selinux August 2009

selinux@lists.fedoraproject.org

46 participants
47 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

Re: AVC every server boot: SELinux is preventing the setxkbmap from using potentially mislabeled files (./.X11-unix).
by Richard Chapman 01 Sep '09

01 Sep '09

Hi Daniel FYI: I have just rebooted the system for the first time in ages - and I'm still using /tmp as opposes to tmpfs - and received 2 more AVCs - very similar to the previous ones. If I understood correctly - you were not expecting this to re-occur. I haven't posted the AVCs because I think they are much the same as the originals - but can do so if you are interested. This is not a major problem - but is one of the issues preventing me from using "enforcing" mode. Any thoughts why it has re-occurred? Richard. Daniel J Walsh wrote: > On 08/15/2009 01:05 AM, Richard Chapman wrote: > >> Daniel J Walsh wrote: >> >>> On 08/14/2009 12:19 AM, Richard Chapman wrote: >>> >>> >>>> Daniel J Walsh wrote: >>>> >>>> >>>>> On 08/12/2009 07:53 PM, Richard Chapman wrote: >>>>> >>>>> >>>>> >>>>>> I am running Centos 5.3 in permissive mode - and recently I started >>>>>> getting 4 avcs every time I boot the server. I am not sure - but I >>>>>> think >>>>>> these might have started when I changed my desktop from Gnome to >>>>>> KDE. I >>>>>> have tried the relabelling suggested in the AVC - but this hasn't >>>>>> fixed it. >>>>>> Does it look like I have something set up wrong - or is there a policy >>>>>> problem? >>>>>> Richard. >>>>>> >>>>>> >>>>>> Summary >>>>>> SELinux is preventing the setxkbmap from using potentially mislabeled >>>>>> files (./.X11-unix). >>>>>> Detailed Description >>>>>> [SELinux is in permissive mode, the operation would have been >>>>>> denied but >>>>>> was permitted due to permissive mode.] >>>>>> >>>>>> SELinux has denied setxkbmap access to potentially mislabeled file(s) >>>>>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use >>>>>> these files. It is common for users to edit files in their home >>>>>> directory or tmp directories and then move (mv) them to system >>>>>> directories. The problem is that the files end up with the wrong file >>>>>> context which confined applications are not allowed to access. >>>>>> >>>>>> Allowing Access >>>>>> If you want setxkbmap to access this files, you need to relabel them >>>>>> using restorecon -v './.X11-unix'. You might want to relabel the >>>>>> entire >>>>>> directory using restorecon -R -v './.X11-unix'. >>>>>> Additional Information >>>>>> >>>>>> Source Context: system_u:system_r:rhgb_t >>>>>> Target Context: system_u:object_r:initrc_tmp_t >>>>>> Target Objects: ./.X11-unix [ dir ] >>>>>> Source: setxkbmap >>>>>> Source Path: /usr/bin/setxkbmap >>>>>> Port: <Unknown> >>>>>> Host: C5.aardvark.com.au >>>>>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1 >>>>>> Target RPM Packages: Policy RPM: >>>>>> selinux-policy-2.4.6-225.el5 >>>>>> Selinux Enabled: True >>>>>> Policy Type: targeted >>>>>> MLS Enabled: True >>>>>> Enforcing Mode: Permissive >>>>>> Plugin Name: home_tmp_bad_labels >>>>>> Host Name: C5.aardvark.com.au >>>>>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue >>>>>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64 >>>>>> Alert Count: 34 >>>>>> First Seen: Sun Jan 11 17:55:13 2009 >>>>>> Last Seen: Mon Aug 10 18:13:15 2009 >>>>>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942 >>>>>> Line Numbers: Raw Audit Messages : >>>>>> >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899195.897:15): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0 >>>>>> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" exe="/usr/bin/setxkbmap" >>>>>> subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899195.897:15): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=3d29351a30 items=0 ppid=4021 pid=4022 auid=4294967295 uid=0 gid=0 >>>>>> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" exe="/usr/bin/setxkbmap" >>>>>> subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> >>>>>> >>>>>> Summary >>>>>> SELinux is preventing the setxkbmap from using potentially mislabeled >>>>>> files (./.X11-unix). >>>>>> Detailed Description >>>>>> [SELinux is in permissive mode, the operation would have been >>>>>> denied but >>>>>> was permitted due to permissive mode.] >>>>>> >>>>>> SELinux has denied setxkbmap access to potentially mislabeled file(s) >>>>>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use >>>>>> these files. It is common for users to edit files in their home >>>>>> directory or tmp directories and then move (mv) them to system >>>>>> directories. The problem is that the files end up with the wrong file >>>>>> context which confined applications are not allowed to access. >>>>>> >>>>>> Allowing Access >>>>>> If you want setxkbmap to access this files, you need to relabel them >>>>>> using restorecon -v './.X11-unix'. You might want to relabel the >>>>>> entire >>>>>> directory using restorecon -R -v './.X11-unix'. >>>>>> Additional Information >>>>>> >>>>>> Source Context: system_u:system_r:rhgb_t >>>>>> Target Context: system_u:object_r:initrc_tmp_t >>>>>> Target Objects: ./.X11-unix [ dir ] >>>>>> Source: setxkbmap >>>>>> Source Path: /usr/bin/setxkbmap >>>>>> Port: <Unknown> >>>>>> Host: C5.aardvark.com.au >>>>>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1 >>>>>> Target RPM Packages: Policy RPM: >>>>>> selinux-policy-2.4.6-225.el5 >>>>>> Selinux Enabled: True >>>>>> Policy Type: targeted >>>>>> MLS Enabled: True >>>>>> Enforcing Mode: Permissive >>>>>> Plugin Name: home_tmp_bad_labels >>>>>> Host Name: C5.aardvark.com.au >>>>>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue >>>>>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64 >>>>>> Alert Count: 35 >>>>>> First Seen: Sun Jan 11 17:55:13 2009 >>>>>> Last Seen: Mon Aug 10 18:13:16 2009 >>>>>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942 >>>>>> Line Numbers: Raw Audit Messages : >>>>>> >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899196.898:16): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899196.898:16): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> >>>>>> >>>>>> Summary >>>>>> SELinux is preventing the setxkbmap from using potentially mislabeled >>>>>> files (./.X11-unix). >>>>>> Detailed Description >>>>>> [SELinux is in permissive mode, the operation would have been >>>>>> denied but >>>>>> was permitted due to permissive mode.] >>>>>> >>>>>> SELinux has denied setxkbmap access to potentially mislabeled file(s) >>>>>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use >>>>>> these files. It is common for users to edit files in their home >>>>>> directory or tmp directories and then move (mv) them to system >>>>>> directories. The problem is that the files end up with the wrong file >>>>>> context which confined applications are not allowed to access. >>>>>> >>>>>> Allowing Access >>>>>> If you want setxkbmap to access this files, you need to relabel them >>>>>> using restorecon -v './.X11-unix'. You might want to relabel the >>>>>> entire >>>>>> directory using restorecon -R -v './.X11-unix'. >>>>>> Additional Information >>>>>> >>>>>> Source Context: system_u:system_r:rhgb_t >>>>>> Target Context: system_u:object_r:initrc_tmp_t >>>>>> Target Objects: ./.X11-unix [ dir ] >>>>>> Source: setxkbmap >>>>>> Source Path: /usr/bin/setxkbmap >>>>>> Port: <Unknown> >>>>>> Host: C5.aardvark.com.au >>>>>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1 >>>>>> Target RPM Packages: Policy RPM: >>>>>> selinux-policy-2.4.6-225.el5 >>>>>> Selinux Enabled: True >>>>>> Policy Type: targeted >>>>>> MLS Enabled: True >>>>>> Enforcing Mode: Permissive >>>>>> Plugin Name: home_tmp_bad_labels >>>>>> Host Name: C5.aardvark.com.au >>>>>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue >>>>>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64 >>>>>> Alert Count: 36 >>>>>> First Seen: Sun Jan 11 17:55:13 2009 >>>>>> Last Seen: Mon Aug 10 18:13:17 2009 >>>>>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942 >>>>>> Line Numbers: Raw Audit Messages : >>>>>> >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc: >>>>>> denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899197.933:18): avc: >>>>>> denied { search } for pid=4041 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899197.933:18): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff31d13e20 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> >>>>>> >>>>>> >>>>>> Summary >>>>>> SELinux is preventing the setxkbmap from using potentially mislabeled >>>>>> files (./.X11-unix). >>>>>> Detailed Description >>>>>> [SELinux is in permissive mode, the operation would have been >>>>>> denied but >>>>>> was permitted due to permissive mode.] >>>>>> >>>>>> SELinux has denied setxkbmap access to potentially mislabeled file(s) >>>>>> (./.X11-unix). This means that SELinux will not allow setxkbmap to use >>>>>> these files. It is common for users to edit files in their home >>>>>> directory or tmp directories and then move (mv) them to system >>>>>> directories. The problem is that the files end up with the wrong file >>>>>> context which confined applications are not allowed to access. >>>>>> >>>>>> Allowing Access >>>>>> If you want setxkbmap to access this files, you need to relabel them >>>>>> using restorecon -v './.X11-unix'. You might want to relabel the >>>>>> entire >>>>>> directory using restorecon -R -v './.X11-unix'. >>>>>> Additional Information >>>>>> >>>>>> Source Context: system_u:system_r:rhgb_t >>>>>> Target Context: system_u:object_r:initrc_tmp_t >>>>>> Target Objects: ./.X11-unix [ dir ] >>>>>> Source: setxkbmap >>>>>> Source Path: /usr/bin/setxkbmap >>>>>> Port: <Unknown> >>>>>> Host: C5.aardvark.com.au >>>>>> Source RPM Packages: xorg-x11-xkb-utils-1.0.2-2.1 >>>>>> Target RPM Packages: Policy RPM: >>>>>> selinux-policy-2.4.6-225.el5 >>>>>> Selinux Enabled: True >>>>>> Policy Type: targeted >>>>>> MLS Enabled: True >>>>>> Enforcing Mode: Permissive >>>>>> Plugin Name: home_tmp_bad_labels >>>>>> Host Name: C5.aardvark.com.au >>>>>> Platform: Linux C5.aardvark.com.au 2.6.18-128.4.1.el5 #1 SMP Tue >>>>>> Aug 4 20:19:25 EDT 2009 x86_64 x86_64 >>>>>> Alert Count: 37 >>>>>> First Seen: Sun Jan 11 17:55:13 2009 >>>>>> Last Seen: Mon Aug 10 18:13:19 2009 >>>>>> Local ID: 0950df01-cfad-420a-9e84-4996a8d31942 >>>>>> Line Numbers: Raw Audit Messages : >>>>>> >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=AVC msg=audit(1249899199.903:20): avc: >>>>>> denied { search } for pid=4022 comm="setxkbmap" name=".X11-unix" >>>>>> dev=dm-0 ino=27590701 scontext=system_u:system_r:rhgb_t:s0 >>>>>> tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> host=C5.aardvark.com.au type=SYSCALL msg=audit(1249899199.903:20): >>>>>> arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffd74235b0 a2=13 >>>>>> a3=8 items=0 ppid=1 pid=4022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 >>>>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 >>>>>> comm="setxkbmap" >>>>>> exe="/usr/bin/setxkbmap" subj=system_u:system_r:rhgb_t:s0 key=(null) >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> fedora-selinux-list mailing list >>>>>> fedora-selinux-list(a)redhat.com >>>>>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list >>>>>> >>>>>> >>>>> chcon -R -t xserver_tmp_t /tmp/.X11-unix >>>>> >>>>> I always use tmpfs for /tmp, so I never end up with garbage on a >>>>> reboot. >>>>> >>>>> >>>>> >>>> Thanks Daniel - but this is the response... >>>> >>>> [root@C5 ~]# chcon -R -t xserver_tmp_t /tmp/.X11-unix >>>> chcon: failed to change context of /tmp/.X11-unix to >>>> system_u:object_r:xserver_t mp_t: Invalid >>>> argument >>>> chcon: failed to change context of /tmp/.X11-unix/X0 to >>>> system_u:object_r:xserve r_tmp_t: Invalid >>>> argument >>>> chcon: failed to change context of /tmp/.X11-unix/X1005 to >>>> user_u:object_r:xserv er_tmp_t: Invalid >>>> argument >>>> [root@C5 ~]# >>>> >>>> Being pretty green - I don't really understand the problem here. Also - >>>> if this chcon worked - would this be a permanent solution - or does it >>>> need to be executed in a boot script? >>>> I like your idea of using tmpfs - but is it ever a problem that tmpfs is >>>> relatively small and finite? Also - please excuse my ignorance - but how >>>> do I make tmpfs the tmp folder? >>>> >>>> Richard. >>>> >>>> >>>> >>>> >>> Must have changed between RHEL5 and F11 >>> >>> Try >>> chcon -R -t xdm_xserver_tmp_t /tmp/.X11-unix >>> >>> Add this line to /etc/fstab >>> >>> tmpfs /tmp tmpfs >>> rootcontext="system_u:object_r:tmp_t:s0",defaults 0 0 >>> >>> And reboot. >>> >>> I don't tend to store huge abouts of stuff in /tmp. If I want to >>> store big stuff I can always use /var/tmp >>> >>> >>> >> Thanks Daniel >> >> That chcon command worked fine. Should this be a permanent solution - or >> will new files appearing there need a chcon too? Should I put this >> command into a boot script somewhere? >> >> I'll try tmpfs and see if it ever overflows in practice. Hopefully I'll >> be able to see something in my logwatch if there is ever a problem. >> Currently - It's using less than 1/2 its 2 gigs or ram - so there is >> some room to spare. Seems your suggestion has sparked quite a bit of >> interest...:-) >> >> Thanks again >> >> Richard. >> >> >> > No the chcon is fine. It was mislabeled at some point and relabeling does not touch /tmp > >

2 3

Dogtag implementation on Fc6
by Rashmi 31 Aug '09

31 Aug '09

Hi, Hi I am new to the Dogtag Certificate system. I have to install the dogtag certificate system on fedora core 6. I would appreciate help from fedora-selinux-list users who have successfully installed and are runing dogtag certificate system on linux. I read the explanantion on dogtag on http://pki.fedoraproject.org/wiki/PKI_Main_Page yet I have some questions before starting the installation. Following are the questions: 1. Do I have to install and run Apache service on the system on which I am going to implement dogtag? 2. I am confused about the configuration of all the PKI subsystems like CA,RA,DRM...etc. In the http://pki.fedoraproject.org/wiki/PKI_Main_Page the configuration of all subsyems is given but I dont understand from where do I get the configuration URL for each subsystem. 3. I have to integrate the setup with Checkpoint, so need steps on the integration. * I would appreciate if someone who has implemented dogtag would provide me easy steps to install dogtag on fedora core 6. Thanks & Regards, Rashmee

2 1

vsftpd not changing security context while dropping privileges
by Seramal 31 Aug '09

31 Aug '09

Hi, I noticed vsftpd starts running with UID 0 and MLS s0. When a user logs in, a new process is spawn (forked) from vsftpd and UID is changed to match the user. The problem is that MLS stays in s0, so if the user has a different MLS it will make everything fail. Starting vsftpd with s0-s0:c0.c1023 would be an option, but will then bypass per-user MLS security. So IMHO vsftpd should be patched to change security context when forking a new process. You can reproduce the problem by running: # semanage user -m -r s0-s0:c0.c1023 user_u # groupadd testing # useradd -m -g testing -Z user_u testing # semanage login -m -r s0:c3 testing # chcon -R -l s0:c3 /home/testing # /etc/init.d/vsftpd start # lftp open -u testing,password localhost ls Daniel Walsh said at https://bugzilla.redhat.com/show_bug.cgi?id=518569 : Lets bring this up for discussion on the SELinux list. There are two possibilities, here, One is to just change the level on the vstfpd process to run at the appropriate level of the user. The second would be to change the type, in order to run as a type appropriate for the user. IE With different privs then the vsftpd server.

2 1

Noob wishing to write policy to allow wireless brother printer
by Michael Greenstein 31 Aug '09

31 Aug '09

Noob wishing to write policy to allow wireless brother printer SElinux is not allowing me to connect to my wireless brother mfc 490 cw - already installed drivers -- For some laughs check out my new complete video page at: http://www.youtube.com/profile?user=troyk9&view=videos ベストセレクション〜日本公演２００４“奇跡”より〜

3 2

My home is fully labeled default_t after a kernel crash
by Laurent Rineau 28 Aug '09

28 Aug '09

On my F11 x64 machine, this morning, I have launch that command: sudo semanage fcontext -a -t textrel_shlib_t /opt/intel/Compiler/11.0/081/mkl/lib/em64t/libmkl_core.so After that, my X11 server freezed. I managed to login on the machine with ssh, but sudo got permission denied. :-( Then I have done: - A soft shutdown with the power button. That shutdown was successful. - Power on the machine. Boot the default kernel. Lots of AVC on the console. X11 and mingetty unable to launch. - Reboot with "enforcing=0 autorelabel=1 single". Relabelling seems ok. - Reboot (with no selinux boot parameters). X11 and GDM ok. But just after I tried to login, a popup told me something about permission denied on $HOME, using HOME=/. Obviously, that failed! - Reboot with enforcing=0. Then I have managed to understand that the problem is that almost all my files in $HOME are labeled: "system_u:object_r:default_t:s0" (actually all my $HOME but files with customized context). Another problem: unconfined_u has disappeared! $ id -Z user_u:user_r:user_t:s0 $ sudo semanage user -l Labeling MLS/ MLS/ SELinux User Prefix MCS Level MCS Range SELinux Roles guest_u user s0 s0 guest_r root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r sysadm_u user s0 s0-s0:c0.c1023 sysadm_r system_u user s0 s0-s0:c0.c1023 system_r user_u user s0 s0 user_r xguest_u user s0 s0 xguest_r I have search on the web for a solution, but the only solutions proposed where /.autorelabel! :-( That is why I am looking for a clue here... The machine is under F11, with updates. My configuration: $ rpm -qa \*selinux\* \*semana\* | sort libselinux-2.0.80-1.fc11.i586 libselinux-2.0.80-1.fc11.x86_64 libselinux-debuginfo-2.0.80-1.fc11.x86_64 libselinux-devel-2.0.80-1.fc11.x86_64 libselinux-python-2.0.80-1.fc11.x86_64 libselinux-utils-2.0.80-1.fc11.x86_64 libsemanage-2.0.31-4.fc11.x86_64 libsemanage-python-2.0.31-4.fc11.x86_64 selinux-policy-3.6.12-78.fc11.noarch selinux-policy-targeted-3.6.12-78.fc11.noarch $ uname -a Linux matisse.localdomain 2.6.29.6-217.2.8.fc11.x86_64 #1 SMP Sat Aug 15 01:06:26 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 24 Policy from config file: targeted (But the machine was in enforcing mode at the beginning of the story.) -- Laurent Rineau http://fedoraproject.org/wiki/LaurentRineau

2 2

atieventsd (xorg-x11-drv-catalyst.rpm) on F11
by QingLong 27 Aug '09

27 Aug '09

Hello! I am trying to utilize proprietary video drivers from (the damned) AMD to get accelerated OpenGL on the ATI Mobility Radeon X300 on Fedora 11. So I have installed the packages (along with the required dependencies): akmod-catalyst xorg-x11-drv-catalyst Installation has finished quite smoothly, but after reboot I get no X. I guess, one of the reasons is the atieventsd is not starting due to selinux: | | type=AVC msg=audit(1251364326.851:16119): avc: denied { execmod } for pid=2212 comm="atieventsd" path="/usr/lib/catalyst/libGL.so.1.2" dev=sda6 ino=103736 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file | type=SYSCALL msg=audit(1251364326.851:16119): arch=40000003 syscall=125 success=yes exit=0 a0=11c000 a1=85000 a2=5 a3=bfc34860 items=0 ppid=2210 pid=2212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="atieventsd" exe="/usr/sbin/atieventsd" subj=system_u:system_r:initrc_t:s0 key=(null) | For now I have to put selinux in permissive mode, but is it possible to get this fixed in a more intelligent way? Thank you. QingLong

2 1

Label eth0 with a MCS security category?
by Jason Shaw 25 Aug '09

25 Aug '09

In FC-11, under the targeted policy, is it possible to label an ethernet interface (such as eth0, eth1) with a specific MCS category? Example: 1) Use semanage to assign user1 to s0:c5 3) Assign eth0 to s0:c4 (Can this be done?) 4) Assign eth1 to s0:c5 Desired result: if user1 tries to ping -I eth1 <ip_address> the ping command will work (as both eth1 and user1 have category c5). If user1 tries to ping -I eth0 <ip_address>, the ping command will not work (category mismatch between user and eth1).

3 2

sharing between dogtag and Apache
by Rob Crittenden 25 Aug '09

25 Aug '09

I'm running dogtag, a certificate server, which can publish CRLs. Right now I'm writing them within the dogtag context which writes the files as pki_ca_var_lib_t. I want to make these available from within Apache so I did: Alias /ipa/crl /var/lib/pki-ca/publish Trouble is Apache can't read the files. The simplest route is to simply grant httpd read/search/getattr access to the directory and files. I've got that working now. This grants Apache the rights to read anything in there though, not really the best solution. Can I create a new label, say pki_ca_publish_t, and use that to share between the two? How might I go about doing that? thanks rob

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2009