selinux September 2008

selinux@lists.fedoraproject.org

35 participants
42 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

Hello world and first question concerning Munin
by Gabriele Pohl 06 Oct '08

06 Oct '08

Hi all, my name is Gabriele Pohl. I live in Bonn, Germany and use Fedora for a few years (starting with Core 4 and upgraded to 9 some months ago) I use Munin (http://munin.projects.linpro.no/) to monitor my computers hardware and services. After upgrading to Fedora 9 I decided to use SELinux in mode *enforce* and run into lots of problems concerning SELinux and Munin-Plugins, that need high system privileges to access block devices a.s.o. I would like to solve this issues in a good manner and therefore subscribed to this list to ask the experts, how to do it. Now my first question: Plugin smart_ is written in Python. It calls "smartctl" from the smartmontools package (http://smartmontools.sourceforge.net/) to read the values of the SMART-Attributes from the harddisks. To activate the plugin, one has to create a link within the service directory. Actually the link looks like this: lrwxrwxrwx root root unconfined_u:object_r:munin_etc_t:s0 smart_sda -> /usr/share/munin/plugins/smart_ The plugins file looks like this: -rwxr-xr-x root root system_u:object_r:munin_exec_t:s0 /usr/share/munin/plugins/smart_ Executable smartctl looks like this: -rwxr-xr-x root root system_u:object_r:fsadm_exec_t:s0 /usr/sbin/smartctl It needs access to the disks block device /dev/sda that looks like this: brw-rw---- root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda I have policy type targeted active and policy module munin 1.4.0 installed. I get the following raw audit messages, when calling smart_sda: host=calex.dipohl.com type=AVC msg=audit(1221221404.542:709): avc: denied { getattr } for pid=18327 comm="python" path="/dev/sda" dev=tmpfs ino=298 scontext=unconfined_u:system_r:munin_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file host=calex.dipohl.com type=SYSCALL msg=audit(1221221404.542:709): arch=40000003 syscall=195 success=no exit=-13 a0=8fbe278 a1=bfcdf038 a2=3e8ff4 a3=8f481b8 items=0 ppid=18220 pid=18327 auid=500 uid=0 gid=491 euid=0 suid=0 fsuid=0 egid=491 sgid=491 fsgid=491 tty=(none) ses=1 comm="python" exe="/usr/bin/python" subj=unconfined_u:system_r:munin_t:s0 key=(null) As the FAQ said, I fed these messages into audit2allow: audit2allow -M mine < avcs and get the following mine.te: ------------------------------- module mine 1.0; require { type munin_t; type fixed_disk_device_t; class blk_file getattr; } require { type munin_t; type fixed_disk_device_t; class blk_file getattr; } #============= munin_t ============== allow munin_t fixed_disk_device_t:blk_file getattr; ------------------------------- and a mine.pp Will it be ok to load that into the kernel using semodule -i mine.pp ? And why are there two identical *require* structs? Can / Should I delete one of them? What shall I do with the message of type "SYSCALL" if it were wrong to put it into the avcs-File? Should I make adjustments to the files above (service-link, plugin-file) Anything else, that you can advise? So far for now & cheers, Gabriele

3 4

Need Info adding\editing to a personal module?
by Frank Murphy 01 Oct '08

01 Oct '08

Examples only: If exim gave an avc denial. 1: Create policy. audit2allow -M myexim < /var/log/audit/audit.log then enable it. semodule -i myexim.pp 2: If then in a couple of days exim generates another avc denial, different from the first. How does one edid\use audid2allow to include the new avc. Have looked at "man audit2allow" and can't seem to grasp an edit from the options. Frank -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com

3 2

Alternate OpenSSH ports
by Arthur Pemberton 01 Oct '08

01 Oct '08

I'm getting an denial when I attempt o use port 23 as an additional port for sshd. That makes sense. What's the best way to define alternate SSHd ports? -- Fedora 9 : sulphur is good for the skin ( www.pembo13.com )

4 7

SELinux detects problem with proprietary binary fglrx driver; however, AMD/ATI will not help
by Francis Shim 30 Sep '08

30 Sep '08

I am submitting this report to this list for documentation, perspectives and, hopefully, helpful assistance towards resolving this issue. Sorry in advance for the length of this post. First reported to the Unofficial Wiki + Bugzilla of the ATI fglrx binary, then to AMD/ATI technical support was the following issue: I have the following configuration: * Lenovo Thinkpad T60p * ATI Mobility FireGL V5250 graphics card * version 8.52.3 of the fglrx module * Fedora 8 running version 2.6.25.14-69.fc8 of the GNU/Linux kernel *NOTE: I have upgraded the kernel and driver from the first indications of the problem; hence, older versions are in the bug report below. However, the same bug persists according to both symptoms and to the security log. At intermittent start-ups of the X server using the fglrx driver the X server does not display due to a security compatibility problem between the fglrx driver and the secure SELinux module of the GNU/linux kernel. The following is the report from the system log outlining the problem: SELinux: out of range capability -157851600 ------------[ cut here ]------------ kernel BUG at security/selinux/hooks.c:1332! invalid opcode: 0000 [#1] SMP Modules linked in: ipv6 snd_hda_intel snd_seq_dummy snd_seq_oss arc4 snd_seq_midi_event snd_seq ecb snd_seq_device crypto_blkcipher snd_pcm_oss snd_mixer_oss snd_pcm i2c_i801 iwl3945 iTCO_wdt battery iTCO_vendor_support snd_timer i2c_core ac mac80211 video thinkpad_acpi bay snd_page_alloc irda output snd_hwdep e1000e button snd cfg80211 crc_ccitt fglrx(P)(U) pcspkr hwmon soundcore sr_mod cdrom sg usb_storage ata_piix dm_snapshot dm_zero dm_mirror dm_mod ahci libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan] Pid: 1488, comm: Xorg Tainted: P (2.6.25.6-27.fc8 #1) EIP: 0060:[<c04cd328>] EFLAGS: 00213246 CPU: 1 EIP is at task_has_capability+0x46/0x79 EAX: 00000030 EBX: f6976030 ECX: 00203046 EDX: 00203046 ESI: f685f200 EDI: f6959eb0 EBP: f6959ebc ESP: f6959e6c DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process Xorg (pid: 1488, ti=f6959000 task=f6f98000 task.ti=f6959000) Stack: c06d780d f6976030 f6f98000 00000003 f6f98000 f6976030 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 f6976030 f6f98000 f69ca000 f6959ecc c04cd37a f6f98000 f9678400 Call Trace: [<c04cd37a>] ? selinux_capable+0x1f/0x23 [<c04c973d>] ? security_capable+0xc/0xe [<c042ca37>] ? __capable+0xb/0x1f [<f954e670>] ? firegl_version+0x0/0x1b0 [fglrx] [<c042ca5b>] ? capable+0x10/0x12 [<f954e537>] ? firegl_ioctl+0xe7/0x220 [fglrx] [<c046e370>] ? handle_mm_fault+0x64f/0x6ef [<f9543c80>] ? ip_firegl_ioctl+0xe/0x10 [fglrx] [<c048ad76>] ? vfs_ioctl+0x4e/0x67 [<c048aff1>] ? do_vfs_ioctl+0x262/0x279 [<c04d0226>] ? selinux_file_ioctl+0xa8/0xab [<c048b048>] ? sys_ioctl+0x40/0x5c [<c0405b7e>] ? syscall_call+0x7/0xb ======================= Code: 05 00 00 89 d0 f3 ab 8b 4d b8 89 d8 b2 04 c1 f8 05 c6 45 bc 03 89 5d c4 89 4d c0 74 19 48 74 11 53 68 0d 78 6d c0 e8 6d 9e f5 ff <0f> 0b 58 5a eb fe ba 45 00 00 00 8b 46 08 83 e3 1f 0f b7 f2 8d EIP: [<c04cd328>] task_has_capability+0x46/0x79 SS:ESP 0068:f6959e6c ---[ end trace 93d33da5bd859df0 ]--- [fglrx:firegl_release] *ERROR* device busy: 1 0 [fglrx] release failed with code -EBUSY -------------------- End of report ------------------- AMD/ATI's response is as follows: I regret there is no support for Linux at this time. Please see the following 737-28027: LINUX support for ATI Video cards LINUX support for ATI Video cards: Although we have drivers for Linux posted on the ATI website, we do not provide technical support for driver or multimedia issues in Linux directly. The Linux drivers available (For laptops, RADEON and All in wonder Products) from AMD are provided are "as is". If you are looking for drivers then go to: http://ati.amd.com/support/driver.html For information regarding the ATI Proprietary Linux Driver visit: http://www.ati.com/products/catalyst/linux.html Our web site offers several links to Linux support websites that may help you. The link below has information that might be helpful to your case. http://wiki.cchtml.com/index.php/Main_Page\ There are also very good articles from third parties: 1. http://www.rage3d.com/content/articles/atilinuxhowto/Linux_ATI.html#SECTION… 2. http://www.linux.org/help/index.html 3. http://www.linuxdoc.org/ 4. http://www.xfree86.org/ To report issues with Linux drivers you can submit an online ticket using the “Linux Driver Feedback” category, and your report will be received and reviewed/tested by our driver team. Please note that your report will only be responded to if we require additional information. We do not respond to all support inquires. For the Linux Driver Feedback submission page, visit. http://support.ati.com/ics/survey/survey.asp?deptID=894&surveyID=508&type=w… ---------------- End of response ----------------- I could disable SELinux and I would not have this problem; however, I was hoping that there was a much secure or safer work-around to this problem. Peace, Frank

6 10

cron_t freshclam
by Sebastian Hennebrueder 29 Sep '08

29 Sep '08

Hello, the freshclam daemon tries to download the updated virus definition to /var/clamav The directory has the context drwxr-xr-x clamav clamav system_u:object_r:clamd_t clamav I get the following error message type=AVC msg=audit(1222221728.847:3043): avc: denied { write } for pid=10192 comm="freshclam" name="clamav" dev=dm-1 ino=522241 scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:clamd_t:s0 tclass=dir type=AVC msg=audit(1222304223.589:82): avc: denied { write } for pid=6100 comm="freshclam" name="clamav" dev=dm-1 ino=522241 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:clamd_t:s0 tclass=dir type=AVC msg=audit(1222304223.666:83): avc: denied { write } for pid=6100 comm="freshclam" name="clamav" dev=dm-1 ino=522241 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:clamd_t:s0 tclass=dir type=AVC msg=audit(1222308125.673:100): avc: denied { write } for pid=7622 comm="freshclam" name="clamav" dev=dm-1 ino=522241 scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:clamd_t:s0 tclass=dir type=AVC msg=audit(1222308125.911:101): avc: denied { write } for pid=7622 comm="freshclam" name="clamav" dev=dm-1 ino=522241 scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:clamd_t:s0 tclass=dir Using audit2allow I get module dummy 1.0; require { type unconfined_t; type crond_t; type clamd_t; class dir write; } #============= crond_t ============== allow crond_t clamd_t:dir write; #============= unconfined_t ============== allow unconfined_t clamd_t:dir write; My impression was that unconfined_ access allows a quite wide access but some testing showed me that without even root cannot create files in that directory. type=AVC msg=audit(1222590942.079:771): avc: denied { write } for pid=27753 comm="touch" name="clamav" dev=dm-1 ino=522241 scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:clamd_t:s0 tclass=dir type=SYSCALL msg=audit(1222590942.079:771): arch=c000003e syscall=2 success=no exit=-13 a0=7fffc9188c93 a1=941 a2=1b6 a3=3ff8d4e0ec items=0 ppid=25482 pid=27753 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=96 comm="touch" exe="/bin/touch" subj=user_u:system_r:unconfined_t:s0 key=(null) So my question, can I allow unconfined access and to which extend will this open the directory? Best Regards Sebastian Hennebrueder

2 1

RE: giving ftp access to specif files and directories
by Clarkson, Mike R (US SSA) 25 Sep '08

25 Sep '08

I'll grant that the difference is fairly subtle, but it gets into the software design principles of the reference policy. Chiefly, attempting to keep modules loosely coupled by using interfaces rather than global use of type identifiers. With the interface approach, all uses of the ftpd_t type are kept within the ftp module. > -----Original Message----- > From: Daniel J Walsh [mailto:dwalsh@redhat.com] > Sent: Thursday, September 25, 2008 10:15 AM > To: Clarkson, Mike R (US SSA) > Cc: fedora-selinux-list(a)redhat.com > Subject: Re: giving ftp access to specif files and directories > > Clarkson, Mike R (US SSA) wrote: > > OK, I'll get more specific. > > > > Let's say I've got some_program that I've created a policy module for so > > that it runs in the some_program_t domain. Suppose some_program uses > > files for various purposes and the module has labeled them, such that > > all the files under the /local/some_dir directory are labeled > > some_file_t. Further suppose that some_program uses ftp to transfer one > > or more of the files labeled some_file_t, and that the policy writer > > does not want to label these files public_content_t. The policy writer > > can do something like this: > > > > require {type ftpd_t;} > > allow ftpd_t some_file_t:file <necessary permissions here>; > > > > Rules giving ftpt_t access to other objects belong in the ftp module, > > but the policy writer really doesn't want to modify the ftp module for > > obvious reasons. This is where it would be nice to have interfaces in > > the ftp module that allowed policy writers to give the ftpd_t domain > > access to files and directories of specific types. There could either be > > a series of interfaces giving different permissions to choose from or it > > could be handled by a generic interface such as this: > > > > ################################################ > > ## <summary> > > ## Give the ftpd_t access to specified file type. > > ## </summary> > > ## <desc> > > ## <param name="file_type"> > > ## File type to which ftpd_t needs access > > ## </param > > ## <param name="object type"> > > ## Type of object (i.e. file or dir) > > ## </param> > > ## <param name="permission"> > > ## Permission needed by ftpd_t(i.e. read, write, etc.) > > ## </param> > > interface(`give_ftp_access',` > > gen_require(` > > type ftpd_t; > > ') > > > > allow ftpd_t $1:$2 $3; > > ') > > > I don't see where this is any easier then just using the code you wrote > above. > > Other then you don't need the gen_require. > > >> -----Original Message----- > >> From: Daniel J Walsh [mailto:dwalsh@redhat.com] > >> Sent: Tuesday, September 23, 2008 9:16 AM > >> To: Clarkson, Mike R (US SSA) > >> Cc: fedora-selinux-list(a)redhat.com > >> Subject: Re: giving ftp access to specif files and directories > >> > >> Clarkson, Mike R (US SSA) wrote: > >>> In RHEL5.1, I don't see an interface allowing the policy writer to > > give > >>> the ftp daemon access to specific file and directory types. This > > would > >>> be nice to have. > >>> > >>> > >>> -- > >>> fedora-selinux-list mailing list > >>> fedora-selinux-list(a)redhat.com > >>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list > >> Not sure what you are after here. Do you want to label a directory or > >> file with public_content_t will allow ftp to gain access. > >> > >> If the files are labeled something non default you could add allow > > rules > >> using audit2allow -M myftp. > >> > >> If you want to add a type specific to ftp that other daemons would not > >> have access to IE Not public_content_t, you could define a module > >> > >> type ftp_content_t; > >> files_type(ftp_content_t) > >> > >> ... > >> > >> Then allow access. And set the labeling correct > >

2 1

RE: giving ftp access to specif files and directories
by Clarkson, Mike R (US SSA) 25 Sep '08

25 Sep '08

OK, I'll get more specific. Let's say I've got some_program that I've created a policy module for so that it runs in the some_program_t domain. Suppose some_program uses files for various purposes and the module has labeled them, such that all the files under the /local/some_dir directory are labeled some_file_t. Further suppose that some_program uses ftp to transfer one or more of the files labeled some_file_t, and that the policy writer does not want to label these files public_content_t. The policy writer can do something like this: require {type ftpd_t;} allow ftpd_t some_file_t:file <necessary permissions here>; Rules giving ftpt_t access to other objects belong in the ftp module, but the policy writer really doesn't want to modify the ftp module for obvious reasons. This is where it would be nice to have interfaces in the ftp module that allowed policy writers to give the ftpd_t domain access to files and directories of specific types. There could either be a series of interfaces giving different permissions to choose from or it could be handled by a generic interface such as this: ################################################ ## <summary> ## Give the ftpd_t access to specified file type. ## </summary> ## <desc> ## <param name="file_type"> ## File type to which ftpd_t needs access ## </param ## <param name="object type"> ## Type of object (i.e. file or dir) ## </param> ## <param name="permission"> ## Permission needed by ftpd_t(i.e. read, write, etc.) ## </param> interface(`give_ftp_access',` gen_require(` type ftpd_t; ') allow ftpd_t $1:$2 $3; ') > -----Original Message----- > From: Daniel J Walsh [mailto:dwalsh@redhat.com] > Sent: Tuesday, September 23, 2008 9:16 AM > To: Clarkson, Mike R (US SSA) > Cc: fedora-selinux-list(a)redhat.com > Subject: Re: giving ftp access to specif files and directories > > Clarkson, Mike R (US SSA) wrote: > > In RHEL5.1, I don't see an interface allowing the policy writer to give > > the ftp daemon access to specific file and directory types. This would > > be nice to have. > > > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Not sure what you are after here. Do you want to label a directory or > file with public_content_t will allow ftp to gain access. > > If the files are labeled something non default you could add allow rules > using audit2allow -M myftp. > > If you want to add a type specific to ftp that other daemons would not > have access to IE Not public_content_t, you could define a module > > type ftp_content_t; > files_type(ftp_content_t) > > ... > > Then allow access. And set the labeling correct

2 1

Xfce Live CD and SELinux
by Rahul Sundaram 25 Sep '08

25 Sep '08

Hi, While building a live cd in a SELinux enabled system, I get this. Should I still be building live images with SELinux in permissive mode? " Installing: selinux-policy-targeted ##################### [685/918] SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.23, searching for an older version. SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.23: No such file or directory /usr/sbin/load_policy: Can't load policy: No such file or directory libsemanage.semanage_reload_policy: load_policy returned error code 2. libsemanage.semanage_install_active: Could not copy /etc/selinux/targeted/modules/active/policy.kern to /etc/selinux/targeted/policy/policy.23. (No such file or directory). semodule: Failed! libsemanage.semanage_link_sandbox: Could not access sandbox base file /etc/selinux/targeted/modules/tmp/base.pp. (No such file or directory). /usr/sbin/semanage: Could not commit semanage transaction /usr/sbin/semanage: Login mapping for __default__ is not defined Installing: authconfig-gtk ##################### [686/918] " Rahul

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2008