selinux May 2008

selinux@lists.fedoraproject.org

36 participants
50 discussions

Stuck in init_t
by Sciola, Dario 14 May '08

14 May '08

Classification: UNCLASSIFIED Hi, I've got a small application that I'm trying to get running as a service on and FC8 SELinux box. I've got an entry in my inittab file to kick start the app, but all my attempts at writing an appropriate policy leaves that app running in the init_t domain. The inittab file entry is: cds:2345:respawn:/usr/bin/CDSserver -l -p 2732 ps -efZ (observing this as a 'root' user) gives: system_u:system_r:init_t:s0 root 2663 1 0 10:01 ? 00:00:00 /usr/bin/CDSserver -l -p 2732 My .te file contains: policy_module(cdsserver,1.0.3) ######################################## # # Declarations # ######################################## # Type declarations ################### # the target domain: type cds_t; # Entrypoint for exec type cds_exec_t; # domain type #domain_type(cds_t) # Mark cds_t as a domain and cds_exec_t as an entrypoint init_daemon_domain(cds_t, cds_exec_t) domain_entry_file(cds_t, cds_exec_t) allow cds_t self:process execmem; ... My .fc file contains: /usr/bin/CDSserver -- gen_context(system_u:object_r:cds_exec_t,s0) My .if file contains: interface(`cds_domtrans',` gen_require(` type cds_t, cds_exec_t; ') domain_auto_trans($1,cds_exec_t,cds_t) allow $1 cds_t:fd use; allow cds_t $1:fd use; allow cds_t $1:fifo_file rw_file_perms; allow cds_t $1:process sigchld; ') I've also tried putting init_t as $1 in the domain_auto_trans() Why isn't the process transitioning to cds_t? I've looked at a lot of sites and examples and can't seem to figure out my problem. The policy is the targeted FC8 policy. Module compiles and loads (semodule) fine. # sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 21 Policy from config file: targeted Any ideas? Dario Sciola

2 1

RE: Samba shares...
by Dan Thurman 14 May '08

14 May '08

Stephen Smalley |Daniel B. Thurman wrote: |> |You can certainly generate a local policy module that gives |> |access to fusefs_t, but it would be better if we could get |> |the context mount option to work. |> |> I will try anything you suggest. Let me know if you can |> resolve this issue, otherwise let me know (in detail) how |> to write a policy as a last resort? | |To generate local policy for this issue, you'd do something like this: | |$ su - |# ausearch -m AVC | grep fuse | audit2allow -M myfuse |# semodule -i myfuse.pp | |Then the fuse-related denials should be allowed. Uh, almost. It still will not allow me to chmod or chgrp the mounted filesystem which means that I cannot write to the shared NTFS filesystem without assigning the proper permissions. I have set samba properties to allow writes but apparently this problem resides with fuse again. Grr. What can I do to allow samba shared writes? Thanks! Dan

3 2

FW: SELinux, apache/php and qmail's sendmail
by D. Hilbig 14 May '08

14 May '08

Can someone please help me with this? -----Original Message----- From: D. Hilbig [mailto:selinux@hilbig.name] Sent: Thursday, May 08, 2008 10:14 AM To: 'fedora-selinux-list(a)redhat.com' Subject: SELinux, apache/php and qmail's sendmail I use qmail instead of sendmail on RHEL v5 and I could use some advice on setting contexts for qmail's sendmail so that apache/php can use it. Below are the files and directories involved with qmail's sendmail (and delivery to queue) allow apache/php to invoke qmail's sendmail program: /var/qmail/bin/sendmail allow qmail's sendmail to invoke qmail-inject program: /var/qmail/bin/qmail-inject allow qmail-inject to list the contents of the config files directory: /var/qmail/control allow qmail-inject to read the config files it uses: /var/qmail/control/defaultdomain /var/qmail/control/deaulthost /var/qmail/control/idhost /var/qmail/control/plusdomain /var/qmail/control/me allow qmail-inject to invoke qmail-queue program: /var/qmail/bin/qmail-queue allow qmail-queue to read the config file used by the 'taps' patch: /var/qmail/control/taps allow qmail-queue to put a message into the queue: (create, edit, delete and link files) /var/qmail/queue/pid (and subdirectories) /var/qmail/queue/mess (and subdirectories) /var/qmail/queue/intd (and subdirectories) /var/qmail/queue/todo (and subdirectories) For testing I specified the context "httpd_sys_content_t" but I know that it isn't the desired context. What context(s) should I specify for the aforementioned programs, directories and configuration files? Are there any other things I should do or consider besides setting the context(s)? Your guidance is greatly appreciated.

2 1

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

Stephen Smalley wrote: |On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote: |> Daniel B. Thurman wrote: |> |Stephen Smalley |> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote: |> ||> Stephen Smalley wrote: |> ||> >> Daniel B. Thurman wrote: |> ||> >> I am not sure what is going on. I am unable to get |> ||> >> samba shares to work for an NTFS filesystem. I do |> ||> >> have several shares working for ext3 filesystems. |> ||> >> |> ||> >> Here is what I did: |> ||> >> |> ||> >> 1) Create an empty directory: /AV |> ||> >> 2) chcon -t samba_share_t /AV |> ||> >> 3) chmod 775 !$ |> ||> >> 4) chgrp avusers !$ |> ||> >> 5) Add to fstab |> ||> >> /dev/sda1 /AV ntfs defaults 1 2 |> | [snipped!] |> || |> ||It is just another mount option, so you can just do something like: |> ||/dev/sda1 /AV ntfs |> |defaults,context=system_u:object_r:samba_share_t 1 2 |> | |> |Yes, I thought so. I tried that and the context does not |> |change. Any ideas? |> |> Mounting an NTFS filesystem even with context options, |> the context always remains as fusefs_t. I am allowed |> to change the context on the directory before the mount, |> but not after the mount. After mounting, I am not allowed |> to chcon the mounted FS as it says that the Operation is |> not allowed. | |Can you confirm that if you umount /AV and then mount it with the |context= option that it really doesn't work for you? You do have to |umount it though if you previously mounted it w/o the context option to |make the option take affect. Yes, I can confirm that adding context= to the option line in /etc/fstab does not seem to do anything, i.e. the context does not change and remains fusefs_t. I tried several times, and even tried the fscontext= as well, neither seems to work. I was forced to reboot sometimes since I was not at times able to unmount the /AV filesystem, it sometimes reports that the /AV filesystem was 'busy'. This seems to happen if I mount/unmount several times then it says 'busy', preventing me from unmounting. Hmm. |I'm not sure why a context mount option wouldn't work for fuse - Eric? | |fuse itself won't let you chcon (setxattr) the files unless the |filesystem supports setxattr, which is why you get Operation not |supported there. | |> I even tried: setsebool -P samba_export_all_rw=1 and that |> does not work, either. |> |> If I setenforce 0, I can share the NTFS filesystem, but I |> really do not want to do this. Can someone please give me |> a workaround? | |You can certainly generate a local policy module that gives access to |fusefs_t, but it would be better if we could get the context mount |option to work. I will try anything you suggest. Let me know if you can resolve this issue, otherwise let me know (in detail) how to write a policy as a last resort? Thanks much! Dan

3 2

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

Daniel B. Thurman wrote: |Daniel J Walsh [ snip! ] ||This looks like a bug. |Seems so. Also, I tried disabling the fuse service |and rebooted and for some reason, the fusefs still |runs? It still mounts /media files even when this |service is so-called disabled? I went back to look |to see if the service was running (it wasn't) and |even tried ps -ef| grep fuse (finding no match), so |why is fuse filesystem still running? Is that a major |bug or is it that the fuse service has no relation to |the fusefs? | |Well, can I have a policy work around or will it fail |anyway due to fuse? | |BTW: I am running Fedora F8. Oh man.... This is what I did: 1) Disable the fuse service permemantly 2) Unmount all fuse filesystems (as root) 3) rmmod fuse 4) lsmod| grep fuse (make sure fuse module is NOT loaded) 5) mount /dev/sda1 /AV -t ntfs -o context=system_u:object_r:samba_share_t 6) lsmod|grep fuse (module is reloaded!) 7) ls -ldZ /AV shows fusefs_t context. So it looks like there is no possible way to get rid of the fuse filesystem module, mount seems to force a fuse filesystem regardless of attempts NOT to do so! Grrr.... Well, please let me know what to do at this point. Seems I have to wait or to setenforce 0 for now until this fix for F8 appears upstream? Thanks for all your time guys! Dan

1 0

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

Daniel J Walsh |Daniel B. Thurman wrote: |> Stephen Smalley wrote: |> |On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote: |> |> Daniel B. Thurman wrote: |> |> |Stephen Smalley |> |> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote: |> |> ||> Stephen Smalley wrote: |> |> ||> >> Daniel B. Thurman wrote: |> |> ||> >> I am not sure what is going on. I am unable to get |> |> ||> >> samba shares to work for an NTFS filesystem. I do |> |> ||> >> have several shares working for ext3 filesystems. |> |> ||> >> |> |> ||> >> Here is what I did: |> |> ||> >> |> |> ||> >> 1) Create an empty directory: /AV |> |> ||> >> 2) chcon -t samba_share_t /AV |> |> ||> >> 3) chmod 775 !$ |> |> ||> >> 4) chgrp avusers !$ |> |> ||> >> 5) Add to fstab |> |> ||> >> /dev/sda1 /AV ntfs defaults 1 2 |> |> | [snipped!] |> |> || |> |> ||It is just another mount option, so you can just do |something like: |> |> ||/dev/sda1 /AV ntfs |> |> |defaults,context=system_u:object_r:samba_share_t 1 2 |> |> | |> |> |Yes, I thought so. I tried that and the context does not |> |> |change. Any ideas? |> |> |> |> Mounting an NTFS filesystem even with context options, |> |> the context always remains as fusefs_t. I am allowed |> |> to change the context on the directory before the mount, |> |> but not after the mount. After mounting, I am not allowed |> |> to chcon the mounted FS as it says that the Operation is |> |> not allowed. |> | |> |Can you confirm that if you umount /AV and then mount it with the |> |context= option that it really doesn't work for you? You do have to |> |umount it though if you previously mounted it w/o the |context option to |> |make the option take affect. |> |> Yes, I can confirm that adding context= to the option line |> in /etc/fstab does not seem to do anything, i.e. the context |> does not change and remains fusefs_t. I tried several times, |> and even tried the fscontext= as well, neither seems to work. |> |> I was forced to reboot sometimes since I was not at times |> able to unmount the /AV filesystem, it sometimes reports |> that the /AV filesystem was 'busy'. This seems to happen |> if I mount/unmount several times then it says 'busy', |> preventing me from unmounting. Hmm. |> |> |I'm not sure why a context mount option wouldn't work for |fuse - Eric? |> | |> |fuse itself won't let you chcon (setxattr) the files unless the |> |filesystem supports setxattr, which is why you get Operation not |> |supported there. |> | |> |> I even tried: setsebool -P samba_export_all_rw=1 and that |> |> does not work, either. |> |> |> |> If I setenforce 0, I can share the NTFS filesystem, but I |> |> really do not want to do this. Can someone please give me |> |> a workaround? |> | |> |You can certainly generate a local policy module that gives |access to |> |fusefs_t, but it would be better if we could get the context mount |> |option to work. |> |> I will try anything you suggest. Let me know if you can |> resolve this issue, otherwise let me know (in detail) how |> to write a policy as a last resort? |> |> Thanks much! |> Dan |This looks like a bug. Seems so. Also, I tried disabling the fuse service and rebooted and for some reason, the fusefs still runs? It still mounts /media files even when this service is so-called disabled? I went back to look to see if the service was running (it wasn't) and even tried ps -ef| grep fuse (finding no match), so why is fuse filesystem still running? Is that a major bug or is it that the fuse service has no relation to the fusefs? Well, can I have a policy work around or will it fail anyway due to fuse? BTW: I am running Fedora F8. Thanks! Dan

1 0

NFSv4 and SELinux
by Hervé WERNER 13 May '08

13 May '08

Hi. I've just installed Fedora 9 today in order to test NFSv4 through SELinux. I know that sending context across the wire is still in progress, but could I find some patch to test? Is there anything I could test to make it work? I also would like to make the context mount option work with NFSv4. The mount command doesn't give any error at mounting but when I list the context of the NFSv4 mount point I get "system_u:object_r:nfs_t". Is there any way to set context for the mounted points? Any help would be appreciated.

3 2

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

Daniel B. Thurman wrote: |Stephen Smalley ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote: ||> Stephen Smalley wrote: ||> >> Daniel B. Thurman wrote: ||> >> I am not sure what is going on. I am unable to get ||> >> samba shares to work for an NTFS filesystem. I do ||> >> have several shares working for ext3 filesystems. ||> >> ||> >> Here is what I did: ||> >> ||> >> 1) Create an empty directory: /AV ||> >> 2) chcon -t samba_share_t /AV ||> >> 3) chmod 775 !$ ||> >> 4) chgrp avusers !$ ||> >> 5) Add to fstab ||> >> /dev/sda1 /AV ntfs defaults 1 2 | [snipped!] || ||It is just another mount option, so you can just do something like: ||/dev/sda1 /AV ntfs |defaults,context=system_u:object_r:samba_share_t 1 2 | |Yes, I thought so. I tried that and the context does not |change. Any ideas? Mounting an NTFS filesystem even with context options, the context always remains as fusefs_t. I am allowed to change the context on the directory before the mount, but not after the mount. After mounting, I am not allowed to chcon the mounted FS as it says that the Operation is not allowed. I even tried: setsebool -P samba_export_all_rw=1 and that does not work, either. If I setenforce 0, I can share the NTFS filesystem, but I really do not want to do this. Can someone please give me a workaround? Thanks- Dan

3 2

NFSv4 and SELinux
by Hervé WERNER 13 May '08

13 May '08

1 0

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2008