selinux September 2009

selinux@lists.fedoraproject.org

33 participants
28 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

Custom labeling network interfaces
by Roberto Sassu 28 Sep '09

28 Sep '09

Hi all i want to create a set of rules that allow the administrator to decide the network interfaces on which daemons can listen to. To do this i created a custom policy module to define the type eth0_netif_t which is bound to the eth0 interface. type eth0_netif_t, netif_type; typeattribute eth0_netif_t netif_type; ifdef(`enable_mls',` gen_require(`type unlabeled_t;') netifcon eth0 gen_context(system_u:object_r:eth0_netif_t,s0 - mls_systemhigh) gen_context(system_u:object_r:unlabeled_t,s0 - mls_systemhigh) ') Next, i executed the following command: semanage interface -a -t eth0_netif_t eth0 Then, without adding extra rules i tried to start the sshd daemon on this interface and the operation was successful. I see with the apol utility that sshd is allowed to bind on the generic interface netif_t but not on eth0_netif_t. How it's possible to explicitly grant the permission to listen on eth0 for each daemon which needs it? Thanks in advance for replies.

3 6

Final year project ideas
by Zbynek Houska 28 Sep '09

28 Sep '09

All, I'm about to embark on a SELinux related final year project for BSc (Hons) in IT this semester. My goal is to learn SELinux well, compare to other (Linux) security projects, demystify it / demonstrate its pros and cons... I would like to do a thorough research on exploit / attack mitigation with SELinux as per Tresys website (http://www.tresys.com/innovation.php) and write a few (new) policies for software of my choice. I intend to use honeypots running Fedora 11 as my base system. However, I'm not sure if college class B network will produce conclusive results. Thus, I would appreciate support, guidance and comments from (seasoned) SELinux gurus, developers and practitioners on this list in order to point me in the right direction when it comes to sourcing literature, white papers, research work other people might already have conducted and overcoming pitfalls related to such testing environments. Kind regards, Zbynek

3 4

How can I use an selinux unused port
by Brian Ginn 25 Sep '09

25 Sep '09

I want to use port 60000 for a confined application that is not postgrey. However port 60000 is "owned by" postgrey and I can't seem to get past that. I don't want to add SELinux policy that allows my app to use postgrey's port, I want my app to think the port is myapp_port_t. Is there a way to free port 60000 from postgrey? [root@domingo install]# netstat -an | grep 60000 [root@domingo install]# semanage port -l | grep 60000 postgrey_port_t tcp 60000 [root@domingo install]# /usr/sbin/semanage port -d -t postgrey_port_t -p tcp 60000 /usr/sbin/semanage: Port tcp/60000 is defined in policy, cannot be deleted [root@domingo install]# Thanks, Brian ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

Confusion about transition when httpd_t process calls sendmail
by Jason L Tibbitts III 18 Sep '09

18 Sep '09

Tough to come up with a subject for this one; it's really messing with my fragile mind. I have a system running RT3, which uses mod_perl or somesuch to run within the web server process. It needs to send mail, so it calls /usr/bin/sendmail, which happens to be exim on this system. If I understand things correctly, the sendmail process is supposed to start as or somehow transition to exim_t where it is then allowed to access whatever exim_t is allowed to access. This was all working until I had to reboot the machine for unrelated reasons today. Now, RT3 can't send mail, and the audit logs seem to indicate that httpd_t is being denied things like writing to the exim spool file location. It really seems like somehow the transition to exim_t is not happening. Perhaps this will illustrate: > s ausearch -ts today |grep exim|audit2allow #============= httpd_t ============== allow httpd_t exim_spool_t:dir { search setattr read write getattr remove_name open add_name }; allow httpd_t exim_spool_t:file { rename setattr read lock create write getattr unlink open append }; allow httpd_t proc_net_t:file { read getattr open }; allow httpd_t self:capability fowner; allow httpd_t smtp_port_t:tcp_socket name_connect; Currently I've simply disabled selinux until I can understand what has happened. yum.log indicates that selinux-policy(-targeted) were updated on the 13th, but everything was working fine up until the today's reboot. No other related packages have been updated recently, and nothing was updated today. I suppose the reboot did boot me into a new kernel version (from kernel-2.6.29.6-217.2.3.fc11.x86_64 to kernel-2.6.30.5-43.fc11.x86_64). > ls -lZ /usr/sbin/exim -rwsr-xr-x. root root system_u:object_r:exim_exec_t:s0 /usr/sbin/exim* (which is what /usr/bin/sendmail is linked to via half a dozen symlinks due to alternatives). - J<

3 5

RE: Unconfining root user in strict policy mode
by Anamitra Dutta Majumdar 16 Sep '09

16 Sep '09

Hi Dan, Thanks for you response. We attempted to set ssh_sysadm_login to 1 in the booleans file for our strict policy. We also did an setsebool -P to turn on ssh_sysadm_login. We also modified the security context of root user to root:sysadm_r:sysadm_t. We see a couple of issues now 1. The value for ssh_sysadm_login is not persistent across reboots 2. Even when the ssh_sysadm_login is turned on we cannot login as root user The sealert messaged seem to indicate the following . What else do we need to do to get it working? [root@vos-cm98 ~]# sealert -l e7c8894d-a508-430a-a594-da2a693e585f Summary: SELinux is preventing sshd (sshd_t) "execute" to /lib/libdl-2.5.so (lib_t). Detailed Description: SELinux denied access requested by sshd. It is not expected that this access is required by sshd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /lib/libdl-2.5.so, restorecon -v '/lib/libdl-2.5.so' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:sshd_t:s0 Target Context system_u:object_r:lib_t:s0 Target Objects /lib/libdl-2.5.so [ file ] Source sshd Source Path /usr/sbin/sshd Port <Unknown> Host vos-cm98.cisco.com Source RPM Packages openssh-server-4.3p2-36.el5 Target RPM Packages glibc-2.5-42 Policy RPM selinux-policy-2.4.6-255.el5 Selinux Enabled True Policy Type strict MLS Enabled False Enforcing Mode Enforcing Plugin Name catchall_file Host Name vos-cm98.cisco.com Platform Linux vos-cm98.cisco.com 2.6.18-160.el5PAE #1 SMP Mon Jul 27 17:45:11 EDT 2009 i686 i686 Alert Count 3 First Seen Tue Sep 15 16:02:26 2009 Last Seen Tue Sep 15 17:51:19 2009 Local ID e7c8894d-a508-430a-a594-da2a693e585f Line Numbers Raw Audit Messages host=vos-cm98.cisco.com type=AVC msg=audit(1253062279.960:406): avc: denied { execute } for pid=4261 comm="sshd" path="/lib/libdl-2.5.so" dev=dm-0 ino=51413920 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:lib_t tclass=file host=vos-cm98.cisco.com type=SYSCALL msg=audit(1253062279.960:406): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=3078 a2=5 a3=802 items=0 ppid=3119 pid=4261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t key=(null) Thanks Anamitra -----Original Message----- From: Daniel J Walsh [mailto:dwalsh@redhat.com] Sent: Friday, September 11, 2009 1:49 PM To: Anamitra Dutta Majumdar (anmajumd) Subject: Re: Unconfining root user in strict policy mode On 09/11/2009 04:34 PM, Anamitra Dutta Majumdar (anmajumd) wrote: > > We need a way to unconfine the root user with the strict policy being > loaded in RHEL5.4. Currently with the strict policy the security > context for root user is root:staff_r:staff_t. > Is there a way to do so. > > > Thanks > Anamitra & Radha > > > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > There is no unconfined_t for Strict policy but you can set the root account to login as sysadm_t which is very close You have to turn on the ssh_sysadm_login if you want to login via ssh as sysadm_t And I think remove staff_r from root account will set it up to login as sysadm_r something like # semanage user -m -R"sysadm_r system_r" root

2 1

SELinux: creating a per-user confined domain
by Roberto Sassu 15 Sep '09

15 Sep '09

Hello all i'm new to SELinux. I'm trying to create per-user domains in a system running Fedora 11 with the targeted policy enabled. The reason for that is that i need to create transitions to different domains when users start the same application. I followed these steps: - written my custom policy module(posted as attachment) in order to create new roles user1_r, user2_r with the default domains user1_t and user2_t; - added to the system new selinux users user1_u and user2_u; - added to the system the new linux users user1 and user2; - associated user1 with user1_u and user2 with user2_u; - labeled home directories respectively with types user1_home_t and user2_home_t - created the two files user1_u and user2_u in /etc/selinux/targeted/contexts/users; Then i tried to connect in local to the ssh server from root to the user1 but it rejected the connection with this log messages (but no AVC warnings): Sep 15 15:39:19 seclab05 sshd[5014]: Accepted password for user1 from ::1 port 53163 ssh2 Sep 15 15:39:19 seclab05 sshd[5014]: pam_selinux(sshd:session): conversation failed Sep 15 15:39:19 seclab05 sshd[5014]: pam_selinux(sshd:session): No response to query: Would you like to enter a security context? [N] Sep 15 15:39:19 seclab05 sshd[5014]: pam_selinux(sshd:session): Unable to get valid context for user1 Sep 15 15:39:19 seclab05 sshd[5014]: pam_unix(sshd:session): session opened for user user1 by (uid=0) Sep 15 15:39:19 seclab05 sshd[5014]: error: PAM: pam_open_session(): Authentication failure Sep 15 15:39:19 seclab05 sshd[5014]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument If putting the system in permissive mode the connection was successful but the security context after login was: system_u:system_r:unconfined_t:s0-s0:c0.c1023 Any suggestions? Thanks in advance.

4 5

too many sealerts, most have been reported, and still see denials
by Antonio Olivares 14 Sep '09

14 Sep '09

Dear fellow selinux experts, I am running rawhide on three machines one recently installed via old xfce spin, the new ones (F12-Alpha isos, dvd and livecd's) don't work because of bugs :(, I see lots of selinux denials, some deal with wine, wineserver, ..., windows applications that I need to use at school with my students. I see firefox stack, and I see others that have been reported. At the beginning there were only two or three erros, but when I started running the windows based programs I got the messages. I am thinking that it is not becoming fun anymore when I have to report those errors/bugs and they are reported back with CLOSED Repeated bug or fixed in selinux-policy, and I still see them again even though I have updated the machine[after I saw there there were indeed updates, because of a confusion with rawhide reports, broken deps was first and I thougnt there were no updates :( ] I don't know but I am getting a little bit upset at this situation, I tried to get a repository suggested by another member of the selinux-list to see if it would help me, but it is for x86_64 and not x86. It failed to work and I disabled it. I am seeing why many folks are disabling selinux, is there any reason as to why there are many changes taking place that *it is not worth filing bugs reports* because they will be CLOSED (NOT A BUG) or already a (DUPLICATE BUG). I appreciate the help that many users on this list have provided through many situations, but this is not getting any easier and my feeling is that if the trend continues Fedora 12 will not play nice to many users because selinux gets in the way of their computing :(, Thanks for any suggestions, advice and/or consolating words. I hope that things come back to normal a bit and sorry for venting out my frustrations. I had been trouble free since a good while but now it is becoming a pain, just starting up and I see the selinux star at the bottom of the panel, and I click on it and *many times I could not file bug reports*, when I did *they were DUPLICATE, or CLOSED, or fixed in selinux-policy-?????* Only to apply updates and start again and I see the bugs again :(, and have like 50 sealerts many of them related :( Regards, Antonio

4 7

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

firefox and selinux alert, here's one maybe filed two or three times :(
by Antonio Olivares 13 Sep '09

13 Sep '09

https://bugzilla.redhat.com/show_bug.cgi?id=522917 Summary: SELinux is preventing /usr/lib/firefox-3.5.3/firefox from changing a writable memory segment executable. Detailed Description: [firefox has a permissive type (unconfined_t). This access was not denied.] The firefox application attempted to change the access protection of memory (e.g., allocated using malloc). This is a potential security problem. Applications should not be doing this. Applications are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. If firefox does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report against this package. Allowing Access: If you trust firefox to run correctly, you can change the context of the executable to execmem_exec_t. "chcon -t execmem_exec_t '/usr/lib/firefox-3.5.3/firefox'". You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t execmem_exec_t '/usr/lib/firefox-3.5.3/firefox'" Fix Command: chcon -t execmem_exec_t '/usr/lib/firefox-3.5.3/firefox' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects None [ process ] Source firefox Source Path /usr/lib/firefox-3.5.3/firefox Port <Unknown> Host (removed) Source RPM Packages firefox-3.5.3-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.31-3.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execmem Host Name (removed) Platform Linux localhost.localdomain 2.6.31-2.fc12.i686 #1 SMP Thu Sep 10 00:41:03 EDT 2009 i686 i686 Alert Count 1 First Seen Sun 13 Sep 2009 11:47:14 AM CDT Last Seen Sun 13 Sep 2009 11:47:14 AM CDT Local ID 1c10f973-7768-4807-9482-d77739f533a2 Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1252860434.198:37): avc: denied { execmem } for pid=1910 comm="firefox" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process node=localhost.localdomain type=SYSCALL msg=audit(1252860434.198:37): arch=40000003 syscall=192 success=yes exit=1601536 a0=0 a1=1000 a2=7 a3=22 items=0 ppid=1898 pid=1910 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="firefox" exe="/usr/lib/firefox-3.5.3/firefox" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Regards, Antonio

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2009