selinux July 2012

selinux@lists.fedoraproject.org

15 participants
11 discussions

Proprietary telnet daemon fails login when SELinux is enabled
by Dave Stoner 01 Aug '12

01 Aug '12

I apologise in advance for asking questions which I feel I should have been able to answer from sources on the internet. If you could possibly give me some pointers on where to look it would be so much appreciated. My system is centos 6.2 - Linux MyHostName 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64 x86_64 x86_64 GNU/Linux SELinux mode is set 'enforced'. I have a proprietary telnet daemon which upon a telnet to port 52000, is started OK when SELinux is disabled. But when it is enabled the same telnet results in /var/log/audit/audit.log showing: type=USER_LOGIN msg=audit(1343048458.345:69): user pid=2536 uid=0 auid=799 ses=7 subj=system_u:system_r:inetd_t:s0-s0:c0.c1023 msg='op=login id=799 exe="/bin/login" hostname=0.0.0.0 addr=0.0.0.0 termi nal=pts/2 res=success' A normal telnet gives a message similar to above, my telnet adds the following: type=AVC msg=audit(1343048458.353:70): avc: denied { entrypoint } for pid=2543 comm="login" path="/bin/bash" dev=sda2 ino=135083 scontext=unconfined_u:system_r:qmail_tcp_env_t:s0-s0:c0.c1023 tconte xt=system_u:object_r:shell_exec_t:s0 tclass=file I believe I can create a policy to overcome this using audit2allow, i.e. it comes up with: module mypola 1.0; require { type qmail_tcp_env_t; type shell_exec_t; class file entrypoint; } #============= qmail_tcp_env_t ============== allow qmail_tcp_env_t shell_exec_t:file entrypoint; But it seems to me what I ought to be doing is somehow to get my daemon to run with a domain of 'remote_logon_t' as is used by the standard telnet daemon, as here: type=USER_LOGIN msg=audit(1343058924.928:212): user pid=3759 uid=0 auid=799 ses=29 subj=system_u:system_r:remote_login_t:s0-s0:c0.c1023 msg='op=login id=799 exe="/bin/login" hostname=localhost addr=:: 1 terminal=pts/2 res=success' This is unfamiliar territory and any hints or pointers would really be appreciated. Dave. Dave Stoner Principal Systems Architect Northgate Reality Direct: +44 (0)1442 272071 - VPN: 872 2071 www.northgate-is.com/reality <http://www.northgate-is.com/reality> ----------------------------------------------------------------------------------------- This email is sent on behalf of Northgate Information Solutions Limited and its associated companies ("Northgate") and is strictly confidential and intended solely for the addressee(s). If you are not the intended recipient of this email you must: (i) not disclose, copy or distribute its contents to any other person nor use its contents in any way or you may be acting unlawfully; (ii) contact Northgate immediately on +44 (0)1442 232424 quoting the name of the sender and the addressee then delete it from your system. Northgate has taken reasonable precautions to ensure that no viruses are contained in this email, but does not accept any responsibility once this email has been transmitted. You should scan attachments (if any) for viruses. Northgate Information Solutions Limited. Registered in England no. 06442582 - Northgate Information Solutions UK Limited. Registered in England no. 968498 - NorthgateArinso UK Limited .Registered in England no. 1587537 - Moorepay Limited. Registered in England no. 891686 - First Business Support Limited. Registered in England no. 3056267 - Registered Office: Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead, Hertfordshire HP2 4NW Northgate Managed Services Limited (NI). Registered in Northern Ireland no. NI032979 - LearnServe Limited (NI). Registered in Northern Ireland no. NI043825 Registered Office: Hillview House, 61 Church Road, Newtownabbey, Co. Antrim, BT36 7LQ -----------------------------------------------------------------------------------------

4 4

relabel after policy update
by Vadym Chepkov 31 Jul '12

31 Jul '12

Hi, Once n a while I find mislabeled files on the file system. Since I never touched them, I assume it is due to the policy change. What is the best practice, shall I relabel the system every time selinux-policy-targeted is updated? For example: # restorecon -vR /usr/ restorecon reset /usr/libexec/sesh context system_u:object_r:bin_t:s0->system_u:object_r:shell_exec_t:s0 # restorecon -vR /var restorecon reset /var/lib/rsyslog context system_u:object_r:var_lib_t:s0->system_u:object_r:syslogd_var_lib_t:s0 Regards, Vadym

2 1

freshclam F17
by Frank Murphy 27 Jul '12

27 Jul '12

freshclam email from cron daemon Sub: Cron <root@foo> /usr/share/clamav/freshclam-sleep Failed to get D-Bus connection: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus) ~$ sudo freshclam works without error. all clamav booleans are on Uncertain if I need the following exim booleans on: exim_manage_user_files exim_read_user_files selinux-policy-targeted-3.10.0-140.fc17.noarch -- Regards, Frank "Jack of all, fubars"

3 4

Fwd: Proprietary telnet daemon fails login when SELinux is enabled
by Maurizio D'Antonio 26 Jul '12

26 Jul '12

Hi, Dave If I understand your problem you need add this port 52000 in the ports.local file for inherit the correct selinux context. The command is: root@localhost # semanage port -a -t telnetd_port_t -p tcp 52000 and probably you need enable the appropriate boolean because you have a denied { entrypoint } for qmail_t domain. Try >>> Maurizio D'Antonio ___________________________________________ H A R D E N I X™ - (Secure by Default) Mobile: +39 331 4440754 FAX: +39 08621960432 Web: www.kernelz.org | www.bylinux.org > 2012/7/26 Dave Stoner <dave.stoner(a)northgate-is.com>: > I apologise in advance for asking questions which I feel I should have been > able to answer from sources on the internet. If you could possibly give me > some pointers on where to look it would be so much appreciated. > > > > My system is centos 6.2 – > > Linux MyHostName 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 > > GMT 2011 x86_64 x86_64 x86_64 GNU/Linux > > > > SELinux mode is set ‘enforced’. > > > > I have a proprietary telnet daemon which upon a telnet to port 52000, is > started OK when SELinux is disabled. But when it is enabled the same telnet > results in /var/log/audit/audit.log showing: > > > > type=USER_LOGIN msg=audit(1343048458.345:69): user pid=2536 uid=0 auid=799 > ses=7 subj=system_u:system_r:inetd_t:s0-s0:c0.c1023 msg='op=login id=799 > exe="/bin/login" hostname=0.0.0.0 addr=0.0.0.0 termi > > nal=pts/2 res=success' > > > > A normal telnet gives a message similar to above, my telnet adds the > following: > > > > type=AVC msg=audit(1343048458.353:70): avc: denied { entrypoint } for > pid=2543 comm="login" path="/bin/bash" dev=sda2 ino=135083 > scontext=unconfined_u:system_r:qmail_tcp_env_t:s0-s0:c0.c1023 tconte > > xt=system_u:object_r:shell_exec_t:s0 tclass=file > > > > I believe I can create a policy to overcome this using audit2allow, i.e. it > comes up with: > > > > module mypola 1.0; > > > > require { > > type qmail_tcp_env_t; > > type shell_exec_t; > > class file entrypoint; > > } > > > > #============= qmail_tcp_env_t ============== > > allow qmail_tcp_env_t shell_exec_t:file entrypoint; > > > > But it seems to me what I ought to be doing is somehow to get my daemon to > run with a domain of ‘remote_logon_t’ as is used by the standard telnet > daemon, as here: > > > > type=USER_LOGIN msg=audit(1343058924.928:212): user pid=3759 uid=0 auid=799 > ses=29 subj=system_u:system_r:remote_login_t:s0-s0:c0.c1023 msg='op=login > id=799 exe="/bin/login" hostname=localhost addr=:: > > 1 terminal=pts/2 res=success' > > > > This is unfamiliar territory and any hints or pointers would really be > appreciated. > > > > Dave. > > > > > > Dave Stoner > > Principal Systems Architect > Northgate Reality > > Direct: +44 (0)1442 272071 - VPN: 872 2071 > > www.northgate-is.com/reality > > > > > ________________________________ > > This email is sent on behalf of Northgate Information Solutions Limited and > its associated companies ("Northgate") and is strictly confidential and > intended solely for the addressee(s). > > If you are not the intended recipient of this email you must: (i) not > disclose, copy or distribute its contents to any other person nor use its > contents in any way or you may be acting unlawfully; (ii) contact Northgate > immediately on +44 (0)1442 232424 quoting the name of the sender and the > addressee then delete it from your system. > > Northgate has taken reasonable precautions to ensure that no viruses are > contained in this email, but does not accept any responsibility once this > email has been transmitted. You should scan attachments (if any) for > viruses. > > Northgate Information Solutions Limited. Registered in England no. 06442582 > - Northgate Information Solutions UK Limited. Registered in England no. > 968498 - NorthgateArinso UK Limited. Registered in England no. 1587537 - > Moorepay Limited. Registered in England no. 891686 - First Business > Support Limited. Registered in England no. 3056267 - Registered Office: > Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead, > Hertfordshire HP2 4NW > > Northgate Managed Services Limited (NI). Registered in Northern Ireland > no. NI032979 - LearnServe Limited (NI). Registered in Northern Ireland > no. NI043825 Registered Office: Hillview House, 61 Church Road, > Newtownabbey, Co. Antrim, BT36 7LQ > > ________________________________ > > > -- > selinux mailing list > selinux(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/selinux

1 0

dovecot denials
by Vadym Chepkov 24 Jul '12

24 Jul '12

Hi, man dovecot_selinux doesn't show any booleans and yet I get the following AVC, which in my opinion should be allowed: ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC msg=audit(1343002203.689:153237): avc: denied { write } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676 scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC msg=audit(1343002203.689:153238): avc: denied { open } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC msg=audit(1343002203.689:153238): avc: denied { read write } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ---- selinux-policy-targeted-3.7.19-155.el6_3.noarch Have I missed something? Thanks, Vadym

3 5

Re: ./autorelabel
by mark 20 Jul '12

20 Jul '12

Daniel J Walsh wrote: > On 07/19/2012 11:18 AM, m.roth(a)5-cent.us wrote: >> Daniel J Walsh wrote: >>> On 07/19/2012 11:03 AM, m.roth(a)5-cent.us wrote: >>>> >>>> I updated a CentOS system yesterday from 6.2 to 6.3. I saw it update >>>> selinux-policy-targeted (I think it was) and several hours later, it >>>> still hadn't gotten to the next package; looking, it appeared to be >>>> running a restorecon. I killed it, and redid the update. >>>> >>>> For other reasons, it didn't reboot. I brought it up under the most >>>> recent previous kernel, it did an fsck on a 2T drive... then it's been >>>> running autorelabel for at least an hour and a half, and I have no >>>> idea how much longer it will be. It's longer than fsck. >>>> >>>> This is a backup server, which uses hardlinks to save space. >>>> >>>> You may not consider this a bug, but it certainly makes selinux close >>>> to unusable in anything resembling a working environment. >>>> >>> If you have a volume with a huge number of files on it, you could mount >>> it with a context option and this will prevent restorecon from entering >>> the volume for relabel. Otherwise an autorelabel will attempt to read >>> the context on ever file on the computer and "fix" it. <snip> >> But still, the fact that it takes that long is what I'm griping about. >> If I'm doing an fsck -c, to check for bad blocks, I can understand why it >> takes forever on 2T and 3T drives; but for this, where there are some >> significantly smaller number of files than blocks, I still see that as a >> problem. > > Right when SELinux policy is updated it attempts to find the least > possible changes of labeling between the old labeling and the new labeling > (fixfiles -C filecontext.pre restore) In some cases this could get as high as > restorecon -R -v /usr or restorecon -R -v /var which seems to be what you saw. As a datapoint, it's now been relabelling for at least three or three and a half hours. As I noted above, I believe that there are significantly fewer files on this f/s than there are physical blocks that an fsck -c would check. Therefore, I suggest to you that you folks need to revisit your code, and look at speed optimizations. mark

3 2

./autorelabel
by mark 19 Jul '12

19 Jul '12

Folks, I updated a CentOS system yesterday from 6.2 to 6.3. I saw it update selinux-policy-targeted (I think it was) and several hours later, it still hadn't gotten to the next package; looking, it appeared to be running a restorecon. I killed it, and redid the update. For other reasons, it didn't reboot. I brought it up under the most recent previous kernel, it did an fsck on a 2T drive... then it's been running autorelabel for at least an hour and a half, and I have no idea how much longer it will be. It's longer than fsck. This is a backup server, which uses hardlinks to save space. You may not consider this a bug, but it certainly makes selinux close to unusable in anything resembling a working environment. mark

2 1

Out of Memory & Relabeling
by Jorge Fábregas 11 Jul '12

11 Jul '12

Hi, I've been running a minimally configured CentOS VM (with 256MB of memory). This morning I upgraded to 6.3 and prior to rebooting I created /.autorelabel which caused the following errors: http://imagebin.org/220184 This looks similar to: https://bugzilla.redhat.com/show_bug.cgi?id=633807 ...albeit for Fedora 16. I'm not sure if I should open a bugzilla as I'm running a VM in a non-supported configuration (512MB is the minimum suggested). I remember I even couldn't perform the installation with 256MB (Anaconda didn't allowed it so I had to increase it to 512MB). After installation I lowered the memory back to 256MB. Are the F16 changes to handle this ever coming to RHEL6 or will it be for RHEL7? Thanks, Jorge

4 14

FC17 and setroubleshoot
by mark 03 Jul '12

03 Jul '12

I have a couple of systems I've just upgraded from FC15 to FC17. I installed setroubleshoot and setroubleshoot-server. FC17 is obviously too new for an old fart like me - I can't find any normal way to start setroubleshootd. Nothing in /etc/init.d.... mark

3 6

Rawhide SELinux issues
by Paul Howarth 03 Jul '12

03 Jul '12

I have a Rawhide VM on which I'm seeing some strange issues. Firstly, I'm getting some AVCs that I don't understand and can't get rid of using audit2allow: type=AVC msg=audit(1341327661.200:69): avc: denied { 0x10 } for pid=537 comm="sssd_nss" capability=36 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability2 (audit2allow doesn't output anything for this) Secondly, I'm seeing denials for kernel_dgram_send for a wide variety of domains: kernel_dgram_send(NetworkManager_t) kernel_dgram_send(audisp_t) kernel_dgram_send(auditd_t) kernel_dgram_send(avahi_t) kernel_dgram_send(chronyd_t) kernel_dgram_send(dhcpc_t) kernel_dgram_send(dnsmasq_t) kernel_dgram_send(ftpd_t) kernel_dgram_send(modemmanager_t) kernel_dgram_send(nfsd_t) kernel_dgram_send(rpcd_t) kernel_dgram_send(sendmail_t) kernel_dgram_send(setroubleshootd_t) kernel_dgram_send(smf_spf_milter_t) kernel_dgram_send(sshd_t) kernel_dgram_send(sssd_t) kernel_dgram_send(system_dbusd_t) kernel_dgram_send(systemd_tmpfiles_t) Is this something that needs adding to a basic domain template? Or should I not be getting these? Paul.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2012