selinux May 2009

selinux@lists.fedoraproject.org

24 participants
36 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

Re: semodule
by Vadym Chepkov 08 Jun '09

08 Jun '09

I compared /etc/pam.d/sshd of the affected and working system, they are identical. But, I found these entries in /var/log/secure of the system in trouble: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument I bet it's a smoking gun, I just have no idea what to do about it. Sincerely yours, Vadym Chepkov

5 4

Re: semodule
by Vadym Chepkov 04 Jun '09

04 Jun '09

> also check /etc/pam.d/system-auth Unexpected, but yes, you were right, when I disabled winbind it worked as expected, but I need winbind enabled. I thought having pam_selinux as a first and last session rule should be sufficient. what's wrong with my config then? $ cat /etc/pam.d/sshd #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session include system-auth session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke $ cat /etc/pam.d/system-auth #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so try_first_pass nullok auth sufficient pam_winbind.so auth required pam_deny.so account sufficient pam_unix.so account required pam_winbind.so password required pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so try_first_pass use_authtok nullok md5 shadow password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient pam_unix.so session required pam_winbind.so Sincerely yours, Vadym Chepkov

2 1

policy to allow myapp to exec chfn
by Brian Ginn 01 Jun '09

01 Jun '09

I have an app which runs from xinetd in the myapp_t domain: system_u:system_r:myapp_t I am attempting to get myapp to exec the chfn program however it reports: chfn: system_u:system_r:myapp_t:SystemLow-SystemHigh is not authorized to change the finger info of test5 I have tried these macros from the reference policy: usermanage_run_chfn(myapp_t,system_r,devpts_t ) type myapp_devpts_t; type myapp_tty_device_t; userdom_change_password_template(myapp) usermanage_run_chfn(myapp_t,system_r,{ myapp_devpts_t myapp_tty_device_t }) but things still don't work. SELinux is not reporting denials in audit.log, presumably because chfn calls security_compute_av() and reports the "denial" itself. Is there policy I can write that will allow myapp to exec chfn? Thanks, Brian

2 3

Re: semodule
by Vadym Chepkov 31 May '09

31 May '09

I am lost. I compared semanage user/login on affected and freshly installed systems - identical. I did relabel several times. both have the same selinux-policy-targeted-3.5.13-59.fc10.noarch installed. on both sshd runs in the same context. Normal system: sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-bash(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') `-pstree(`unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023') Affected system: sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-sshd(`system_u:system_r:sshd_t:s0-s0:c0.c1023') `-bash(`system_u:system_r:unconfined_t:s0-s0:c0.c1023') `-pstree(`system_u:system_r:unconfined_t:s0-s0:c0.c1023') As you can see, my login shell doesn't become 'unconfined_u'. So, I decided to experiment and added a new SEuser #semanage user -a -P user -r s0-s0:c0.c1023 -R "system_r unconfined_r" vvc_u and assigned this SEuser to my login, to see if it makes a difference #semanage login --add -s vvc_u -r s0-s0:c0.c1023 vvc $id -Z system_u:system_r:unconfined_t:s0-s0:c0.c1023 Totally ignored Is some PAM entry or whatever is missing? Sincerely yours, Vadym Chepkov --- On Tue, 5/26/09, Vadym Chepkov <chepkov(a)yahoo.com> wrote: > From: Vadym Chepkov <chepkov(a)yahoo.com> > Subject: Re: semodule > To: "Daniel J Walsh" <dwalsh(a)redhat.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Tuesday, May 26, 2009, 3:53 PM > --- On Tue, 5/26/09, Daniel J Walsh > <dwalsh(a)redhat.com> > wrote: > > Do you have a file in > > /etc/selinux/targeted/contexts/users/unconfined_u > > > -rw-r--r-- 1 root root 578 2009-05-07 07:30 > /etc/selinux/targeted/contexts/users/unconfined_u > >

1 0

Rsyncing every file on the root to another disk
by Nickolas Gray 30 May '09

30 May '09

I have a requirement to rsync ALL files over to a newly mounted partition. the command is "rsync -AaXxH /home/snapshot/* /target/" I can get this to work in permissive, and with a bit of massaging. I can get an operational system that boots in enforcing on a new disk. For the life of me I can't determine how I can gain access to copy and write all these files in enforcing. I have included the simple rules like files_read_all_files(), but it seems there must be an easier assured way of making sure I don't miss anything. It appears to me that not everyfile in the system is really labeled with the attribute file_type. Is there something I am missing on how to do this? Suggestions? Nick -- "THIS time it really is fixed. I mean, how many times can we get it wrong? At some point, we just have to run out of bad ideas.." Linus Torvalds Nickolas Gray nick(a)magitek.ltd

2 3

[ANN] 2009 SELinux Developer Summit Call for Participation
by James Morris 28 May '09

28 May '09

The call for participation for the 2009 SELinux Developer Summit is now open. The summit will be held Sunday September 20th in Portland as part of LinuxCon [1]. Note that all attendees must be registered as attendees of LinuxCon. Primary topics for this year's summit will be extensibility and usability, with a flexible format to include interactive talks and development sessions. Extensibility topics of interest include (but are not limited to) storage, virtualization, databases, web applications, and the desktop environment. Usability topics of interest include (but are not limited to) policy development and deployment, system administration, and high-level tools. Other topics relating to SELinux technology, flexible mandatory access control, and its application to real-world problems are also of interest for this symposium. Such topics might include: * Updates on the various Linux distributions using SELinux * Flexible MAC in other operating systems * Case studies and application experience with flexible MAC * User and customer concerns and needs Forms of participation include: * Interactive technical presentations (30 minutes each, papers are optional) * Lightning talks * Development sessions Proposals may be sent to the organizing team at: sel-dev-summit-pc AT selinuxproject.org In your proposal, please identify the form of participation, the amount of time you expect to need, and a title and abstract describing the topic you wish to cover. If you wish to attend the summit in any capacity, please subscribe to the mailing list [2] so the organizers can estimate numbers as well as provide you with updated event information. Please also visit the summit wiki page [3] for more details on the event and location. Important dates: * CFP ends: 1st July 2009 * Speaker notifications: 15th July 2009 * Publish schedule: 1st August 2009 Note that early bird registration for LinuxCon ends on June 1st, and standard registration ends on August 14th. URLs: [1] LinuxCon, http://events.linuxfoundation.org/events/linuxcon [2] Mailing list, http://selinuxproject.org/mailman/listinfo/selinux-developer-summit-2009 [3] SELinux Developer Summit page, http://selinuxproject.org/page/Developer_Summit_2009 ----------------------------------------------------------------------------

1 0

lvconvert does not work in enforcing, no AVC, instead I get SELINUX_ERR
by Nickolas Gray 28 May '09

28 May '09

I am trying to run the "lvconvert" command in enforcing and cannot determine how to do it. I am using the domain type lvm_t and running lvconvert inside a bash script. The command works in permissive but fails in enforcing. with the following audit trail. ---- node=develop.local.austin.rr.com type=PATH msg=audit(05/27/2009 10:31:40.907:208246) : item=0 name=/dev/vg00/root inode=813052 dev=00:0f mode=link,777 ouid=root ogid=siterep rdev=00:00 obj=siterep_u:object_r:device_t:s15:c0.c1023 node=develop.local.austin.rr.com type=CWD msg=audit(05/27/2009 10:31:40.907:208246) : cwd=/home/siterep1 node=develop.local.austin.rr.com type=SYSCALL msg=audit(05/27/2009 10:31:40.907:208246) : arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=7fffd2b27a20 a1=7f97ca9034b9 a2=7f97c9ad16c0 a3=1e items=1 ppid=9777 pid=9820 auid=siterep1 uid=root gid=siterep euid=root suid=root fsuid=root egid=siterep sgid=siterep fsgid=siterep tty=pts7 ses=1 comm=lvconvert exe=/sbin/lvm subj=siterep_u:siterep_r:lvm_t:s15:c0.c1023 key=(null) node=develop.local.austin.rr.com type=SELINUX_ERR msg=audit(05/27/2009 10:31:40.907:208246) : security_validate_transition: denied for oldcontext=siterep_u:object_r:device_t:s15:c0.c1023 newcontext=system_u:object_r:device_t:s0 taskcontext=siterep_u:siterep_r:lvm_t:s15:c0.c1023 tclass=lnk_file ---- node=develop.local.austin.rr.com type=PATH msg=audit(05/27/2009 10:31:40.908:208247) : item=0 name=/dev/vg00/snap inode=813108 dev=00:0f mode=link,777 ouid=root ogid=siterep rdev=00:00 obj=siterep_u:object_r:device_t:s15:c0.c1023 node=develop.local.austin.rr.com type=CWD msg=audit(05/27/2009 10:31:40.908:208247) : cwd=/home/siterep1 node=develop.local.austin.rr.com type=SYSCALL msg=audit(05/27/2009 10:31:40.908:208247) : arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=7fffd2b27a20 a1=7f97ca9034b9 a2=7f97c9acc480 a3=1e items=1 ppid=9777 pid=9820 auid=siterep1 uid=root gid=siterep euid=root suid=root fsuid=root egid=siterep sgid=siterep fsgid=siterep tty=pts7 ses=1 comm=lvconvert exe=/sbin/lvm subj=siterep_u:siterep_r:lvm_t:s15:c0.c1023 key=(null) node=develop.local.austin.rr.com type=SELINUX_ERR msg=audit(05/27/2009 10:31:40.908:208247) : security_validate_transition: denied for oldcontext=siterep_u:object_r:device_t:s15:c0.c1023 newcontext=system_u:object_r:device_t:s0 taskcontext=siterep_u:siterep_r:lvm_t:s15:c0.c1023 tclass=lnk_file ---- node=develop.local.austin.rr.com type=PATH msg=audit(05/27/2009 10:31:40.983:208258) : item=0 name=/dev/vg00/root inode=813142 dev=00:0f mode=link,777 ouid=root ogid=siterep rdev=00:00 obj=siterep_u:object_r:device_t:s15:c0.c1023 node=develop.local.austin.rr.com type=CWD msg=audit(05/27/2009 10:31:40.983:208258) : cwd=/home/siterep1 node=develop.local.austin.rr.com type=SYSCALL msg=audit(05/27/2009 10:31:40.983:208258) : arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=7fffd2b27b30 a1=7f97ca9034b9 a2=7f97c4556b10 a3=1e items=1 ppid=9777 pid=9820 auid=siterep1 uid=root gid=siterep euid=root suid=root fsuid=root egid=siterep sgid=siterep fsgid=siterep tty=pts7 ses=1 comm=lvconvert exe=/sbin/lvm subj=siterep_u:siterep_r:lvm_t:s15:c0.c1023 key=(null) node=develop.local.austin.rr.com type=SELINUX_ERR msg=audit(05/27/2009 10:31:40.983:208258) : security_validate_transition: denied for oldcontext=siterep_u:object_r:device_t:s15:c0.c1023 newcontext=system_u:object_r:device_t:s0 taskcontext=siterep_u:siterep_r:lvm_t:s15:c0.c1023 tclass=lnk_file ---- node=develop.local.austin.rr.com type=PATH msg=audit(05/27/2009 10:31:40.984:208260) : item=0 name=/dev/vg00/snap inode=813145 dev=00:0f mode=link,777 ouid=root ogid=siterep rdev=00:00 obj=siterep_u:object_r:device_t:s15:c0.c1023 node=develop.local.austin.rr.com type=CWD msg=audit(05/27/2009 10:31:40.984:208260) : cwd=/home/siterep1 node=develop.local.austin.rr.com type=SYSCALL msg=audit(05/27/2009 10:31:40.984:208260) : arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=7fffd2b27b30 a1=7f97ca9034b9 a2=7f97c455dc90 a3=1e items=1 ppid=9777 pid=9820 auid=siterep1 uid=root gid=siterep euid=root suid=root fsuid=root egid=siterep sgid=siterep fsgid=siterep tty=pts7 ses=1 comm=lvconvert exe=/sbin/lvm subj=siterep_u:siterep_r:lvm_t:s15:c0.c1023 key=(null) node=develop.local.austin.rr.com type=SELINUX_ERR msg=audit(05/27/2009 10:31:40.984:208260) : security_validate_transition: denied for oldcontext=siterep_u:object_r:device_t:s15:c0.c1023 newcontext=system_u:object_r:device_t:s0 taskcontext=siterep_u:siterep_r:lvm_t:s15:c0.c1023 tclass=lnk_file ---- There are no AVCs associated with the error and I am using the following policy statements ( where jcdx_fsbackup_t is the domain type of the entire script) lvm_domtrans(jcdx_fsbackup_t) mls_file_write_all_levels(lvm_t) allow lvm_t lvm_control_t:chr_file write; allow lvm_t lvm_lock_t:dir { write remove_name add_name }; allow lvm_t lvm_metadata_t:dir { write remove_name add_name }; At this point the script is ---------- #!/bin/bash /sbin/lvconvert -s vg00/root snap ---------- The policy is selinux-policy-3.5.13-57.fc10, A push in the right direction would be appreciated. -- "THIS time it really is fixed. I mean, how many times can we get it wrong? At some point, we just have to run out of bad ideas.." Linus Torvalds Nickolas Gray nick(a)magitek.ltd

3 3

ports under SELinux on RHEL-5.3
by Brian Ginn 26 May '09

26 May '09

My app binds to a random port prior to connecting to a well known port. If the random port is in use (errno == EADDRINUSE) the port number is incremented and a new bind is attempted. SELinux port labeling was causing errno==EACCES for ports that are under SELinux control. I found corenet_tcp_bind_all_ports() which fixed the problem - because now, my app is allowed to use those ports. Dan Walsh suggested corenet_tcp_bind_generic_port() instead - so my app doesn't use the ports managed by SELinux for other apps. So I changed my code to also increment the port and re-attempt a bind when errno==EACCES. I find that some non-SELinux controlled ports are also causing EACCES (but only in enforcing mode)... and EACCES is a problem I've never run into before on non-SELinux boxes... so I believe that SELinux is somehow preventing access to the un-controlled ports. Each of the ports listed below, the PRIOR port has an SELinux type shown by 'semanage port -l', yet these ports also get the EACCES error: 1702 2607 3261 3552 4691 5433 5704 6021 7001 8022 8119 8291 8293 9011 9223 9283 9293 9434 9702 13446 16002

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2009