selinux July 2009

selinux@lists.fedoraproject.org

36 participants
45 discussions

Re: Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

That would be unfortunate. Mine approach is not uncommon. If you look closely you will see the same technique in wast scripts. spamassassin restarts itself when it updates anti-spam rules, clamav does that (antivirus) and on and on. I use Fedora 11, by the way. For now, instead of creating a new policy I just added 'runcon -t unconfind_t ' in the cron, and it seemed to did the trick. Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 8:57 AM > On Sat, 2009-07-04 at 05:48 -0700, > Vadym Chepkov wrote: > > I really get used to running my scripts unconfined, > how I can accomplish it in this scenario? > > > > Sincerely yours, > > Vadym Chepkov > > > > if you want the system to run jobs you will need to write > some policy or > extend the system_cronjob_t domain i think > > > Were those the only avc denial you got? I would expect more > denials. > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > Subject: Re: Domain transition missing > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > Date: Saturday, July 4, 2009, 8:41 AM > > > On Sat, 2009-07-04 at 14:38 +0200, > > > Dominick Grift wrote: > > > > On Sat, 2009-07-04 at 05:11 -0700, Vadym > Chepkov > > > wrote: > > > > > Hi, > > > > > > > > > > Last night I got a nasty surprise from > selinux. I > > > am using winbind for external authentication and > since it > > > has history of failures I have a simple watchdog > implemented > > > to check the status and restart it if necessary. > That > > > is what happened last night and as a law > abiding > > > selinux citizen I used 'service winbind restart', > but it > > > seems the proper domain transitions is missing > and winbind > > > was started in system_cronjob_t domain instead of > winbind_t > > > and none of other domains could connect to it. > > > > > > > > > > I think jobs running from cron should > be granted > > > the same transition rules as from > unconfined_t. > > > > > > > > > > I will file bugzilla report about it, > but could > > > somebody help me with modifying my local policy > until/if it > > > gets implemented, please? Thank you. > > > > > > > > > > Sincerely yours, > > > > > Vadym Chepkov > > > > > > > > A domain transition would be: > > > > > > > > policy_module(mywinbind, 0.0.1) > > > > > > > > require { type system_cronjob_t, > winbind_exec_t, > > > winbind_t; } > > > > domain_auto_trans(system_cronjob_t, > winbind_exec_t, > > > winbind_t) > > > > > > > > Can you show us the full raw avc denial? > > > > > > > > > But personally would deal with this in a > different way. I > > > would write > > > policy for the script that restarts winbind and > then i > > > would create a > > > domain transition for the domain in which the > script runs > > > to winbind_t. > > > > > > Mainly because i wouldnt want to extend/modify > > > system_cronjob_t > > > > > > So: system_cronjob_t -> myscript_exec_t -> > myscript_t > > > -> winbind_exec_t > > > -> winbind_t > > > > > > > > -- > > > > > fedora-selinux-list mailing list > > > > > fedora-selinux-list(a)redhat.com > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > >

2 1

Re: Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

Thank you Every single daemon out there was choking, just a few: type=AVC msg=audit(1246707387.606:8922): avc: denied { connectto } for pid=1313 comm="dovecot-auth" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:dovecot_auth_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707463.608:8931): avc: denied { connectto } for pid=6828 comm="sendmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707468.105:8932): avc: denied { connectto } for pid=6841 comm="procmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:procmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707508.622:8935): avc: denied { connectto } for pid=6847 comm="sendmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707508.629:8936): avc: denied { connectto } for pid=6851 comm="dbus-daemon-lau" path="/var/run/winbindd/pipe" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707632.720:8963): avc: denied { connectto } for pid=7855 comm="pop3" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707632.732:8964): avc: denied { connectto } for pid=7857 comm="dbus-daemon-lau" path="/var/run/winbindd/pipe" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 8:38 AM > On Sat, 2009-07-04 at 05:11 -0700, > Vadym Chepkov wrote: > > Hi, > > > > Last night I got a nasty surprise from selinux. I am > using winbind for external authentication and since it has > history of failures I have a simple watchdog implemented to > check the status and restart it if necessary. That is > what happened last night and as a law abiding selinux > citizen I used 'service winbind restart', but it seems the > proper domain transitions is missing and winbind was started > in system_cronjob_t domain instead of winbind_t and none of > other domains could connect to it. > > > > I think jobs running from cron should be granted the > same transition rules as from unconfined_t. > > > > I will file bugzilla report about it, but could > somebody help me with modifying my local policy until/if it > gets implemented, please? Thank you. > > > > Sincerely yours, > > Vadym Chepkov > > A domain transition would be: > > policy_module(mywinbind, 0.0.1) > > require { type system_cronjob_t, winbind_exec_t, winbind_t; > } > domain_auto_trans(system_cronjob_t, winbind_exec_t, > winbind_t) > > Can you show us the full raw avc denial? > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > >

2 1

Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

Hi, Last night I got a nasty surprise from selinux. I am using winbind for external authentication and since it has history of failures I have a simple watchdog implemented to check the status and restart it if necessary. That is what happened last night and as a law abiding selinux citizen I used 'service winbind restart', but it seems the proper domain transitions is missing and winbind was started in system_cronjob_t domain instead of winbind_t and none of other domains could connect to it. I think jobs running from cron should be granted the same transition rules as from unconfined_t. I will file bugzilla report about it, but could somebody help me with modifying my local policy until/if it gets implemented, please? Thank you. Sincerely yours, Vadym Chepkov

2 2

proftpd and mod_ban
by Paul Howarth 03 Jul '09

03 Jul '09

proftpd's mod_ban uses shared memory, so I needed to add this policy locally on F-11: # Proftpd needs shared memory for mod_ban allow ftpd_t self:shm create_shm_perms; Paul.

2 1

Supporting multiple OS releases
by Rob Crittenden 01 Jul '09

01 Jul '09

In the freeIPA project we have our own SELinux policy. We support RHEL 5 up through Fedora Rawhide. With Fedora 11 we saw some problems compiling our SELinux module which Dan Walsh provided a patch for. I haven't tried this on older releases yet but I'm guessing it won't work as expected (some policies seem to have been renamed, such as corenet_non_ipsec_sendrecv() -> corenet_all_recvfrom_unlabeled() My question is, how can we handle this in our source tree? Are we going to need to maintain per-release policies or does SELinux support some sort of versioning conditionals? thanks rob

5 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2009