selinux November 2008

selinux@lists.fedoraproject.org

25 participants
36 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

selinux denying a cups printer
by Gene Heskett 02 Dec '08

02 Dec '08

Greetings; Uptodate F8, targeted setting host=coyote.coyote.den type=AVC msg=audit(1227891049.940:679): avc: denied { execute } for pid=6486 comm="cupsd" name="lp3" dev=sda3 ino=104400725 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file host=coyote.coyote.den type=SYSCALL msg=audit(1227891049.940:679): arch=40000003 syscall=33 success=no exit=-13 a0=bff13656 a1=1 a2=b7f17ff4 a3=b7f18a3c items=0 ppid=6485 pid=6486 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) The troubleshooters recommended fix is a restorecon -v './lp3' The only ./lp3 I could find was in /etc/cups.d/interfaces/lp3, and while it did change the context of the file, it does not fix the problem. This particular driver ppd is the lpr and cupswrapper of the HL2140 driver kit from Brother, and apparently is installed in a /usr/local/Brother subdir by their rpms. All this did work flawlessly before I had a drive failure, and it worked after an Fu8 install, but failed sometime in the nearly 2 weeks uptime, as did all my other printer profiles, which I have now deleted and rebuilt, and work except for this one. I am going to try touching /.autorelabel and reboot again see if that helps. However, nothing happened the last time I tried that 2 weeks ago... -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Q: How many IBM CPU's does it take to do a logical right shift? A: 33. 1 to hold the bits and 32 to push the register.

2 2

Setroubleshootd on FC8 has a major memory leak
by spo 02 Dec '08

02 Dec '08

Hello, after 9 days of running it used over 2G (virt, rss ~1G). Greetings, Edek

2 1

preventing unconfined users exec in home and tmp
by Murray McAllister 02 Dec '08

02 Dec '08

Hi, I have turned "allow_unconfined_exec_content" off, but unconfined users (unconfined_u) can still execute files in their home directories and /tmp/. I tried adding a user with "useradd -Z unconfined_u". This user can still execute. I could not find any dontaudit rules. Am I missing something? Thanks.

2 2

installing xine from source yields lots of selinux denials
by Antonio Olivares 02 Dec '08

02 Dec '08

Dear all, Trying to install xine-lib from source *to put in the missing pieces* gives selinux denials with chcon Summary: SELinux is preventing chcon (unconfined_t) "mac_admin" unconfined_t. Detailed Description: SELinux denied access requested by chcon. It is not expected that this access is required by chcon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0 Target Objects None [ capability2 ] Source chcon Source Path /usr/bin/chcon Port <Unknown> Host emachines-3 Source RPM Packages coreutils-6.12-17.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name emachines-3 Platform Linux emachines-3 2.6.27.5-109.fc10.x86_64 #1 SMP Thu Nov 13 20:12:05 EST 2008 x86_64 x86_64 Alert Count 60 First Seen Tue 18 Nov 2008 07:47:03 AM CST Last Seen Tue 18 Nov 2008 07:48:36 AM CST Local ID 395c28ed-1aab-4d88-9105-57cecfd55b14 Line Numbers Raw Audit Messages node=emachines-3 type=AVC msg=audit(1227016116.77:132): avc: denied { mac_admin } for pid=3757 comm="chcon" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 node=emachines-3 type=SYSCALL msg=audit(1227016116.77:132): arch=c000003e syscall=188 success=no exit=-22 a0=133e670 a1=6236f9 a2=133fa40 a3=21 items=0 ppid=3751 pid=3757 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="chcon" exe="/usr/bin/chcon" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) Thanks, Antonio

3 3

Re: How to HTTP Serve Fedora Distribution
by David Highley 26 Nov '08

26 Nov '08

"Murray McAllister wrote:" > > David Highley wrote: > > How can we set up HTTP serving of Fedora distribution since we can not > > label the files in the ISO? What we have tried: > > - copy ISO file into web tree > > - loopback mount the ISO to /mnt > > - symlink /mnt into the web tree > > or > > - create directory in web tree > > - loopback mount the ISO to directory in web tree > > > > Selinux blocks access to the distribution. The only solution we are > > aware of is to drop the pants on selinux by going to permissive mode. > > > > David Highley > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Hi, > > Paul seemed to have answered your question. There are some examples of > overriding SELinux contexts with the mount command here: > > <http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/sect-Security-En…> > > Hope that helps, > > Cheers. > Yes, Paul did answer my question. We were not aware that options had been added to the mount command.

1 0

How to HTTP Serve Fedora Distribution
by David Highley 26 Nov '08

26 Nov '08

How can we set up HTTP serving of Fedora distribution since we can not label the files in the ISO? What we have tried: - copy ISO file into web tree - loopback mount the ISO to /mnt - symlink /mnt into the web tree or - create directory in web tree - loopback mount the ISO to directory in web tree Selinux blocks access to the distribution. The only solution we are aware of is to drop the pants on selinux by going to permissive mode. David Highley

2 1

Which permission to execute a script?
by Bruno Wolff III 24 Nov '08

24 Nov '08

I was making a modified version of the guest policy that needed to be able to edit and run some perl scripts that also are visible to the web server. I used the manage_files macro and allowed execute, but I can't run the script directly. But I can run it via perl. For example: [tomarndt@wolff area]$ ./newcheck.pl -bash: ./newcheck.pl: /usr/bin/perl: bad interpreter: Permission denied [tomarndt@wolff area]$ perl ./newcheck.pl Ownership counts: Ownership of games with owners owning less than 10 new games. newcheck.pl starts with: #!/usr/bin/perl This is the modified policy for tom_t: policy_module(tom,1.0.0) ######################################## # # Declarations # userdom_restricted_user_template(tom) require { type httpd_sys_content_t; type httpd_sys_script_exec_t; type postgresql_tmp_t; type postgresql_t; } ######################################## # # tom local policy # optional_policy(` qmail_per_role_template(tom,tom_t,tom_r) ') manage_dirs_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t) manage_files_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t) manage_files_pattern(tom_t, httpd_sys_script_exec_t, httpd_sys_script_exec_t) allow tom_t postgresql_tmp_t:sock_file write; allow tom_t postgresql_t:unix_stream_socket connectto; allow tom_t httpd_sys_script_exec_t:file execute;

3 10

GCL
by Jerry James 24 Nov '08

24 Nov '08

Once upon a time on fedora-devel-list, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > +/usr/bin/gcl -- gen_context(system_u:object_r:execmem_exec_t,s0) > > > Will be in selinux-policy-3.5.13-19.fc10 I've done some experimenting, and I think I need a couple of modifications to this. First, it turns out that GCL needs both execmem and execheap permissions. Do I need to create a gcl_exec_t type to combine those? Second, /usr/bin/gcl is just a shell script. It does an exec of /usr/lib/gcl-%{version}/unixport/saved_ansi_gcl, which is the saved Lisp image, along with appropriate command line options. I don't expect permissions to persist across an exec (but tell me if I'm wrong), so I think I need the policy to mention the saved image instead of /usr/bin/gcl. There are some problems associated with this: 1) The /usr/lib prefix is used on both 32-bit and 64-bit platforms, which is bad. I'll see if I can get that fixed, but it appears to require some code changes (i.e., not just makefile changes). 2) The GCL build process can produce multiple image files, with various combinations of options (such as profiling, ANSI vs. CLtL1 support, a GUI, etc.). Fedora has only ever shipped one image, but I can see an argument for producing a profiling version of the standard image and making /usr/bin/gcl choose between them based on command line arguments. In any case, all of the image names start with "saved_". The upshot of all this is that, to make the policy future-proof, I really need the execmem + execheap permissions for all files that match this pattern: /usr/lib*/gcl-*/unixport/saved_* Is that okay? If so, how do I proceed? Thanks for helping out an SELinux newbie. -- Jerry James http://loganjerry.googlepages.com/

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2008