selinux January 2010

selinux@lists.fedoraproject.org

45 participants
44 discussions

Re: SELinux domains for relabeling
by Dominick Grift 27 Jan '10

27 Jan '10

On 01/26/2010 05:40 PM, Stephen Smalley wrote: > On Tue, 2010-01-26 at 17:14 +0100, Dominick Grift wrote: >> On 01/26/2010 02:27 PM, Roberto Sassu wrote: >>> Hello all >>> >>> i'm trying to investigate what domains in the Fedora 12 policy are allowed to >>> modify SELinux labels (in particular domain entrypoints). >> >> sesearch --allow -s domain -t exec_type -c file -p relabelto >> sesearch --allow -s domain -t exec_type -c file -p relabelfrom >> >> This lists all source domain types relabelto and relabelfrom access to >> executable file types (entry types) > > Does that work for you? You are right it does not work. I wonder why. Why would sysadm_t be a "domain" and unconfined_t not? > sesearch --allow -s domain -t exec_type -c file -p relabelto | awk '/allow/{print $2}' | sort | uniq -c > 1 prelink_t > 568 restorecond_t > 568 rpm_t > 568 sysadm_t > > Where is unconfined_t and friends? > > sesearch --allow -s unconfined_t -t sshd_exec_t -c file -p relabelto > Found 1 semantic av rules: > allow files_unconfined_type file_type : file { ioctl read write > create getattr setattr lock relabelfrom relabelto append unlink link > rename execute swapon quotaon mounton execute_no_trans entrypoint > open } ; >

3 5

SELinux domains for relabeling
by Roberto Sassu 26 Jan '10

26 Jan '10

Hello all i'm trying to investigate what domains in the Fedora 12 policy are allowed to modify SELinux labels (in particular domain entrypoints). After reading the article of D. J. Walsh "Confined processes statistics in Fedora 12?" i removed the "unconfined" package in order to get a shorter list. For the selection process i'm considering not only domains which are directly allowed to do relabeling, but also those that are allowed to directly interact with the system by: - loading the selinux policy - performing the setenforce command - loading kernel modules - accessing to /dev/mem device Since domains are grouped by attributes and the last have a name which suggests the type of action that can be performed on the system, i selected those that seems to meet the criteria described before. admindomain can_change_object_identity can_change_process_identity can_change_process_role can_load_kernmodule can_load_policy can_relabelto_binary_policy can_relabelto_shadow_passwords can_setenforce can_system_change can_write_binary_policy can_setsecparam kern_unconfined memory_raw_read memory_raw_write selinux_unconfined_type sysadm_usertype staff_usertype unconfined_domain_type unconfined_file_type Then i have expanded the list by listing all domains included in each attribute. Just for verifying i verified using the command sesearch --allow -d -t <file label> -p relabelto that, for some file labels, the domains obtained are included in the list built. Does this approach can be considered valid to meet the goal? Any comment about this argument may be appreciated. Thanks in advance.

2 1

We are working on the Fedora SELinux FAQ
by Daniel J Walsh 25 Jan '10

25 Jan '10

Any comments? What should we add? What should we remove? http://sradvan.fedorapeople.org/SELinux_FAQ/#id2654720 Dan

9 16

Re: We are working on the Fedora SELinux FAQ
by Antonio Olivares 23 Jan '10

23 Jan '10

--- On Sat, 1/23/10, Philippe Vouters <Philippe.Vouters(a)laposte.net> wrote: > From: Philippe Vouters <Philippe.Vouters(a)laposte.net> > Subject: Re: We are working on the Fedora SELinux FAQ > To: "Antonio Olivares" <olivares14031(a)yahoo.com> > Cc: selinux(a)lists.fedoraproject.org, Marvin.Stodolsky(a)gmail.com > Date: Saturday, January 23, 2010, 11:57 AM > > Dear Antonio, > > Can John $ cat his /etc/selinux/config ? > > Also, after doing ls /dev/ttyS*, I wonder whether doing ln > -sf /dev/536ep /dev/ttySX with X a figure next to the > highest ttyS > number read followed by a chgrp dialout /dev/536ep, > eventually followed > by chgrp dialout /dev/ttySX wouldn't do the trick under > SELinux ! > > I even wonder whether a single chgrp dialout /dev/536ep > wouldn't do the > trick ! > > Yours truly, > -- > sip:Vouters.Philippe@ekiga.net > IM: philvout (Yahoo!) > http://vouters.dyndns.org/ > Philippe Vouters (Fontainebleau/France) > > Sorry to butt in Phillipe, but John asked other questions for the official Fedora Selinux FAQ, I just used his message to ask my question regarding this (selinux denials of modem /dev/tty??). It happens when I use a gui namely KPPP. at the modem, i am sending this using kppp and I did [root@localhost ~]# ls /dev/536* -l crw-rw-rw-. 1 root root 240, 1 2010-01-23 14:10 /dev/536ep crw-rw----. 1 root root 240, 1 2010-01-23 13:43 /dev/536ep0 [root@localhost ~]# restorecon -v '/dev/536ep' restorecon reset /dev/536ep context system_u:object_r:device_t:s0->system_u:object_r:usb_device_t:s0 setroubleshoot recommendation, I will see if this fixes it, but I tried to file a bug, but the process appears to be hanging :( will see if *it gets through* I waited a little bit and it did* :) https://bugzilla.redhat.com/show_bug.cgi?id=558130 I hope not to see this again with gui KPPP. Have not tried NetWorkManager yet? I wonder how it works here? Regards, Antonio

1 1

Re: We are working on the Fedora SELinux FAQ
by Antonio Olivares 23 Jan '10

23 Jan '10

>http://sradvan.fedorapeople.org/SELinux_FAQ/#id2654720 > Great questions John! I applaud your questions and you have given me valor and courage to ask other questions. Dialup and Modem questions CC'd to Phillipe Vouters, maintainer of Intel 536/537 family of modems, and Marvin Stodolsky maintainer of scanModem script. http://vouters.dyndns.org/ http://linmodems.technion.ac.il/ Since I had not let them know about this, * selinux getting in the way of /dev/536ep, /dev/martian, /dev/slamr0, ..., etc. Devices created and used for dialout with respective drivers. I use dialup on Fedora, I don't use NetworkManager, kppp gui dialers. I like plain old wvdial. I don't see any problems or complaints. Q: Why does selinux complain when I start using a gui to dialout on my dialout connection? I see it when I use /dev/536ep for Intel 536 Modem using Kppp, I got the following complaint: Summary: SELinux is preventing /sbin/consoletype "read write" access to device /dev/536ep. Detailed Description: [consoletype has a permissive type (consoletype_t). This access was not denied.] SELinux has denied consoletype "read write" access to device /dev/536ep. /dev/536ep is mislabeled, this device has the default label of the /dev directory, which should not happen. All Character and/or Block Devices should have a label. You can attempt to change the label of the file using restorecon -v '/dev/536ep'. If this device remains labeled device_t, then this is a bug in SELinux policy. Please file a bg report. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR, and find a type that would work for /dev/536ep, you can use chcon -t SIMILAR_TYPE '/dev/536ep', If this fixes the problem, you can make this permanent by executing semanage fcontext -a -t SIMILAR_TYPE '/dev/536ep' If the restorecon changes the context, this indicates that the application that created the device, created it without using SELinux APIs. If you can figure out which application created the device, please file a bug report against this application. Allowing Access: Attempt restorecon -v '/dev/536ep' or chcon -t SIMILAR_TYPE '/dev/536ep' Additional Information: Source Context unconfined_u:system_r:consoletype_t:s0 Target Context system_u:object_r:device_t:s0 Target Objects /dev/536ep [ chr_file ] Source consoletype Source Path /sbin/consoletype Port <Unknown> Host localhost.localdomain Source RPM Packages initscripts-9.02-1 Target RPM Packages Policy RPM selinux-policy-3.6.32-41.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name device Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.31.6-145.fc12.i686.PAE #1 SMP Sat Nov 21 16:12:37 EST 2009 i686 i686 Alert Count 4 First Seen Sun 13 Dec 2009 09:17:50 PM CST Last Seen Sun 13 Dec 2009 09:21:15 PM CST Local ID d08c40b6-e21a-43f9-b076-b15955131bce Line Numbers Raw Audit Messages node=localhost.localdomain type=AVC msg=audit(1260760875.661:322): avc: denied { read write } for pid=14823 comm="consoletype" path="/dev/536ep" dev=tmpfs ino=12344 scontext=unconfined_u:system_r:consoletype_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file node=localhost.localdomain type=AVC msg=audit(1260760875.661:322): avc: denied { read write } for pid=14823 comm="consoletype" path="socket:[10132603]" dev=sockfs ino=10132603 scontext=unconfined_u:system_r:consoletype_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_dgram_socket node=localhost.localdomain type=SYSCALL msg=audit(1260760875.661:322): arch=40000003 syscall=11 success=yes exit=0 a0=9f191d8 a1=9f19238 a2=9f11f08 a3=9f19238 items=0 ppid=14822 pid=14823 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:system_r:consoletype_t:s0 key=(null) I know that *selinux is permitting* the action, but why is it complaining? Users don't care that [consoletype has a permissive type (consoletype_t). This access was not denied.] if there is wrong labeling, they just want to use the computer and get online. Why does selinux have too many of these things? It appears to happen with martian modem on Fedora also, *but only if I use gui like KPPP*, so since I use wvdial most of the time, I have not bothered to contact selinux list to ask for this. Also, since fedora does not have DVD playback out of the box *by default*, one can add rpmfusion reposistories to fix this, there are projects like xine-lib that already come with Fedora but crippled. Q: If one compiles xine-lib from source, selinux interferes and denies many chmods that used by xine install scripts, I have gotten around by disabling/not enforcing selinux to install these, but why do we have to contact xine-lib developers to fix this?, not everyone out there uses selinux so they would ignore these. Q: Why are there too many numerous complains with nspluginwrapper/nspluginviewer: Good that it is here: http://fedoraproject.org/wiki/Flash but is it there in FAQ? SELinux problems In some cases, nspluginwrapper produces SELinux AVC errors, some of which may prevent viewing Flash content. Changing the relevant SELinux boolean may resolve this problem, but eliminates a great deal of additional security when using nspluginwrapper. To make the change, run the following command: su -c 'setsebool -P allow_unconfined_nsplugin_transition=0' Also nsplugin viewer :( http://old.nabble.com/SELinux-is-preventing-npviewer.bin-(nsplugin_t)-"read"-to-controlC0-(sound_device_t).-td15815169.html I have seen *too many complains*, that I have run away from using Flash and not use it. Also with Firefox exec_mem stack? errors. I have also moved away from using it. I am content to using Konqueror. At one point I was using Opera and it also encountered problems, but the fix suggested by setroubleshooter fixed them :), operapluginwrapper or something like that. Q: How does selinux address native HTML 5 implementations if any? A friend of mine told me that HTML 5 cures many illnesses with flash and other proprietary crap out there, how does selinux deal with HTML 5? Q: How does selinux treat gnash (the free/open source alternative to adobe flash)? Thank you very much for your time. Although I expect many of these questions to go to /dev/null, I am asking to know more and find out if *not everything out there* will be in permissive mode and one has to take care of our own problems on a case by case basis? Regards, Antonio

1 0

autorelabel process
by George Henrique Silva 22 Jan '10

22 Jan '10

Hello all, I am trying to find out how the autorelabel process works. I am searching in linux Kernel code version 2.6.14 I am also trying to find the autorelabel code in the sysvinit-2.86. My target is to find the process which triggers the autorelabel process from the flag-file /.autorelabel or who receives the kernel boot argument autorelabel=1 Is autorelabel related to SELinux only, or is it another module from Linux? Best Regards -- -- George Henrique Silva

3 2

How do I figure out on what file dac_override is attempted?
by Göran Uddeborg 20 Jan '10

20 Jan '10

Here is another strange AVC I'm trying to understand. SETroubleshoot on one of my machines is telling me that SELinux is preventing plymouthd (plymouthd_t) "dac_override" plymouthd_t. The full message is attached. If I have understood this correctly, this means that plymouthd was trying to read a file as root. But the regular permissions bits of the file would not allow that. (Right?) I assume there is some file with wrong permission bits, which causes this to happen. But I can't find any indication WHAT file it was. Looking at the message, it seems to me it was trying a dac_override on itself. Is there a way to know what file was involved?

4 17

Re: Assigning a Type to Network Interfaces
by Stephen Smalley 19 Jan '10

19 Jan '10

On Sun, 2010-01-17 at 21:21 -0700, Jason Shaw wrote: > Just wanted to follow-up to see if I am misunderstanding the purpose > of semanage -interface. Once a type is assigned to an interface such > as eth0, should an application running in its own domain be able to > bind to the interface without an allow rule (using net_raw, tcp, or > udp)? (extended cc line to include fedora and upstream selinux lists). There are no netif-based checks during bind(2). There can be netif-based checks during packet send/recv, but the legacy checks were obsoleted and removed as I noted, and the newer checks require additional configuration (iptables for SECMARK, netlabel or ipsec for labeled networking). > On Thu, Jan 14, 2010 at 7:37 AM, Stephen Smalley <sds(a)tycho.nsa.gov> > wrote: > > On Thu, 2010-01-14 at 07:08 -0700, Jason Shaw wrote: > > I need help understanding if SELinux supports restricting a > confined > > application from binding to specific network interfaces. I > cannot seem > > to make this work under F11 and F12 (using targeted, mls, > and > > reference policies), or under RHEL 5.3U3 targeted. > > > > Details: > > - I have a system with two network interfaces: eth0 and > eth1. > > - I have an application that must only be allowed to read > data from > > eth0 (raw and tcp). > > - I do not need to label packets. > > > > Here's what I have tried > > 1) In a new policy module, I create new types: myApp_exec_t, > myApp_t, > > myApp_eth0_t, myApp_eth1_t. > > 2) I use semanage -fcontext to label my application's > executable file > > as myApp_exec_t > > 3) I assign eth0 with a new type: 'semanage interface -a -t > > myApp_eth0_t eth0' > > 4) I assign eth1 with a new type: 'semanage interface -a -t > > myApp_eth1_t eth1' > > 5) In my policy module, I allow the following: "allow > myApp_t > > self:capability net raw", and "allow myApp_t self:tcp_socket > { accept > > read }" > > 6) I verify that when I execute my application, using ps > -efZ it is > > running in the myApp_t domain (has transitioned properly > from > > unconfined_t) > > > > The problem is, my app can read raw or tcp data from either > eth0 or > > eth1 even though both interfaces have been assigned > different types > > using semanage -interface. > > > > Is this because 'allow myApp_t self:capability net_raw' does > not > > distinguish between network interfaces? Is my understanding > of > > semanage -interface incorrect - shouldn't labeling the > interface > > result in no ability to use the interface unless explicitly > allowed? > > > The legacy network permission checks were removed in Linux > 2.6.30, and > even prior to that they had been disabled for a long time by > default > unless you set /selinux/compat_net to 1. These days you need > to use > secmark or the newer ingress/egress permission checks to > achieve the > same effect. Using secmark requires you to configure > iptables SECMARK > targets to label the packets. Using ingress/egress requires > you to > configure labeled networking (netlabel or labeled ipsec) and > make sure > that /selinux/policy_capabilities/network_peer_controls exists > and is > set to 1 (requires Linux >= 2.6.25 and a policy built with > that > capability). See: > http://paulmoore.livejournal.com/4281.html > http://paulmoore.livejournal.com/2128.html > > -- > Stephen Smalley > National Security Agency > > -- Stephen Smalley National Security Agency

2 1

Re: How do I figure out on what file dac_override is attempted?
by Eric Paris 19 Jan '10

19 Jan '10

On Tue, 2010-01-19 at 09:57 -0500, Steve Grubb wrote: > On Tuesday 19 January 2010 04:33:31 am Göran Uddeborg wrote: > > Daniel J Walsh: > > > If you use ausearch -m avc to look for this avc, is there some info > > > setroubleshoot might have dropped? > > > > It didn't miss anything. It just gave exactly the same info as in the > > end of the SETroubleshoot message. > > > > (But looking at that and the surrounding events, I realised these > > AVC:s happen when the machine goes down, not when it comes back up as > > I first thought. That could be one more clue. I'll keep searching.) > > There are 2 general issues. Finding and fixing the current problem and having > troubleshooting info for the next incident. To find the current issue, I think > all you have to do is add any audit rule which will turn on full auditing. > This should get the path record if one exists. You could add a rule like this > to /etc/audit/audit.rules: > > -a always,exit -S personality > > and that should be one that never triggers. > > But going a step further for the next incident, I think that on capability > denied decisions for: chown, dac_override, dac_read_search, fowner, fsetid, > and linux_immutable, the object of the operation should be recorded and that > would be a file or directory. Device and inode should suffice. The issue with any cap_* check is that there is no "object of the operation." Capabilities are really just checks for the process. I think the only way to get it is going to be to make sure you have an audit rule and you'd get a name record. I tend to use -a exit,always -F arch=b32 -S kill -F pid=1 Which is sure to never trigger.... -Eric

1 0

Re: How do I figure out on what file dac_override is attempted?
by Göran Uddeborg 18 Jan '10

18 Jan '10

Steve Grubb: > The problem is that if you don't have auditing enabled and later in the > syscall have an AVC, the data you need may be gone. The AVC has the device and > inode, This I don't understand. The raw audit records WERE included in the message. (I repeat them below.) But they don't include any inode. > Does setroubleshoot give instruction > how to use the inode and device with the find command? No, but I would know how to do it. If I had any device/inode to search for. Raw Audit Messages node=freddi type=AVC msg=audit(1263843455.583:203): avc: denied { dac_override } for pid=6050 comm="plymouthd" capability=1 scontext=system_u:system_r:plymouthd_t:s0 tcontext=system_u:system_r:plymouthd_t:s0 tclass=capability node=freddi type=SYSCALL msg=audit(1263843455.583:203): arch=c000003e syscall=2 success=no exit=-19 a0=d13a60 a1=2 a2=0 a3=7fff3cad2310 items=0 ppid=1 pid=6050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="plymouthd" exe="/sbin/plymouthd" subj=system_u:system_r:plymouthd_t:s0 key=(null)

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2010