selinux August 2009

selinux@lists.fedoraproject.org

46 participants
47 discussions

Testing SELinux
by John Smith 11 Aug '09

11 Aug '09

Hello, I'm doing a testing for SELinux, so far I have create a domain for a special program. It does work correctly. I have not given the domain any permissions to access any top leve directories or their subdirectories since I am running it in chroot. The thing when it came to testing now, I have created some bash files, and labelled with with exec as the entry to the domain. But even after changing the default security context for these bash files, when executing them, the still be in unconfined domain instead of entering the new domain for testing. Anyone can identify where is the problem? Thanks in advance _________________________________________________________________ Windows Live Messenger: Thanks for 10 great years—enjoy free winks and emoticons. http://clk.atdmt.com/UKM/go/157562755/direct/01/

3 2

SELinux Reset
by Peter Joseph 10 Aug '09

10 Aug '09

While experimenting with SELinux, I finally managed to lock myself out of the system. The only way to get back in, I had to add "selinux=0" to the end of the kernel line. Now, if I run in a permissive mode the following message appears when I try to log in: "Could not connect to session bus: An SELinux policy prevents this sender from sending this message to this recipient (rejected message had sender "(unset)" interface "org.freedesktop.DBus" member "Hello" error name "(unset)" destination "org.freedesktop.DBus)." I am forced to go back to the grub prompt and disable SELinux again, in order to get in. What is the best way to reset SEL to its original state? -- View this message in context: http://www.nabble.com/SELinux-Reset-tp24855587p24855587.html Sent from the Fedora SELinux List mailing list archive at Nabble.com.

5 23

F9: sendmail AVC complaint
by Dan Thurman 10 Aug '09

10 Aug '09

I got this AVC complaint fairly recently so please let me know how to fix this one thanks! File: /var/log/messages ================================================= setroubleshoot: SELinux is preventing sendmail (system_mail_t) "read" to /var/log/messages (var_log_t). For complete SELinux messages. run sealert -l 5672ff6c-ad2c-4d3b-aa2b-4c53178ed5f2 $ sealert -l 5672ff6c-ad2c-4d3b-aa2b-4c53178ed5f2 ================================================= Summary: SELinux is preventing sendmail (system_mail_t) "read" to /var/log/messages (var_log_t). Detailed Description: SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /var/log/messages, restorecon -v '/var/log/messages' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_mail_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_log_t:s0 Target Objects /var/log/messages [ file ] Source sendmail Source Path /usr/sbin/sendmail.sendmail Port <Unknown> Host mysystem.mydomain.com Source RPM Packages sendmail-8.14.2-4.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-135.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name mysystem.mydomain.com Platform Linux mysystem.mydomain.com 2.6.27.25-78.2.56.fc9.i686 #1 SMP Thu Jun 18 12:47:50 EDT 2009 i686 i686 Alert Count 1 First Seen Mon Aug 10 04:47:23 2009 Last Seen Mon Aug 10 04:47:23 2009 Local ID 5672ff6c-ad2c-4d3b-aa2b-4c53178ed5f2 Line Numbers Raw Audit Messages node=mysystem.mydomain.com type=AVC msg=audit(1249904843.352:37350): avc: denied { read } for pid=16757 comm="sendmail" path="/var/log/messages" dev=sda6 ino=86361 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file node=mysystem.mydomain.com type=AVC msg=audit(1249904843.352:37350): avc: denied { read } for pid=16757 comm="sendmail" path="/var/log/secure" dev=sda6 ino=86369 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file node=mysystem.mydomain.com type=AVC msg=audit(1249904843.352:37350): avc: denied { read } for pid=16757 comm="sendmail" path="/var/log/maillog" dev=sda6 ino=4956165 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file node=mysystem.mydomain.com type=SYSCALL msg=audit(1249904843.352:37350): arch=40000003 syscall=11 success=yes exit=0 a0=8f4e3d0 a1=8f4e458 a2=8f4da48 a3=0 items=0 ppid=16704 pid=16757 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=6305 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)

2 2

HPLIP and Fedora9
by Arthur Dent 09 Aug '09

09 Aug '09

Hello all, I tried today to install the latest hplip package from http://hplipopensource.com to use the printer driver for my HP Printer on my Fedora 9 system (I plan to upgrade to Fedora 11 in the next few weeks). The install package warns you to turn off selinux so I setenforce 0. I assumed that I would be able to write a policy before resuming enforcing mode. The install went fine with no avcs. I then tried to print a test page and got 3 avcs (I can post in full if required). SELinux is preventing hp (hplip_t) "name_bind" howl_port_t. SELinux is preventing hp (hplip_t) "search" to ./dbus (system_dbusd_var_run_t). SELinux is preventing hpcups (cupsd_t) "name_bind" howl_port_t. From these I tried to create a policy using audit2allow. This is what it proposed: ########################################## # cat myhplip.te policy_module(myhplip, 9.0.1) require { type cupsd_t; type hplip_t; type system_dbusd_t; class unix_stream_socket { write connectto search }; } #============= cupsd_t ============== corenet_udp_bind_howl_port(cupsd_t) #============= hplip_t ============== allow hplip_t system_dbusd_t:unix_stream_socket { write connectto search }; corenet_udp_bind_howl_port(hplip_t) ########################################## "make -f" worked OK on this, but when I tried semodule -i I got the following error: [root@localhost selinux]# semodule -i myhplip.pp libsepol.permission_copy_callback: Module myhplip depends on permission search in class unix_stream_socket, not satisfied libsemanage.semanage_link_sandbox: Link packages failed semodule: Failed! Is there any way I can resolve this? The only existing bug I can find on hplip is 516078 (https://bugzilla.redhat.com/show_bug.cgi?id=516078) is it related? Thanks in advance for any help or suggestions... Mark

3 2

(no subject)
by ramkarthik 07 Aug '09

07 Aug '09

1 0

SELinux and Wine
by Ryan Anthony 07 Aug '09

07 Aug '09

Hello, I use FC11 64 bit and have the default (add/remove software) installation for both SELinux and Wine. I've been trying to get my Windows programs to run but see entries in my setroubleshoot log regarding Wine not being cleared for "allow_execmem" or "mmap_zero." I'm not that experienced with it, but I gather enabling either of these would be a bad thing from what I've already seen on google. Is there a way I can get Wine to run without effectively disabling SELinux? Regards, Ryan

4 7

Conflicting contexts for httpd and Samba
by Trevor Hemsley 07 Aug '09

07 Aug '09

I have a machine where I am trying to turn on selinux in enforcing mode - currently running in permissive mode while I sort out what's likely to stop working. On this machine I have both Samba and Apache. The Samba server has shares on a disk partition that's mounted on /share and I was getting AVCs for this so I used semanage and restorecon to mark all directories on there as context samba_share_t. Works great except that one directory on that share is also used by Apache and then I started getting AVCs for that dir whenever someone tried to access its content over http. Having done some reading I then tried to mark that directory as context public_content_t and that gets rid of the AVCs for http but I get them back for the Samba server instead :( The directory in question that resides on the /share partition is used by the Sophos Anti-Virus Enterprise Console to keep copies of all its install materials and locally cached copies of all the AV definition files. We have a Windows XP machine that runs the Enterprise Console and this updates the AV definitions on the Samba share about every 5 minutes - so Samba needs to have update access to the directory in question. For users outside the main office we also make the Sophos AV definitions available over https so Apache needs to be able to read the same directory that Samba can write to. Both Samba and Apache processes are running on the same machine and are accessing /share as a local file system. I can see booleans that let Apache access Samba shares as network drives but not as local file systems. These are the sort of AVCs I am currently getting and I'm now out of ideas about how to solve this. Does anyone have any suggestions please? [root@here manifests]# ausearch -i -a 12027 ---- type=SYSCALL msg=audit(07/08/09 09:14:50.432:12027) : arch=x86_64 syscall=open success=yes exit=41 a0=7fff3638c690 a1=42 a2=1f4 a3=4a7bf08a items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:50.432:12027) : avc: denied { create } for pid=460 comm=smbd name=pws-bcr.ide scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file type=AVC msg=audit(07/08/09 09:14:50.432:12027) : avc: denied { add_name } for pid=460 comm=smbd name=pws-bcr.ide scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=dir type=AVC msg=audit(07/08/09 09:14:50.432:12027) : avc: denied { write } for pid=460 comm=smbd name=savxp dev=drbd3 ino=2293891 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=dir [root@here manifests]# ausearch -i -a 12028 ---- type=SYSCALL msg=audit(07/08/09 09:14:50.434:12028) : arch=x86_64 syscall=ftruncate success=yes exit=0 a0=29 a1=0 a2=2ad636132320 a3=1 items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:50.434:12028) : avc: denied { write } for pid=460 comm=smbd name=pws-bcr.ide dev=drbd3 ino=2850949 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file [root@here manifests]# ausearch -i -a 12029 ---- type=SYSCALL msg=audit(07/08/09 09:14:50.440:12029) : arch=x86_64 syscall=utimes success=yes exit=0 a0=7fff3638b4d0 a1=7fff3638a9a0 a2=71be1 a3=0 items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:50.440:12029) : avc: denied { setattr } for pid=460 comm=smbd name=pws-bcr.ide dev=drbd3 ino=2850949 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file [root@here manifests]# ausearch -i -a 12030 ---- type=SYSCALL msg=audit(07/08/09 09:14:52.556:12030) : arch=x86_64 syscall=unlink success=yes exit=0 a0=2ad63619e430 a1=2ad63619e430 a2=0 a3=2ad623feab20 items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:52.556:12030) : avc: denied { unlink } for pid=460 comm=smbd name=cidsync.upd dev=drbd3 ino=1572898 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file type=AVC msg=audit(07/08/09 09:14:52.556:12030) : avc: denied { remove_name } for pid=460 comm=smbd name=cidsync.upd dev=drbd3 ino=1572898 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=dir [root@here manifests]# ausearch -i -a 12031 ---- type=SYSCALL msg=audit(07/08/09 09:14:52.559:12031) : arch=x86_64 syscall=stat success=yes exit=0 a0=7fff3638adb8 a1=7fff3638b1a0 a2=7fff3638b1a0 a3=0 items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:52.559:12031) : avc: denied { getattr } for pid=460 comm=smbd path=/codefarm/backups dev=dm-15 ino=2 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir type=AVC msg=audit(07/08/09 09:14:52.559:12031) : avc: denied { search } for pid=460 comm=smbd name=codefarm dev=dm-0 ino=819201 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir [root@here manifests]# ausearch -i -a 12032 ---- type=SYSCALL msg=audit(07/08/09 09:14:52.559:12032) : arch=x86_64 syscall=stat success=yes exit=0 a0=2ad636320285 a1=7fff3638ae60 a2=7fff3638ae60 a3=0 items=0 ppid=5277 pid=460 auid=unset uid=SophosEmLibUser1 gid=root euid=SophosEmLibUser1 suid=root fsuid=SophosEmLibUser1 egid=Domain Users sgid=root fsgid=Domain Users tty=(none) ses=4294967295 comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(07/08/09 09:14:52.559:12032) : avc: denied { getattr } for pid=460 comm=smbd path=/proc/sys/fs/binfmt_misc dev=binfmt_misc ino=6477 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=dir [root@here manifests]# -- Trevor Hemsley Infrastructure Engineer ................................................. * C A L Y P S O * Brighton, UK OFFICE +44 (0) 1273 666 350 FAX +44 (0) 1273 666 351 ................................................. www.calypso.com This electronic-mail might contain confidential information intended only for the use by the entity named. If the reader of this message is not the intended recipient, the reader is hereby notified that any dissemination, distribution or copying is strictly prohibited. * P * /*/ Please consider the environment before printing this e-mail /*/

2 1

SELinux managing confined services guide - call for review
by Scott Radvan 05 Aug '09

05 Aug '09

Hi, Having added many new chapters/services, the Fedora SELinux managing confined services guide is very close to reaching publication. I would greatly appreciate any and all comments or corrections: http://sradvan.fedorapeople.org/SELinux_Managing_Confined_Services/en-US/ Cheers, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

1 0

Some AVC denials to consider:
by Dominick Grift 05 Aug '09

05 Aug '09

dev_rw_generic_files(NetworkManager_t) allow consoletype_t device_t:file { read getattr ioctl }; xserver_rw_xdm_home_files(staff_dbusd_t) allow staff_t staff_screen_t:process sigchld; allow staff_t print_spool_t:dir getattr; allow staff_t screen_var_run_t:fifo_file read; dev_rw_dri(staff_t) allow ifconfig_t device_t:file read; allow mount_t dgrift_t:unix_stream_socket { read write }; allow nscd_t device_t:file read; allow ifconfig_t device_t:file read; allow mount_t dgrift_t:unix_stream_socket { read write }; allow nscd_t device_t:file read; term_use_console(portreserve_t) allow readahead_t proc_kcore_t:file getattr; allow readahead_ self:capability net_admin; allow rpcbind_t self:udp_socket listen; allow xdm_dbusd_t xdm_var_lib_t:dir search; dev_rw_generic_files(auditctl_t) allow readahead_t self:capability net_admin; fs_rw_tmpfs_chr_files(readahead_t) fprintd_dbus_chat(staff_sudo_t) fprintd_dbus_chat(staff_t) fprintd_dbus_chat(fprintd_t)

3 7

spamassassin transition
by Scott Radvan 04 Aug '09

04 Aug '09

Hi, Working on the Postfix chapter in my SELinux managing confined services book [0] and am having trouble with Postfix/spamassassin. I have got email traversing back and forth just fine, but I am trying to invoke a denial or a problem for which I can document the work-around. spamassassin_can_network seems to be a good Boolean to explain, show the denial and then show the work-around for. This Boolean is off by default, which as far as I can tell would stop spamassassin from launching as a daemon listening on the machine's actual IP/interface. But my problem is that it is launching without a problem and listening on the machine's interface without error. I am assuming that it is working fine because the spamassassin processes are only launching as initrc_t, when it should be transitioning to something else..? # ps -eZ | grep spamd unconfined_u:system_r:initrc_t:s0 3085 ? 00:00:01 spamd unconfined_u:system_r:initrc_t:s0 3087 ? 00:00:00 spamd unconfined_u:system_r:initrc_t:s0 3088 ? 00:00:00 spamd # ls -lZ /etc/init.d/spamassassin -rwxr-xr-x. rootrootsystem_u:object_r:initrc_exec_t:s0 /etc/init.d/spamassassin (I tried labelling this differently to this default setting, to spamd_initrc_exec_t, but to no avail.) # getsebool -a | grep spam spamassassin_can_network --> off spamd_enable_home_dirs --> on Basically I need to make sure spamassassin is starting normally so that the Boolean mentioned will block access. So any help is appreciated, should spamassassin as a daemon transition to something other than initrc_t? And how do I get it to do so? Or am I going down the wrong track to get this Boolean which is off by default to do something which I can demonstrate and fix? Thank you, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

4 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2009