selinux December 2010

selinux@lists.fedoraproject.org

19 participants
25 discussions

Getting a RuntimeError: Invalid argument from _seinfo
by Frank Licea 20 Dec '10

20 Dec '10

I'm on a fresh installation of Fedora 14 and I'm encountering an error when I use the `sandbox` policy script. I'm would like to know if there are any others who are getting the same issue that I am. Using the sandbox policy with any command (for example): `sandbox ls` `sandbox` Always returns the following error message: Traceback (most recent call last): File "/usr/bin/sandbox", line 443, in <module> rc = sandbox.main() File "/usr/bin/sandbox", line 428, in main self.__parse_options() File "/usr/bin/sandbox", line 251, in __parse_options types = "\t" + "\n\t".join(setools.seinfo(setools.ATTRIBUTE, "sandbox_type")[0]['types']) File "/usr/lib/python2.7/site-packages/setools/__init__.py", line 49, in seinfo dict_list = _seinfo.seinfo(setype, name) RuntimeError: Invalid argument Anyone else getting this or just me?

2 2

F13: nautilus & mmap
by Dan Thurman 17 Dec '10

17 Dec '10

Not sure what this means, but it sound omimous... Using the latest updates. ================================================== Summary: Your system may be seriously compromised! /usr/bin/nautilus (deleted) attempted to mmap low kernel memory. Detailed Description: SELinux has denied the nautilus the ability to mmap low area of the kernel address space. The ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps protect against exploiting null deref bugs in the kernel. All applications that need this access should have already had policy written for them. If a compromised application tries modify the kernel this AVC would be generated. This is a serious issue. Your system may very well be compromised. Allowing Access: Contact your security administrator and report this issue. Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects None [ memprotect ] Source nautilus Source Path /usr/bin/nautilus (deleted) Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.7.19-74.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name mmap_zero Host Name (removed) Platform Linux <host>.<domain>.com 2.6.34.7-61.fc13.i686 #1 SMP Tue Oct 19 04:42:47 UTC 2010 i686 i686 Alert Count 1186 First Seen Thu 09 Dec 2010 12:08:59 PM PST Last Seen Thu 09 Dec 2010 12:13:09 PM PST Local ID aba9eed1-e6cf-48cb-80c4-88ccf2d90f43 Line Numbers Raw Audit Messages node=<host>.<domain>.com type=AVC msg=audit(1291925589.462:92406): avc: denied { mmap_zero } for pid=26679 comm="nautilus" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect node=<host>.<domain>.com type=SYSCALL msg=audit(1291925589.462:92406): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=a000 a2=3 a3=22 items=0 ppid=2663 pid=26679 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus" exe=2F7573722F62696E2F6E617574696C7573202864656C6574656429 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

4 13

Re: Reporting denials which already exist in bugzilla
by Daniel J Walsh 17 Dec '10

17 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/16/2010 02:29 PM, Sandro Janke wrote: > On 12/16/2010 03:21 PM, Daniel J Walsh wrote: > On 12/16/2010 08:52 AM, Sandro Janke wrote: >>>> I recently got a few denials on a F14 system when trying to add USB >>>> storage to a guest system. >>>> >>>> I checked my booleans and both qemu_use_usb and virt_use_usb are >>>> turned on. >>>> >>>> Upon reporting the denials using SELinux Troubleshooter I am lead to two >>>> closed bugs ([1],[2]) which in turn are duplicates and lead to another >>>> closed bug [3]. I asked for [3] to be re-opened, but I'm told to report >>>> a new bug. >>>> >>>> Should I report the new bugs on selinux-policy or on libvirt which is >>>> the component of [3] and [4]. [4] being the bug the third alert in this >>>> series lead me to. >>>> >>>> [1] https://bugzilla.redhat.com/show_bug.cgi?id=579744 >>>> [2] https://bugzilla.redhat.com/show_bug.cgi?id=580333 >>>> [3] https://bugzilla.redhat.com/show_bug.cgi?id=537227 >>>> [4] https://bugzilla.redhat.com/show_bug.cgi?id=638801 >>>> >>>> -- Sandro >>>> -- >>>> selinux mailing list >>>> selinux(a)lists.fedoraproject.org >>>> https://admin.fedoraproject.org/mailman/listinfo/selinux >>>> >>>> > Report new bugs on libvirt and cc me. - -- selinux mailing list selinux(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux > I put some more info in bug #638801. Shall I attach the AVC denials of > the ioctl/read write there as well. They all boil down to the same thing > as you already mentioned. > -- Sandro Yes -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0LbSgACgkQrlYvE4MpobNuzgCguZThoOTObZyx7vMNbvO5AWYV 7UMAnA1nH5jFyPm6QvNX5LS+KOLP+Bho =k+s1 -----END PGP SIGNATURE-----

1 0

Reporting denials which already exist in bugzilla
by Sandro Janke 16 Dec '10

16 Dec '10

I recently got a few denials on a F14 system when trying to add USB storage to a guest system. I checked my booleans and both qemu_use_usb and virt_use_usb are turned on. Upon reporting the denials using SELinux Troubleshooter I am lead to two closed bugs ([1],[2]) which in turn are duplicates and lead to another closed bug [3]. I asked for [3] to be re-opened, but I'm told to report a new bug. Should I report the new bugs on selinux-policy or on libvirt which is the component of [3] and [4]. [4] being the bug the third alert in this series lead me to. [1] https://bugzilla.redhat.com/show_bug.cgi?id=579744 [2] https://bugzilla.redhat.com/show_bug.cgi?id=580333 [3] https://bugzilla.redhat.com/show_bug.cgi?id=537227 [4] https://bugzilla.redhat.com/show_bug.cgi?id=638801 -- Sandro

2 1

Nero for Linux & rpm initial labels
by Jorge Fábregas 13 Dec '10

13 Dec '10

Hi, I installed the latest "Nero for Linux" (version 4) and noticed that rpm labeled all files in /usr/lib/nero/lib* as textrel_shlib_t.. However, there's no reference to this path in file_contexts and when I do a restorecon of these files they get labeled as "lib_t" (as I would expect since there's no regex in files_context for these). I thought that what made rpm SELinux-aware was that it somehow consulted the file_contexts (or a library called by rpm) but this is not the case in the above example. Is it that rpm has some hardcoded rules to label some files in /usr/lib/ as textrel_shlib_t regardless of what's in the file_contexts? BTW, I had to add some regular expressions to the local file_contexts in order to label some Nero libs as textrel_shlib_t for the ones located in /usr/lib/nero/plug-ins/lib* as I got many AVCs when using the program. There's one regex in file_contexts for Nero: /usr/lib(64)?/nero/plug-ins/libMP3\.so(\.[^/]*)* -- system_u:object_r:textrel_shlib_t:s0 ...but there are other libs in that directory (besides the MP3 one) that need textrel_shlib_t. I ddin't file a bug report as I'm on Fedora 12 (it reached its end of life). I'll check again if this happens when I install Fedora 14. Thanks, Jorge

4 5

No AVC when sshd is mislabeled
by Jorge Fábregas 12 Dec '10

12 Dec '10

Hi, On my Fedora 12 system I changed - on purpose - the label for the sshd binary. I gave it httpd_exec_t and tried to start it with the service command to see what happens. I got: Starting sshd: Could not load host key: /etc/ssh/ssh_host_rsa_key Could not load host key: /etc/ssh/ssh_host_dsa_key ..which is expected as "httpd_t" doesn't have access to these files. My question is: Why don't I get any AVC errors for this? I was expecting something like "httpd_t is ttrying to read files labeled as sshd_key_t..." There's nothing in /var/log/audit/audit.log (I'm using auditd). Are there any "dontaudit" rules for these types of access that causes SELinux not to log these? Regards, Jorge

2 6

selinux policy for encrypted files
by Roberto Sassu 10 Dec '10

10 Dec '10

Hi all i want to write a policy for encrypted files. In order to do this i created some new types which have the name of the correspondent type used for non encrypted files, with the prefix 'encrypted_'. Then i need to define the policy for applications that need to use these new types which is very similar to this defined for original types, except that i want to take rules only for the 'dir' and 'file' class. What this the best way to define the policy? Do i have to duplicate all required interfaces/templates or can i reuse the existent code, for instance by adding a new parameter? I will show an example of what i'm trying to define. New type: encrypted_etc_t; Example interface: interface(`files_list_etc',` gen_require(` type etc_t; ') allow $1 etc_t:dir list_dir_perms; ') Added interface: interface(`files_list_encrypted_etc',` gen_require(` type encrypted_etc_t; ') allow $1 encrypted_etc_t:dir list_dir_perms; ')

2 3

The concept of unconfined_t
by Jorge Fábregas 09 Dec '10

09 Dec '10

Hi, I'm wondering about unconfined_t... Is it that, for unconfined_t, there are a bunch of "allow rules" for every type of object and every available type? Is there anything unconfined_t can't do? Thanks, Jorge

2 4

Re: avc: smartcard token login
by Dominick Grift 07 Dec '10

07 Dec '10

Reference: http://lists.fedoraproject.org/pipermail/selinux/2010-December/013294.html This may be more appropriate if other login programs need this as well. Signed-off-by: Dominick Grift <domg472(a)gmail.com> --- :100644 100644 6521109... ceadd00... M policy/modules/system/authlogin.if policy/modules/system/authlogin.if | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 6521109..ceadd00 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -189,6 +189,12 @@ interface(`auth_login_pgm_domain',` ') optional_policy(` + openct_stream_connect($1) + openct_signull($1) + openct_read_pid_files($1) + ') + + optional_policy(` corecmd_exec_bin($1) storage_getattr_fixed_disk_dev($1) mount_domtrans($1) -- 1.7.3.2

3 11

avc: smartcard token login
by Mr Dash Four 05 Dec '10

05 Dec '10

When I try to log in (via a terminal) using smartcard token managed by openct I get the following AVC: type=AVC msg=audit(1291494642.695:5): avc: denied { search } for pid=1651 comm="login" name="openct" dev=dm-0 ino=9737 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openct_var_run_t:s0 tclass=dir type=SYSCALL msg=audit(1291494642.695:5): arch=40000003 syscall=5 success=no exit=-13 a0=bfee6f9c a1=0 a2=3ad326 a3=0 items=0 ppid=1 pid=1651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null) When I put SELinux in permissive mode I found out that openct, via /bin/login, is trying to access its status file (/var/run/openct/status): type=AVC msg=audit(1291510211.246:10): avc: denied { search } for pid=1656 comm="login" name="openct" dev=dm-0 ino=4248 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openct_var_run_t:s0 tclass=dir type=AVC msg=audit(1291510211.246:10): avc: denied { read } for pid=1656 comm="login" name="status" dev=dm-0 ino=57346 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file type=AVC msg=audit(1291510211.246:10): avc: denied { open } for pid=1656 comm="login" name="status" dev=dm-0 ino=57346 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file type=SYSCALL msg=audit(1291510211.246:10): arch=40000003 syscall=5 success=yes exit=5 a0=bfaf597c a1=0 a2=ab1326 a3=0 items=0 ppid=1 pid=1656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1291510211.277:11): avc: denied { getattr } for pid=1656 comm="login" path="/var/run/openct/status" dev=dm-0 ino=57346 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file type=SYSCALL msg=audit(1291510211.277:11): arch=40000003 syscall=197 success=yes exit=0 a0=5 a1=bfaf587c a2=3a5ff4 a3=3 items=0 ppid=1 pid=1656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null) The Linux policy I am using is the latest for FC13. My /etc/pam.d/login file is: #%PAM-1.0 auth sufficient pam_pkcs11.so #auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_pkcs11.so auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth include system-auth account required pam_nologin.so account include system-auth password include system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open session required pam_namespace.so session optional pam_keyinit.so force revoke session include system-auth -session optional pam_ck_connector.so pam_pkcs11.so is used by openct to perform the actual login and appropriate mapping. Any ideas - should I report this as a bug?

2 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2010