selinux April 2009

selinux@lists.fedoraproject.org

20 participants
29 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

scp only using SELinux
by Vadym Chepkov 04 May '09

04 May '09

Hi, I wonder if it is possible to achieve "scp only" capability for a user just by using SELinux? Basically I want a user to be able to only upload/download files from his home via scp/sftp and nothing else. Thank you. Sincerely yours, Vadym Chepkov

2 1

SELinux is preventing npviewer.bin (nsplugin_t) "unix_read unix_write" unconfined_java_t.
by Antonio Olivares 28 Apr '09

28 Apr '09

Just as I sent the other message, I got this one: Summary: SELinux is preventing npviewer.bin (nsplugin_t) "unix_read unix_write" unconfined_java_t. Detailed Description: SELinux denied access requested by npviewer.bin. It is not expected that this access is required by npviewer.bin and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:unconfined_r:unconfined_java_t:s0-s0: c0.c1023 Target Objects None [ sem ] Source npviewer.bin Source Path /usr/lib64/nspluginwrapper/npviewer.bin Port <Unknown> Host gray Source RPM Packages nspluginwrapper-1.3.0-5.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-9.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name gray Platform Linux gray 2.6.29.1-102.fc11.x86_64 #1 SMP Mon Apr 20 15:33:38 EDT 2009 x86_64 x86_64 Alert Count 2 First Seen Tue 28 Apr 2009 05:08:56 PM CDT Last Seen Tue 28 Apr 2009 05:08:56 PM CDT Local ID 9c2334d3-9938-4dac-9be2-41980e1cdcd4 Line Numbers Raw Audit Messages node=gray type=AVC msg=audit(1240956536.52:59): avc: denied { unix_read unix_write } for pid=4852 comm="npviewer.bin" key=-583345475 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023 tclass=sem node=gray type=SYSCALL msg=audit(1240956536.52:59): arch=c000003e syscall=64 success=no exit=-13 a0=dd3adabd a1=1 a2=380 a3=7ffffabb11d0 items=0 ppid=3116 pid=4852 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib64/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)

2 1

Selinux is denying access to files with the default label, default_t and preventing ck-get-x11-serv (consolekit_t) "search" xdm_var_run_t.
by Antonio Olivares 28 Apr '09

28 Apr '09

I'll copy/paste alerts one by one : Summary: SELinux is preventing access to files with the default label, default_t. Detailed Description: SELinux permission checks on files labeled default_t are being denied. These files/directories have the default label on them. This can indicate a labeling problem, especially if the files being referred to are not top level directories. Any files/directories under standard system directories, /usr, /var. /dev, /tmp, ..., should not be labeled with the default label. The default label is for files/directories which do not have a label on a parent directory. So if you create a new directory in / you might legitimately get this label. Allowing Access: If you want a confined domain to use these files you will probably need to relabel the file/directory with chcon. In some cases it is just easier to relabel the system, to relabel execute: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:default_t:s0 Target Objects .kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host gray Source RPM Packages kdelibs-4.2.2-9.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-9.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name default Host Name gray Platform Linux gray 2.6.29.1-102.fc11.x86_64 #1 SMP Mon Apr 20 15:33:38 EDT 2009 x86_64 x86_64 Alert Count 92 First Seen Thu 23 Apr 2009 08:34:03 PM CDT Last Seen Tue 28 Apr 2009 04:52:40 PM CDT Local ID bfed3a21-1e6d-40ce-bd73-53aaabd164a7 Line Numbers Raw Audit Messages node=gray type=AVC msg=audit(1240955560.271:36): avc: denied { search } for pid=1767 comm="kde4-config" name=".kde" dev=dm-0 ino=262 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir node=gray type=SYSCALL msg=audit(1240955560.271:36): arch=c000003e syscall=6 success=no exit=-13 a0=6e5e58 a1=7fff38fa1be0 a2=7fff38fa1be0 a3=21 items=0 ppid=1766 pid=1767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing access to files with the default label, default_t. Detailed Description: SELinux permission checks on files labeled default_t are being denied. These files/directories have the default label on them. This can indicate a labeling problem, especially if the files being referred to are not top level directories. Any files/directories under standard system directories, /usr, /var. /dev, /tmp, ..., should not be labeled with the default label. The default label is for files/directories which do not have a label on a parent directory. So if you create a new directory in / you might legitimately get this label. Allowing Access: If you want a confined domain to use these files you will probably need to relabel the file/directory with chcon. In some cases it is just easier to relabel the system, to relabel execute: "touch /.autorelabel; reboot" Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:default_t:s0 Target Objects /.kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host gray Source RPM Packages kdelibs-4.2.2-9.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-9.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name default Host Name gray Platform Linux gray 2.6.29.1-102.fc11.x86_64 #1 SMP Mon Apr 20 15:33:38 EDT 2009 x86_64 x86_64 Alert Count 28 First Seen Thu 23 Apr 2009 08:34:03 PM CDT Last Seen Tue 28 Apr 2009 04:52:40 PM CDT Local ID 6da3a105-c4c8-4352-bd0e-3f438b1634a8 Line Numbers Raw Audit Messages node=gray type=AVC msg=audit(1240955560.107:34): avc: denied { getattr } for pid=1767 comm="kde4-config" path="/.kde" dev=dm-0 ino=262 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir node=gray type=SYSCALL msg=audit(1240955560.107:34): arch=c000003e syscall=6 success=no exit=-13 a0=7fff38fa1c80 a1=7fff38fa1b80 a2=7fff38fa1b80 a3=6d3b20 items=0 ppid=1766 pid=1767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing ck-get-x11-serv (consolekit_t) "search" xdm_var_run_t. Detailed Description: SELinux denied access requested by ck-get-x11-serv. It is not expected that this access is required by ck-get-x11-serv and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:consolekit_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_run_t:s0 Target Objects gdm [ dir ] Source ck-get-x11-serv Source Path /usr/libexec/ck-get-x11-server-pid Port <Unknown> Host gray Source RPM Packages ConsoleKit-x11-0.3.0-8.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-9.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name gray Platform Linux gray 2.6.29.1-102.fc11.x86_64 #1 SMP Mon Apr 20 15:33:38 EDT 2009 x86_64 x86_64 Alert Count 9 First Seen Thu 23 Apr 2009 03:55:23 PM CDT Last Seen Tue 28 Apr 2009 04:52:47 PM CDT Local ID 93d6261d-88da-4ca0-9328-743e29739a13 Line Numbers Raw Audit Messages node=gray type=AVC msg=audit(1240955567.631:44): avc: denied { search } for pid=1938 comm="ck-get-x11-serv" name="gdm" dev=dm-0 ino=263869 scontext=system_u:system_r:consolekit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=dir node=gray type=SYSCALL msg=audit(1240955567.631:44): arch=c000003e syscall=21 success=no exit=-13 a0=7fff62086fab a1=4 a2=0 a3=7fff62083710 items=0 ppid=1937 pid=1938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=system_u:system_r:consolekit_t:s0-s0:c0.c1023 key=(null) I have tried the fixes. I still see the same sealerts :( touch, reboot autorelabel. I have booted in permissive mode and still see the alters :( Should I file a bug here? Thanks, Antonio

3 3

semodule denial
by Tony Molloy 24 Apr '09

24 Apr '09

Hi, I'm getting the following denial on a fully updated Centos 5.3 system with ( selinux-policy-2.4.6-203.el5.noarch ) Summary: SELinux is preventing semodule (semanage_t) "getattr" to / (fs_t). Detailed Description: SELinux denied access requested by semodule. It is not expected that this access is required by semodule and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:semanage_t:SystemLow-SystemHigh Target Context system_u:object_r:fs_t Target Objects / [ filesystem ] Source semodule Source Path <Unknown> Port <Unknown> Host a.b.c.d Source RPM Packages Target RPM Packages filesystem-2.4.0-2.el5.centos Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name a.b.c.d Platform Linux a.b.c.d 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:10:25 EDT 2009 x86_64 x86_64 Alert Count 1 First Seen Thu Apr 23 08:53:08 2009 Last Seen Thu Apr 23 08:53:08 2009 Local ID 227642bc-dd66-4a04-bcad-13c3d52e5e63 Line Numbers Raw Audit Messages host=a.b.c.d type=AVC msg=audit(1240473188.358:3149): avc: denied { getattr } for pid=29325 comm="semodule" name="/" dev=sda5 ino=2 scontext=root:system_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem I can generate local policy but is that the best solution Regards, Tony -- Dept. of Comp. Sci. University of Limerick.

2 3

SELinux managing-confined-services guide - call for review
by Scott Radvan 23 Apr '09

23 Apr '09

Hi all, The Fedora SELinux managing-confined-services guide I have been working on is nearing completion. I would greatly appreciate any and all comments or corrections that anyone has on it. It is available here: http://sradvan.fedorapeople.org/SELinux_Managing_Confined_Services/en-US/ Cheers, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

2 4

No Read Up No Write Down
by Mohammad zoroufi 23 Apr '09

23 Apr '09

Dear All, After switching on SELinux in MLS enforcing mode, I'd like to know how the slogan of "no read up, no write down" works. I created some text files with the following descriptions TestFile_S0 system_u:object_r:usr_t:s0 TestFile_S0C2 system_u:object_r:usr_t:s0:c2 TestFile_S1 system_u:object_r:usr_t:s1 TestFile_S2 system_u:object_r:usr_t:s2 TestFile_S2C11 system_u:object_r:usr_t:s2:c11 TestFile_S2C5 system_u:object_r:usr_t:s2:c5 TestFile_S3 system_u:object_r:usr_t:s3 TestFile_S3C14 system_u:object_r:usr_t:s3:c14 TestFile_S3C5 system_u:object_r:usr_t:s3:c5 After creating these text file, I went to create users having different security clearance; The clearance of each created user is listed bellow: *Login Name SELinux User Role MLS/MCS Range* first x_first xguest_r s0 second x_second sysadm_r s3-s3:c5.c15 third x_third sysadm_r s1:c3.c15-s3:c5.c10 forth x_forth system_r s1-s1:c0.c10 root root system_r s0-s15:c0.c1023 having the clearance delegated for each user I expect user first have read write access to TestFile_S0 and just write access to all other files; user second have read access to files such as TestFile_S0, TestFile_S0C2, TestFile_S2, TestFile_S2C5, TestFile_S2C11 and only write access to TestFile_S3, TestFile_S3C14. when I switch to MLS enforcing mode I see something else. These users have no permission to write to files they expect they have write access to. I'd like to know the where this problem originates Moreover when user first wants to take a list of the directory contents only TestFile_S0, TestFile_S1, TestFile_S2 are listed not else; user second sees TestFile_S0, TestFile_S1, TestFile2, TestFile3; users third and root sees all files; user forth sees just TestFile_S0 not more. I don't know why such lists are taken when I'd like to take a list. Any comment is wellcome Best Regards

2 1

Re: How to label top level non default dirs
by Tony Molloy 21 Apr '09

21 Apr '09

On Tuesday 21 April 2009 13:25:52 you wrote: > On 04/21/2009 07:31 AM, Tony Molloy wrote: > > Hi, > > > > If I have a top level non default directory say for argument called > > /data. This directory contains various scripts and text files which > > should be available to everyone. Now when I do an install it gets the > > default selinux context file_t. But this generates lots of AVC's if I set > > selinux to enforcing. What should I label this directory as. > > > > Regards, > > > > Tony > > You should never get a file/directory labeled file_t. These should only > be able to be created on machines without SELInux. file_t means no > label at all. If you run restorecon on /data it will get assigned > default_t. > > restorecon -R -v /data These were old partitions left over from previous installs. The restorecon changed them to default_t. So that worked. > > This label should be available to the unconfined user and not available > to any confined domain. That will probably fix most of your avc's If > you wanted to label it like a home directory you could set it's labeling > to user_home_t. > > # semanage fcontext -a -t user_home_t '/data(/.*)?' > # restorecon -R -v /data > > This would allow all confined domains that have access to the home > directory access to these files. If you want to give access to apache, > you might need to assign a different context. The situation is I have a partition on all my servers called /archive which survives re-installs. This contains several directories for eg. /archive/extra-software for extra software to be installed on the server after a re-install /archive/gpg-keys the gpg-keys to be installed /archive/server-config-script A script to be run after an install to configure the server Now this script needs to be able to write to /archive to log what it did. So I was wondering if there was a context which should be used for this type of situation. I suppose I could label it as a home directory. Thanks, Tony -- Dept. of Comp. Sci. University of Limerick.

1 0

How to label top level non default dirs
by Tony Molloy 21 Apr '09

21 Apr '09

Hi, If I have a top level non default directory say for argument called /data. This directory contains various scripts and text files which should be available to everyone. Now when I do an install it gets the default selinux context file_t. But this generates lots of AVC's if I set selinux to enforcing. What should I label this directory as. Regards, Tony -- Dept. of Comp. Sci. University of Limerick.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2009