selinux August 2009

selinux@lists.fedoraproject.org

46 participants
47 discussions

Logrotate on mounted partition
by Arthur Dent 18 Aug '09

18 Aug '09

I have a procmail recipe which writes a copy of every mail I receive (just because I'm paranoid it doesn't mean they aren't out to get me!) to a backup area on my /dev/sda9 partition, mounted as /mnt/backup/ by fstab. (It is an ext3 partition). Back in March 2008 when I was on F8 Stephen Smalley kindly helped me to prevent the hundreds of avcs by suggesting the following: semanage fcontext -a -t mail_spool_t "/mnt/backup(/.*)?" restorecon -v -R /mnt/backup This worked perfectly. It also held true throughout my time with F9. I have now upgraded to F11 (I skipped F10) and it still kind of works. I get an avc when logrotate tries to access these files. The strange thing is this didn't happen under F8 or F9. Is there an elegant solution to this problem or should I write a policy module? This is what audit2allow proposes: module rawmail 1.0; require { type mail_spool_t; type logrotate_t; class file getattr; } #============= logrotate_t ============== allow logrotate_t mail_spool_t:file getattr; The full avc is below. Many thanks for all your help.... Mark Summary SELinux is preventing logrotate (logrotate_t) "getattr" mail_spool_t. Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by logrotate. It is not expected that this access is required by logrotate and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see FAQ Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report against this package. Additional Information Source Context: system_u:system_r:logrotate_t:s0-s0:c0.c1023 Target Context: system_u:object_r:mail_spool_t:s0 Target Objects: /mnt/backup/mail/rawmail [ file ] Source: logrotate Source Path: /usr/sbin/logrotate Port: <Unknown> Host: troodos.org.uk Source RPM Packages: logrotate-3.7.8-2.fc11 Target RPM Packages: Policy RPM: selinux-policy-3.6.12-72.fc11 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall Host Name: mydomain Platform: Linux mydomain 2.6.29.6-217.2.3.fc11.i686.PAE #1 SMP Wed Jul 29 16:05:22 EDT 2009 i686 i686 Alert Count: 3 First Seen: Thu Aug 13 03:45:40 2009 Last Seen: Sat Aug 15 03:26:41 2009 Local ID: 3a8c20b3-ff25-43ea-8214-bd926c28215b Line Numbers: Raw Audit Messages : node=mydomain type=AVC msg=audit(1250303201.472:2436): avc: denied { getattr } for pid=15100 comm="logrotate" path="/mnt/backup/mail/rawmail" dev=sda9 ino=2490369 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file node=troodos.org.uk type=SYSCALL msg=audit(1250303201.472:2436): arch=40000003 syscall=196 success=yes exit=0 a0=8a7d598 a1=bfe1faa4 a2=77cff4 a3=1 items=0 ppid=15098 pid=15100 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=513 comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)

3 10

xguest: firefox - execmem
by Christoph A. 18 Aug '09

18 Aug '09

Hi, I wanted to try the xguest user, but firefox always crashed on startup. This AVC appears many times in the logs: type=AVC msg=audit(1250580934.287:24730): avc: denied { execmem } for pid=4845 comm="firefox" scontext=xguest_u:xguest_r:mozilla_t:s0 tcontext=xguest_u:xguest_r:mozilla_t:s0 tclass=process execmem is not allowed: getsebool -a|grep execmem allow_execmem --> off Allowing execmem resolves the problem, but is there a better solution for this? Another question: I would like to make some permanent changes to the xguest account (keyboard layout, safe passphrase for wifi access, set keyring pw, remove some icons,...) How can I as admin do that? thanks, Christoph

3 6

setroubleshooter not filing bugs, is there another way
by Antonio Olivares 18 Aug '09

18 Aug '09

Dear fellow selinux experts, I am encountering a problem with setroubleshooter and avc denials for wine. It gives me a fatal error report, but I can't copy + paste like I used to, I tried to file a bugzilla report but the process hangs and it is not being sent. Is there another way to capture the report so I can send in the avc denials? I am running xfce fully updated in rawhide. I try to dmesg but get no avcs and I can't run windows programs under wine without seeing the setroubleshoot(er) go crazy :( Thanks, Antonio

5 7

rsync as backup from f11 to F10 - issues
by mike cloaked 17 Aug '09

17 Aug '09

I have been running backups using rsync from various machines on my LAN onto a main (F10) machine into which is plugged a usb external drive that takes the backup files. This year the machine into which the backup drive is plugged has been running F10 fully up to date, and with SELinux fully enforcing. Machines on the LAN have been running backups across the network using an rsync command within a script which essentially does: rsync --delete -aXH --exclude blah /opt home1:/media/usbdrive/BACKUPS/myhostname and similar for other directories. This has worked fine until I installed F11 on some of the machines in the LAN, with ext4 filesystems on them. Trying the same thing in this case gave AVC denials on the machine (running F10) to which the the external usb drive was attached (and with an ext3 filesystem to take the backups) The AVC contained: Summary SELinux is preventing rsync (unconfined_t) "mac_admin" unconfined_t. Detailed Description SELinux denied access requested by rsync. It is not expected that this access is required by rsync and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see FAQ Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report against this package. Additional Information Source Context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Target Context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Target Objects: None [ capability2 ] Source: rsync Source Path: /usr/bin/rsync Port: <Unknown> Host: home1.xxxxxxxxx Source RPM Packages: rsync-3.0.6-0.fc10 Target RPM Packages: Policy RPM: selinux-policy-3.5.13-67.fc10Selinux Enabled: TruePolicy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: catchall Host Name: home1.xxxxxxxxx Platform: Linux home1.xxxxxxxxxx 2.6.27.29-170.2.78.fc10.i686 #1 SMP Fri Jul 31 04:40:15 EDT 2009 i686 i686 Alert Count: 72 First Seen: Tue 11 Aug 2009 08:45:24 PM BST Last Seen: Tue 11 Aug 2009 08:57:08 PM BST Local ID: 2f39a50c-7f62-4e03-aa28-5826d349f52a Line Numbers: Raw Audit Messages : node=home1.xxxxxxxxxxxxxx type=AVC msg=audit(1250020628.16:1141): avc: denied { mac_admin } for pid=18683 comm="rsync" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=capability2 node=home1.xxxxxxxxxxxxxx type=SYSCALL msg=audit(1250020628.16:1141): arch=40000003 syscall=227 success=no exit=-22 a0=bfc81358 a1=9e3808c a2=9e38068 a3=24 items=0 ppid=18663 pid=18683 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=145 comm="rsync" exe="/usr/bin/rsync" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) This seems to stem from a context incompatibility between F10 and F11. My work-around is as follows: I have made a new ext4 filesystem on the external drive using mke2fs -t ext4 and labelling it using e2label, and then running the backup with the drive attached to a machine running F11 with SElinux enforcing and which has an ext4 filesystem for / and /opt. Now I am currently running a backup from one of the other machines on the LAN which is also running F11 with SElinux enforcing and so far I am not seeing AVC denials. My question is whether there is a workaround for the original scenario backup up files from the F11 machines onto an external drive with ext3 connected to an F10 machine with ext3 filesystem. Or is the filesystem a red herring and the problem stemming from selinux alone? You may ask why I need to copy the extended attributes - it surely makes life easier if I restore files later. -- View this message in context: http://www.nabble.com/rsync-as-backup-from-f11-to-F10---issues-tp24925988p2… Sent from the Fedora SELinux List mailing list archive at Nabble.com.

5 14

F11 Relabel problem
by Arthur Dent 14 Aug '09

14 Aug '09

Hello all, I have just upgraded from F9 to F11 and, still having one or two selinux related problems, decided to do a /.autorelabel. Knowing how long this can take on my ageing hardware I went off for a cup of tea... On the screen when I returned (the job had not finished) was: SELinux: Context system_u:object_r:gamin_??? is not valid (left unmapped) The question marks are mine. I just reached for a pen when another load of messages flashed by and the job finished. Here is what I found in /var/log/messages: Context system_u:object_r:gamin_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:pppd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:NetworkManager_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:nscd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:bluetooth_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:squid_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:dovecot_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:kerneloops_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:syslogd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:fail2ban_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:openvpn_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:setroubleshoot_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:rpcbind_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:fsdaemon_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:samba_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:mysqld_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:snmp_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:dnsmasq_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:httpd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:auditd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:ntpd_script_exec_t:s0 is not valid (left unmapped). Context system_u:object_r:squid_var_t:s0 is not valid (left unmapped). Context unconfined_u:object_r:squid_var_t:s0 is not valid (left unmapped). My question(s): 1) Should I be worried? 2) Should I do anything? Note: I don't know if this is relevant because there is not much additional information to go on in the logs, but - I have in my /etc/fstab mappings to other partitions - one of which contains the former F9 system (so that I can refer to previous system configs while I tune my F11 system) /home is on its own partition. Thanks for any help / suggestions.... Mark

2 5

kvm/qemu problems
by Dr. Michael J. Chudobiak 14 Aug '09

14 Aug '09

Hi all, My kvm/qemu instance of WindowsXP on Fedora stopped functioning in the past week or two, due to some change in selinux policies. This is the problem: [root@xena ~]# audit2allow -a #============= svirt_t ============== allow svirt_t devpts_t:chr_file setattr; allow svirt_t self:capability { chown fsetid }; allow svirt_t self:process setrlimit; Is there a handy just-make-it-work boolean for this? Should this be a bug? selinux-policy-targeted-3.6.12-72.fc11.noarch - Mike

2 1

Apache crashing in F-11
by Rob Crittenden 14 Aug '09

14 Aug '09

I'm having a problem where Apache is segfaulting when SELinux is enabled because of an AVC. I'm using freeIPA which defines a mod_python handler. The AVCs are: type=AVC msg=audit(1250255388.275:27650): avc: denied { execute } for pid=7849 comm="httpd" path=2F746D702F6666696A7435517772202864656C6574656429 dev=sda1 ino=442585 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_tmp_t:s0 tclass=file type=AVC msg=audit(1250255388.288:27652): avc: denied { execute } for pid=7850 comm="httpd" path=2F6465762F73686D2F6666696D436E667967202864656C6574656429 dev=tmpfs ino=33960 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_tmpfs_t:s0 tclass=file audit2allow generated this: module test 1.0; require { type httpd_tmp_t; type httpd_t; type httpd_tmpfs_t; class file execute; } #============= httpd_t ============== allow httpd_t httpd_tmp_t:file execute; allow httpd_t httpd_tmpfs_t:file execute; I'm a bit stumped. What should I look for, something doing an exec, something messing in /tmp, both? thanks rob

2 2

samba and system users home
by Vadym Chepkov 13 Aug '09

13 Aug '09

Hi, Each time anybody trying to access a samba share I get a denials like this: type=AVC msg=audit(1250191256.756:26956): avc: denied { getattr } for pid=20508 comm="smbd" path="/var/www" dev=dm-5 ino=2 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir type=AVC msg=audit(1250191256.756:26955): avc: denied { getattr } for pid=20508 comm="smbd" path="/var/mysql" dev=dm-4 ino=2 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir I am not sure why samba is trying to access this directories, it's no ones home, just a mount point. dovecot generates the same AVCs, but only when it starts. What is the best way to suppress these? Thanks. Sincerely yours, Vadym Chepkov

3 4

does SELinux can log all the files access?
by Bai Shuwei 13 Aug '09

13 Aug '09

Hi, ALL: I cannot find any log tools to log all the files access, including delete/remove/read/write operations. So i want to know whether SELinux upport the functions. Thanks for your responce! Best Regards! Bai Shuwei -- Love other people, as same as love yourself! Don't think all the time, do it by your hands! Personal URL: http://dslab.lzu.edu.cn:8080/members/baishw/ E-Mail: baishuwei(a)gmail.com or baishuwei(a)dslab.lzu.edu.cn

3 2

two denials one for ck-get-x11-serv and one for wine
by Antonio Olivares 13 Aug '09

13 Aug '09

Dear fellow selinux experts and users, I had problems updating a rawhide machine and I used xfce spin to get back in the saddle. I encountered two denials and I post them here for guidance. Thanks in Advance, Antonio Summary: SELinux is preventing the ck-get-x11-serv from using potentially mislabeled files (.Xauthority). Detailed Description: SELinux has denied ck-get-x11-serv access to potentially mislabeled file(s) (.Xauthority). This means that SELinux will not allow ck-get-x11-serv to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want ck-get-x11-serv to access this files, you need to relabel them using restorecon -v '.Xauthority'. You might want to relabel the entire directory using restorecon -R -v ''. Additional Information: Source Context system_u:system_r:consolekit_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:admin_home_t:s0 Target Objects .Xauthority [ file ] Source ck-get-x11-serv Source Path /usr/libexec/ck-get-x11-server-pid Port <Unknown> Host (removed) Source RPM Packages ConsoleKit-x11-0.3.1-2.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.26-8.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name (removed) Platform Linux localhost.localdomain 2.6.31-0.125.rc5.git2.fc12.i686 #1 SMP Tue Aug 4 03:18:57 EDT 2009 i686 i686 Alert Count 1 First Seen Wed 12 Aug 2009 02:42:54 AM CDT Last Seen Wed 12 Aug 2009 02:42:54 AM CDT Local ID ffd20bb6-e1cf-466f-b51e-9de4c94b4991 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1250062974.438:22): avc: denied { read } for pid=1325 comm="ck-get-x11-serv" name=".Xauthority" dev=dm-0 ino=78946 scontext=system_u:system_r:consolekit_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1250062974.438:22): arch=40000003 syscall=33 success=no exit=-13 a0=bffedfbc a1=4 a2=18ab18 a3=bffedfbc items=0 ppid=1324 pid=1325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=system_u:system_r:consolekit_t:s0-s0:c0.c1023 key=(null) Can't copy the wine and can't submit the above one to bugzilla. The wine one looks serious as I try to run some windows programs that worked before without problems. Will see how I can capture them?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2009