selinux July 2009

selinux@lists.fedoraproject.org

36 participants
45 discussions

dhclient denial F-11
by Paul Howarth 13 Jul '09

13 Jul '09

I get one of these every time my DHCP lease is renewed: type=AVC msg=audit(1247181873.317:23522): avc: denied { create } for pid=31499 comm="mv" name="yp.conf.predhclient.br0" scontext=unconfined_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file type=SYSCALL msg=audit(1247181873.317:23522): arch=c000003e syscall=2 success=no exit=-13 a0=7fff9e36ebcc a1=c1 a2=180 a3=65726373662f7274 items=0 ppid=31485 pid=31499 auid=1012 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="mv" exe="/bin/mv" subj=unconfined_u:system_r:dhcpc_t:s0 key=(null) It originates from /etc/dhcp/dhclient.d/nis.sh in the ypbind package. Paul..

4 6

Re: Domain transition missing
by Vadym Chepkov 13 Jul '09

13 Jul '09

It would be nice if the interface would be smart enough and allow output from the cron job to be sent, but no one is perfect :) ---- type=AVC msg=audit(1246715821.417:10142): avc: denied { write } for pid=11916 comm="winbind" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file ---- type=AVC msg=audit(1246715821.780:10143): avc: denied { write } for pid=11925 comm="winbindd" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:winbind_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Vadym Chepkov <chepkov(a)yahoo.com> wrote: > From: Vadym Chepkov <chepkov(a)yahoo.com> > Subject: Re: Domain transition missing > To: "Dominick Grift" <domg472(a)gmail.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 10:00 AM > This worked well too, thank you > > system_u:system_r:winbind_t:SystemLow root > 11926 1 0 09:57 ? > 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11928 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11954 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11956 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11957 > 11926 0 09:57 ? 00:00:00 winbindd > > > Sincerely yours, > Vadym Chepkov > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > From: Dominick Grift <domg472(a)gmail.com> > > Subject: Re: Domain transition missing > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > Date: Saturday, July 4, 2009, 9:28 AM > > On Sat, 2009-07-04 at 06:18 -0700, > > Vadym Chepkov wrote: > > > That would be unfortunate. Mine approach is not > > uncommon. If you look closely you will see the same > > technique in wast scripts. spamassassin restarts > itself when > > it updates anti-spam rules, clamav does that > (antivirus) and > > on and on. I use Fedora 11, by the way. > > > > > > For now, instead of creating a new policy I just > added > > 'runcon -t unconfind_t ' in the cron, and it seemed to > did > > the trick. > > > > > > Sincerely yours, > > > Vadym Chepkov > > > > > > > Looking here: > > http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/servi… > > line 235 to line 269. > > > > That seems like a interface one might use in your > > situation: > > > > cron_system_entry(winbind_t, winbind_exec_t) > > > > I admit that using cron with SELinux is not very easy > > currently > > > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > > wrote: > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > Subject: Re: Domain transition missing > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > Date: Saturday, July 4, 2009, 8:57 AM > > > > On Sat, 2009-07-04 at 05:48 -0700, > > > > Vadym Chepkov wrote: > > > > > I really get used to running my > scripts > > unconfined, > > > > how I can accomplish it in this scenario? > > > > > > > > > > Sincerely yours, > > > > > Vadym Chepkov > > > > > > > > > > > > > if you want the system to run jobs you will > need > > to write > > > > some policy or > > > > extend the system_cronjob_t domain i think > > > > > > > > > > > > Were those the only avc denial you got? I > would > > expect more > > > > denials. > > > > > > > > > --- On Sat, 7/4/09, Dominick Grift > <domg472(a)gmail.com> > > > > wrote: > > > > > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > > > Subject: Re: Domain transition > missing > > > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > > > Date: Saturday, July 4, 2009, 8:41 > AM > > > > > > On Sat, 2009-07-04 at 14:38 > +0200, > > > > > > Dominick Grift wrote: > > > > > > > On Sat, 2009-07-04 at 05:11 > -0700, > > Vadym > > > > Chepkov > > > > > > wrote: > > > > > > > > Hi, > > > > > > > > > > > > > > > > Last night I got a > nasty > > surprise from > > > > selinux. I > > > > > > am using winbind for external > > authentication and > > > > since it > > > > > > has history of failures I have a > simple > > watchdog > > > > implemented > > > > > > to check the status and restart it > if > > necessary. > > > > That > > > > > > is what happened last night and > > as a law > > > > abiding > > > > > > selinux citizen I used 'service > winbind > > restart', > > > > but it > > > > > > seems the proper domain > transitions is > > missing > > > > and winbind > > > > > > was started in system_cronjob_t > domain > > instead of > > > > winbind_t > > > > > > and none of other domains could > connect > > to it. > > > > > > > > > > > > > > > > I think jobs running > from > > cron should > > > > be granted > > > > > > the same transition rules as > > from > > > > unconfined_t. > > > > > > > > > > > > > > > > I will file bugzilla > report > > about it, > > > > but could > > > > > > somebody help me with modifying > my > > local policy > > > > until/if it > > > > > > gets implemented, please? Thank > you. > > > > > > > > > > > > > > > > Sincerely yours, > > > > > > > > Vadym > > Chepkov > > > > > > > > > > > > > > A domain transition would > be: > > > > > > > > > > > > > > policy_module(mywinbind, > 0.0.1) > > > > > > > > > > > > > > require { type > system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t; } > > > > > > > > > domain_auto_trans(system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t) > > > > > > > > > > > > > > Can you show us the full raw > avc > > denial? > > > > > > > > > > > > > > > > > > But personally would deal with > this in > > a > > > > different way. I > > > > > > would write > > > > > > policy for the script that > restarts > > winbind and > > > > then i > > > > > > would create a > > > > > > domain transition for the domain > in > > which the > > > > script runs > > > > > > to winbind_t. > > > > > > > > > > > > Mainly because i wouldnt want to > > extend/modify > > > > > > system_cronjob_t > > > > > > > > > > > > So: system_cronjob_t -> > > myscript_exec_t -> > > > > myscript_t > > > > > > -> winbind_exec_t > > > > > > -> winbind_t > > > > > > > > > > > > > > -- > > > > > > > > fedora-selinux-list > mailing > > list > > > > > > > > fedora-selinux-list(a)redhat.com > > > > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

3 2

SELinux and gitosis (FC11)
by Jonathan Stott 13 Jul '09

13 Jul '09

Hi all Today I updated to FC11 and gitosis stopped working (gitosis is a collection of scripts for easing multiuser access to git repositories over ssh). I can tell it's an SELinux problem, because '/sbin/setenforcing 0' clears it up. On the server, the git repositories are managed by the 'git' user, which has the guest_u selinux type (though it also fails when given the user_u user). The home directory (/home/git) has the correct selinux context (user_home_t) as far as I can tell and I've run 'restorecon -Rvv' anyway, just to be sure. gitosis works by calling a system binary, gitosis-serve, which lives in /usr/bin/ and has the type of 'bin_t' so guest_u should be able to execute it. Even with 'setenforcing 0' no AVC denials are created though. Checking /var/log/secure shows that the key is being accepted, and it seems like the process then hangs. Any suggestions appreciated, Regards Jon

4 10

Re: spamassassin pre-compiled rules
by Vadym Chepkov 12 Jul '09

12 Jul '09

I figured it out. There is a proper label in the policy /var/lib/spamassassin/compiled/.*\.so.* regular file system_u:object_r:lib_t:s0 It seems when a script that compiles this library runs, it creates shared libraries with spamd_var_lib_t instead. So I guess the only way to fix this issue is to run restorecon -R /var/lib/spamassassin/compiled/ right after sa-compile finishes. Sincerely yours, Vadym Chepkov --- On Sat, 7/11/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: spamassassin pre-compiled rules > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 11, 2009, 12:38 PM > On Sat, 2009-07-11 at 05:06 -0700, > Vadym Chepkov wrote: > > spamassassin rules got updated recently and I got this > avc > > > > type=AVC msg=audit(1247216252.200:31900): avc: > denied { execute } for pid=24001 comm="spamd" > path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" > dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 > tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file > > > > audit2allow suggests this > > #============= spamd_t ============== > > allow spamd_t spamd_var_lib_t:file execute; > > seems reasonable, but why is it missing in standard > policy? > > > > Sincerely yours, > > Vadym Chepkov > > Is that file part of the package? > /var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so > > It is probably created by spamd_t. > > The problem is that if you allow spamd_t to execute files > with type > spamd_var_lib_t then spamd_t can run everything > in /var/lib/spamassassin. > > This is not so nice but it might not be a problem either > > Looking at the path it appears that spamd put compiled > stuff > under /var/lib/spamassassin/compiled/ > > assuming that all stuff under there should be executable by > spamd_t, one > could consider to introduce a new type for spamd_t > executable files > there. > > That would look something like this: > > myspamd.te: > policy_module(myspamd, 0.0.1) > type spamd_var_lib_exec_t; > files_type(spamd_var_lib_exec_t) > require { type spamd_t; } > filetrans_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t, > { dir file }) > manage_dirs_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > manage_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > exec_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > > myspamd.fc: > /var/lib/spamassassin/compiled(/.*)? -- > gen_context(system_u:object_r:spamd_var_lib_exec_t, s0) > > But i guess that depends on your security requirements > > For now this could be considered a bug in selinux-policy > > > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list >

2 2

SELinux is preventing gconf-defaults- (gconfdefaultsm_t) "read" security_t.
by Robert Nichols 11 Jul '09

11 Jul '09

When trying to set a new default for Power Management Preferences: Detailed Description: SELinux denied access requested by gconf-defaults-. It is not expected that this access is required by gconf-defaults- and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 Target Context system_u:object_r:security_t:s0 Target Objects mls [ file ] Source gconf-defaults- Source Path /usr/libexec/gconf-defaults-mechanism Port <Unknown> Host omega-3p.local Source RPM Packages GConf2-2.26.2-1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-53.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name omega-3p.local Platform Linux omega-3p.local 2.6.29.5-191.fc11.i586 #1 SMP Tue Jun 16 23:11:39 EDT 2009 i686 i686 Alert Count 2 First Seen Fri 10 Jul 2009 04:20:11 PM CDT Last Seen Fri 10 Jul 2009 04:20:11 PM CDT Local ID de1d32d5-dded-47ec-9eb5-9dc8167a8685 Line Numbers Raw Audit Messages node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { read } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { open } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=SYSCALL msg=audit(1247260811.959:37): arch=40000003 syscall=5 success=yes exit=3 a0=bfd414e8 a1=8000 a2=0 a3=bfd414e8 items=0 ppid=3540 pid=3541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gconf-defaults-" exe="/usr/libexec/gconf-defaults-mechanism" subj=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 key=(null) -- Bob Nichols "NOSPAM" is really part of my email address. Do NOT delete it.

2 2

Question about split betweeen delivered and local policy
by David Highley 10 Jul '09

10 Jul '09

Seems with every new version of Fedora there are several modifications to selinux policy that we need to do. So were trying to understand where the split is between creating a bug report and when we need to create local policy modifications. For example, email seems to always need selinux policy changes so that avc's are not blocking spamassassin and pyzor. We did a tar with option --xattrs on a Fedora 10 system for home directories and were not able to restore the tar on a Fedora 11 until we did a policy change. Still ended up needing to a restorecon on the home directories. We wonder if poking these holes in the delivered policies is the correct fix or are we opening up unnecessary security holes.

3 4

selinux and rsync
by Scott Radvan 09 Jul '09

09 Jul '09

Hi all, Having a bit of trouble with rsync on F11 for the managing confined services book I am working on. I am trying to demonstrate the allow_rsync_anon_write boolean as a configuration example by invoking a denial and detailing the subsequent work-around, but rsyncd is happily letting me anonymously read and write files across the network no matter the state of the boolean. The default install of F11 I'm using as a server has a simple 'files' rsyncd module (in daemon mode) set up in rsyncd.conf which by itself should allow access anonymously, but my understanding is that SELinux should still over-ride this and stop anonymous writes even with this loose rsyncd setup. /etc/rsyncd.conf: log file = /var/log/rsyncd.log pid file = /var/run/rsyncd.pid local file = /var/run/rsync.lock [files] path = /srv/files comment = file area read only = false >From the F11 client: $ rsync -avHPAX 100M_file <server_addr>::files sending incremental file list 100M_file 104857600 100% 52.37MB/s 0:00:01 (xfer#1, to-check=0/1) sent 104870493 bytes received 27 bytes 41948208.00 bytes/sec total size is 104857600 speedup is 1.00 $ My rsync command is entered so that it will preserve extended attributes (-X) and ACLs (-A), as shown in rsync(1). But I am getting no denials or errors, SELinux does not seem to be having a problem with me doing anonymous writes/reads with allow_rsync_anon_write --> off Perhaps I'm doing something wrong altogether, or misinterpreting this boolean, but I would have thought SELinux would have a problem with me performing this rsync operation while that boolean is off. Further, rsync_selinux(8) says: "SELinux requires files to have an extended attribute to define the file type. Policy governs the access daemons have to these files. If you want to share files using the rsync daemon, you must label the files and directories public_content_t" But my manually-created path for rsync files is var_t, as is the file I copied over, with no denial mentioning public_content_t - is this man page out of date? My problem is that it all works too easily! I would have thought SELinux would not at all be happy with what I'm doing, but I'm yet to get a single denial. What am I doing wrong? Thanks, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

2 1

removing context
by Brian Krusic 08 Jul '09

08 Jul '09

Hi, When doing an ls -lZ, some files show a security context like; root:object_r:user_home_t:s0 ... while some don't. Does any one know how to remove this context either on a file, dir or file system level? This would solve my dump/restore issue as even though they work, dump level 9 for example is being treated as a 0 because of the error. - Brian

3 4

getpwnam and SELinux
by Brian Ginn 08 Jul '09

08 Jul '09

I have an app that I'm trying to confine. In enforcing mode, getpwnam() returns "X" for the pw_passwd field. Is there SELinux policy to allow this app to get the shadow passwd? I've tried the following without success: auth_can_read_shadow_passwords( ) auth_read_shadow( ) auth_tunable_read_shadow( ) auth_use_nsswitch( ) Thanks, Brian

2 6

dump/restore EA errors
by Brian Krusic 08 Jul '09

08 Jul '09

Hi, Not sure if even this is were I should post so forgive the mis- posting. I did a search for selinux help and this is were I got. I'm running RHEL 5 and am having SE linux issues even though I have SE Linux disabled. I have basic support and they really are of no help on this matter. My scenario; RHEL 5 NFS server (although it can be a Centos NFS server or even a BlueArc). Centos 5 NFS client. Dump/Restore. From my NFS client I do; dump -f - / | restore -r -r - I can get screen loads of stuff like; restore: ./etc/ysyconfig/network-scripts/ifcfg-eth0: EA set security.selinux:system_u:object_r:etc_t:s0 failed: Operation not supported. This happens on various files in various folders. The dump/restore does complete and the files do get restored. lsattr shows nothing set on the source files and when doing it on the NFS share, I get; lsattr: Inappropriate ioctl for device While reading flags on .... (this is various dirs). Any clues are appreciated. Thanks in advance, - Brian

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2009