selinux March 2008

selinux@lists.fedoraproject.org

30 participants
57 discussions

SELinux is preventing access to files with the label, file_t.
by Antonio Olivares 04 Mar '08

04 Mar '08

Dear all, I have done this before : "touch /.autorelabel; reboot" several days pass and I see this file_t again and I have to do "in quote" this again . What is file_t anyway? I do not know of any in my system. Thanks, Antonio Summary: SELinux is preventing access to files with the label, file_t. Detailed Description: SELinux permission checks on files labeled file_t are being denied. file_t is the context the SELinux kernel gives to files that do not have a label. This indicates a serious labeling problem. No files on an SELinux box should ever be labeled file_t. If you have just added a new disk drive to the system you can relabel it using the restorecon command. Otherwise you should relabel the entire files system. Allowing Access: You can execute the following command as root to relabel your computer system: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:tmpreaper_t Target Context system_u:object_r:file_t Target Objects ./virtual-olivares.1dNZIJ [ dir ] Source tmpwatch Source Path /usr/sbin/tmpwatch Port <Unknown> Host localhost Source RPM Packages tmpwatch-2.9.13-2 Target RPM Packages Policy RPM selinux-policy-3.3.1-9.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name file Host Name localhost Platform Linux localhost 2.6.25-0.80.rc3.git2.fc9 #1 SMP Fri Feb 29 18:17:34 EST 2008 i686 athlon Alert Count 1 First Seen Mon 03 Mar 2008 10:01:18 AM CST Last Seen Mon 03 Mar 2008 10:01:18 AM CST Local ID 08676827-232c-4027-aa44-9431e45d6d53 Line Numbers Raw Audit Messages host=localhost type=AVC msg=audit(1204560078.2:50): avc: denied { rmdir } for pid=32386 comm="tmpwatch" name="virtual-olivares.1dNZIJ" dev=dm-0 ino=31391789 scontext=system_u:system_r:tmpreaper_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir host=localhost type=SYSCALL msg=audit(1204560078.2:50): arch=40000003 syscall=40 success=no exit=-13 a0=960ec33 a1=28 a2=960f1a0 a3=960ec33 items=0 ppid=32384 pid=32386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0 key=(null) ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

mock context needs updating
by Paul Howarth 04 Mar '08

04 Mar '08

Since mock 0.9.x (I think), mock has dropped the SUID helper and become a consolehelper-based application. So /usr/bin/mock, which used to be a regular file labelled as unconfined_notrans_exec_t, is now a symlink to /usr/sbin/mock. As a result of this, mock now does domain transitions and that results in some AVCs. I think that labelling /usr/sbin/mock as unconfined_notrans_exec_t should fix it. I believe this currently affects Fedora 8 and Rawhide but not (yet) Fedora 7. Paul.

1 0

logrotate_t wants ptrace to the masses.... ;)
by Tom London 03 Mar '08

03 Mar '08

Running current Rawhide, logrotate must have kicked in and generated lots of AVCs when in enforcing mode. All of them are for ptrace: #============= logrotate_t ============== allow logrotate_t NetworkManager_t:process ptrace; allow logrotate_t apmd_t:process ptrace; allow logrotate_t audisp_t:process ptrace; allow logrotate_t auditd_t:process ptrace; allow logrotate_t consolekit_t:process ptrace; allow logrotate_t crond_t:process ptrace; allow logrotate_t cupsd_t:process ptrace; allow logrotate_t dhcpc_t:process ptrace; allow logrotate_t entropyd_t:process ptrace; allow logrotate_t fsdaemon_t:process ptrace; allow logrotate_t getty_t:process ptrace; allow logrotate_t hald_t:process ptrace; allow logrotate_t init_t:process ptrace; allow logrotate_t initrc_t:process ptrace; allow logrotate_t klogd_t:process ptrace; allow logrotate_t mount_t:process ptrace; allow logrotate_t restorecond_t:process ptrace; allow logrotate_t self:capability sys_ptrace; allow logrotate_t self:process ptrace; allow logrotate_t setrans_t:process ptrace; allow logrotate_t setroubleshootd_t:process ptrace; allow logrotate_t sshd_t:process ptrace; allow logrotate_t syslogd_t:process ptrace; allow logrotate_t system_crond_t:process ptrace; allow logrotate_t udev_t:process ptrace; allow logrotate_t unconfined_t:process ptrace; allow logrotate_t xdm_t:process ptrace; allow logrotate_t xdm_xserver_t:process ptrace; Complete audit.log attached. tom -- Tom London

1 0

selinux interfering with dynamic dns
by Edward Kuns 03 Mar '08

03 Mar '08

I have dhcp + named set up to cooperate, but selinux (understandably) denies named write access to the files it needs to modify for dynamic dns updates. I have created the following policy. Is there a better way of doing this? Best would be if there was a way to allow write access *only* to those handful of files in /var/named/chroot/var/named that are truly dynamic, perhaps by labeling. Would it be possible or reasonable to add named_dynamic_zone_t or some equivalent? Is there a better way to solve this problem or am I missing some already-available mechanism? Thanks Eddie module mybind 1.0; require { type named_t; type named_zone_t; class file write; } #============= named_t ============== allow named_t named_zone_t:file write; -- Edward Kuns <ekuns(a)kilroy.chi.il.us>

2 1

SELinux interfering with clamav?
by Edward Kuns 02 Mar '08

02 Mar '08

A couple times a day (23 times in 10 days), I get the following AVC: Summary SELinux is preventing /usr/sbin/clamav-milter (clamd_t) "search" to <Unknown> (bin_t). Detailed Description SELinux denied access requested by /usr/sbin/clamav-milter. It is not expected that this access is required by /usr/sbin/clamav-milter and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:clamd_t:s0 Target Context system_u:object_r:bin_t:s0 Target Objects None [ dir ] Affected RPM Packages clamav-milter-0.92.1-1.fc8 [application] Policy RPM selinux-policy-3.0.8-84.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8 #1 SMP Sun Feb 10 17:48:34 EST 2008 i686 i686 Alert Count 23 First Seen Wed 20 Feb 2008 12:25:16 PM CST Last Seen Thu 28 Feb 2008 09:11:28 PM CST Local ID 7eb02331-c2e4-4c65-a413-d283fbb7ca6f Line Numbers Raw Audit Messages avc: denied { search } for comm=clamav-milter dev=dm-0 egid=486 euid=492 exe=/usr/sbin/clamav-milter exit=-13 fsgid=486 fsuid=492 gid=486 items=0 name=bin pid=13663 scontext=system_u:system_r:clamd_t:s0 sgid=486 subj=system_u:system_r:clamd_t:s0 suid=492 tclass=dir tcontext=system_u:object_r:bin_t:s0 tty=(none) uid=492 I assume that we want to allow clamav to scan anything on the system, yes? If I follow the advice from an earlier Email and try the following: grep clamav /var/log/audit/audit.log | audit2allow -M clamav I get a file that contains: module clamav 1.0; require { type bin_t; type clamd_t; class dir search; } #============= clamd_t ============== allow clamd_t bin_t:dir search; Is this something that should be part of standard policy? Hmm, I try to install the above policy and get a complaint: # semodule -i clamav.pp libsepol.print_missing_requirements: clamav's global requirements were not met: type/attribute clamd_t libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! Any thoughts? Thanks Eddie -- Edward Kuns <ekuns(a)kilroy.chi.il.us>

2 7

segatex-5.30 released
by Shintaro Fujiwara 02 Mar '08

02 Mar '08

I released segatex-5.30. Incorporated aureport. almost all the options you can enjoy. http://sourceforge.net/projects/segatex/ ####################################### About segatex segatex is a program even if not knowing much about SELinux commands, can easily set SELinux commands by GUI. Written in C++. Requires Qt ( qt-devel package ). ####################################### -- http://intrajp.no-ip.com/ Home Page

1 0

SELinux PHP setup, how ?
by Kuang-Chun Cheng 01 Mar '08

01 Mar '08

Hi, I'm new to RH5.x/SELinux. I have a simple PHP script which will call passthru() or exec() to invoke "/bin/ls" or other external commands to do some taskes. The SELinux (targeted policy) deny the action by default. Following the message in sealert which ask me to relabel /bin/ls to allow httpd to invoke /bin/ls from my PHP (ls.php) ... well, it's OK ... but I'm wondering if I can only limit invoking "/bin/ls" from ONLY my "ls.php". So, other PHP still can't call exec() to invoke "/bin/ls". Is this possible in targeted policy ? Thanks KC

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2008