selinux June 2008

selinux@lists.fedoraproject.org

32 participants
34 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

rsyncd can't open log file, but there are no avc messages
by Johnny Tan 09 Jul '08

09 Jul '08

I'm stumped. I run a Java app called Solr, which does search indexing. My solr server creates the index, then I have a bunch of solr clients that rsync that index over. The rsync itself is fine, that works. The problem is it won't write to the appropriate logfile, which is: /opt/solr/logs/rsyncd.log /opt/solr/logs is a symlink to /var/log/store. Here's how it looks: == [root@solr:~]# ls -l /opt/solr/ lrwxrwxrwx 1 tomcat tomcat 14 Apr 29 13:52 logs -> /var/log/store [root@solr:~]# ls -ldZ /opt/solr/logs/ drwxr-xr-x tomcat tomcat user_u:object_r:var_log_t /opt/solr/logs/ [root@solr:~]# ls -ldZ /var/log/store drwxr-xr-x tomcat tomcat user_u:object_r:var_log_t /var/log/store [root@solr:~]# ls -Z /opt/solr/logs/rsyncd.log -rw-rw-rw- tomcat tomcat user_u:object_r:var_log_t /var/log/store/rsyncd.log == Note that the mode is 666 on the rsyncd.log. When a client tries to connect, though, I get, in /var/log/messages: Jun 24 10:15:02 solr rsyncd[19355]: rsync: failed to open log-file /opt/solr/logs/rsyncd.log: Permission denied (13) But there are no avc denials (no, I don't have audit package installed, so all avc messages go to /var/log/messages -- I do get avc denials for other things). So, at first, I didn't think it was selinux-related, and tried to troubleshoot general unix permissions. But got nowhere. Then I noticed... when I put selinux in permissive mode, it works -- rsyncd properly logs to the above file. When I set it back to enforcing, I get the above error in /var/log/messages and nothing in the rsyncd.log, but no avc denials either. Any ideas? If it helps, here's how my rsyncd module looks like: == module solrrsync 1.0; require { type initrc_tmp_t; type port_t; type var_log_t; type restorecon_t; type rsync_t; type usr_t; class netlink_route_socket { read create bind getattr write nlmsg_read }; class lnk_file read; class file { read write getattr create append }; class tcp_socket { name_connect name_bind }; class dir { write add_name }; } #============= restorecon_t ============== allow restorecon_t initrc_tmp_t:file { read write }; allow restorecon_t usr_t:lnk_file read; allow restorecon_t var_log_t:lnk_file read; #============= rsync_t ============== allow rsync_t initrc_tmp_t:file { read write }; allow rsync_t port_t:tcp_socket { name_connect name_bind }; allow rsync_t self:netlink_route_socket { read create bind getattr write nlmsg_read }; allow rsync_t usr_t:lnk_file read; allow rsync_t usr_t:file { read getattr }; allow rsync_t var_log_t:lnk_file read; allow rsync_t var_log_t:dir { write add_name }; allow rsync_t var_log_t:file { read write getattr create append };

6 16

Creating a custom user role
by Jonathan Stott 03 Jul '08

03 Jul '08

Hi I'm on FC9, and I would like to create a user based on guest_u who is almost as unprivileged as that role, but is allowed to ssh out. So I opened up the polgengui tool kit and selected 'minimal terminal user role' I then also allowed it access to the guest role as an additional role. (I'm not sure if this step is required) I then allowed the role to connect to port 22 And then made the policy files. On running the script, I got the message '/usr/sbin/semanage: You must specify a prefix', which lead me to look a little closer at the generated file. One thing I noticed was that amongst the roles to be assigned to the new role was 'system_r', which I believe is the system administration role, so removing that and adding a prefix of user, I could then run the script and install the role. Adding it as the role for the user I want to allow ssh access out to, I then tried to login, which got me the message Unable to get valid context for username Setting the user to guest_u or user_u works fine, though. What did I do wrong? Regards, Jonathan.

2 1

xinetd rsync --daemon problems
by Chuck Anderson 03 Jul '08

03 Jul '08

I'm using Fedora Core 6, and trying to start a rsync daemon via xinetd. The default configuration is: # default: off # description: The rsync server is a good addition to an ftp server, as it \ # allows crc checksumming etc. service rsync { disable = no socket_type = stream wait = no user = root server = /usr/bin/rsync server_args = --daemon log_on_failure += USERID } With this rsyncd.conf: motd file = /etc/rsyncd.motd pid file = /var/run/rsyncd.pid port = 873 uid = rsyncd gid = mirror use chroot = yes max connections = 10 log file = /var/log/rsyncd.log read only = yes hosts allow = 127.0.0.1, ::1, etc.... #hosts deny = 0.0.0.0/0, :: ignore nonreadable = yes transfer logging = yes timeout = 600 dont compress = * [fedora-linux-core] path = /srv/ftp/pub/fedora/linux/core comment = Fedora Linux Core [fedora-linux-core-updates] path = /srv/ftp/pub/fedora/linux/core/updates comment = Fedora Linux Core Updates [fedora-linux-extras] path = /srv/ftp/pub/fedora/linux/extras comment = Fedora Linux Extras [fedora-linux-core-test] path = /srv/ftp/pub/fedora/linux/core/test comment = Fedora Linux Core Test [fedora-linux-releases] path = /srv/ftp/pub/fedora/linux/releases comment = Fedora Linux Releases [fedora-linux-development] path = /srv/ftp/pub/fedora/linux/development comment = Fedora Linux Development [fedora-enchilada] path = /srv/ftp/pub/fedora comment = Fedora - The whole enchilada [fedora-linux-updates] path = /srv/ftp/pub/fedora/linux/updates comment = Fedora Linux Updates [fedora-web] path = /srv/ftp/pub/fedora/web comment = Web content for Fedora Linux mirrors I get these AVCs when running from xinetd and making a client connection that I don't get if I start the daemon directly via "rsync --daemon" as root: type=AVC msg=audit(1192132336.713:3464): avc: denied { lock } for pid=8488 comm="rsync" name="rsyncd.lock" dev=dm-4 ino=2064435 scontext=user_u:system_r:rsync_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file type=SYSCALL msg=audit(1192132336.713:3464): arch=40000003 syscall=221 success=no exit=-13 a0=4 a1=d a2=bff80730 a3=bff80730 items=0 ppid=8167 pid=8488 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) type=AVC_PATH msg=audit(1192132336.713:3464): path="/var/run/rsyncd.lock" type=AVC msg=audit(1192132400.044:3465): avc: denied { bind } for pid=8499 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192132400.044:3465): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf8f4674 a2=4df50ff4 a3=3 items=0 ppid=8167 pid=8499 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) I tried creating and loading a policy module: # grep "rsync" /var/log/audit/audit.log | audit2allow -M rsyncd # semodule -i rsyncd.pp Here is rsyncd.te: module rsyncd 1.0; require { type var_run_t; type rsync_t; class netlink_route_socket create; class file { read write }; } #============= rsync_t ============== allow rsync_t self:netlink_route_socket create; allow rsync_t var_run_t:file { read write }; But I still get these AVCs: type=AVC msg=audit(1192139751.238:3586): avc: denied { bind } for pid=9311 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192139751.238:3586): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfbb6144 a2=4df50ff4 a3=3 items=0 ppid=8732 pid=9311 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) Additionally, when using xinetd I don't ever get any log messages in /var/log/rsyncd.log like I do when I run "rsync --daemon" directly: 2007/10/11 17:08:01 [8613] rsyncd version 2.6.9 starting, listening on port 873 2007/10/11 17:08:13 [8616] connect from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 17:08:13 [8616] rsync on fedora-enchilada/linux/ from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 21:08:13 [8616] building file list 2007/10/11 21:08:13 [8616] sent 1629 bytes received 106 bytes total size 19

2 2

Fedora 9 SELinux is preventing sendmail (exim_t) "getattr" to pipe (system_crond_t)
by Frank Murphy 30 Jun '08

30 Jun '08

I think this has to do with exim trying to send logs? Should I actually bug-report? or just use the audit2allow -M local < /tmp/avcs Frank Summary: SELinux is preventing sendmail (exim_t) "getattr" to pipe (system_crond_t). Detailed Description: SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:exim_t:s0 Target Context system_u:system_r:system_crond_t:s0 Target Objects pipe [ fifo_file ] Source sendmail Source Path /usr/sbin/exim Port <Unknown> Host frank-01 Source RPM Packages exim-4.69-4.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-69.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name frank-01 Platform Linux frank-01 2.6.25.6-55.fc9.i686 #1 SMP Tue Jun 10 16:27:49 EDT 2008 i686 i686 Alert Count 3 First Seen Sat 28 Jun 2008 11:01:27 IST Last Seen Sat 28 Jun 2008 11:01:27 IST Local ID 675df78e-7627-418a-8d0b-2f9943cd7033 Line Numbers Raw Audit Messages host=frank-01 type=AVC msg=audit(1214647287.324:61): avc: denied { getattr } for pid=16267 comm="sendmail" path="pipe:[94447]" dev=pipefs ino=94447 scontext=system_u:system_r:exim_t:s0 tcontext=system_u:system_r:system_crond_t:s0 tclass=fifo_file host=frank-01 type=SYSCALL msg=audit(1214647287.324:61): arch=40000003 syscall=197 success=no exit=-13 a0=1 a1=bf812f64 a2=981ff4 a3=b805d84c items=0 ppid=1 pid=16267 auid=4294967295 uid=93 gid=93 euid=93 suid=93 fsuid=93 egid=93 sgid=93 fsgid=93 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/exim" subj=system_u:system_r:exim_t:s0 key=(null)

2 1

rsyncd and pre-xfer/post-xfer exec problem with FC8 selinux
by Przemysław Sztoch 29 Jun '08

29 Jun '08

Running fully updated Fedora 8, trying to upload somefiles via rsync, and getting a couple of denials (on server with xinetd&rsyncd): avc: denied { read } for pid=20530 comm="rsync" name="sh" dev=dm-0 ino=1507433 scontext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=lnk_file avc: denied { execute } for pid=20530 comm="rsync" name="bash" dev=dm-0 ino=1507343 sc ontext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { read } for pid=20530 comm="rsync" name="bash" dev=dm-0 ino=1507343 scont ext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { execute_no_trans } for pid=20530 comm="rsync" path="/bin/bash" dev=dm-0 ino=1507343 scontext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file avc: denied { getattr } for pid=20530 comm="sh" path="/bin/bash" dev=dm-0 ino=1507343 scontext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file My rsyncd.conf: use chroot = yes max connections = 50 log file = /var/log/rsync.log uid = autobackup gid = users [autobackup] path = /opt/autobackup read only = no write only = yes list = no uid = autobackup incoming chmod = u=rw,go-rwx transfer logging = yes pre-xfer exec = /usr/local/bin/autobackup-hook pre post-xfer exec = /usr/local/bin/autobackup-hook post What should I do to use pre/post scripts in rsync? -- View this message in context: http://www.nabble.com/rsyncd-and-pre-xfer-post-xfer-exec-problem-with-FC8-s… Sent from the Fedora SELinux List mailing list archive at Nabble.com.

2 2

segatex-6.50 released
by Shintaro Fujiwara 29 Jun '08

29 Jun '08

Hi, guys. I released segatex-6.50. ################################################## In this version... It pops up Widget when denied message happens. ################################################## It can do anything you need when you configure SELinux thing. Enjoy. http://sourceforge.net/projects/segatex/ -- http://intrajp.no-ip.com/ Home Page

1 0

audit2allow failure in rawhide
by Joe Nall 29 Jun '08

29 Jun '08

While playing with rawhide/mls/permissive+Ted Toth's wm policy: [root@xtest log]# audit2allow </var/log/Xorg.0.log Traceback (most recent call last): File "/usr/bin/audit2allow", line 344, in <module> app.main() File "/usr/bin/audit2allow", line 338, in main self.__output() File "/usr/bin/audit2allow", line 314, in __output g.add_role_types(self.__role_types) AttributeError: PolicyGenerator instance has no attribute 'add_role_types'

3 2

KVM image problems
by Adam Huffman 25 Jun '08

25 Jun '08

Having applied Dan Walsh's suggested fix for a SpamAssassin problem, I'm now seeing errors when running a virtual machine via KVM. The image was created in virt-install quite a while ago: -rwxr-xr-x root root system_u:object_r:xen_image_t XP1 However, after changing to enforcing mode I saw lots of these errors: > > Summary: > > SELinux is preventing qemu-kvm (qemu_t) "write" to /var/lib/xen/images/XP1 > (xen_image_t). > > Detailed Description: > > SELinux denied access requested by qemu-kvm. It is not expected that > this access > is required by qemu-kvm and this access may signal an intrusion > attempt. It is > also possible that the specific version or configuration of the > application is > causing it to require additional access. > > Allowing Access: > > Sometimes labeling problems can cause SELinux denials. You could try > to restore > the default system file context for /var/lib/xen/images/XP1, > > restorecon -v '/var/lib/xen/images/XP1' > > If this does not work, there is currently no automatic way to allow > this access. > Instead, you can generate a local policy module to allow this access - > see FAQ > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can > disable > SELinux protection altogether. Disabling SELinux protection is not > recommended. > Please file a bug report > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > against this package. > > Additional Information: > > Source Context system_u:system_r:qemu_t > Target Context user_u:object_r:xen_image_t > Target Objects /var/lib/xen/images/XP1 [ file ] > Source qemu-kvm > Source Path /usr/bin/qemu-kvm > Port <Unknown> > Host saintloup.smith.man.ac.uk > Source RPM Packages kvm-65-7.fc9 > Target RPM Packages > Policy RPM selinux-policy-3.3.1-64.fc9 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name catchall_file > Host Name saintloup.smith.man.ac.uk > Platform Linux saintloup.smith.man.ac.uk > 2.6.25.6-55.fc9.x86_64 #1 SMP Tue Jun 10 > 16:05:21 > EDT 2008 x86_64 x86_64 > Alert Count 105 > First Seen Tue 24 Jun 2008 11:14:08 BST > Last Seen Tue 24 Jun 2008 11:15:23 BST > Local ID ae1ef75a-23f4-495d-af20-604d56fa2cde > Line Numbers > > Raw Audit Messages > > host=saintloup.smith.man.ac.uk type=AVC > msg=audit(1214302523.807:45871): avc: denied { write } for pid=6827 > comm="qemu-kvm" path="/var/lib/xen/images/XP1" dev=dm-6 ino=2621983 > scontext=system_u:system_r:qemu_t:s0 > tcontext=user_u:object_r:xen_image_t:s0 tclass=file > > host=saintloup.smith.man.ac.uk type=SYSCALL > msg=audit(1214302523.807:45871): arch=c000003e syscall=1 success=no > exit=-13 a0=5 a1=364ea00 a2=200 a3=1 items=0 ppid=3284 pid=6827 > auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > fsgid=0 tty=(none) ses=4294967295 comm="qemu-kvm" > exe="/usr/bin/qemu-kvm" subj=system_u:system_r:qemu_t:s0 key=(null) > > I received a permission denied error when I tried manually to change the file to system_u:system_r:qemu_t and restorecon -v doesn't seem to do anything. Adam

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2008