selinux November 2011

selinux@lists.fedoraproject.org

19 participants
19 discussions

clamd_use_jit on
by Frank Murphy 14 Nov '11

14 Nov '11

Boot up screen, said I needed to run setsebool -P clamd_use_jit on for clamd.clamav but as root in Terminal $ setsebool -P clamd_use_jit on libsepol.expand_filename_trans: Conflicting filename trans rules xvc9 kernel_t device_t : chr_file otype1:tty_device_t otype2:tty_device_t libsepol.expand_module: Error during expand libsemanage.semanage_expand_sandbox: Expand module failed Could not change policy booleans selinux-policy-targeted-3.10.0-55.fc16.noarch -- Regards, Frank Murphy UTF_8 Encoded Friend of fedoraproject.org

2 1

incorrect type transition rules in fedora policy
by KaiGai Kohei 12 Nov '11

12 Nov '11

Hi, I noticed the selinux-policy of Fedora is not updated to the latest upstream refpolicy in type_transition rules. The attached file is a diff set of services/postgresql.te between the upstream and selinux-policy-3.10.0-55. It drops the following type_transition rules: type_transition postgresql_t sepgsql_database_type:db_schema sepgsql_schema_t; type_transition postgresql_t sepgsql_schema_type:db_table sepgsql_sysobj_t; type_transition postgresql_t sepgsql_schema_type:db_sequence sepgsql_seq_t; type_transition postgresql_t sepgsql_schema_type:db_view sepgsql_view_t; type_transition postgresql_t sepgsql_schema_type:db_procedure sepgsql_proc_exec_t; And, it defines the rules incorrectly. -type_transition sepgsql_admin_type sepgsql_schema_type:db_sequence sepgsql_seq_t; +type_transition sepgsql_admin_type sepgsql_schema_type:db_schema sepgsql_seq_t; -type_transition sepgsql_admin_type sepgsql_schema_type:db_view sepgsql_view_t; +type_transition sepgsql_admin_type sepgsql_view_type:db_view sepgsql_view_t; Please fix them. Thanks, -- KaiGai Kohei <kaigai(a)kaigai.gr.jp>

1 0

customizable_types
by Artur Szymczak 06 Nov '11

06 Nov '11

Hi, could some give me an real-world example, when I would like to use customizable_types? Regards -- Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2 GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D http://CodzienneChodzenieZBogiem.blogspot.com/

2 1

selinux doesn't prevent php fopen to remote 80/tcp
by Marko Uskoković 04 Nov '11

04 Nov '11

Hello, If I understand documentation correctly, SELinux should prevent php scripts (running via mod_php) from opening remote urls with fopen function by default, that is when httpd_can_network_connect --> off Here are the links that confirm that behavior in the past: http://www.php.net/manual/en/function.fopen.php#56551 https://bugzilla.redhat.com/show_bug.cgi?id=164700 I've installed and updated Fedora 15 with no selinux modifications: [root@localhost ~]# cat /etc/redhat-release Fedora release 15 (Lovelock) [root@localhost ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 26 Policy from config file: targeted I've made three tests: [root@localhost ~]# cat /var/www/html/marko1.php <?php $file = fopen ("http://www.example.com", "r"); if (!$file) { echo "<p>Unable to open remote file.\n"; exit; } while (!feof ($file)) { $line = fgets ($file, 1024); echo ($line); } fclose($file); ?> [root@localhost ~]# cat /var/www/html/marko2.php <?php $file = fopen ("http://10.11.12.13:31254/", "r"); if (!$file) { echo "<p>Unable to open remote file.\n"; exit; } while (!feof ($file)) { $line = fgets ($file, 1024); echo ($line); } fclose($file); ?> [root@localhost ~]# cat /var/www/html/marko3.php <?php exec ('wget http://www.example.com -O /tmp/example.html'); exec ('wget http://10.11.12.13:31254 -O /tmp/mail.html'); ?> IP 10.11.12.13 is a remote machine, with apache listening on tcp port 31254 and i can reach it with wget running under unconfined root account. My httpd booleans are: [root@localhost ~]# getsebool -a|grep http allow_httpd_anon_write --> off allow_httpd_mod_auth_ntlm_winbind --> off allow_httpd_mod_auth_pam --> off allow_httpd_sys_script_anon_write --> off httpd_builtin_scripting --> on httpd_can_check_spam --> off httpd_can_network_connect --> off httpd_can_network_connect_cobbler --> off httpd_can_network_connect_db --> off httpd_can_network_memcache --> off httpd_can_network_relay --> off httpd_can_sendmail --> off httpd_dbus_avahi --> off httpd_enable_cgi --> on httpd_enable_ftp_server --> off httpd_enable_homedirs --> off httpd_execmem --> off httpd_read_user_content --> off httpd_setrlimit --> off httpd_ssi_exec --> off httpd_tmp_exec --> off httpd_tty_comm --> on httpd_unified --> off httpd_use_cifs --> off httpd_use_gpg --> off httpd_use_nfs --> off named_bind_http_port --> off and semanage -o - gives: boolean -D boolean -1 httpd_builtin_scripting login -D login -a -s unconfined_u -r 's0-s0:c0.c1023' __default__ login -a -s unconfined_u -r 's0-s0:c0.c1023' root login -a -s system_u -r 's0-s0:c0.c1023' system_u user -D port -D interface -D node -D fcontext -D The problem is that opening marko1.php in browser gives me the html found on http://www.example.com and opening marko3.php produces the /tmp/example.html file on server with the html found on http://www.example.com The requests for http://10.11.12.13:31254/ both php's and wget-s, are not successful and are logged logged like: type=AVC msg=audit(1320370308.125:103): avc: denied { name_connect } for pid=1842 comm="wget" dest=31254 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket type=AVC msg=audit(1320370308.980:104): avc: denied { name_connect } for pid=1656 comm="httpd" dest=31254 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket mod_proxy is commented and not enabled (which is default in F15, AFAIK). Am I missing something or has the documentation missed this little fact? ;) -- Marko Uskokovic Mainstream d.o.o. www.mainstream.rs

2 2

Object Classes and kernel
by Artur Szymczak 04 Nov '11

04 Nov '11

Hi, how can kernel distinguishes objects in system and object in policy? I mean. How kernel know, that this allow rule is correct to /etc/passwd and not correct for /etc itself (as dir): allow httpd_t etc_t : file { ioctl read getattr lock open } ; Ok, it is written in policy, that it is a file, but it is only a object class. Is it defined somewher, that object class 'file' is file, and object class 'dir' is directory? How can I create new object class named foo, which will be usedd for named_pipe? Regards -- Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2 GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D http://CodzienneChodzenieZBogiem.blogspot.com/

4 3

Spamassassin / GPG Problem
by Arthur Dent 04 Nov '11

04 Nov '11

Hello all, I use Spamassassin on my server. It regularly downloads updated signatures and checks the download using GPG. Since I upgraded to selinux-policy-targeted-3.9.16-44.fc15.noarch this week I have been getting errors reported by Spamassassin: ========8<============================================================== error: GPG validation failed! The update downloaded successfully, but the GPG signature verification failed. channel: GPG validation failed, channel failed 02-Nov-2011 06:05:06: SpamAssassin: Update available, but download or extract failed ========8<============================================================== I also get the an SELinux AVC (full details below). What is the best way to deal with this? Thanks in advance... Mark ========8<============================================================== SELinux is preventing /usr/bin/gpg from read access on the file .spamassassin12765zsyG6Ftmp. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that gpg should be allowed read access on the .spamassassin12765zsyG6Ftmp file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep gpg /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:gpg_t:s0-s0:c0.c1023 Target Context system_u:object_r:spamd_tmp_t:s0 Target Objects .spamassassin12765zsyG6Ftmp [ file ] Source gpg Source Path /usr/bin/gpg Port <Unknown> Host mydomain.org.uk Source RPM Packages gnupg-1.4.11-3.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.16-44.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name troodos.org.uk Platform Linux mydomain.org.uk 2.6.40.6-0.fc15.i686.PAE #1 SMP Tue Oct 4 00:44:38 UTC 2011 i686 i686 Alert Count 2 First Seen Mon Oct 31 05:22:55 2011 Last Seen Wed Nov 2 06:05:06 2011 Local ID bb4e6159-04a3-4e8c-b5f5-f41c0ff80d56 Raw Audit Messages type=AVC msg=audit(1320213906.154:7990): avc: denied { read } for pid=12766 comm="gpg" name=".spamassassin12765zsyG6Ftmp" dev=sda5 ino=1058383 scontext=system_u:system_r:gpg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1320213906.154:7990): arch=i386 syscall=open success=no exit=EACCES a0=bfe78f49 a1=8000 a2=0 a3=bfe78f49 items=0 ppid=12765 pid=12766 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1070 comm=gpg exe=/usr/bin/gpg subj=system_u:system_r:gpg_t:s0-s0:c0.c1023 key=(null) Hash: gpg,gpg_t,spamd_tmp_t,file,read audit2allow #============= gpg_t ============== allow gpg_t spamd_tmp_t:file read; audit2allow -R #============= gpg_t ============== allow gpg_t spamd_tmp_t:file read;

3 3

Lexmark - I'm impressed
by Artur Szymczak 02 Nov '11

02 Nov '11

Hi, I just finished installation of my new printer at home: Lexmark Prospect Pro209 on F16rc4 (fresh install on my wife's netbook). I used drivers from lexmark (for Fedora 64bit) and... I saw this during installation: [quote] (...) ============================= Execute: /usr/bin/checkmodule -M -m -o /tmp/selfgz746922398/pkg/files/dbuspolicy.mod /tmp/selfgz746922398/pkg/files/dbuspolicy.te /usr/bin/checkmodule: loading policy configuration from /tmp/selfgz746922398/pkg/files/dbuspolicy.te /usr/bin/checkmodule: policy configuration loaded /usr/bin/checkmodule: writing binary representation (version 13) to /tmp/selfgz746922398/pkg/files/dbuspolicy.mod ============================= ============================= Execute: /usr/bin/semodule_package -o /tmp/selfgz746922398/pkg/files/dbuspolicy.pp -m /tmp/selfgz746922398/pkg/files/dbuspolicy.mod ============================= ============================= Execute: /usr/sbin/semodule -i /tmp/selfgz746922398/pkg/files/dbuspolicy.pp ============================= (...) ============================= Execute: /usr/bin/checkmodule -M -m -o /tmp/selfgz746922398/pkg/files/lxhcp.mod /tmp/selfgz746922398/pkg/files/lxhcp.te /usr/bin/checkmodule: loading policy configuration from /tmp/selfgz746922398/pkg/files/lxhcp.te /usr/bin/checkmodule: policy configuration loaded /usr/bin/checkmodule: writing binary representation (version 13) to /tmp/selfgz746922398/pkg/files/lxhcp.mod ============================= ============================= Execute: /usr/bin/semodule_package -o /tmp/selfgz746922398/pkg/files/lxhcp.pp -m /tmp/selfgz746922398/pkg/files/lxhcp.mod ============================= ============================= Execute: /usr/sbin/semodule -i /tmp/selfgz746922398/pkg/files/lxhcp.pp ============================= (...) [/quote] So i looked on this tw policy files: [code] $ cat dbuspolicy.te module printfilter 1.0; require { type unconfined_t; type cupsd_t; class unix_stream_socket connectto; }; #============= cupsd_t ============== allow cupsd_t unconfined_t:unix_stream_socket connectto; $ cat lxhcp.te module lxhcp 1.0; require { type howl_port_t; type cupsd_t; class udp_socket name_bind; } #============= cupsd_t ============== allow cupsd_t howl_port_t:udp_socket name_bind; [/code] It seems, that not everybody (vendors for software/hardware) are disabling SELinux. I checked printing in Enforcing mode and all works fine. Regards -- Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2 GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D http://CodzienneChodzenieZBogiem.blogspot.com/

1 0

SELinux on Android
by Mr Dash Four 01 Nov '11

01 Nov '11

Has this been done/implemented? I've come across quite a few attempts - all in the not-so-recent past, but don't like any of them. The most "promising" effort I could find was by Yuichi Nakamura (ynakam(a)hitachisoft.jp), Hitachi Software Engineering Co., Ltd dating about 5 years ago! This effort is described at http://elinux.org/images/a/a3/ELC2008_nakamura.pdf. Are there any better SELinux attempts/implementations done since then?

2 4

fixfiles, setfiles and restorecon
by Artur Szymczak 01 Nov '11

01 Nov '11

Hi, I'm wondering which command and when should I use. Yes, I read man, but it doesn't help. IMHO they do the same things. -- Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2 GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D http://CodzienneChodzenieZBogiem.blogspot.com/

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2011