selinux September 2009

selinux@lists.fedoraproject.org

33 participants
28 discussions

The SELinux Documentation Project [Request for topics]
by Joshua Brindle 14 Dec '09

14 Dec '09

As we discussed at Linux Plumbers Conference during the 'Making SELinux Easier to Use" talk we have some document deficiencies in the SELinux project. I volunteered to start an SELinux Documentation Project. The primary purpose of the project would be to get as much documentation as possible on the selinuxproject.org wiki, organized in a fashion that users can understand and consume easily. As I admitted before, we, the developers, are not always the best people to judge what documentation users need and therefore am requesting users, hopefully from different backgrounds and environments, tell us what documentation they feel is lacking, what questions they've been asked or have asked themselves and couldn't find documentation for. I think we need basic documentation that tells about SELinux (both beginner and advanced), howto's for specific things (using secmark, using netlabel, etc) and a set of short 'recipes' to accomplish simple tasks. There are documents all over the place with various information, as well as blog entries and mailing list archives but the effort here is to consolidate all those resources onto selinuxproject.org. I'd also like to see volunteers in the community to help out with the documentation effort, I know quite a few people already write things like this on blogs, etc and it would be great to see that information moved/copied onto selinuxproject.org. Users: Please, if you are a user and have run in to lack of documentation respond to this thread, or privately if you aren't comfortable talking on list so that we can collect what the biggest deficiencies are and get to writing documentation as soon as possible. Thanks.

5 11

Samba AVC
by Tony Molloy 01 Oct '09

01 Oct '09

Hi, This is Centos 5.3 fully updated. Im getting the following error from setroubleshoot SELinux is preventing samba (smbd) "unlink" to ./log.cs244-34.old (samba_log_t). when samba tries to rotate the log files. Running sealert I get the following ( edited ) Summary: SELinux is preventing samba (smbd) "unlink" to ./log.cs244-24.old (samba_log_t). Detailed Description: SELinux denied samba access to ./log.cs244-24.old. If you want to share this directory with samba it has to have a file context label of samba_share_t. If ^^^^^^^^^^^^^ you did not intend to use ./log.cs244-24.old as a samba repository it could indicate either a bug or it could signal a intrusion attempt. Allowing Access: You can alter the file context by executing chcon -R -t samba_share_t './log.cs244-24.old' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t samba_share_t './log.cs244-24.old'" The following command will allow this access: chcon -R -t samba_share_t './log.cs244-24.old' Additional Information: Source Context root:system_r:smbd_t Target Context root:object_r:samba_log_t Target Objects ./log.cs244-24.old [ file ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host janus.x.y.z Source RPM Packages samba-3.0.33-3.7.el5_3.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name samba_share Host Name janus.x.y.z Platform Linux janus.x.y.z 2.6.18-128.7.1.el5 #1 SMP Mon Aug 24 08:21:56 EDT 2009 x86_64 x86_64 Alert Count 53 First Seen Fri Sep 25 15:54:24 2009 Last Seen Tue Sep 29 15:55:25 2009 Local ID e4426abc-3b0b-4df2-a380-3f0fba344c63 Line Numbers Raw Audit Messages host=janus.x.y.z type=AVC msg=audit(1254236125.438:70641): avc: denied { unlink } for pid=27420 comm="smbd" name="log.cs244-24.old" dev=sda5 ino=164076 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:samba_log_t:s0 tclass=file host=janus.x.y.z type=SYSCALL msg=audit(1254236125.438:70641): arch=c000003e syscall=82 success=no exit=-13 a0=2b1b457b5220 a1=7fffa9a7ba90 a2=1f a3=0 items=0 ppid=3787 pid=27420 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1675 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null) log.cs244-24.old is a file not a directory and it's located in the /var/log/samba directory with permissions system_u:object_r:samba_log_t samba Any ideas, Tony -- Dept. of Comp. Sci. University of Limerick.

4 5

sesearch --neverallow is broken ?
by Shintaro Fujiwara 30 Sep '09

30 Sep '09

I typed in F11, sesearch --neverallow but seems it returns allow sentences. -- http://intrajp.no-ip.com/ Home Page

3 4

Clamav/SeLinux, issue with system call recvmsg, and auxilary data.
by J. David Rye of Roadtech 29 Sep '09

29 Sep '09

Hello All I triggered this issue with clamav/clamav-milter 0.95.2 from rpmforge running on a test box with Centos 5.3 Clamd opens a socket /var/run/clamav/clamd.sock to accept requests to scan things. ls -Z /var/run/clamav/clamd.sock srwxrwxrwx clamav clamav root:object_r:clamd_var_run_t /var/run/clamav/clamd.sock Requests are read using the system call recvmsg, this allows for the passing auxiliary control data. Clamav-milter 0.95.2 uses this to pass a handle to the temp file containing the data to be scanned With SeLinux set to targeted enforcing, this call reads and returns the normal data fine, but returns with the flag MSG_CTRUNC set. according to the man page this is "indicates that some control data were discarded due to lack of space in the buffer for ancillary data." clamd responded by closing the socket, clamav-milter responded to the closed socket by looping a 100% CPU. :-( Running the audit log through audit2allow suggests grep clam /var/log/audit/audit.log | audit2allow -m local > local.te [root@fallback0 selinux]# cat local.te module local 1.0; require { type initrc_tmp_t; type proc_t; type sysctl_kernel_t; type clamd_t; class dir search; class file { read write getattr }; } #============= clamd_t ============== allow clamd_t initrc_tmp_t:file { read write getattr }; allow clamd_t proc_t:file { read getattr }; allow clamd_t sysctl_kernel_t:dir search; allow clamd_t sysctl_kernel_t:file read; The allow clamd_t proc_t:file { read getattr }; looks to relate to reading /proc/meminfo allow clamd_t sysctl_kernel_t:dir search; allow clamd_t sysctl_kernel_t:file read; Look to relate to these log entries type=AVC msg=audit(1254139856.343:48724): avc: denied { search } for pid=14771 comm="clamd" name="kernel" dev=proc ino=-268435416 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir type=AVC msg=audit(1254139856.343:48724): avc: denied { read } for pid=14771 comm="clamd" name="ngroups_max" dev=proc ino=-268435368 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file type=AVC msg=audit(1254149740.665:48885): avc: denied { search } for pid=1261 comm="clamd" name="kernel" dev=proc ino=-268435416 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir This if I have figured it out right relate to something that clamd is calling in turn trying to read /proc/sys/kernel/ngroups_max So by elimination allow clamd_t initrc_tmp_t:file { read write getattr }; Must relate to the the use of auxiliary data with the socket, and the following log entries but I do not see why. Can anyone explain? type=AVC msg=audit(1254150147.188:48924): avc: denied { read write } for pid=1288 comm="clamd" path=2F746D702F636C616D61762D3063666237656532666331656139656636323364373463316236626532623735202864656C6574656429 dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0 tcontext=root:object_r:initrc_tmp_t:s0 tclass=file type=AVC msg=audit(1254150153.681:48925): avc: denied { read write } for pid=1288 comm="clamd" path=2F746D702F636C616D61762D3336316332323033323138613239633865363633633937303962663133363664202864656C6574656429 dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0 tcontext=root:object_r:initrc_tmp_t:s0 tclass=file type=AVC msg=audit(1254150177.903:48926): avc: denied { read write } for pid=1288 comm="clamd" path=2F746D702F636C616D61762D3366636162623138633237636231383466643064656630643838353063363933202864656C6574656429 dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0 tcontext=root:object_r:initrc_tmp_t:s0 tclass=file type=AVC msg=audit(1254150188.366:48927): avc: denied { read write } for pid=1288 comm="clamd" path=2F746D702F636C616D61762D6366393131623632353130333564353832656435396466663136373362626131202864656C6574656429 dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0 tcontext=root:object_r:initrc_tmp_t:s0 tclass=file type=AVC msg=audit(1254150220.428:48928): avc: denied { read write } for pid=1288 comm="clamd" path=2F746D702F636C616D61762D3931633534623761393630653531386630363539653033363537303937323135202864656C6574656429 dev=dm-0 ino=34668546 scontext=root:system_r:clamd_t:s0 tcontext=root:object_r:initrc_tmp_t:s0 tclass=file Yours J. David Rye ************************************************************************* This e-mail is confidential and may be legally privileged. It is intended solely for the use of the individual(s) to whom it is addressed. Any content in this message is not necessarily a view or statement from Road Tech Computer Systems Limited but is that of the individual sender. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. We use reasonable endeavours to virus scan all e-mails leaving the company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our networks is reserved by us Road Tech Computer Systems Ltd. Shenley Hall, Rectory Lane, Shenley, Radlett, Hertfordshire, WD7 9AN. - VAT Registration No GB 449 3582 17 Registered in England No: 02017435, Registered Address: Charter Court, Midland Road, Hemel Hempstead, Hertfordshire, HP2 5GE. *************************************************************************

2 3

Two AVCs
by John Griffiths 29 Sep '09

29 Sep '09

3 6

Logging with bind-chroot
by Paul Howarth 29 Sep '09

29 Sep '09

Today's update of bind in F11 suggests adding this line to /etc/rsyslog.conf to maintain logging with a chroot-ed bind: $AddUnixListenSocket /var/named/chroot/dev/log For this to work on F-11, I needed to add the following policy module: :::::::::::::: mybindchroot.fc :::::::::::::: /var/named/chroot/dev -d gen_context(system_u:object_r:device_t,s0) /var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0) :::::::::::::: mybindchroot.te :::::::::::::: policy_module(mybindchroot, 0.0.4) require { type syslogd_t; } # rsyslog needs to search the bind chroot when creating # /dev/log in the chroot bind_search_cache(syslogd_t) I'd expect the same to apply in other releases too. Paul.

3 2

have finally succeeded installing rawhide by livecd, got sealert but couldn't load it :(
by Antonio Olivares 29 Sep '09

29 Sep '09

[liveuser@localhost ~]$ sealert Traceback (most recent call last): File "/usr/bin/sealert", line 37, in <module> import slip.dbus.service File "/usr/lib/python2.6/site-packages/slip/dbus/__init__.py", line 1, in <module> import bus ImportError: No module named bus [liveuser@localhost ~]$ dmesg | grep 'avc' type=1400 audit(1254092543.093:7): avc: denied { read } for pid=844 comm="passwd" path="/dev/console" dev=tmpfs ino=2114 scontext=system_u:system_r:passwd_t:s0 tcontext=system_u:object_r:console_device_t:s0 tclass=chr_file type=1400 audit(1254092543.094:8): avc: denied { read } for pid=844 comm="passwd" path="/dev/console" dev=tmpfs ino=2114 scontext=system_u:system_r:passwd_t:s0 tcontext=system_u:object_r:console_device_t:s0 tclass=chr_file installed from KDE-x86_64-20090926.19 [liveuser@localhost ~]$ uname -r 2.6.31.1-48.fc12.x86_64 [liveuser@localhost ~]$ cat /etc/fedora-release Fedora release 11.91 (Rawhide) Regards, Antonio

3 2

Dear List members
by tarnait 29 Sep '09

29 Sep '09

Hi, I'm new to SElinux and I'm a bit careful with it, so up till now I want to run it in permissive mode. After reading a lot's of docs I fixed most of my problems, but there are still some errors in audit.log. Now I would like to ask you to review this errors and give me feedback if this rules are safe to add to my policy or not. In summary is my understanding correct that: O auditctl, ifconfig, iptables-restor, dmesg and pppd try to write to the console, O pppd searches something in the root home directory ??!, O and iptables writes to a socket? if I would add this policy to the module wouldn't it be too much (e.g. could for example pppd access all my files?) Thanks for the answers, Kind Regards, Tibor type=AVC msg=audit(1253870573.883:13): avc: denied { read write } for pid=877 comm="auditctl" name="console" dev=sda1 ino=15533 scontext=system_u:system_r:auditctl_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870574.190:15): avc: denied { read write } for pid=918 comm="ifconfig" name="console" dev=sda1 ino=15533 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870574.264:16): avc: denied { read write } for pid=921 comm="pppd" name="console" dev=sda1 ino=15533 scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870574.325:17): avc: denied { search } for pid=921 comm="pppd" name="root" dev=sda1 ino=12 scontext=system_u:system_r:pppd_t:s0 tcontext=unconfined_u:object_r:unconfined_home_dir_t:s0 tclass=dir Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870574.401:18): avc: denied { read write } for pid=929 comm="iptables-restor" name="console" dev=sda1 ino=15533 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870576.482:19): avc: denied { read write } for pid=1087 comm="dmesg" name="console" dev=sda1 ino=15533 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1253870578.829:20): avc: denied { read write } for pid=1242 comm="iptables" path="socket:[3131]" dev=sockfs ino=3131 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=packet_socket Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.

4 4

New equivalent to browser_confine_xguest?
by Bruno Wolff III 29 Sep '09

29 Sep '09

There used to be a boolean browser_confine_xguest, but there no longer is. Is there a simple way to not let firefox connect to the network when run by an xguest user?

2 1

Can I allow console_type_t to access pppd_t?
by chenh 29 Sep '09

29 Sep '09

Everytime I use adsl connection, AVC alerts: "SELinux is preventing consoletype (consoletype_t) "read write" pppd_t. " I typed "audit2allow -a" and saw: #============= alsa_t ============== allow alsa_t file_t:file read; #============= consoletype_t ============== allow consoletype_t file_t:file read; allow consoletype_t pppd_t:packet_socket { read write }; #============= dmesg_t ============== allow dmesg_t file_t:file read; #============= hwclock_t ============== allow hwclock_t file_t:file read; #============= ifconfig_t ============== allow ifconfig_t file_t:file read; #============= mount_t ============== allow mount_t file_t:file unlink; #============= setroubleshootd_t ============== allow setroubleshootd_t locate_var_lib_t:file read; There're two rule about consoletype above. Is it safe to add them using audit2allow? Thanks!

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2009