selinux August 2008

selinux@lists.fedoraproject.org

26 participants
29 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

rsync, xattrs, ntfs-3g and "selinux.selinux"
by Tom London 08 Sep '08

08 Sep '08

Running rawhide. I use "rsync" to backup my system to a USB hard drive. I also ntfs-3g mount a WinXP partition to '/mnt/windows' on boot, and I use the above rsync to back that up as well. Adding '-xattrs' to the argument list for rsync seems to produce scads of the following (I'm guessing one for each file in the ntfs-3g file system ): rsync: rsync_xal_clear: lremovexattr("mnt/windows/WINDOWS/twain_32/wiatwain.ds","security.selinux") failed: Permission denied (13) rsync: rsync_xal_clear: lremovexattr("mnt/windows/temp","security.selinux") failed: Permission denied (13) rsync: rsync_xal_clear: lremovexattr("mnt/windows/temp/setup.log","security.selinux") failed: Permission denied (13) Destination fs i ext4dev. When mounted, all the files in /mnt/windows have type: fusefs_t. When rsych'ed, the type on the ext4 fs is file_t. Running 'getfatttr -d' on the source files produces, for example: [root@localhost temp]# getfattr -d * getfattr: setup.log: Operation not supported [root@localhost temp]# On the destination fs, result is [root@localhost temp]# getfattr -d * [root@localhost temp]# This something due to the way I mounted the ntfs-3g fs? The way I run rsync? Other? thanks, tom -- Tom London

4 7

MLS enforcing and kerberos
by Robert Story 04 Sep '08

04 Sep '08

I'm trying to switch a working kerberos server from targeted/enforcing to mls/enforcing. The krb5kdc daemon start fine, but kadmin does not. There is a single avc in the audit log: type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file I ran this through audit2allow and loaded the module, with no luck. I ran 'semodule -DB' to see what else was being hit and not audited, and get quite a few more: type=AVC msg=audit(1219421462.655:714): avc: denied { siginh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=AVC msg=audit(1219421462.655:714): avc: denied { rlimitinh } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=AVC msg=audit(1219421462.655:714): avc: denied { noatsecure } for pid=2436 comm="kadmind" scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tclass=process type=SYSCALL msg=audit(1219421462.655:714): arch=14 syscall=11 success=yes exit=0 a0=100f1600 a1=100f13b0 a2=100f03d8 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.668:715): avc: denied { read } for pid=2436 comm="kadmind" name="config" dev=dm-5 ino=57734 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.668:715): arch=14 syscall=5 success=no exit=-13 a0=1fcdc380 a1=10000 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.670:716): avc: denied { write } for pid=2436 comm="kadmind" name="kdc.conf" dev=dm-5 ino=82034 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5kdc_conf_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.670:716): arch=14 syscall=33 success=no exit=-13 a0=20020c30 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421462.671:717): avc: denied { write } for pid=2436 comm="kadmind" name="krb5.conf" dev=dm-5 ino=378227 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:krb5_conf_t:s0 tclass=file type=SYSCALL msg=audit(1219421462.671:717): arch=14 syscall=33 success=no exit=-13 a0=20020d20 a1=2 a2=1b6 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.369:718): avc: denied { name_bind } for pid=2436 comm="kadmind" src=916 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1219421464.369:718): arch=14 syscall=102 success=no exit=-13 a0=2 a1=bfb6c484 a2=10 a3=bfb6c5dc items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.372:719): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file type=SYSCALL msg=audit(1219421464.372:719): arch=14 syscall=195 success=no exit=-13 a0=203136c0 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) type=AVC msg=audit(1219421464.405:720): avc: denied { getattr } for pid=2436 comm="kadmind" path="/var/tmp/kadmin_0" dev=dm-5 ino=82064 scontext=system_u:system_r:kadmind_t:s0-s15:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=file type=SYSCALL msg=audit(1219421464.405:720): arch=14 syscall=195 success=no exit=-13 a0=20409ad8 a1=bfb6c120 a2=bfb6c120 a3=0 items=0 ppid=2435 pid=2436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5 comm="kadmind" exe="/usr/kerberos/sbin/kadmind" subj=system_u:system_r:kadmind_t:s0-s15:c0.c1023 key=(null) running this through audit2allow and loading the module doesn't help either... What can I try next? -- Robert Story SPARTA

3 4

AVC Denial "services"
by Frank Murphy 03 Sep '08

03 Sep '08

su - root chcon -t bin_t './system-config-services-mechanism.py' chcon: cannot access `./system-config-services-mechanism.py': No such file or directory Summary: SELinux is preventing the dbus-daemon-lau (system_dbusd_t) from executing ./system-config-services-mechanism.py. Detailed Description: SELinux has denied the dbus-daemon-lau from executing ./system-config-services-mechanism.py. If dbus-daemon-lau is supposed to be able to execute ./system-config-services-mechanism.py, this could be a labeling problem. Most confined domains are allowed to execute files labeled bin_t. So you could change the labeling on this file to bin_t and retry the application. If this dbus-daemon-lau is not supposed to execute ./system-config-services-mechanism.py, this could signal a intrusion attempt. Allowing Access: If you want to allow dbus-daemon-lau to execute ./system-config-services-mechanism.py: chcon -t bin_t './system-config-services-mechanism.py' If this fix works, please update the file context on disk, with the following command: semanage fcontext -a -t bin_t './system-config-services-mechanism.py' Please specify the full path to the executable, Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy to make sure this becomes the default labeling. Additional Information: Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 Target Context system_u:object_r:usr_t:s0 Target Objects ./system-config-services-mechanism.py [ file ] Source dbus-daemon-lau Source Path /lib/dbus-1/dbus-daemon-launch-helper Port <Unknown> Host rawhide-02 Source RPM Packages dbus-1.2.3-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name execute Host Name rawhide-02 Platform Linux rawhide-02 2.6.27-0.238.rc2.fc10.i686 #1 SMP Thu Aug 7 08:00:04 EDT 2008 i686 i686 Alert Count 1 First Seen Sat 30 Aug 2008 08:22:57 IST Last Seen Sat 30 Aug 2008 08:22:57 IST Local ID ffddfd97-63b1-4809-aee4-c10e29d86722 Line Numbers Raw Audit Messages host=rawhide-02 type=AVC msg=audit(1220080977.294:17): avc: denied { execute } for pid=3564 comm="dbus-daemon-lau" name="system-config-services-mechanism.py" dev=dm-0 ino=2605067 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file host=rawhide-02 type=SYSCALL msg=audit(1220080977.294:17): arch=40000003 syscall=11 success=no exit=-13 a0=9774018 a1=9773d60 a2=9773008 a3=b8d9bc items=0 ppid=3563 pid=3564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)

2 1

AVC denials when using RH Cluster Suite's qdiskd and ping heuristic
by Sean E. Millichamp 03 Sep '08

03 Sep '08

I have been experimenting with using a quorum disk with the RH cluster suite product (qdiskd in the cman RPM). One of the requirements of using qdiskd is that you must specify at least one command that can be run to test the health of the node. A typical command to use for this heuristic is ping, although any command that returns a 0/non-0 exit status is acceptable. When I configure a simple ping test with qdisk I get: type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sda4" dev=tmpfs ino=1051 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_ r:fixed_disk_device_t:s0 tclass=blk_file type=AVC msg=audit(1219960233.627:4561): avc: denied { read write } for pid=23174 comm="ping" path="/dev/sdb4" dev=tmpfs ino=985 scontext=root:system_r:ping_t:s0 tcontext=system_u:object_r :fixed_disk_device_t:s0 tclass=blk_file type=SYSCALL msg=audit(1219960233.627:4561): arch=c000003e syscall=59 success=yes exit=0 a0=1f3575a0 a1=1f357610 a2=1f356150 a3=3 items=0 ppid=23163 pid=23174 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=189 comm="ping" exe="/bin/ping" subj=root:system_r:ping_t:s0 key=(null) The test is: "/bin/ping -c1 -t1 x.x.x.x" where x.x.x.x is a known-reachable IP. This works without AVC denials from the command line. Interestingly, the ping command seems to complete and return an exit code properly to qdisk as the log message shows that it is up. I have used audit2allow which told me I could do: allow ping_t fixed_disk_device_t:blk_file { read write }; and silence the message, but somehow giving ping access to fixed_disk_device_t to quiet a log message seems like it defeats the spirit of limited access :) I have no idea why ping (I am assuming that I am reading it correctly and it is ping) would be trying to access /dev/sda4 or /dev/sdb4. Those partitions are the extended partition container on my software RAID-1 boot drives. I've poked briefly at the qdiskd code and it seems to do a normal fork/exec to invoke the ping. Has anyone seen anything like this or have any ideas on where I should look next? I've spent a while on it so far and I don't have a lot more time to spend on it, but I'd like to solve it if possible and (if needed) get a fix out somewhere. I have been doing my testing with the RHEL versions of these tools as I don't have a cluster of Fedora machines handy, but I couldn't find a RHEL SELinux list and this looked like the best bet. selinux-policy-targeted-2.4.6-137.1.el5 cman-2.0.84-2.el5 I'm still pretty new to trying to sift through SELinux policy/messages so please be patient with me. :) Thanks! Sean

2 3

Bootable copy of an FC9 system.
by Nickolas Gray 03 Sep '08

03 Sep '08

I am attempting to create a bootable copy of a running SELinux box on FC9. I think I am close but I am coming up with a kernel panic (text at end) Here are the steps and a brief reason. If anyone has any suggestions where I might have made a mistake or left something out a comment would be appreciated. The only requirement so far is that it has to be a disk to disk copy with no CD/DVD rescue involved. The original looks like mbr on boot sector /dev/sda1 ext3 /boot /dev/sda2 LVM VolGroup00/LogVol00 is root VolGroup00/LogVol01 is swap This is what I am doing. • This seemed like an efficient way to dup the filesystems of the source to the target. sfdisk -d /dev/sda | sfdisk /dev/sdb •Duplicate the MBR dd if=/dev/sda1 of=/dev/sdb1 bs=512k •Copy the entire /boot from a to b dd if=/dev/sda of=/dev/sdb bs=664 count=1 •Add the /dev/sdb2 to LVM pvcreate /dev/sdb2 create the VolGroup for / vgcreate -s 32m VolGroup01 /dev/sdb2 Create the logical volume for / and swap lvcreate -l 1562 -n LogVol00 VolGroup01 lvcreate -l 62 -n LogVol01 VolGroup01 Create the swap area mkswap /dev/VolGroup01/LogVol01 Format the / filesystem mkfs -t ext3 /dev/VolGroup01/LogVol00 Create the snapshot lvcreate -L 20g -s -n snap /dev/VolGroup00/LogVol00 Mount the snapshot mount /dev/VolGroup00/snap /snapshot Mount the target mount /dev/VolGroup01/LogVol00 /target Rsync over the snapshot rsync -vXxpr /snapshot/* /target Unmount the snapshot umount /snapshot lvremove -f VolGroup00/snap At this point I fixed the initrd, the fstab and grub.conf on the target to point to VolGroup01 instead of VolGroup00. I would think this should be it. What I get is. root (hd0,0) Filesystem type is ..... kerne /vmlinuz ...... Linux bzimage..... initrd / initrd .... Linux initrd Decompresing Linux ... Done Booting the kernel Red Hat nash version 6,0,52 starting Reading all physical volumes this make take awhile .... Found volume group VolGroup01 now active ERROR: exec of init (/sbin/init) failed failed!!!! No such file or directory ERROR: failed in exec of /bin/echo: No such file or directory a couple messages about not finding /bin/sleep Kernel Panic I am not really sure where this is getting to. I thought it was getting to the initrd but now I am not sure. Thanks Nick

2 1

policy rpm %post script encounters avc violations
by Johnson, Richard 03 Sep '08

03 Sep '08

When installing a policy rpm, one cannot log the install activity w/o generating avc errors. For example: rpm -i lsb-ft-asn-selinux > /var/log/rpm-update.log produces the following violation: type=SYSCALL msg=audit(1219774608.030:789): arch=c000003e syscall=59 success=yes exit=0 a0=be952e0 a1=be93390 a2=be958f0 a3=8 items=0 ppid=2848 pid=2875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS1 ses=2 comm="restorecon" exe="/sbin/restorecon" subj=root:system_r:restorecon_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1219774608.030:789): avc: denied { write } for pid=2875 comm="restorecon" path="/var/log/rpm-update.log" dev=md2 ino=2694055 scontext=root:system_r:restorecon_t:s0-s0:c0.c1023 tcontext=root:object_r:var_log_t:s0 tclass=file The problems seems to stem from recording the %post script's attempts to relabel files affected by the policy, specifically: /sbin/restorecon -F -R -v /opt/ft/sbin/sra_alarm; /sbin/restorecon -F -R -v /etc/opt/ft/asn; /sbin/restorecon -F -R -v /var/opt/ft/asn; /sbin/restorecon -F -R -v /var/opt/ft/log; Is there any way to preserve the logging w/o disabling selinux for the duration of the install? FWIW, the rpm commands are executed from a bash script.

3 3

selinux and readahead
by Antonio Olivares 03 Sep '08

03 Sep '08

Dear all, I have encountered the following setroubleshoot warning: Summary: SELinux is preventing readahead (readahead_t) "read" to inotify (inotifyfs_t). Detailed Description: SELinux denied access requested by readahead. It is not expected that this access is required by readahead and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for inotify, restorecon -v 'inotify' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:readahead_t:SystemLow-SystemHigh Target Context system_u:object_r:inotifyfs_t Target Objects inotify [ dir ] Source readahead Source Path /usr/sbin/readahead Port <Unknown> Host localhost.localdomain Source RPM Packages readahead-1.4.4-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-4.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 i686 Alert Count 2 First Seen Thu 21 Aug 2008 04:04:26 AM CDT Last Seen Thu 21 Aug 2008 04:04:28 AM CDT Local ID c67dc8d2-0096-4510-9075-cbea7074ffa2 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1219309468.106:155): avc: denied { read } for pid=7574 comm="readahead" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:readahead_t:s0-s0:c0.c1023 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1219309468.106:155): arch=40000003 syscall=11 success=yes exit=0 a0=9f292d0 a1=9f29368 a2=9f295c0 a3=0 items=0 ppid=7564 pid=7574 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=24 comm="readahead" exe="/usr/sbin/readahead" subj=system_u:system_r:readahead_t:s0-s0:c0.c1023 key=(null) I do not know if readahead should be denied or not? What do you recommend that I do? Regards, Antonio

2 1

Samba Policy - Type Enforcement File
by prakash hallalli 03 Sep '08

03 Sep '08

Hi All I have installed selinux on fedora 8, I was using targeted policy which is the default policy in fedora. I have searched the policy module file ( File Context (FC) Type Enforcement (TE) and an Interface file (IF) ) Because i have configured samba server, so i need to change some permissions in samba.te file, but i couldn't find these file. Please help me where can i get these file and which package i have to install. Thanks praksh,h,k

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2008