selinux September 2008

selinux@lists.fedoraproject.org

35 participants
42 discussions

nsplugin module files are not in /
by yiruli＠ccsl.carleton.ca 24 Sep '08

24 Sep '08

nsplugin.pp is loaded in my machines. But I can not find the three module files--nsplugin.if, nsplugin.te, and nsplugin.fc? Should not they be in the directory /serefpolicy-3.3.1/policy/modules/apps of the src.rpm package? thanks a lot. Yiru

2 1

giving ftp access to specif files and directories
by Clarkson, Mike R (US SSA) 23 Sep '08

23 Sep '08

In RHEL5.1, I don't see an interface allowing the policy writer to give the ftp daemon access to specific file and directory types. This would be nice to have.

2 1

openoffice_plugin_per_role_template
by Joe Nall 23 Sep '08

23 Sep '08

Is this misnamed? It has a per_role_template name but is an interface in policy 3.5.6-4. joe

1 0

where can I find source policy for Mozilla Browser (Firefox)
by yiruli＠ccsl.carleton.ca 22 Sep '08

22 Sep '08

Hi, Where can I find the source policy for Mozilla Firefox? From the SELinux administration tool, I see that Mozilla module has been loaded? But I find the following through the command "ps -Z": unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 2600 ? 00:17:34 firefox Can I say that the policy for Firefox in my machine is not enforced yet? How can I make the policy be enforced? What is the status of the policy writing for Firefox? In one web article, Dan said that the policy writing for Firefox has little success due to its variant behaviour. I am a beginner of SELinux. Thanks a lot. Yiru

5 4

Advice needed designing packages for selinux
by David Carter 22 Sep '08

22 Sep '08

Hey folks! Here's some architectural background on my application. I have two pieces: an agent and a library that links with an application. The library communicates with the agent via semaphores, message queues, and shared memory. The files corresponding to these IPC mechanisms had been stored in /tmp. But here's the rub. The agent could run in root space as a system wide agent, but also in user space as a development and debugging tool. To facilitate this, each instance creates it's own subdirectory to hold the IPC files. Since they'll need to clean this up when they're done, I'd set the sticky bit on the directory. So know, if I move the system queues to /var/lib as I should, I have to have the sticky but set there, which is bad. Alternatively, if I leave it in the /tmp directory, I don't see how I can set the ACL's that selinux requires. The third option is to give any applications requiring access permissions so broad as to defeat the purpose of selinux. And the fourth is to disable selinux entirely, which is also not good. Advice? TIA, Dave

2 1

was selinux-policy-devel merged into selinux-policy
by Murray McAllister 21 Sep '08

21 Sep '08

Hi, Sorry for the silly question. On Fedora 9, "rpm -qf /usr/share/selinux/devel/policygentool" says that it belongs to selinux-policy-devel-3.3.1-87.fc9. On rawhide, "rpm -qf /usr/share/selinux/devel/policygentool" says that it belongs to selinux-policy-3.5.7-1.fc10.noarch. When I try "yum install selinux-policy-devel", it says that selinux-policy-3.5.7-1.fc10.noarch is already installed. Was selinux-policy-devel merged into selinux-policy? (I looked in the selinux-policy changelog but wasn't sure) Thanks.

2 1

sealert won't erase some entries
by John Griffiths 19 Sep '08

19 Sep '08

I need some guidance. I have four entries that show up in sealert browser mode that will not erase. I select them, delete them, and remove those that are marked deleted and nothing happens. There are only four entries that do this. The other log entires can be deleted just fine. The four entries don't seem to cause any problems; they are just an annoyance. Any help would be appreciated. Thanks, John

2 2

restoring default selinux policy configuration
by Murray McAllister 18 Sep '08

18 Sep '08

Hi, If I change a lot of booleans, or install a lot of custom policies, is there any way to restore selinux policy (targeted) to its default configuration? Thanks.

4 7

Backing up and restoring SELinux file contexts
by Frank Sweetser 17 Sep '08

17 Sep '08

I'm looking at helping to extend the Bacula backup system to handle SELinux file contexts, and I wanted to make sure I'm going down the right path. Now as I understand it, the context associated with a file on disk can be retrieved via getfilecon, and set via setfilecon. However, on disk, the context is stored as an extended attribute, which are handled via getxattr and setxattr. So my question is, is it practical to just use the *xattr functions to backup and restore the file contexts, or do I need to perform an explicit check to see if I'm running on an SELinux system and, if so, use the *filecon functions instead? I'd prefer to use the *xattr functions if at all possible, since that would simplify a lot of cases, such as restoring an SELinux system from a non SELinux aware rescue disk, but want to make sure there aren't any gotchas I'm missing. -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that WPI Senior Network Engineer | is simple, elegant, and wrong. - HL Mencken GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

2 2

question on new filecontext type and documentation issues
by Sebastian Hennebrueder 15 Sep '08

15 Sep '08

Hello, thank you for the nice solution you provided with Selinux. I have two issues: 1) I use Centos 5.2 which clones Redhat Enterprise Linux. I use the targeted policy. Postfix and dovecot shares the certicates. I solved the problem in a way that I copied the certificates and set the corresponding context. I don't like this approach. Alternatively I can use the normal audit2allow approach to allow postfix access to dovecot or vice versa but I would like not to give them this right. The best solution is to create a new context which can be accessed by both domains. With the new module approach, how do I start to write a new context type? It is probably simple but I don't find the way to start by reading the documentation on the net. 2) I am actually a Java developer running my own Linux server, so I am far away from being a Linux expert. My feeling is that the documentation is really hard to follow. It was hard to find out how to interpret the audit.log. The only location to explain the different attributes seams to be > http://seedit.sourceforge.net/doc/access_vectors/ > <javascript:void(0);/*1221395834258*/> But still some documented log entries would be fine, e.g. what does a socket connect require, what does a search for the config file in /etc require, ... I found the tip to use sealert -a on the http://wiki.centos.org/HowTos/SELinux <javascript:void(0);/*1221395813896*/> I found the statement do 'cat audit.log | audit2allow ...' but don't trust the result somewhere. But well, if I shouldn't trust, I would appreciate to analyse as well. Your wiki does note http://people.redhat.com/dwalsh/SELinux/Presentations/ManageRHEL5.pdf <javascript:void(0);/*1221395820244*/> which is a good resource after having understood the basics The next page told me about sesearch, which is a very important tool IMHO. http://www.durchmesser.ch/wiki/SELinux <javascript:void(0);/*1221395840703*/> I still have no idea how to find information on the different macros which where noted somewhere. From my beginner point of view, I noted my steps and resources on my blog at http://www.laliluna.de/blog/ To summarize, I would appreciate a somehow more centralized complete documentation, much more oriented to practical use cases. Best Regards Sebastian

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2008