selinux January 2010

selinux@lists.fedoraproject.org

45 participants
44 discussions

Selinux Alerts
by Anthony Davis 11 Jan '10

11 Jan '10

Hi guys, Im getting selinux alerts logged to audit.log, is there anyway to parse the alerts via the command line to get human readable alerts? I have read that you can install setroubleshoot, but installs a huge list of dependencies for use with the gui, but i dont have a gui installed. Any ideas? Tony

7 11

Selinux alerts
by Jouni Viikari 11 Jan '10

11 Jan '10

I wonder why I started to get tons of this kind of *warnings*: SELinux is preventing /usr/lib/nagios/plugins/check_http "create" access. Detailed Description [check_imap has a permissive type (nagios_system_plugin_t). This access was not denied.] SELinux denied access requested by check_http. It is not expected that this access is required by check_http and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. If I remember correctly this started when I did #restorecon /usr/lib/nagios/plugins BR, Jouni #rpm -qi selinux-policy Name : selinux-policy Version : 3.6.32 Release : 66.fc12 ...

3 2

A really simple question
by Usman S. Ansari 08 Jan '10

08 Jan '10

I have written a driver for Linux kernel, in this driver I am using sk_security field for driver's internal data structure. This means that if SELinux is enabled, it will have conflict with my driver. For this reason, I run my driver with SELinux disabled. I want to know if it is possible to, only enable security on files and not on network objects ? >From what I have read about SELinux, it looks like this it possible, I just need conformation. And if this is possible, will SELinux need to use sk_security filed or not. If this is wrong list, please let me know appropriate place. Thanks.

2 1

Home directories within /var
by Robert Nichols 07 Jan '10

07 Jan '10

On my system I have home directories in /var/home and bind mounted to /home: /var/home on /home type none (rw,bind) Is there any way to prevent restorecon on /var from descending into /var/home and destroying the normal home directory file contexts? Reproducing all of file_contexts.homedirs in local policy is of course unmaintainable. -- Bob Nichols "NOSPAM" is really part of my email address. Do NOT delete it.

3 4

selinux and smagent
by mark 07 Jan '10

07 Jan '10

I never did solve this, and I'm looking at it again. Selinux still gripes (it's in permissive mode, or this would be more of a problem). httpd_unified is on, which is what the *wrong* error message from selinux tells me will fix this. Given the info below, *should* I chcon (or semanage) /var/log/httpd/smagent.log to the same type as the httpd error.log? Will that make selinux happy? mark, not happy with selinux host=biblio type=AVC msg=audit(1262787360.769:5531): avc: denied { write } for pid=1654 comm="LLAWP" path="/var/log/httpd/smagent.log" dev=sda3 ino=46107941 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:httpd_log_t:s0 tclass=file ll -Z /var/log/httpd/smagent.log -rw-r--r-- apache root user_u:object_r:httpd_log_t /var/log/httpd/smagent.log ll -Z /usr/local/opt/<blah>/webagent/bin/LLAWP -rwxrwxr-x root root system_u:object_r:bin_t /usr/local/opt/<blah>/webagent/bin/LLAWP ll -Z /var/log/httpd/error_log -rw-r--r-- root root system_u:object_r:httpd_log_t /var/log/httpd/error_log ll -Z /usr/sbin/httpd -rwxr-xr-x root root system_u:object_r:httpd_exec_t /usr/sbin/httpd

2 1

Move httpd root, selinux help
by Anthony Davis 07 Jan '10

07 Jan '10

Hi, Wishing everyone a happy new year! Can anyone point me in the right direction with a problem im having with selinux and httpd please? I have created a virtual host and have created the directory structure: /vhosts/domain.tld/htdocs # Document root /vhosts/domain.tld/logs # Log root /vhosts/domain.tld/private # Private root I have set the contexts and they display as: [root@server htdocs]# ls -laZ /vhosts/domain.tld/htdocs drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 . drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 .. -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html [root@server htdocs]# ls -laZ /vhosts/domain.tld/logs drwxr-xr-x. root root unconfined_u:object_r:httpd_log_t:s0 . drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 .. so to me this looks like it has the right contexts. when i try to start apache i get the following error: [root@server htdocs]# /sbin/service httpd start Starting httpd: Warning: DocumentRoot [/vhosts/domain.tld/htdocs] does not exist httpd: Could not reliably determine the server's fully qualified domain name, using ::1 for ServerName [FAILED] now i know the directory exists, which confuses me. below are the error logs: [root@server htdocs]# tail /var/log/httpd/error_log (13)Permission denied: httpd: could not open error log file /wb01/specialistdevelopment.com/www.specialistdevelopment.com/logs/error.log. Unable to open logs Can anyone help as i am really stuck. Thankyou in advance! Tony

4 4

generating rules in permissive mode?
by sai ganesh 05 Jan '10

05 Jan '10

hi, i have a query if i want to start a completely custom made service .i have defined all the transitions and types.now i need only the allow rules. what is the difference between (going to permissive mode and checking the logs to generate the entire set of policy's allow rules ) and ( generating the allow rules one by one after updating the policy again and again in the enforcing mode ).i find it easier to generate the entire set of allow rules switching to permissive mode.is there any chance that i may miss a rule if i switch to permissive mode and generate the rules from the logs or say i give extra permissions ? which is the preffered method?. -- s.saiganesh “The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do it yourself'. Yes, that's it

4 3

CentOS 5.4 + xinetd + sshd + SELinux issues
by Grzegorz Nosek 05 Jan '10

05 Jan '10

Hi all, I have a problem trying to run sshd via xinetd on a CentOS 5.4 system (I want to slap a tcpwrappers-style wrapper before sshd, so I need it that way). In permissive mode I can log in/out with the following failures reported by audit2allow: allow amanda_t consoletype_exec_t:file { execute execute_no_trans }; allow amanda_t devpts_t:chr_file { write ioctl }; allow amanda_t hostname_exec_t:file { execute execute_no_trans }; allow amanda_t shell_exec_t:file entrypoint; I don't even have amanda installed, so the context is clearly bogus. After a chat on #fedora-selinux it seems that sshd cannot find its default context, so falls back to the first available one, which happens to be something:something:amanda_t (the list is read from /selinux/user). This operation is performed by sshd itself (as verified by strace). I don't need Fort Knox type security but I'd like to use SELinux to tighten down other parts of the system, so I'd really like to use the enforcing mode. Any hints? A good TFM to R will hopefully do. Best regards, Grzegorz Nosek

3 3

Bug in bind.if - bind_admin
by Dominick Grift 04 Jan '10

04 Jan '10

Whoops sorry but similar bug apears in bind_admin: bind_initrc_exec_t is non-existent; use named_initrc_exec_t instead. init_labeled_script_domtrans($1, bind_initrc_exec_t) bind, named... i know its confusing thanks

1 0

bug in bind.if - bind_initrc_domtrans
by Dominick Grift 04 Jan '10

04 Jan '10

I just stumbled on a bug: Bad: ######################################## ## <summary> ## Execute bind server in the bind domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # # interface(`bind_initrc_domtrans',` gen_require(` type bind_initrc_exec_t; ') init_labeled_script_domtrans($1, bind_initrc_exec_t) Good: ######################################## ## <summary> ## Execute bind server in the bind domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # # interface(`bind_initrc_domtrans',` gen_require(` type bind_initrc_exec_t; ') init_labeled_script_domtrans($1, named_initrc_exec_t) ') Thanks

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2010