selinux March 2013

selinux@lists.fedoraproject.org

18 participants
23 discussions

apache and setroubleshot policy oddities
by mark 14 Mar '13

14 Mar '13

CentOS 6.4 (probably not the current kernel) selinux-policy, selinux-policy-targetd 3.7.19-155.el6_3.14 And we're running SiteMinder from CA (and have *zero* control over that, don't get me started) unconfined_u:system_r:httpd_t:s0 apache <...> LLAWP /etc/httpd/conf/WebAgent.conf -APACHE22 apache root unconfined_u:object_r:httpd_log_t:s0 /var/log/httpd/agent.log So, why would I get AVCs, and running them through audit2allow gives me: #============= httpd_t ============== allow httpd_t httpd_log_t:file write; Why on earth can't something running as httpd_t write to a logfile of httpd_log_t in /var/log/httpd/? And then there's this... #============= setroubleshootd_t ============== allow setroubleshootd_t httpd_sys_script_t:dir read; allow setroubleshootd_t httpd_sys_script_t:file getattr; Shouldn't setroubleshootd have rights? mark

4 3

Looking for links: passenger & selinux
by mark 14 Mar '13

14 Mar '13

Gag. I hate passenger... This is CentOS 6.3 Does someone have a link to info on what selinux passenger context to set what files to? I see passenger set to lib_t, which I may have done a while back, but the current policy may be more picky. I've looked at the passenger_selinux manpage, and it doesn't suggest what they should be. The version of ruby my users are on is the old 1.8.7 enterprise, *not* installed from an rpm, so nothing's correct.... mark

2 2

setroubleshoot bug returns?
by mark 14 Mar '13

14 Mar '13

I just updated a system to the latest 6.3 (no CR), and I'm seeing setroubleshoot: [avc.ERROR] Plugin Exception catchall_boolean #012Traceback (most recent call last):#012 File "/usr/lib64/python2.6/site-packages/setroubleshoot/analyze.py", line 191, in analyze_avc#012 report = plugin.analyze(avc)#012 File "/usr/share/setroubleshoot/plugins/catchall_boolean.py", line 90, in analyze#012 man_page = self.check_for_man(b)#012 File "/usr/share/setroubleshoot/plugins/catchall_boolean.py", line 76, in check_for_man#012 man_page = name.split("_")[0] + "_selinux"#012AttributeError: 'tuple' object has no attribute 'split' which appears to be *exactly* Red Hat Bugzilla – Bug 518232, closed in rawhide on 2009-08-19. Has this crept back in? mark

3 4

staff_u unable to run ls in /var on one system
by Erinn Looney-Triggs 13 Mar '13

13 Mar '13

I have an odd problem. Users running as staff_u are unable to run ls in /var on one system only (though I haven't tested all of them). It is definetly an SELinux thing, setenforce 0, problem goes away, setenforce 1, problem returns. ausearch -m avc -ts now shows nothing. restorecon on /var yields nothing and the labels are the same from one system to the next. id -Z staff_u:staff_r:staff_t:s0-s0:c0.c1023 Same on both systems (this is set via IPA and SSSD) So I can't really figure out where the problem lies: ls -lZd /var drwxr-xr-x. root root system_u:object_r:var_t:s0 /var Any ideas? -Erinn

3 5

Re: selinux Digest, Vol 109, Issue 10
by Jean-David Beyer 13 Mar '13

13 Mar '13

On 03/13/2013 08:05 AM, auto-reply from ivan.makale(a)ngi.it wrote: > Old email address, no longer used. > -- > selinux mailing list > selinux(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/selinux > What is so funny about this (his autoresponder not sending out the auto response flagged as "bulk") is that as a result, he gets the autoresponse, to which he autoresponds ...

1 0

Whats this sys_admin capability
by Tony Molloy 11 Mar '13

11 Mar '13

Hi, I'm seeing messages similar to the following for a number of services on a recently updated Centos 6.4 system. I can generate local policies for each service but is there some boolean which can affecdt this sys_admin capability. Mar 9 12:45:10 youngmunster setroubleshoot: SELinux is preventing /usr/sbin/nmbd from using the sys_admin capability. For complete SELinux messages. run sealert -l 5a37dd50-b60c-4a1c-b97d-6d62baeee33a [root@youngmunster ~]# sealert -l 5a37dd50-b60c-4a1c-b97d-6d62baeee33a SELinux is preventing /usr/sbin/nmbd from using the sys_admin capability. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that nmbd should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep nmbd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Thanks, Tony

2 1

SELinux is preventing /usr/sbin/apcupsd (deleted) from read access on the file LCK...
by Garry Williams 10 Mar '13

10 Mar '13

I recently started seeing this: SELinux is preventing /usr/sbin/apcupsd (deleted) from read access on the file LCK... See https://bugzilla.redhat.com/show_bug.cgi?id=917878 . -- Garry T. Williams

2 2

Re: setroubleshoot bug returns?
by mark 08 Mar '13

08 Mar '13

Trevor Hemsley wrote: > On 08/03/13 16:44, m.roth(a)5-cent.us wrote: >> Trevor Hemsley wrote: >>> On 08/03/13 15:05, m.roth(a)5-cent.us wrote: >>>> This is CentOS - 6.4 is still in q/a. >>> >>> Actually not, you can get access to it now via >>> >>> yum --enablerepo=extras install centos-release-cr >>> yum update >>> >>> First one installs the CR repo and it contains all of 6.4 except the >>> centos-release package that updates /etc/redhat-release >>> >> What part of "I have to negotiate with users as to when I can update >> their production and developments systems to a new release, which can >> take up to a month or more" was I not clear about? >> > Well, a) you didn't say that at all in this thread and b) sorry for > trying to be helpful. Remind me not to bother next time. Oh, sorry, I *hate* the way the selinux list is configured, so that it replies to an *individual*, and cc's the list, and if you don't remember (I have no other lists I'm on, or have been on in for the decades I've been online), you can miss that it only went that way. Other point: thinking about this over lunch, it strikes me that this looks like a bug in the code, not in a policy, since it explicitly refers to the file catchall_boolean.py. mark

1 0

[PATCH 1/2] iptables (userspace): add secmark match
by Mr Dash Four 05 Mar '13

05 Mar '13

This patch is part of the userspace changes needed for the "secmark" match in iptables. Signed-off-by: Mr Dash Four <mr.dash.four(a)googlemail.com> --- extensions/libxt_secmark.c | 100 ++++++++++++++++++++++++++++++++++ extensions/libxt_secmark.man | 22 ++++++++ include/linux/netfilter/xt_secmark.h | 24 ++++++++ 3 files changed, 146 insertions(+) create mode 100644 extensions/libxt_secmark.c create mode 100644 extensions/libxt_secmark.man create mode 100644 include/linux/netfilter/xt_secmark.h diff --git a/extensions/libxt_secmark.c b/extensions/libxt_secmark.c new file mode 100644 index 0000000..92ecc6b --- /dev/null +++ b/extensions/libxt_secmark.c @@ -0,0 +1,100 @@ +/* + * Shared library add-on to iptables to add secmark match support. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 (or + * any later at your option) as published by the Free Software Foundation. + */ +#include <stdbool.h> +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include <getopt.h> +#include <xtables.h> + +#include <linux/netfilter/x_tables.h> +#include <linux/netfilter/xt_secmark.h> + +#define PFX "secmark match: " + +enum { + O_SELCTX = 0, +}; + +#define s struct xt_secmark_match_info +static const struct xt_option_entry secmark_opts[] = { + {.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING, + .flags = XTOPT_MAND|XTOPT_PUT, XTOPT_POINTER(s, secctx)}, + XTOPT_TABLEEND, +}; +#undef s + +static void secmark_help(void) +{ + printf("secmark match options:\n" + " --selctx STRING SELinux security context\n"); +} + +static void secmark_parse(struct xt_option_call *cb) +{ + struct xt_secmark_match_info *info = cb->data; + + xtables_option_parse(cb); + switch (cb->entry->id) { + case O_SELCTX: + if (strchr(cb->arg, '\n') != NULL) + xtables_error(PARAMETER_PROBLEM, PFX + "new lines not allowed in --selctx"); + info->mode = SECMARK_MODE_SEL; + break; + } +} + +static void +secmark_print_selctx(const struct xt_secmark_match_info *info, char *str) +{ + switch (info->mode) { + case SECMARK_MODE_SEL: + printf(" %sselctx %s", str, info->secctx); + break; + + default: + xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); + } +} + +static void secmark_print(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + const struct xt_secmark_match_info *info = + (struct xt_secmark_match_info *)match->data; + + secmark_print_selctx(info, ""); +} + +static void secmark_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_secmark_match_info *info = + (struct xt_secmark_match_info *)match->data; + + secmark_print_selctx(info, "--"); +} + +static struct xtables_match secmark_match = { + .family = NFPROTO_UNSPEC, + .name = "secmark", + .version = XTABLES_VERSION, + .revision = 0, + .size = XT_ALIGN(sizeof(struct xt_secmark_match_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_secmark_match_info)), + .help = secmark_help, + .print = secmark_print, + .save = secmark_save, + .x6_parse = secmark_parse, + .x6_options = secmark_opts, +}; + +void _init(void) +{ + xtables_register_match(&secmark_match); +} diff --git a/extensions/libxt_secmark.man b/extensions/libxt_secmark.man new file mode 100644 index 0000000..b38e32c --- /dev/null +++ b/extensions/libxt_secmark.man @@ -0,0 +1,22 @@ +The secmark match is used to match the security mark value +associated with a packet. +.PP +Only one option is available with this match which needs +to be specified: +.TP +\fB\-\-selctx\fP \fIselctx\fP +This option selects the SELinux security context (\fBselctx\fP) to +be used for packet matching. This security context needs to have already +been assigned to a packet by using the \fBSECMARK\fP target. +.PP +For this extension to be used, the appropriate SELinux support needs +to be installed and present in the Linux kernel. +.PP +Examples: +.IP +iptables \-I INPUT \-p icmp \-\-icmp-type 3 \-m secmark \-\-selctx +system_u:object_r:dns_packet_t:s0 \-j ACCEPT +.IP +iptables \-I OUTPUT \-m secmark \-\-selctx +system_u:object_r:ssh_packet_t:s0 \-j DROP + diff --git a/include/linux/netfilter/xt_secmark.h b/include/linux/netfilter/xt_secmark.h new file mode 100644 index 0000000..c74a35d --- /dev/null +++ b/include/linux/netfilter/xt_secmark.h @@ -0,0 +1,24 @@ +#ifndef _XT_SECMARK_MATCH_H +#define _XT_SECMARK_MATCH_H + +#include <linux/types.h> + +/* + * Header file for iptables xt_secmark match + * + * This is intended for use by various security subsystems (but not + * at the same time). + * + * 'mode' refers to the specific security subsystem which the + * packets are being marked for. + */ +#define SECMARK_MODE_SEL 0x01 /* SELinux */ +#define SECMARK_SECCTX_MAX 256 + +struct xt_secmark_match_info { + __u8 mode; + __u32 secid; + char secctx[SECMARK_SECCTX_MAX]; +}; + +#endif /* _XT_SECMARK_MATCH_H */

1 0

[PATCH 0/2] iptables: add secmark match
by Mr Dash Four 05 Mar '13

05 Mar '13

The secmark match is used to match the security mark value associated with a packet. For this extension to be available, the appropriate SELinux support needs to be installed and present in the Linux kernel. Examples: iptables -I INPUT -p icmp --icmp-type 3 -m secmark --selctx system_u:object_r:dns_packet_t:s0 -j ACCEPT iptables -I OUTPUT -m secmark --selctx system_u:object_r:ssh_packet_t:s0 -j DROP Mr Dash Four (2): iptables (userspace): add secmark match iptables (kernel): add secmark match

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2013