selinux July 2009

selinux@lists.fedoraproject.org

36 participants
45 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

add a transition rule
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you. Sincerely yours, Vadym Chepkov

4 5

ausearch and terminal
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I observe a very strange behavior of the ausearch utility. audit-1.7.7-6.el5_3.3 # cat /root/bin/autest.sh /sbin/ausearch -m avc| wc -l If I run it, I get expected results: # /root/bin/autest.sh 1563 But if I run it from cron, I get this in e-mail: <no matches> 0 Why?? Sincerely yours, Vadym Chepkov

2 3

Help with SELinux Policy for Usability Study
by Cliffe 30 Jul '09

30 Jul '09

Dear SELinux Gurus, I am a PhD candidate conducting research into the usability of security mechanisms. I would really appreciate some help regarding the use of SELinux. Let me know if this is not the right place to be asking these types of questions. I generated a policy for opera using polgengui. I then ran the generated ./opera.sh. Although SELinux was still set to enforcing mode opera seemed to run unconfined. The executable and process was labelled as expected (unconfined_u:unconfined_r:opera_t). AVCs were generated, but not enforced. I added to opera.te using grep opera /var/log/audit/audit.log | audit2allow >> opera.te and reran ./opera.sh until no AVCs were generated. Looking at opera.te I noticed the line "permissive opera_t", and not knowing exactly what this line does, I thought it may be placing this domain into permissive mode (although the gui tools suggest otherwise). Removing the line causes "/bin/sh: /usr/bin/opera: Permission denied". No AVCs are generated. So I am not sure why opera seams to be unconfined, or if removing the permissive line was on the right track. Any advice? Also I tried creating a policy for kwrite. This time the created policy seemed to be in effect as soon as I ran the kwrite.sh script. I set setenforce 0 and added to kwrite.te (as above for opera) until no error msgs were generated. Then I reran ./kwrite.sh. Now kwrite exists with "kwrite(2533): Couldn't register name '"org.kate-editor.kwrite-2533'" with DBUS -- another process owns it already!". When setenforce 0 it runs without AVCs. Again I am sure I am missing something simple and your advice will help a lot. I need to resolve this asap and will really appreciate any advice. Soon I will be running a comparative study comparing a number of security mechanisms and I need to sort this out. Thank you, Cliffe.

4 5

Selinux Audit "Unmatched Entries"?
by Frank Murphy 30 Jul '09

30 Jul '09

Waht does all this mean from logwatch, What are in plain speak unmatched entries? --------------------- Selinux Audit Begin ------------------------ Number of audit daemon starts: 5 Number of audit daemon stops: 6 **Unmatched Entries** audit(1248863231.539:55834): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248863231.539:55835): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248865986.300:28653): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248865986.300:28654): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248867118.172:28695): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248867118.172:28696): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 config change requested by pid=9598 auid=500 subj=unconfined_u:system_r:initrc_t:s0 audit(1248871767.418:3339) config changed, auid=500 pid=9598 subj=unconfined_u:system_r:initrc_t:s0 res=success ---------------------- Selinux Audit End ------------------------- -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

2 3

latest fc10 kernel and policy seem to be out of sync (kernel_service)
by Ted Toth 30 Jul '09

30 Jul '09

With kernel-2.6.29.6-93.fc10 we are seeing errors in dmesg about kernel_service class not defined in policy. Looking at the selinux-policy source I find no definition of this class. Ted

1 0

Rawhide F12 and Skype AVC
by Frank Murphy 27 Jul '09

27 Jul '09

Following is AVC Do I replace '<unknown>' with skype? > Summary: > > SELinux is preventing skype from changing a writable memory segment executable. > > Detailed Description: > > The skype application attempted to change the access protection of memory (e.g., > allocated using malloc). This is a potential security problem. Applications > should not be doing this. Applications are sometimes coded incorrectly and > request this permission. The SELinux Memory Protection Tests > (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to > remove this requirement. If skype does not work and you need it to work, you can > configure SELinux temporarily to allow this access until the application is > fixed. Please file a bug report > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. > > Allowing Access: > > If you trust skype to run correctly, you can change the context of the > executable to execmem_exec_t. "chcon -t execmem_exec_t '<Unknown>'". You must > also change the default file context files on the system in order to preserve > them even on a full relabel. "semanage fcontext -a -t execmem_exec_t '<Unknown>'" > > Fix Command: > > chcon -t execmem_exec_t '<Unknown>' > > Additional Information: > > Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Objects None [ process ] > Source skype > Source Path <Unknown> > Port <Unknown> > Host (removed) > Source RPM Packages > Target RPM Packages > Policy RPM selinux-policy-3.6.22-2.fc12 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name allow_execmem > Host Name (removed) > Platform Linux internet01.frankly3d.local > 2.6.31-0.86.rc3.git5.fc12.x86_64 #1 SMP Wed Jul 22 > 15:31:34 EDT 2009 x86_64 x86_64 > Alert Count 1 > First Seen Fri 24 Jul 2009 17:38:51 IST > Last Seen Fri 24 Jul 2009 17:38:51 IST > Local ID 6c5beb61-0671-4497-b86d-cd1bf0944901 > Line Numbers > > Raw Audit Messages > > node=internet01.frankly3d.local type=AVC msg=audit(1248453531.351:24900): avc: denied { execmem } for pid=2079 comm="skype" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process > > node=internet01.frankly3d.local type=SYSCALL msg=audit(1248453531.351:24900): arch=c000003e syscall=59 per=400000 success=no exit=-13 a0=1dae08f a1=1c0bcd0 a2=7fff70be3b38 a3=7fff70be2410 items=0 ppid=2078 pid=2079 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="skype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) > > -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

3 3

postfix_smtp_t
by Christoph Höger 27 Jul '09

27 Jul '09

Hi, this is a rather special use case, but I think it is valid. According to Pauls hints at http://marilyn.frields.org:8080/~paul/wordpress/?p=2616 I configured postfix to relay my local mail via some mail servers. But since I like a clean approach I did not want the sasl_password files in /etc/ so that the admin (me) has to handle plain text passwords there. Postfix seems to support multiple db files at arbitrary positions. But SELinux does not. I guess the transition to postfix_smtp_t is a little too early (before chroot). So I changed the context of my sasl_passwd files to postfix_smtp_t, just to notice that: 1. I (as a user) cannot do this 2. After I did it nevertheless I cannot edit those files So here is my proposal: Introduce postfix_userconfig_t and let postfix_smtp_t read it, and allow transitions and read/write access from unconfined_t to it. I know that this is suboptimal because it effectively becomes unconfinded_t, but since the admin _must_ add those files to /etc/postfix/main.cf (and should allow only harmless files) I guess that this is ok. any objections or shall I try to write a patch for the policy?

2 3

SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t
by Edward Kuns 25 Jul '09

25 Jul '09

Just in the past few days I've received seven of this AVC complaint, and I haven't seen any of this complaint before that. On 11 July, I updated selinux to 3.6.12-62.fc11. I currently have clamav-0.95.1-2.fc11.i586, installed on 1 July. I am not aware of anything that changed on or just before the 17th. Any ideas? Here's the sealert: Thanks Eddie Summary: SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t. Detailed Description: SELinux denied access requested by clamd.scan. It is not expected that this access is required by clamd.scan and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_cronjob_t:s0 Target Context system_u:system_r:crond_t:s0-s0:c0.c1023 Target Objects pipe [ fifo_file ] Source clamd.scan Source Path /bin/bash Port <Unknown> Host kilroy.chi.il.us Source RPM Packages bash-4.0-6.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-62.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.29.5-191.fc11.i686.PAE #1 SMP Tue Jun 16 23:19:53 EDT 2009 i686 i686 Alert Count 7 First Seen Fri Jul 17 10:36:13 2009 Last Seen Mon Jul 20 16:36:12 2009 Local ID 39c625f5-4b31-49f2-bb14-57835e8afc61 Line Numbers Raw Audit Messages node=kilroy.chi.il.us type=AVC msg=audit(1248125772.619:80082): avc: denied { write } for pid=3642 comm="clamd.scan" path="pipe:[8230868]" dev=pipefs ino=8230868 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file node=kilroy.chi.il.us type=SYSCALL msg=audit(1248125772.619:80082): arch=40000003 syscall=11 success=yes exit=0 a0=9ef08f0 a1=9ef0910 a2=9eeecb8 a3=9ef0910 items=0 ppid=509 pid=3642 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2000 comm="clamd.scan" exe="/bin/bash" subj=system_u:system_r:system_cronjob_t:s0 key=(null)

4 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2009