selinux November 2008

selinux@lists.fedoraproject.org

25 participants
36 discussions

F10 Logwatch and avc(s) long post
by Frank Murphy 24 Nov '08

24 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------A snip from the logwatch included at end----------------- Summary: SELinux is preventing netstat (logwatch_t) "search" to <Unknown> (sysctl_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects None [ dir ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 4 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 144ff94f-abf9-47ba-8ab6-bda6cceb41e8 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:48): avc: denied { search } for pid=4085 comm="netstat" scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir node=frank-01 type=SYSCALL msg=audit(1227345433.820:48): arch=40000003 syscall=33 success=no exit=-13 a0=805f195 a1=4 a2=ffffffff a3=8064020 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./unix (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./unix, restorecon -v './unix' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./unix [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 2 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID c323266d-4b2a-4e47-9b13-eeb640939573 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:45): avc: denied { read } for pid=4085 comm="netstat" name="unix" dev=proc ino=4026531984 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.820:45): arch=40000003 syscall=33 success=no exit=-13 a0=805c8b9 a1=4 a2=ffffffff a3=8064360 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./if_inet6 (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./if_inet6, restorecon -v './if_inet6' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./if_inet6 [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 4 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 9de63b84-aff8-4a49-bc45-510abd4637b3 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:46): avc: denied { read } for pid=4085 comm="netstat" name="if_inet6" dev=proc ino=4026532168 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.820:46): arch=40000003 syscall=33 success=no exit=-13 a0=805f29e a1=4 a2=ffffffff a3=8064180 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./dev (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./dev, restorecon -v './dev' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./dev [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages filesystem-2.4.19-1.fc10 Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 6 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 44eb7259-6162-4669-9b01-b5d48a63aaa5 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.855:51): avc: denied { read } for pid=4085 comm="netstat" name="dev" dev=proc ino=4026531957 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.855:51): arch=40000003 syscall=5 success=no exit=-13 a0=805ff47 a1=0 a2=1b6 a3=0 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Logwatch: --------------------- Network Report Begin ------------------------ Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. ------------- Network Interfaces --------------- Ethernet : 1 Other : 1 Total : 2 ------------- Ethernet ------------------------- eth1 Link encap:Ethernet HWaddr 00:19:E0:7A:40:4C ------------- Other ---------------------------- lo Link encap:Local Loopback ------------- Network Interfaces --------------- ------------- Network statistics --------------- 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:19:e0:7a:40:4c brd ff:ff:ff:ff:ff:ff inet 192.168.0.5/24 brd 192.168.0.255 scope global eth1 inet6 fe80::219:e0ff:fe7a:404c/64 scope link valid_lft forever preferred_lft forever Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Iface MTU RX-ERR TX-ERR eth1 1500 no BMRU lo 16436 no LRU ------------- Network statistics --------------- ---------------------- Network Report End ------------------------- - -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkknz/8ACgkQzrcOE0b3RmITUgCfR/8BYJmpAiluEAH0SWqOtXnr QUgAn1bhRbsmlsZGyJEsTlwl2MNcp57J =fMiJ -----END PGP SIGNATURE-----

3 4

selinux denies iptables
by Antonio Olivares 24 Nov '08

24 Nov '08

Dear all, I am still having trouble setting up the dhcp server because selinux denies iptables type=1400 audit(1227530280.458:4): avc: denied { write } for pid=1430 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file Thanks in Advance, Antonio

2 2

restorecon isn't restoring what matchpathcon shows
by Chuck Anderson 21 Nov '08

21 Nov '08

There are a bunch of files and directories in my F10 home dirs that have type unconfined_u:object_r:user_home_t, but matchpathcon says they are supposed to be system_u:object_r:user_home_t. I tried to run restorecon but it isn't changing the type: [root@l 9:06:49 /home/install]#matchpathcon /home/install/Templates /home/install/Templates system_u:object_r:user_home_t:s0 [root@l 9:06:51 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ [root@l 9:06:56 /home/install]#restorecon -R Templates [root@l 9:07:07 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ [root@l 9:07:10 /home/install]#su - install [install@l ~]$ restorecon -R . [install@l ~]$ restorecon -R Templates/ [install@l ~]$ logout [root@l 9:08:23 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ Why does this happen?

4 4

Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.439:5): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin"
by Antonio Olivares 21 Nov '08

21 Nov '08

Dear fellow selinux experts, npviewer is causing lots of trouble. Firefox freezes and I have to kill it/terminate it and restart it just to post :( What should I do, I have filed bugs on this several times :( Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.439:5): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.548:6): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.659:7): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.694:8): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.732:9): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.764:10): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.790:11): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.816:12): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.841:13): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:14:02 localhost kernel: __ratelimit: 42 callbacks suppressed Nov 19 07:14:02 localhost kernel: type=1400 audit(1227100442.317:28): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Thanks, Antonio

2 5

Installing MLS policy on Fedora 9
by Elihu Smails 21 Nov '08

21 Nov '08

I have installed Fedora 9 and wanted to install the MLS Policy. I performed the following steps: 1. Install Fedora 9 2. Install Patches 3. Reboot 4. yum install -y selinux-policy-mls 5. Open /etc/selinux/config and change the following: SELINUX=enforcing SELINUXTYPE=targeted to SELINUX=permissive SELINUXTYPE=mls 6. touch /.autorelabel 7. Reboot. The relabelling works fine 8. Set SELINUX to enforcing in /etc/selinux/config 9. Reboot. I get many error messages about the file system and it drops me into a single user shell. Can someone please tell me what the proper steps are. Thank you.

2 1

selinux is denying iptables, how can I get the dhcp server working
by Antonio Olivares 21 Nov '08

21 Nov '08

Dear all, After I got the rules and many things down, now selinux comes in and denies iptables http://fcp.surfsite.org/modules/newbb/viewtopic.php?topic_id=64110&forum=12 https://www.redhat.com/archives/fedora-list/2008-November/msg01208.html https://www.redhat.com/archives/fedora-list/2008-November/msg01640.html I see the following: type=1400 audit(1227217617.326:6): avc: denied { write } for pid=10490 comm="iptables-save" path="/etc/sysconfig/iptables" dev=dm-0 ino=28345626 scontext=unconfined_u:unconfined_r:iptables_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file Thanks, Antonio

2 1

Selinux issues in user-compiled code
by Jason L Tibbitts III 20 Nov '08

20 Nov '08

A while back I made the decision to enable selinux on all of my user desktops. It hasn't really been all that painful; generally the issues I have are with proprietary software, essentially all of which it seems has one issue or another. This morning I received the following question from a user: ----- Can you explain why I often get a linker error: "cannot restore segment prot after reloc: Permission denied" running code I've built in my home directory.But then if I rerun once or twice it will execute properly. It's not always the same library that the linker complains about.... ----- Unfortunately I don't really know how to answer. I can handle selinux at a system level, because if I know some program has an issue I can just change a file context and things work. But I've no idea how to deal with code that users might compile, or where to point them for info in writing code that doesn't have these issues. - J<

2 1

root vs system cron jobs (MLS_LEVEL)
by Nikolas Lam 20 Nov '08

20 Nov '08

Hi On Fedora 9, we've got a symlink in /etc/cron.daily/ to /usr/local/bin/checkmailspool which ultimately tries to run /usr/sbin/postqueue -p It works if you call it via the root user's crontab, but not when you put the script in /etc/cron.daily/. (I've included the sealert output below). When called by the "system" cron (in which the denial occurs) id -Z output is system_u:system_r:system_crond_t:s0-s0:c0.c1023 OTOH, the root cron (which works) shows root:unconfined_r:unconfined_t:s0-s0:c0.c1023 I've just read crontab(5) which mentions setting MLS_LEVEL on the first line of the crontab, but it seems to suggest that this would apply (perhaps unnecessarily) to all the jobs run in that crontab. What's the recommended method to get this one script working from within /etc/cron.daily/ ? Regards, Nik Lam Summary: SELinux is preventing postqueue (postfix_postqueue_t) "connectto" to /var/spool/postfix/public/showq (unconfined_t). Detailed Description: SELinux denied access requested by postqueue. It is not expected that this access is required by postqueue and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:postfix_postqueue_t:s0-s0:c0.c10 23 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects /var/spool/postfix/public/showq [ unix_stream_socket ] Source postqueue Source Path /usr/sbin/postqueue Port <Unknown> Host replaced.example.com Source RPM Packages postfix-2.5.5-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-107.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name replaced.example.com Platform Linux replaced.example.com 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 i686 Alert Count 38 First Seen Tue Nov 4 05:04:42 2008 Last Seen Thu Nov 20 05:04:42 2008 Local ID f5f4066b-d167-44ca-9c00-afd71f485225 Line Numbers Raw Audit Messages host=replaced.example.com type=AVC msg=audit(1227117882.675:17773): avc: denied { connectto } for pid=15651 comm="postqueue" path="/var/spool/postfix/public/showq" scontext=system_u:system_r:postfix_postqueue_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket host=replaced.example.com type=SYSCALL msg=audit(1227117882.675:17773): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfa89e00 a2=b808eff4 a3=bfa89e6a items=0 ppid=15647 pid=15651 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=90 sgid=90 fsgid=90 tty=(none) ses=2419 comm="postqueue" exe="/usr/sbin/postqueue" subj=system_u:system_r:postfix_postqueue_t:s0-s0:c0.c1023 key=(null)

1 0

seliux denying spamd write access to its own user home dir
by Gene Heskett 20 Nov '08

20 Nov '08

Greetings; Just recovering from a drive failure, and just now managed to get enough perl deps installed to run spamassassin. I modified the spamassassin script in /etc/init.d to run it as the same user that fetches the mail, also fixed the spamassassin in /etc/sysconfig to match, and according to htop, the spamd's are running as that user. But, selinux is still having a cow for every incoming message. ========= Source Context: system_u:system_r:spamd_t:s0 Target Context: system_u:object_r:home_root_t:s0 Target Objects: ./user_prefs [ file ] ===temp end of snip >From that, here is that file: [root@coyote .spamassassin]# ls -l user_prefs -rw-r--r-- 1 gene gene 1164 2006-01-16 13:45 user_prefs [root@coyote .spamassassin]# ls -l --context user_prefs -rw-r--r-- gene gene system_u:object_r:home_root_t:s0 user_prefs ===back to troubleshooter output host=coyote.coyote.den type=AVC msg=audit(1227116423.127:797): avc: denied { write } for pid=7118 comm="spamd" name="user_prefs" dev=sda3 ino=74942440 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=file host=coyote.coyote.den type=SYSCALL msg=audit(1227116423.127:797): arch=40000003 syscall=5 success=no exit=-13 a0=9a83590 a1=8241 a2=1b6 a3=8241 items=0 ppid=7116 pid=7118 auid=0 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=1 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null) ========= Secondary Q: when are we going to be able to copy & paste from the selinuxtroubleshooter screen and preserve the ^%$*^%$( formatting? I have performed the troubleshooter recommended fix: setsebool -P spamd_enable_home_dirs=1 and restarted spamassassin several times. Perms or context problem with the /home dirs? A bug? Or I need to do an autorelabel? The /home dirs, FWIW, were copied from another drive by mc & then 'chown -R user:user' when the copy was finished which may not have been the correct thing to do FAIK. But it was the only way I could preserve an email corpus that is in the 10Gb area for size. There are no entries for spamassassin or spamd in /etc/group that I could use to make that file a member of. Fix please? Thanks. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) "Truth never comes into the world but like a bastard, to the ignominy of him that brought her birth." -- Milton

2 3

Further on SElinux and kismet
by mike cloaked 19 Nov '08

19 Nov '08

Some days ago I was trying to run kismet on a system with F9 running SElinux and kismet failed to start and complained about being unable to write to the file ssid_map which was in the normal user main dir. There was an AVC denial indicating that kismet was not permitted to access that file. It was suggested that I make kismet look at /var/lib/kismet instead. Having tried again this evening and changed kismet.conf so that %h/ was changed to /var/lib/kismet/ then kismet still fails to start and the terminal window gives: Will attempt to put networkmanager to sleep... Allowing clients to fetch WEP keys. WARNING: Disabling GPS logging. SSID cloak file did not exist, it will be created. FATAL: Could not open SSID track file '/var/lib/kismet/ssid_map' for writing: Permission denied Sending termination request to channel control child 3538... Waiting for channel control child 3538 to exit... WARNING: Sometimes cards don't always come out of monitor mode cleanly. If your card is not fully working, you may need to restart or reconfigure it for normal operation. Trying to wake networkmanager back up... WARNING: Failed to connect to DBUS system, will not be able to control networkmanager: Failed to connect to socket /var/run/dbus/system_bus_socket: Permission denied WARNING: Failed to send 'wake' command to networkmanager via DBUS, NM may still be inactive.Kismet exiting. Done. I checked the contexts: [root@lapmike2 kismet]# ll -Zld /var/lib/kismet drwxrwx--- 2 system_u:object_r:kismet_var_lib_t:s0 root kismet 4096 2008-11-18 20:59 /var/lib/kismet [root@lapmike2 kismet]# ll -Z /var/lib/kismet -rw-rw-rw- root root unconfined_u:object_r:kismet_var_lib_t:s0 ssid_map Any ideas how to fix this - in the above there is no AVC denial but I am guessing that SElinux may still be involved?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2008