selinux February 2008

selinux@lists.fedoraproject.org

34 participants
61 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

xinetd rsync --daemon problems
by Chuck Anderson 03 Jul '08

03 Jul '08

I'm using Fedora Core 6, and trying to start a rsync daemon via xinetd. The default configuration is: # default: off # description: The rsync server is a good addition to an ftp server, as it \ # allows crc checksumming etc. service rsync { disable = no socket_type = stream wait = no user = root server = /usr/bin/rsync server_args = --daemon log_on_failure += USERID } With this rsyncd.conf: motd file = /etc/rsyncd.motd pid file = /var/run/rsyncd.pid port = 873 uid = rsyncd gid = mirror use chroot = yes max connections = 10 log file = /var/log/rsyncd.log read only = yes hosts allow = 127.0.0.1, ::1, etc.... #hosts deny = 0.0.0.0/0, :: ignore nonreadable = yes transfer logging = yes timeout = 600 dont compress = * [fedora-linux-core] path = /srv/ftp/pub/fedora/linux/core comment = Fedora Linux Core [fedora-linux-core-updates] path = /srv/ftp/pub/fedora/linux/core/updates comment = Fedora Linux Core Updates [fedora-linux-extras] path = /srv/ftp/pub/fedora/linux/extras comment = Fedora Linux Extras [fedora-linux-core-test] path = /srv/ftp/pub/fedora/linux/core/test comment = Fedora Linux Core Test [fedora-linux-releases] path = /srv/ftp/pub/fedora/linux/releases comment = Fedora Linux Releases [fedora-linux-development] path = /srv/ftp/pub/fedora/linux/development comment = Fedora Linux Development [fedora-enchilada] path = /srv/ftp/pub/fedora comment = Fedora - The whole enchilada [fedora-linux-updates] path = /srv/ftp/pub/fedora/linux/updates comment = Fedora Linux Updates [fedora-web] path = /srv/ftp/pub/fedora/web comment = Web content for Fedora Linux mirrors I get these AVCs when running from xinetd and making a client connection that I don't get if I start the daemon directly via "rsync --daemon" as root: type=AVC msg=audit(1192132336.713:3464): avc: denied { lock } for pid=8488 comm="rsync" name="rsyncd.lock" dev=dm-4 ino=2064435 scontext=user_u:system_r:rsync_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file type=SYSCALL msg=audit(1192132336.713:3464): arch=40000003 syscall=221 success=no exit=-13 a0=4 a1=d a2=bff80730 a3=bff80730 items=0 ppid=8167 pid=8488 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) type=AVC_PATH msg=audit(1192132336.713:3464): path="/var/run/rsyncd.lock" type=AVC msg=audit(1192132400.044:3465): avc: denied { bind } for pid=8499 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192132400.044:3465): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf8f4674 a2=4df50ff4 a3=3 items=0 ppid=8167 pid=8499 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) I tried creating and loading a policy module: # grep "rsync" /var/log/audit/audit.log | audit2allow -M rsyncd # semodule -i rsyncd.pp Here is rsyncd.te: module rsyncd 1.0; require { type var_run_t; type rsync_t; class netlink_route_socket create; class file { read write }; } #============= rsync_t ============== allow rsync_t self:netlink_route_socket create; allow rsync_t var_run_t:file { read write }; But I still get these AVCs: type=AVC msg=audit(1192139751.238:3586): avc: denied { bind } for pid=9311 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192139751.238:3586): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfbb6144 a2=4df50ff4 a3=3 items=0 ppid=8732 pid=9311 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) Additionally, when using xinetd I don't ever get any log messages in /var/log/rsyncd.log like I do when I run "rsync --daemon" directly: 2007/10/11 17:08:01 [8613] rsyncd version 2.6.9 starting, listening on port 873 2007/10/11 17:08:13 [8616] connect from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 17:08:13 [8616] rsync on fedora-enchilada/linux/ from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 21:08:13 [8616] building file list 2007/10/11 21:08:13 [8616] sent 1629 bytes received 106 bytes total size 19

2 2

Sendmail milters in Fedora 8
by Paul Howarth 03 Jun '08

03 Jun '08

Since upgrading my mail server from Fedora 7 to Fedora 8, I've come across some problems with the sockets used for communication between sendmail and two of the "milter" plugins I'm using with it, namely milter-regex and spamass-milter. It's very likely that other milters will have similar issues. The sockets used are created when the milter starts, as follows: milter-regex: /var/spool/milter-regex/sock (var_spool_t, inherited from parent directory) spamass-milter: /var/run/spamass-milter/spamass-milter.sock (spamd_var_run_t, in policy) These are pretty well the upstream locations, though I'm open to moving the milter-regex socket from /var/spool to /var/run or elsewhere for consistency. Since moving to Fedora 8, I've had to add the following to local policy to get these milters working: allow sendmail_t spamd_var_run_t:dir { search getattr }; allow sendmail_t spamd_var_run_t:sock_file { getattr write }; allow sendmail_t var_spool_t:sock_file { getattr write }; allow sendmail_t initrc_t:unix_stream_socket { read write connectto }; The last of these is the strangest, and relates to Bug #425958 (https://bugzilla.redhat.com/show_bug.cgi?id=425958). Whilst the socket file itself has the context listed above, the unix domain socket that sendmail connects to is still initrc_t, as can be seen from the output of "netstat -lpZ": ... unix 2 [ ACC ] STREAM LISTENING 14142 5853/spamass-milter system_u:system_r:initrc_t:s0 /var/run/spamass-milter/spamass-milter.sock unix 2 [ ACC ] STREAM LISTENING 13794 5779/milter-regex system_u:system_r:initrc_t:s0 /var/spool/milter-regex/sock ... So, my questions are: 1. Why are the sockets still initrc_t? 2. Is this a kernel issue or a userspace issue that should be fixed in the milters? 3. Should there be a standard place for milter sockets to live, and if so, where? 4. How come this worked OK in Fedora 7 and previous releases? Paul.

2 13

SELinux interfering with clamav?
by Edward Kuns 02 Mar '08

02 Mar '08

A couple times a day (23 times in 10 days), I get the following AVC: Summary SELinux is preventing /usr/sbin/clamav-milter (clamd_t) "search" to <Unknown> (bin_t). Detailed Description SELinux denied access requested by /usr/sbin/clamav-milter. It is not expected that this access is required by /usr/sbin/clamav-milter and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:clamd_t:s0 Target Context system_u:object_r:bin_t:s0 Target Objects None [ dir ] Affected RPM Packages clamav-milter-0.92.1-1.fc8 [application] Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 23 First Seen Wed 20 Feb 2008 12:25:16 PM CST Last Seen Thu 28 Feb 2008 09:11:28 PM CST Local ID 7eb02331-c2e4-4c65-a413-d283fbb7ca6f Line Numbers Raw Audit Messages avc: denied { search } for comm=clamav-milter dev=dm-0 egid=486 euid=492 exe=/usr/sbin/clamav-milter exit=-13 fsgid=486 fsuid=492 gid=486 items=0 name=bin pid=13663 scontext=system_u:system_r:clamd_t:s0 sgid=486 subj=system_u:system_r:clamd_t:s0 suid=492 tclass=dir tcontext=system_u:object_r:bin_t:s0 tty=(none) uid=492 I assume that we want to allow clamav to scan anything on the system, yes? If I follow the advice from an earlier Email and try the following: grep clamav /var/log/audit/audit.log | audit2allow -M clamav I get a file that contains: module clamav 1.0; require { type bin_t; type clamd_t; class dir search; } #============= clamd_t ============== allow clamd_t bin_t:dir search; Is this something that should be part of standard policy? Hmm, I try to install the above policy and get a complaint: # semodule -i clamav.pp libsepol.print_missing_requirements: clamav's global requirements were not met: type/attribute clamd_t libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! Any thoughts? Thanks Eddie -- Edward Kuns <ekuns(a)kilroy.chi.il.us>

2 7

gnome login broken.... "null" avcs...
by Tom London 29 Feb '08

29 Feb '08

After applying today's selinux-policy* packages, gnome/gdm login fails: gdmgreeter runs, but X quickly dies after enter password and you're back to the greeter. Booting up in permissive lets me log in. Here are the borkages: #============= mono_t ============== allow mono_t xdm_xserver_t:x_device read; #============= unconfined_execmem_t ============== allow unconfined_execmem_t xdm_xserver_t:x_device read; #============= unconfined_t ============== allow unconfined_t mono_t:x_resource write; allow unconfined_t unconfined_execmem_t:x_resource { write read }; allow unconfined_t unlabeled_t:x_drawable { destroy getattr }; [root@localhost ~]# I attach complete log file. This something to do with new X keyboard confinement stuff? tom -- Tom London

4 12

F8 updates kill setroubleshootd?
by Paul Howarth 29 Feb '08

29 Feb '08

Having installed the latest bunch of Fedora 8 updates this morning, which included selinux-policy and setroubleshoot, I'm getting these denials: type=AVC msg=audit(1204275163.032:209): avc: denied { connectto } for pid=26345 comm="setroubleshootd" path="/var/run/audispd_events" scontext=unconfined_u:system_r:setroubleshootd_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1204275171.133:210): avc: denied { read } for pid=26379 comm="setroubleshootd" name=".rpmmacros" dev=0:15 ino=6331637 scontext=unconfined_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file The first one looks like a policy issue but I can't fathom why setroubleshootd would be trying access ~/.rpmmacros for the second one. Paul.

2 2

Problem with audit2allow reference policy involving logs
by Forrest Taylor 28 Feb '08

28 Feb '08

Running RHEL5.1 with with selinux-policy-strict-2.4.6-106.el5_1.3. I am building my own policy for FTP and in creating the xferlog, audit2allow -alR gives this macro: logging_search_logs(ftpd_t) The problem is that this macros generates the following type transition: type_transition ftpd_t var_log_t : file sendmail_log_t; This, of course, is not really what I want, so I dropped the -R option to audit2allow and it returns: allow ftpd_t var_log_t:dir search; With the next iteration, audit2allow -alR shows: sendmail_create_log(ftpd_t) and audit2allow -la shows: allow ftpd_t var_log_t:dir write; Someone really liked sendmail_log_t ;o) Forrest

2 1

MLS Guide
by Ryan Ware 28 Feb '08

28 Feb '08

Does anyone know of a decent guide for setting up an SELinux MLS policy in Fedora 8 with polyinstantiated home directories? Thank you, Ryan W.

1 0

SELinux prevented dbus-daemon from using the terminal /dev/tty1
by Antonio Olivares 27 Feb '08

27 Feb '08

Summary: SELinux prevented dbus-daemon from using the terminal /dev/tty1. Detailed Description: SELinux prevented dbus-daemon from using the terminal /dev/tty1. In most cases daemons do not need to interact with the terminal, usually these avc messages can be ignored. All of the confined daemons should have dontaudit rules around using the terminal. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy. If you would like to allow all daemons to interact with the terminal, you can turn on the allow_daemons_use_tty boolean. Allowing Access: Changing the "allow_daemons_use_tty" boolean to true will allow this access: "setsebool -P allow_daemons_use_tty=1." Fix Command: setsebool -P allow_daemons_use_tty=1 Additional Information: Source Context unconfined_u:unconfined_r:unconfined_dbusd_t :SystemLow-SystemHigh Target Context unconfined_u:object_r:unconfined_tty_device_t Target Objects /dev/tty1 [ chr_file ] Source dbus-daemon Source Path /bin/dbus-daemon Port <Unknown> Host localhost Source RPM Packages dbus-1.1.4-6.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-4.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_daemons_use_tty Host Name localhost Platform Linux localhost 2.6.25-0.69.rc3.git1.fc9 #1 SMP Tue Feb 26 16:12:54 EST 2008 i686 athlon Alert Count 6 First Seen Fri 01 Feb 2008 05:06:20 PM CST Last Seen Wed 27 Feb 2008 01:01:38 PM CST Local ID c0a79310-b4d4-41fc-a712-a4db505290d5 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1204138898.740:24): avc: denied { read write } for pid=2845 comm="dbus-daemon" path="/dev/tty1" dev=tmpfs ino=1858 scontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_tty_device_t:s0 tclass=chr_file host=localhost type=SYSCALL msg=audit(1204138898.740:24): arch=40000003 syscall=11 success=yes exit=0 a0=804c907 a1=bfd1f04c a2=bfd20474 a3=7 items=0 ppid=2844 pid=2845 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="dbus-daemon" exe="/bin/dbus-daemon" subj=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 key=(null) ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2008