restarted it: # free total used free shared buffers cached Mem: 1027704 637460 390244 0 4496 46400 -/+ buffers/cache: 586564 441140 Swap: 1048568 1023676 24892 # service setroubleshoot restart Stopping setroubleshootd: free [ OK ] Starting setroubleshootd: [ OK ] # free total used free shared buffers cached Mem: 1027704 630096 397608 0 5172 47336 -/+ buffers/cache: 577588 450116 Swap: 1048568 628444 420124 # So it was was 400MB in size (and all swapped due to recent memory pressure). This seems somewhat excessive. Also after I'd restarted setroubleshootd, auditd went wild and maxed the cpu out until I restarted that too. I'm using fully updated Fedora 7. setroubleshoot-server-1.9.4-2.fc7 2.6.22.1-41.fc7 #1 SMP Fri Jul 27 18:21:43 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux 00:24:02 up 8 days, 8:22, 7 users, load average: 0.54, 1.72, 3.20 Cheers, Martin.

2 2

Webmin bug, with SELinux in Permissive Mode
by Lanny Marcus 01 Sep '07

01 Sep '07

I found a bug in Webmin. The author of Webmin is also a SELinux newbie. (this is the first time I have enabled SELinux) He would like me to post and try to find help, from experienced SELinux users. He wrote: > Unfortunately I am a newbie when it comes to selinux too :-( > What I am looking for is a way to selinux that any process can write > to a file. I suspect that the chcon command can do this, but am not > sure how.. Prior to the above, he wrote: > Ok, thanks ... I see the problem. Webmin opens the log file > /var/webmin/miniserv.error and connects STDERR to it, then runs other > commands like iptables, which inherits the STDERR file descriptor. > This is generally a good thing, as any error output from the iptables > command will go to that log file. > > But with selinux enabled, this fails as iptables doesn't have the > security context needed to write to that file. Is there a chcon option > or other command that can allow a file to be written by any process? > If so, I should update Webmin to run that on the error log file. This bug is at the below URL: <https://sourceforge.net/tracker/?func=detail&atid=117457&aid=1781101&group_…> If someone can explain, in simple terms, what needs to be done, that will be greatly appreciated! TIA, Lanny

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2007