selinux October 2010

selinux@lists.fedoraproject.org

16 participants
18 discussions

why label /dev/hugepages directory hugetlbfs_t?
by Dominick Grift 12 Oct '10

12 Oct '10

Why is /dev/hugepages specified to be labeled hugetlbfs_t? Any particular reason for this? In my branch i labelled it device_t like most directories in /dev. This makes it easier because udev does some magic in /lib/udev/devices(hugetables) which causes all kinds of extra denials if i label the hugepages dir hugetlbfs_t. For example hugetlbfs_t must associate to device_t etc. Much easier to just label hugepages directories at both /dev/hugepage and /lib/udev/devices/hugepages device_t. Also i noticed that /sys/fs/cgroup is specified to be labeled cgroup_t, but i think the kernel creates that directory with type sysfs_t. So that would mean that it needs to be restored at each boot-up.

3 7

cgi over nfs
by mark 07 Oct '10

07 Oct '10

Can someone give me a pointer as to where I need to start? On the server the directory is physically on, I've set a bunch of cgi scripts to httpd_sys_script_exec_t, and restarted nfs. Then I did the same on the server mounting that directory... and the scripts show as nfs_t. getsebool -a | grep nfs shows allow_ftpd_use_nfs --> off allow_nfsd_anon_write --> off httpd_use_nfs --> on nfs_export_all_ro --> on nfs_export_all_rw --> on nfsd_disable_trans --> off qemu_use_nfs --> on samba_share_nfs --> off use_nfs_home_dirs --> on virt_use_nfs --> off So, what do I need to do to get rid of the AVCs (yeah, we're in permissive mode)? mark

2 1

F13: SELinux is preventing /usr/sbin/smbd "quotaget" access
by Dan Thurman 05 Oct '10

05 Oct '10

Below happened 224 times. How can I fix this? =========================================================================== Summary: SELinux is preventing /usr/sbin/smbd "quotaget" access . Detailed Description: SELinux denied access requested by smbd. It is not expected that this access is required by smbd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:smbd_t:s0 Target Context system_u:object_r:samba_share_t:s0 Target Objects None [ filesystem ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host (removed) Source RPM Packages samba-3.5.5-68.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-57.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux host.domain.com 2.6.34.6-54.fc13.i686 #1 SMP Sun Sep 5 17:52:31 UTC 2010 i686 i686 Alert Count 224 First Seen Thu 30 Sep 2010 11:32:04 AM PDT Last Seen Thu 30 Sep 2010 09:18:41 PM PDT Local ID 01035ab1-2396-4e92-9b1e-09645d976534 Line Numbers Raw Audit Messages node=host.domain.com type=AVC msg=audit(1285906721.444:102672): avc: denied { quotaget } for pid=17451 comm="smbd" scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=filesystem node=host.domain.com type=SYSCALL msg=audit(1285906721.444:102672): arch=40000003 syscall=131 success=no exit=-13 a0=80000701 a1=1282200 a2=1f5 a3=bfdb5d7c items=0 ppid=2144 pid=17451 auid=4294967295 uid=0 gid=0 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)

4 8

httpd_use_nfs
by Jens Falsmar Oechsler 04 Oct '10

04 Oct '10

Hi I have Apache httpd running on F12 system, serving files from NFS mount. I'm wondering if this shouldn't be restricted by boolean "httpd_use_nfs -> off Allow httpd to access nfs file systems"? Or is that a misunderstanding? Files on NFS mount shows context system_u:object_r:nfs_t:s0 Regards Jens

2 3

F11 VSFTPD post install problem
by Aaron Gray 03 Oct '10

03 Oct '10

Hi, I had a fresh F11 server install, but with out VSFTPD, then I installed VSFTPD, but it is blocked by SELinux. I turn off enforcement and FTP runs fine. Is there some script or proceedure I can run to allow VSFTPD on F11 or do I have to do a reinstall of Fedora ? Many thanks in advance, Aaron

2 7

F13: SELinux is preventing /usr/bin/updatedb "read" access on My Documents
by Dan Thurman 01 Oct '10

01 Oct '10

I get this often too, how to fix? ==================================================================== Summary: SELinux is preventing /usr/bin/updatedb "read" access on My Documents. Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:locate_t:s0-s0:c0.c1023 Target Context system_u:object_r:samba_share_t:s0 Target Objects My Documents [ lnk_file ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host host.domain.com Source RPM Packages mlocate-0.22.4-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-57.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name host.domain.com Platform Linux host.domain.com 2.6.34.6-54.fc13.i686 #1 SMP Sun Sep 5 17:52:31 UTC 2010 i686 i686 Alert Count 130 First Seen Thu 30 Sep 2010 03:43:09 AM PDT Last Seen Fri 01 Oct 2010 03:37:52 AM PDT Local ID 4ee4e27f-095e-4186-a718-dfeb6cb22169 Line Numbers Raw Audit Messages node=host.domain.com type=AVC msg=audit(1285929472.607:103678): avc: denied { read } for pid=22716 comm="updatedb" name=4D7920446F63756D656E7473 dev=sdc3 ino=83907 scontext=system_u:system_r:locate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:samba_share_t:s0 tclass=lnk_file node=host.domain.com type=SYSCALL msg=audit(1285929472.607:103678): arch=40000003 syscall=12 success=no exit=-13 a0=9e9c8f9 a1=bfe5b6f0 a2=bfe5b8e4 a3=bfe5b6f0 items=0 ppid=22709 pid=22716 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=6602 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0-s0:c0.c1023 key=(null)

3 3

error: ssh_selinux_getctxbyname: Failed to get default SELinux security context
by Matthias Imsand 01 Oct '10

01 Oct '10

Hello I get the following error when I try to log in through ssh (even if selinux is in permissive mode!!!): Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: Accepted keyboard-interactive/pam for mat from 131.102.233.127 port 58912 ssh2 Sep 28 09:01:32 stvlx05.test.admin.ch kernel: [60557.252750] type=1400 audit(1285657292.298:286): avc: denied { audit_control } for pid=12614 comm="sshd" capability=30 scontext=system_u:system_r:sysadm_t tcontext=system_u:system_r:sysadm_t tclass=capability Sep 28 09:01:32 stvlx05.test.ch sshd[12621]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for mat Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for mat Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument I already went through this post: http://www.nsa.gov/research/selinux/list-archive/0910/30906.shtml but I can't figure out the exact problem. Here is what I've done so far: - Downloaded the latest reference policy from tresys: http://oss.tresys.com/files/refpolicy/refpolicy-2.20100524.tar.bz2 - Compiled and installed it on my sles 11.1 - set selinux into permissive mode: (so far so good.. :)) sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 24 Policy from config file: refpolicy - Add selinux user "mat_u": semanage user -R "staff_r system_r" -P user -a mat_u - Add linux user " mat": useradd mat - Set password for "mat": passwd mat - User mapping: semanage login -s mat_u -a mat - add security context for "mat_u" by copying staff_u's context (don't know if that's needed??!): cp /etc/selinux/refpolicy/contexts/user/staff_u /etc/selinux/refpolicy/contexts/user/mat_u - set boolean for sysadm ssh login to true (don't know if thats needed?!): setsebool ssh_sysadm_login on In other posts I've read something about sepermit.conf and namespace.conf but these files don't exist on my system. What about these files? Do I need them? What's wrong on my system? Why it's not possible to login even if selinux is in permissive mode? Any suggestions? thanks in advance Matthias

4 31

odd message - execmod related
by Genes MailLists 01 Oct '10

01 Oct '10

I was trying to test the early version of thunbderbird 3.3 and got the following : ------------------- SELinux is preventing /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin "execmod" access to /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/libxul.so. ------------------- SELinux denied access requested by /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin. /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin is mislabeled. /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin default SELinux type is usr_t, but its current type is usr_t. Changing this file back to the default type, may fix your problem. If you believe this is a bug, please file a bug report against this package. Allowing AccessYou can restore the default system context to this file by executing the restorecon command. resto ----------------------------------- (1) Note the message: "default SELinux type is usr_t, but its current type is usr_t." confuses me ... ? setebool -P execmod 1 allowed it run - but that seems like way overkill. (2) What is the 'right' way to allow /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/libxul.so to be execmod'ed (or whatever its called) ? Thanks gene/

4 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2010