selinux February 2008

selinux@lists.fedoraproject.org

34 participants
61 discussions

SELinux is preventing avahi-daemon (avahi_t) "getcap" to <Unknown> (avahi_t).
by Antonio Olivares 25 Feb '08

25 Feb '08

Dear all, I am running rawhide. I see the following: Is avahi-deamon doing something that it shouldn't? Thanks, Antonio Summary: SELinux is preventing avahi-daemon (avahi_t) "getcap" to <Unknown> (avahi_t). Detailed Description: SELinux denied access requested by avahi-daemon. It is not expected that this access is required by avahi-daemon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:avahi_t Target Context system_u:system_r:avahi_t Target Objects None [ process ] Source avahi-daemon Source Path /usr/sbin/avahi-daemon Port <Unknown> Host localhost Source RPM Packages avahi-0.6.17-1.fc7 Target RPM Packages Policy RPM selinux-policy-3.3.0-1.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost Platform Linux localhost 2.6.25-0.65.rc2.git7.fc9 #1 SMP Sat Feb 23 23:06:09 EST 2008 i686 athlon Alert Count 12 First Seen Sat 23 Feb 2008 01:04:44 PM CST Last Seen Mon 25 Feb 2008 07:19:57 AM CST Local ID e83550c8-f8d8-4109-9f8f-215e82dbb99c Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1203945597.443:10): avc: denied { getcap } for pid=2159 comm="avahi-daemon" scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:avahi_t:s0 tclass=process host=localhost type=SYSCALL msg=audit(1203945597.443:10): arch=40000003 syscall=184 success=no exit=-13 a0=8c60e3c a1=0 a2=9df0f0 a3=8c60e38 items=0 ppid=1 pid=2159 auid=4294967295 uid=70 gid=70 euid=70 suid=70 fsuid=70 egid=70 sgid=70 fsgid=70 tty=(none) ses=4294967295 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon" subj=system_u:system_r:avahi_t:s0 key=(null) ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

avahi wants getcap
by Tom London 25 Feb '08

25 Feb '08

Running rawhide: avahi-0.6.22-7.fc9.i386, selinux-policy-3.3.0-1.fc9.noarch Appears avahi needs getcap: type=AVC msg=audit(1203904427.662:13): avc: denied { getcap } for pid=2255 comm="avahi-daemon" scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:avahi_t:s0 tclass=process type=SYSCALL msg=audit(1203904427.662:13): arch=40000003 syscall=184 success=no exit=-13 a0=8a1a78c a1=0 a2=4cb0f0 a3=8a1a788 items=0 ppid=1 pid=2255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon" subj=system_u:system_r:avahi_t:s0 key=(null) type=AVC msg=audit(1203904427.665:14): avc: denied { getcap } for pid=2255 comm="avahi-daemon" scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:avahi_t:s0 tclass=process type=SYSCALL msg=audit(1203904427.665:14): arch=40000003 syscall=184 success=no exit=-13 a0=8a1b454 a1=0 a2=4cb0f0 a3=8a1b450 items=0 ppid=1 pid=2255 auid=4294967295 uid=70 gid=70 euid=70 suid=70 fsuid=70 egid=70 sgid=70 fsgid=70 tty=(none) ses=4294967295 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon" subj=system_u:system_r:avahi_t:s0 key=(null) -- Tom London

2 1

periodic policy audits
by Bill Nottingham 22 Feb '08

22 Feb '08

Again, looking through the policy I see sections for policy to confine cardmgr, /etc/hotplug scripts, updfstab, etc. Do we do any routine policy updates to purge obsolete policy? If not, should we? Bill

3 2

SELinux is preventing ntpd (ntpd_t) "getcap" to <Unknown> (ntpd_t)
by Antonio Olivares 21 Feb '08

21 Feb '08

Summary: SELinux is preventing ntpd (ntpd_t) "getcap" to <Unknown> (ntpd_t). Detailed Description: SELinux denied access requested by ntpd. It is not expected that this access is required by ntpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:ntpd_t Target Context unconfined_u:system_r:ntpd_t Target Objects None [ process ] Source ntpdate Source Path /usr/sbin/ntpdate Port <Unknown> Host localhost Source RPM Packages ntp-4.2.4p4-3.fc9 Target RPM Packages Policy RPM selinux-policy-3.2.9-1.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name localhost Platform Linux localhost 2.6.25-0.40.rc1.git2.fc9 #1 SMP Wed Feb 13 17:55:35 EST 2008 i686 athlon Alert Count 2 First Seen Thu 21 Feb 2008 10:58:12 AM CST Last Seen Thu 21 Feb 2008 10:58:20 AM CST Local ID ad5db6a3-d94d-4ee7-87ca-e8ea7b0196ea Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1203613100.285:81): avc: denied { getcap } for pid=14697 comm="ntpd" scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:system_r:ntpd_t:s0 tclass=process host=localhost type=SYSCALL msg=audit(1203613100.285:81): arch=40000003 syscall=184 success=no exit=-13 a0=b8e93444 a1=0 a2=2ad0f0 a3=b8e93440 items=0 ppid=1 pid=14697 auid=500 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=2 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null) ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

"getcap" AVCs ....
by Tom London 21 Feb '08

21 Feb '08

Running selinux-policy-targeted-3.2.9-1.fc9.noarch type=AVC msg=audit(1203608392.877:5): avc: denied { getcap } for pid=2231 comm="dbus-daemon" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=process type=SYSCALL msg=audit(1203608392.877:5): arch=40000003 syscall=184 success=no exit=-14 a0=b93db7f4 a1=0 a2=1a20f0 a3=b93db7f0 items=0 ppid=1 pid=2231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dbus-daemon" exe="/bin/dbus-daemon" subj=system_u:system_r:system_dbusd_t:s0 key=(null) and type=AVC msg=audit(1203608414.575:14): avc: denied { getcap } for pid=2295 comm="ntpd" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:system_r:ntpd_t:s0 tclass=process type=SYSCALL msg=audit(1203608414.575:14): arch=40000003 syscall=184 success=no exit=-14 a0=b8ab14cc a1=0 a2=2ad0f0 a3=b8ab14c8 items=0 ppid=1 pid=2295 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null) tom -- Tom London

2 1

Re: SELinux smolt stats
by James Morris 20 Feb '08

20 Feb '08

On Wed, 20 Feb 2008, Valent Turkovic wrote: > James Morris wrote: > > It seems that the SELinux enablement stats are now online -- thanks! > > > > I have a question about what the numbers mean. The current values are: > > > > SELinux Enabled > > False 185085 53.3 % True 162262 46.7 % > > If this arguments are true for Fedora 8 than it looks like that more people > dislike selinux than like it, right? Why did you delete the rest of the email, which queried these numbers and suggested that the real figure for enablement was much higher? btw, I asked off-list for a raw SQL query for just F8 systems (which have been reporting SELinux stats all along), and the "Enabled=True" value is currently 94%. It's not clear to me what these numbers really mean, and I think it may be some time before we are able to really see what's happening (e.g. between smolt changes, initial reports, re-reporting, different distro versions with different levels of usability, permissive vs. enforcing etc.). - James -- James Morris <jmorris(a)namei.org>

3 3

Relocate directories (e.g. tmp): how?
by S P Arif Sahari Wibowo 20 Feb '08

20 Feb '08

Hi! Is there any generic and straighforward way to adjust SELinux to allow a functional directories replaced by a symlink to other location? For example, I have always been relocate the tmp and var directories in one separate volume (rapid changing content). Usually the volume will be mounted on /var and /tmp is a symlink to var/tmp. This arrangement has been working well for me until RHEL / CentOS 4. Then when I tried Fedora 8, this setup stop working: SELinux stop some program - e.g. Xorg and dhcp client - to work with this tmp symlink. Is there a mechanism to tell SELinux to treat everything under /var/tmp the same as under /tmp? Thanks! -- (stephan paul) Arif Sahari Wibowo _____ _____ _____ _____ /____ /____/ /____/ /____ _____/ / / / _____/ http://www.arifsaha.com/ Xinnian Kuaile! 新年快樂 Gongxi Facai 恭喜發財

3 3

mailman doesn't receive messages from sendmail on fresh F8 install
by Edward Kuns 20 Feb '08

20 Feb '08

I freshly installed F8 on a new box, then copied the mailman and sendmail configuration over from the old box. I made sure everything was labeled correctly with "restorecon -r -v /etc" and the same for /var where mailman lives. The web pages work, but if I try to send a message to any list, I get SELinux alerts that prevent the message from going through. I don't believe I was using selinux on the old machine. I know I could just set selinux to permissive mode and this would probably work, but I'd rather understand what the problem is and fix it. Below are the selinux complaints generated from trying to send to the mailman test list on my server: Any ideas on what I can do to fix this? I've been googling for a couple hours and haven't found anything that fits this situation exactly. Thanks Eddie Summary SELinux is preventing python (sendmail_t) "search" to <Unknown> (mailman_log_t). Detailed Description SELinux denied access requested by python. It is not expected that this access is required by python and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:sendmail_t:s0 Target Context system_u:object_r:mailman_log_t:s0 Target Objects None [ dir ] Affected RPM Packages Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 15 First Seen Mon 18 Feb 2008 09:18:28 AM CST Last Seen Mon 18 Feb 2008 01:06:39 PM CST Local ID 78d260f8-f1d3-49b3-bea6-bc0cc400735c Line Numbers Raw Audit Messages avc: denied { search } for comm=python dev=dm-2 egid=41 euid=8 exe=/usr/bin/python exit=-13 fsgid=41 fsuid=8 gid=41 items=0 name=mailman pid=12198 scontext=system_u:system_r:sendmail_t:s0 sgid=41 subj=system_u:system_r:sendmail_t:s0 suid=8 tclass=dir tcontext=system_u:object_r:mailman_log_t:s0 tty=(none) uid=8 Summary SELinux is preventing python (sendmail_t) "getattr" to /var/lib/mailman/lists/mailman/config.pck (mailman_data_t). Detailed Description SELinux denied access requested by python. It is not expected that this access is required by python and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /var/lib/mailman/lists/mailman/config.pck, restorecon -v /var/lib/mailman/lists/mailman/config.pck If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:sendmail_t:s0 Target Context system_u:object_r:mailman_data_t:s0 Target Objects /var/lib/mailman/lists/mailman/config.pck [ file ] Affected RPM Packages Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 1 First Seen Mon 18 Feb 2008 01:06:39 PM CST Last Seen Mon 18 Feb 2008 01:06:39 PM CST Local ID 5d954998-3826-4af2-9569-0295ae134c27 Line Numbers Raw Audit Messages avc: denied { getattr } for comm=python dev=dm-2 egid=41 euid=8 exe=/usr/bin/python exit=-13 fsgid=41 fsuid=8 gid=41 items=0 path=/var/lib/mailman/lists/mailman/config.pck pid=12198 scontext=system_u:system_r:sendmail_t:s0 sgid=41 subj=system_u:system_r:sendmail_t:s0 suid=8 tclass=file tcontext=system_u:object_r:mailman_data_t:s0 tty=(none) uid=8 Summary SELinux is preventing python (sendmail_t) "getattr" to /var/lib/mailman/lists/mailman/config.pck.last (mailman_data_t). Detailed Description SELinux denied access requested by python. It is not expected that this access is required by python and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /var/lib/mailman/lists/mailman/config.pck.last, restorecon -v /var/lib/mailman/lists/mailman/config.pck.last If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:sendmail_t:s0 Target Context system_u:object_r:mailman_data_t:s0 Target Objects /var/lib/mailman/lists/mailman/config.pck.last [ file ] Affected RPM Packages Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 1 First Seen Mon 18 Feb 2008 01:06:39 PM CST Last Seen Mon 18 Feb 2008 01:06:39 PM CST Local ID 37d2b949-06bf-4cb0-845e-6aa41a16076c Line Numbers Raw Audit Messages avc: denied { getattr } for comm=python dev=dm-2 egid=41 euid=8 exe=/usr/bin/python exit=-13 fsgid=41 fsuid=8 gid=41 items=0 path=/var/lib/mailman/lists/mailman/config.pck.last pid=12198 scontext=system_u:system_r:sendmail_t:s0 sgid=41 subj=system_u:system_r:sendmail_t:s0 suid=8 tclass=file tcontext=system_u:object_r:mailman_data_t:s0 tty=(none) uid=8

2 8

Problem with apache accessing files outside of /var/www/html directory
by David Bartmess 19 Feb '08

19 Feb '08

I'm trying to get apache to serve up via a CGI script the formatted contents of a directory outside of the DocumentRoot directory structure, and SELinux is giving me a "Permissions Denied" error. How can I modify the SELinux context on the files being shown to fix this? The current files/dirs have the following context: drwxr-xr-x apache apache system_u:object_r:default_t v1x3x3_R3-6 drwxr-xr-x apache apache system_u:object_r:default_t v1x3x4-R1-0 drwxr-xr-x apache apache system_u:object_r:default_t v1x3x4-R2-0 -rwxr-xr-x apache apache system_u:object_r:default_t ASUCTests_v1-2-3_b1x3x4.R2_JUnitReport.zip -rwxr-xr-x apache apache system_u:object_r:default_t Emma_Acquisition_Configuration_v2-3-0.zip I'm a newbie at this SELinux stuff, so please speak clearly <grin> David Bartmess. Configuration Manager Cell: +1 (303) 883-9117 Office:+1 (303) 256-5123

4 3

[F8] (Re)Starting httpd reveals php pdf.so stack permission errors...
by Dan Thurman 19 Feb '08

19 Feb '08

# setenforce 1 (If set to 0, no following errors are generated) # service httpd restart <Generates the following errors> /etc/log/httpd/errors_log: ================= PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/pdf.so' - libpdf.so.6: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0 # ls -lZ /usr/lib/php/modules/pdf.so -rwxr-xr-x root root system_u:object_r:textrel_shlib_t:s0 /usr/lib/php/modules/pdf.so # find / -xdev -name libpdf.so.6 <does not exist> /etc/log/audit/audit_log: =============== type=AVC msg=audit(1203285527.123:3893): avc: denied { execstack } for pid=21241 comm="httpd" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process type=SYSCALL msg=audit(1203285527.123:3893): arch=40000003 syscall=125 success=no exit=-13 a0=bfca1000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1 pid=21241 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) SEAlert: ================================================= Summary SELinux is preventing /usr/sbin/httpd (httpd_t) "execstack" to <Unknown> (httpd_t). Detailed Description SELinux denied access requested by /usr/sbin/httpd. It is not expected that this access is required by /usr/sbin/httpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:httpd_t:s0 Target Context system_u:system_r:httpd_t:s0 Target Objects None [ process ] Affected RPM Packages httpd-2.2.8-1.fc8 [application] Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall Host Name gold.cdkkt.com Platform Linux gold.cdkkt.com 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 10 First Seen Sun 17 Feb 2008 04:50:41 AM PST Last Seen Sun 17 Feb 2008 01:46:21 PM PST Local ID b2d0de85-f78b-4945-8d01-1ef26660fe47 Line Numbers Raw Audit Messages avc: denied { execstack } for comm=httpd egid=0 euid=0 exe=/usr/sbin/httpd exit=-13 fsgid=0 fsuid=0 gid=0 items=0 pid=20396 scontext=system_u:system_r:httpd_t:s0 sgid=0 subj=system_u:system_r:httpd_t:s0 suid=0 tclass=process tcontext=system_u:system_r:httpd_t:s0 tty=(none) uid=0

3 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2008