selinux September 2010

selinux@lists.fedoraproject.org

26 participants
32 discussions

sandbox cleanup?
by Christoph A. 20 Jun '11

20 Jun '11

Hi, I just noticed that I have over 100 processes running in the sandbox_web_client_t domain, although I closed all my sandbox windows. ps auxZ|grep sandbox_web_client_t|grep -c /usr/libexec/gvfsd 52 ps auxZ|grep sandbox_web_client_t|grep -c '/bin/dbus-daemon --fork --print-pid 5 --print-address 7 --session' 51 Shouldn't they be killed after I closed all sandbox windows? Kind regards, Christoph

5 11

sandbox: open new firefox tab from outside
by Christoph A. 22 Apr '11

22 Apr '11

Hi, I was using firefox within sandboxes for a while without perm. home directory. To store bookmarks, addons and so on, I started to use perm. homedir (-H). Because firefox does not allow multiple concurrent sessions (lock on .mozilla) it is not possible to open multiple websites when specifying the same sandbox homedir, hence I'm looking for a possibility to open new websites within a running sandbox from outside. Without sandboxes everyone can open new websites in a running firefox instance using: firefox -remote "openurl(http://www.mozilla.org)" sandbox scenario: 1. step: start firefox: sandbox -X -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox 2. step: sandbox -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox -remote "openurl(http://www.mozilla.org)" My current attempts fail because I'm unable use the '-l' option (#632377) but would the policy allow the 'firefox -remote' command if type and security level matches with the already running sandbox? kind regards, Christoph

2 4

SELinux and Shorewall with IPSets
by Mr Dash Four 17 Jan '11

17 Jan '11

Problems combining these 2 to run while SELinux is in 'enforced' mode (policy running is the 'stock' targeted one supplied with FC13). I get 2 audit alerts when Shorewall starts (and fails!) - see logs below. I have x86_64 arch machine with FC13 running. Stock Shorewall is installed. IPSet (xtunnels) is compiled in (though with the 'stock' rpm I am getting the same errors). The problem seems to be caused by the Shorewall init script (see further below). The relevant part of my syslog when SELinux is in enforced mode is: =========SELinux=Enforcing================================ Jun 26 23:18:38 dev1 shorewall[2456]: Compiling... Jun 26 23:18:38 dev1 kernel: type=1400 audit(1277590718.634:29543): avc: denied { create } for pid=2577 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:18:38 dev1 kernel: type=1400 audit(1277590718.637:29544): avc: denied { create } for pid=2579 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/zones... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/interfaces... Jun 26 23:18:38 dev1 shorewall[2456]: Determining Hosts in Zones... Jun 26 23:18:38 dev1 shorewall[2456]: Preprocessing Action Files... Jun 26 23:18:38 dev1 shorewall[2456]: Pre-processing /usr/share/shorewall/action.Drop... Jun 26 23:18:38 dev1 shorewall[2456]: Pre-processing /usr/share/shorewall/action.Reject... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/policy... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/blacklist... Jun 26 23:18:38 dev1 shorewall[2456]: ERROR: ipset names in Shorewall configuration files require Ipset Match in your kernel and iptables : /etc/shorewall/blacklist (line 11) Jun 26 23:18:38 dev1 shorewall[2456]: ERROR: Shorewall start failed ========================================================== When I switch SELinux to Permissive I get two further errors: =========SELinux=Permissive=============================== Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29551): avc: denied { create } for pid=3799 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29552): avc: denied { getopt } for pid=3799 comm="ipset" lport=255 scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29553): avc: denied { setopt } for pid=3799 comm="ipset" lport=255 scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/zones... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/interfaces... Jun 26 23:32:45 dev1 shorewall[3678]: Determining Hosts in Zones... Jun 26 23:32:45 dev1 shorewall[3678]: Preprocessing Action Files... Jun 26 23:32:45 dev1 shorewall[3678]: Pre-processing /usr/share/shorewall/action.Drop... Jun 26 23:32:45 dev1 shorewall[3678]: Pre-processing /usr/share/shorewall/action.Reject... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/policy... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/blacklist... Jun 26 23:32:45 dev1 shorewall[3678]: Adding Anti-smurf Rules Jun 26 23:32:45 dev1 shorewall[3678]: Compiling TCP Flags filtering... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling Kernel Route Filtering... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling Martian Logging... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling MAC Filtration -- Phase 1... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/rules... Jun 26 23:32:45 dev1 shorewall[3678]: Generating Transitive Closure of Used-action List... Jun 26 23:32:45 dev1 shorewall[3678]: Processing /usr/share/shorewall/action.Reject for chain Reject... Jun 26 23:32:45 dev1 shorewall[3678]: Processing /usr/share/shorewall/action.Drop for chain Drop... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling MAC Filtration -- Phase 2... Jun 26 23:32:45 dev1 shorewall[3678]: Applying Policies... Jun 26 23:32:45 dev1 shorewall[3678]: Generating Rule Matrix... Jun 26 23:32:45 dev1 shorewall[3678]: Creating iptables-restore input... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling iptables-restore input for chains blacklst mangle:... Jun 26 23:32:45 dev1 shorewall[3678]: Shorewall configuration compiled to /var/lib/shorewall/.start Jun 26 23:32:45 dev1 shorewall[3678]: Starting Shorewall.... Jun 26 23:32:45 dev1 shorewall[3678]: Initializing... Jun 26 23:32:46 dev1 kernel: u32 classifier Jun 26 23:32:46 dev1 kernel: Performance counters on Jun 26 23:32:46 dev1 kernel: input device check on Jun 26 23:32:46 dev1 kernel: Actions configured Jun 26 23:32:46 dev1 shorewall[3678]: Processing /etc/shorewall/init ... Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-x1.ips Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-x2.ips Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-z1.ips Jun 26 23:32:47 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-z2.ips Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/tcclear ... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Route Filtering... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Martian Logging... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Proxy ARP... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Traffic Control... Jun 26 23:32:49 dev1 shorewall[3678]: Preparing iptables-restore input... Jun 26 23:32:49 dev1 shorewall[3678]: Running /sbin/iptables-restore... Jun 26 23:32:49 dev1 shorewall[3678]: IPv4 Forwarding Enabled Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/start ... Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/started ... Jun 26 23:32:49 dev1 shorewall[3678]: Shorewall started ========================================================== The problem seems to be caused by the shorewall init script, which is: ===========Shorewall init script========================== modprobe ifb numifbs=1 ip link set dev ifb0 up # configure the ipsets sw_ips_mask='/etc/shorewall/ips/*.ips' ipset_exec='/usr/sbin/ipset' if [ "$COMMAND" = start ]; then $ipset_exec -F $ipset_exec -X for c in `/bin/ls $sw_ips_mask 2>/dev/null`; do echo loading $c $ipset_exec -R < $c done fi ========================================================== The above script executes /usr/sbin/ipset to create my IP Sets needed for running Shorewall (all IP set commands are contained in those *.ips files). These IP sets comprise mainly of IP subnets which are part of my blacklists (banned IP subnets), though they also contain some IP Port sets as well. Don't know why SELinux denies "create" (and then "getopt" and "setopt") on a, what seems to be, raw ip socket (IPSet do not use/need one as far as I know!)? If I remove the IP Set part of the init script above and rearrange Shorewall to run without IPSets all is well, though its functionality is VERY limited and barely useful to me! Two questions to the SELinux gurus on here: 1) Why am I getting these alerts? and 2) How can I fix the problem so that I could run both Shorewall and IPSets with SELinux in Enforced mode? This is important for me as this is a production server and a lot of stuff runs on it and needs to be available 24/7. Many thanks in advance!

4 57

error: ssh_selinux_getctxbyname: Failed to get default SELinux security context
by Matthias Imsand 01 Oct '10

01 Oct '10

Hello I get the following error when I try to log in through ssh (even if selinux is in permissive mode!!!): Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: Accepted keyboard-interactive/pam for mat from 131.102.233.127 port 58912 ssh2 Sep 28 09:01:32 stvlx05.test.admin.ch kernel: [60557.252750] type=1400 audit(1285657292.298:286): avc: denied { audit_control } for pid=12614 comm="sshd" capability=30 scontext=system_u:system_r:sysadm_t tcontext=system_u:system_r:sysadm_t tclass=capability Sep 28 09:01:32 stvlx05.test.ch sshd[12621]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for mat Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for mat Sep 28 09:01:32 stvlx05.test.ch sshd[12614]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument I already went through this post: http://www.nsa.gov/research/selinux/list-archive/0910/30906.shtml but I can't figure out the exact problem. Here is what I've done so far: - Downloaded the latest reference policy from tresys: http://oss.tresys.com/files/refpolicy/refpolicy-2.20100524.tar.bz2 - Compiled and installed it on my sles 11.1 - set selinux into permissive mode: (so far so good.. :)) sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 24 Policy from config file: refpolicy - Add selinux user "mat_u": semanage user -R "staff_r system_r" -P user -a mat_u - Add linux user " mat": useradd mat - Set password for "mat": passwd mat - User mapping: semanage login -s mat_u -a mat - add security context for "mat_u" by copying staff_u's context (don't know if that's needed??!): cp /etc/selinux/refpolicy/contexts/user/staff_u /etc/selinux/refpolicy/contexts/user/mat_u - set boolean for sysadm ssh login to true (don't know if thats needed?!): setsebool ssh_sysadm_login on In other posts I've read something about sepermit.conf and namespace.conf but these files don't exist on my system. What about these files? Do I need them? What's wrong on my system? Why it's not possible to login even if selinux is in permissive mode? Any suggestions? thanks in advance Matthias

4 31

odd message - execmod related
by Genes MailLists 01 Oct '10

01 Oct '10

I was trying to test the early version of thunbderbird 3.3 and got the following : ------------------- SELinux is preventing /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin "execmod" access to /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/libxul.so. ------------------- SELinux denied access requested by /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin. /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin is mislabeled. /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/thunderbird-bin default SELinux type is usr_t, but its current type is usr_t. Changing this file back to the default type, may fix your problem. If you believe this is a bug, please file a bug report against this package. Allowing AccessYou can restore the default system context to this file by executing the restorecon command. resto ----------------------------------- (1) Note the message: "default SELinux type is usr_t, but its current type is usr_t." confuses me ... ? setebool -P execmod 1 allowed it run - but that seems like way overkill. (2) What is the 'right' way to allow /opt/Local/vers/mozilla/released/thunderbird-3.3a1pre-100930/libxul.so to be execmod'ed (or whatever its called) ? Thanks gene/

4 7

Is setroubleshoot-server designed for a server?
by Vadym Chepkov 29 Sep '10

29 Sep '10

No one else finds this excessive? It's a server, after all Dependencies Resolved ==================================================================================================================================== Package Arch Version Repository Size ==================================================================================================================================== Installing: setroubleshoot-server i686 2.2.96-1.fc13 updates 340 k Installing for dependencies: ConsoleKit i686 0.4.1-5.fc13 fedora 81 k ConsoleKit-libs i686 0.4.1-5.fc13 fedora 17 k atk i686 1.30.0-1.fc13 fedora 206 k audit-libs-python i686 2.0.4-3.fc13 fedora 60 k avahi i686 0.6.25-7.fc13 updates 250 k cairo i686 1.8.10-1.fc13 fedora 320 k cups-libs i686 1:1.4.4-10.fc13 updates 345 k dbus i686 1:1.2.24-1.fc13 fedora 211 k dbus-python i686 0.83.0-6.fc12 fedora 173 k dbus-x11 i686 1:1.2.24-1.fc13 fedora 39 k dmz-cursor-themes noarch 0.4-3.fc13 fedora 390 k eggdbus i686 0.6-2.fc13 fedora 91 k enchant i686 1:1.6.0-1.fc13 fedora 50 k gnutls i686 2.8.6-2.fc13 updates 353 k gtk2 i686 2.20.1-1.fc13 fedora 3.5 M hicolor-icon-theme noarch 0.12-1.fc13 fedora 42 k hunspell i686 1.2.8-17.fc13 fedora 181 k jasper-libs i686 1.900.1-15.fc13 fedora 140 k libICE i686 1.0.6-2.fc13 fedora 52 k libSM i686 1.1.0-7.fc12 fedora 25 k libXcomposite i686 0.4.1-2.fc13 fedora 17 k libXcursor i686 1.1.10-4.fc13 fedora 33 k libXdamage i686 1.1.2-2.fc13 fedora 16 k libXext i686 1.1.2-2.fc13 updates 33 k libXfixes i686 4.0.4-2.fc13 fedora 19 k libXft i686 2.1.14-1.fc13 fedora 48 k libXi i686 1.3.2-1.fc13 updates 32 k libXinerama i686 1.1-2.fc13 fedora 15 k libXrandr i686 1.3.0-5.fc13 fedora 29 k libXrender i686 0.9.5-1.fc13 fedora 26 k libdaemon i686 0.14-1.fc13 fedora 27 k libglade2 i686 2.6.4-3.fc12 fedora 57 k libnotify i686 0.5.0-1.fc13 updates 35 k libselinux-python i686 2.0.94-2.fc13 updates 197 k libsemanage-python i686 2.0.45-1.fc13 fedora 80 k libsexy i686 0.1.11-15.fc13 fedora 42 k libtasn1 i686 2.4-2.fc13 fedora 239 k libthai i686 0.1.14-2.fc13 fedora 185 k libtiff i686 3.9.4-1.fc13 updates 134 k libxfce4util i686 4.6.2-1.fc13 updates 113 k libxfcegui4 i686 4.6.4-1.fc13 updates 315 k libxml2-python i686 2.7.7-1.fc13 fedora 312 k make i686 1:3.81-19.fc13 updates 385 k pango i686 1.28.0-1.fc13 fedora 349 k pixman i686 0.18.0-1.fc13 fedora 154 k policycoreutils-python i686 2.0.83-28.fc13 updates 332 k polkit i686 0.96-1.fc13 fedora 156 k pygobject2 i686 2.21.1-6.fc13 fedora 181 k python-decorator noarch 3.1.2-2.fc13 fedora 15 k python-slip noarch 0.2.13-1.fc13 updates 26 k python-slip-dbus noarch 0.2.13-1.fc13 updates 28 k setools-libs i686 3.3.7-7.fc13 updates 400 k setools-libs-python i686 3.3.7-7.fc13 updates 211 k setroubleshoot-plugins noarch 2.1.61-1.fc13 updates 536 k startup-notification i686 0.10-4.fc13 fedora 37 k xcb-util i686 0.3.6-1.fc12 fedora 37 k xfce4-notifyd i686 0.1.0-3.fc12 fedora 56 k xfconf i686 4.6.2-1.fc13 updates 133 k xml-common noarch 0.6.3-32.fc13 fedora 9.4 k Transaction Summary ==================================================================================================================================== Install 60 Package(s) Total download size: 12 M Installed size: 47 M Is this ok [y/N]: N

2 2

Statement precedence/priority (neverallow)
by Mr Dash Four 28 Sep '10

28 Sep '10

In the standard policy most of the kernel/service modules allow access to unlabelled traffic, interfaces and nodes. I have a simple question regarding this: if I were to write an additional module and include neverallow statement to deny previously granted access to such resources would this be enough (my understanding of neverallow is that it just checks whether previous 'allow' statements were issued and if so, generates a warning and stops)? If neverallow is not the way to go, what could I do, short of altering every single policy file and remove the appropriate allow statements, to disable such access to the above resources?

2 5

unsubscribe
by Powell, Tim B. (IT Solutions) 28 Sep '10

28 Sep '10

Tim B. Powell Solutions Engineering 571.281.4501

1 0

Selinux Audit -- Rawhide (F15) Deprecated entry?
by Frank Murphy 26 Sep '10

26 Sep '10

Getting the following through logwatch: --------------------- Selinux Audit Begin ------------------------ **Unmatched Entries** auditd (1319): /proc/1319/oom_adj is deprecated, please use /proc/1319/oom_score_adj instead. auditd (1323): /proc/1323/oom_adj is deprecated, please use /proc/1323/oom_score_adj instead. ---------------------- Selinux Audit End ------------------------- -- Regards, Frank Murphy UTF_8 Encoded Friend of Fedora

1 0

SELinux and Rsyslog
by Erinn Looney-Triggs 24 Sep '10

24 Sep '10

I am trying to get Rsyslog queues working on RHEL 5.5. Queues, sort of as the name implies, will queue messages, in my case they will queue messages if the central log server goes down (if you want the details take a look here: http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html). Now for the most part this queue remains in memory, but it can be written to disk. That of course is the rub with SELinux, it will deny access to arbitrary locations that I want to put files into. I don't really want to use a custom policy as that just creates overhead, so I searched for allow rules for syslogd_t and came up with the following options that looked promising: allow syslogd_t syslogd_var_lib_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow syslogd_t syslogd_var_lib_t : dir { ioctl read write getattr lock add_name remove_name search }; allow syslogd_t syslogd_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename }; allow syslogd_t syslogd_var_run_t : dir { ioctl read write getattr lock add_name remove_name search }; Excellent, so if I have a location labelled with either of those types I ought to be good (well I think so, I am kind of new to this). But again in the interest of not maintaining local changes across many systems I wanted the files labels to come from the default contexts, so after a little digging through /etc/selinux/targeted/contexts/files: /var/lib/syslog-ng(/.*)? system_u:object_r:syslogd_var_lib_t:s0 Bingo, sort of. What is a syslog-ng setup doing in a distribution that doesn't even ship with syslog-ng? Is this for third party installs of syslog-ng? I guess it doesn't really matter. Here are the questions after that long winded introduction: Is this the right way to go about setting this up? If we can have a syslog-ng specific file context is there any reason we can't have a rsyslog specific one given that rsyslog is actually shipping with RHEL? I know it is just names but it bothers my OCD ;). Thanks for the help, -Erinn

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2010