selinux January 2013

selinux@lists.fedoraproject.org

24 participants
34 discussions

New to this list, and new to SELinux.
by Jean-David Beyer 22 Jan '13

22 Jan '13

I have been running Red Hat Enterprise Linux since 2004, starting with RHEL 3. Later I upgraded to RHEL 5. When I needed a new computer, I got RHEL 6 to run on it. RHEL 6 runs with SELinux turned on by default and it is presenting me with oneproblem, but my /var/log/messages file indicates I have _a lot_ of others. Now according to Red Hat's documentation, I should report these as bugs, but that seems a bit extreme if it is just a misconfiguration problem. > Missing Type Enforcement rules are usually caused by bugs in SELinux > policy, and should be reported in Red Hat Bugzilla. For Red Hat > Enterprise Linux, create bugs against the Red Hat Enterprise Linux > product, and select the selinux-policy component. Include the output > of the audit2allow -w -a and audit2allow -a commands in such bug > reports. Should I really do that? And if so, just how? How do I specify the problem in a way to be useful? One problem is that I have a shell script, run by cron that sends an email with mailx to me (on the same machine). That means it is run by root. And the mail fails when cron runs it. It is adding an attachment and SELinux says it is denied. Now when I run it myself, but logged in as root, the e-mail works. I do not specifically want to solve that problem here, but I do need to now how to change the system policy file, wherever it is, so I do not need to continually make little ones, say by running stuff like this: # grep boinc_client /var/log/audit/audit.log | audit2allow -M myboinc # semodule -i myboinc.pp I also wish to make the change, if they are really required, permanent. Any advice?

4 12

Backups with rsync totally broken in Fedora 18
by David Highley 21 Jan '13

21 Jan '13

Upgraded a test box to Fedora 18 and have tried to get rsync backups to it working. Looked at many discussions about backing up in a selinux environment and all discussions seemed to be incomplete. Most indicate you should not keep selinux labels, but none of those discussion indicate what options to change. After working on a thousand line policy file I'm beginning to think you just want to completely turn off any audit of the rsync domain. Is this how we should approach backups? If you do not preserve selinux labels what should the backup location get labeled to? I'm surprised as long as selinux has been in use that a template with details has not been defined for this. By the way I had just submitted an enhancement bug report for rsync with examples of getting it to function with systemd control.

3 9

SELinux: avc: denied { associate }
by Napoleon Quashie 21 Jan '13

21 Jan '13

This has been "doing my head in" as the British will say. I've been battling it for days now. A post to Fedora forums and irc hasn't helped. You guys are my last resort. It goes like so: 1. type=AVC msg=audit(1358529889.481:315): avc: denied { associate } for pid=1522 comm="httpd"name="access.log" scontext =system_u:object_r:httpd_sys_rw_content_t:s0tcontext =system_u:object_r:httpd_sys_content_t:s0 tclass=filesystem 2. 3. Was caused by: 4. Unknown - would be allowed by active policy 5. Possible mismatch between this policy and the one under which the audit message was generated. 6. 7. Possible mismatch between current in-memory boolean settings vs. permanent ones. 8. ------------------------------------------------------------------------------------------------ 9. 10. <VirtualHost *:80> 11. ServerAdmin webmaster@localhost 12. ServerName lab.dev 13. 14. DocumentRoot /shared/www/lab/public 15. 16. <Directory /shared/www/lab/public/> 17. Options Indexes FollowSymLinks 18. AllowOverride All 19. Order allow,deny 20. Allow from all 21. </Directory> 22. 23. # Custom log file locations 24. LogLevel warn 25. ErrorLog /shared/www/lab/logs/error.log 26. CustomLog /shared/www/lab/access.log combined 27. 28. </VirtualHost> 29. ------------------------------------------------------------------------------------------ 30. /etc/fstab 31. ---------- 32. # 33. # /etc/fstab 34. # Created by anaconda on Tue Jan 15 21:01:00 2013 35. # 36. # Accessible filesystems, by reference, are maintained under '/dev/disk' 37. # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info 38. # 39. /dev/mapper/fedora-root / ext4 defaults 1 1 40. UUID=f92ec976-f49c-496d-be24-2bd7391eec2e /boot ext4 defaults 1 2 41. /dev/mapper/fedora-home /home ext4 defaults 1 2 42. /dev/mapper/fedora-swap swap swap defaults 0 0 43. /dev/disk/by-uuid/E0D8317FD83154CE /windows auto nosuid,nodev,nofail,x-gvfs-show,x-gvfs-name=Windows 0 0 44. /dev/disk/by-uuid/D0D6BF93D6BF7874 /shared auto context= "system_u:object_r:httpd_sys_content_t:s0" 0 0 45. ======================================================================================================= 46. 47. /shared is an ntfs partition and /shared/www/public is the root of the site lab.dev Thanks for any assistance.

4 3

[ANN] segatex-7.840 released. (segatex is a third party SELinux GUI tool)
by Shintaro Fujiwara 20 Jan '13

20 Jan '13

segatex-7.840 released ! http://sourceforge.net/projects/segatex/?source=navbar I have fixed refpolicy analyzer, but it's not completed yet so I will fix it in near future. Interfaces and macros are mixed in the name of interface. But, you can understand little by little refpolicy just hitting the buttons. Those who wants to understand how interfaces work, please see /usr/share/segatex/raw_if_files/*.if_raw It's already there, but you can break down .if files pushing breakif.sh. It will take a long time to break all the interfaces down especially in contrib directory. /////////////////////////////////////////////////////////////////////////////////////// segatex is a SELinux third-party GUI tool. See tresys page here. http://userspace.selinuxproject.org/trac/wiki/SelinuxTools /////////////////////////////////////////////////////////////////////////////////////// Enjoy !

1 0

Context for Xvnc?
by Ian Pilcher 18 Jan '13

18 Jan '13

I just went through the process of setting up Xvnc with XDMCP on F18, and I ran into an SELinux-related issue. I have configured KDM to accept XDMCP queries from localhost, and I'm starting Xvnc with the following systemd unit file: /etc/systemd/system/xvnc@.service: [Unit] Description=VNC remote display %I After=syslog.target [Service] Type=simple User=nobody ExecStart=/usr/bin/Xvnc -SecurityTypes None -query 127.0.0.1 %i [Install] WantedBy=multi-user.target When I first did this, KDM was unable to talk to Xvnc: /var/log/kdm.log: /usr/bin/xrdb: Permission denied /usr/bin/xrdb: Can't open display ':10' kdmgreet: cannot connect to X server :10 /var/log/audit/audit.log: type=AVC msg=audit(1357179264.974:426): avc: denied { connectto } for pid=11481 comm="kdm_greet" path=002F746D702F2E5831312D756E69782F583130 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket The problem was that Xvnc was running as initrc_t, because /usr/bin/Xvnc was labeled as bin_t. Changing the label to xserver_exec_t makes the process run as xserver_t, KDM is able to connect to the server, and everything appears to be working. Is there a reason I'm not seeing that the context of /usr/bin/Xvnc should *not* be changed to xserver_exec_t? If not, I'll go ahead and BZ this. Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com Sometimes there's nothing left to do but crash and burn...or die trying. ========================================================================

3 7

Invalid security context messages
by Anamitra Dutta Majumdar 18 Jan '13

18 Jan '13

We have removed the unconfined domain from our system based on RHEL6. After that when we run audit2allow we see the following messages [root@vos-cm148 ~]# audit2allow -a libsepol.context_from_record: invalid security context: "sysadm_u:system_r:useradd_t:s0-s0:c0.c1023" libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert sysadm_u:system_r:useradd_t:s0-s0:c0.c1023 to sid Are these harmful? What do they mean and how can we get rid of them. Thanks, Anamitra

2 3

sechecker tool not working
by Anamitra Dutta Majumdar 18 Jan '13

18 Jan '13

We are trying to run the sechecker tool on one of our boxes based on RHEL6 and get the following error.. [root@vos-cm142 ~]# sechecker -m types_wo_allow -v Using policy: /etc/selinux/targeted/policy/policy.24 Using file contexts: /etc/selinux/targeted/contexts/files/file_contexts ERROR: Cannot get avrules: Neverallow rules requested but not available ERROR: Cannot get avrules: Neverallow rules requested but not available ERROR: Cannot get avrules: Neverallow rules requested but not available ERROR: Cannot get avrules: Neverallow rules requested but not available Is this a known issue. Thanks, Anamitra

2 1

sendmail and server.lock
by mark 17 Jan '13

17 Jan '13

We have a server in permissive, thank you, so this is just an annoyance, but I want to make it go away. Centos 6.3, current torque 2.5.7-9.el6 It's the head node of a torque cluster. I found someone, while googling, who describes the same error, and presumably the same action resulting in the same result. He writes: Excerpt: We're running Torque 2.3.7 on a central Torque server running RHEL6.3 OS (this old version of Torque is *required* for stable use with the Maui scheduler, see an older thread in this list). We're seeing the following syslog message every time a job completes and sends an E-mail message to the user: setroubleshoot: SELinux is preventing /usr/sbin/sendmail.sendmail from write access on the file /var/spool/torque/server_priv/server.lock. SELinux is enabled in permissive mode, so this is not a severe problem, but it's still a nuisance to have extraneous syslog messages. I prefer having SELinux enabled in order to log security related events. I looked at the Torque code server/svr_mail.c which opens a pipe to execute Sendmail, writes some data and then closes the pipe. The pbs_server's lockfile filename is never written to the Sendmail pipe, so why on earth would SELinux complain about Sendmail trying to write to that lockfile?? Could it be because svr_mail.c closes the pipe by fclose(outmail) in stead of pclose(outmail) as is done in the Torque 2.5 code? --- end excerpt --- So, what can I do to make selinux shut up about this? server.lock is in /var/lib/torque/server_priv, and shows as ll -Z /var/lib/torque/server_priv/ drwxr-x---. root root system_u:object_r:var_lib_t:s0 ./ drwxr-xr-x. root root system_u:object_r:var_lib_t:s0 ../ <...> -rw-------. root root system_u:object_r:var_lib_t:s0 server.lock mark

1 0

zoneminder & nfs, redux
by mark 16 Jan '13

16 Jan '13

Hi. I've tried relabelling the entire system after a roboot, and I'm still getting the AVCs when motion is trying to do things with files it's creating/removing on an NFS-mounted directory. Fedora 17, fully updated, kernel 3.6.10-2.fc17.x86_6 selinux-policy 3.10.0-161.fc17 selinux-policy-targeted 3.10.0-161.fc17 mark

3 3

No default labels, is it intentional?
by Göran Uddeborg 15 Jan '13

15 Jan '13

I'm running a "restorecon -n -R -v /" from cron once a month, just to be careful and know what is happening. Last night when it ran, I got a lot of error messages like these: restorecon: Warning no default label for /dev/pts/3 and restorecon: Warning no default label for /tmp/efs0YYVa79.html There were a couple for things in /dev, and lots of them for things in /tmp. I have lately been upgrading bit by bit to Fedora 18 (the beta, strictly speaking, since the final release isn't officially out at the time of this writing), so I assume the new message is related to these upgrades. But why? When I list file contexts, I see rules like this: /dev/pts(/.*)? all files <<None>> So I guess it is not a simple mistake. But what is the reason? Why don't some /dev entries, and almost the entire /tmp directory, have any default context any more?

4 15

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2013