selinux June 2013

selinux@lists.fedoraproject.org

12 participants
7 discussions

Bootup error with Selinux +F15
by magina antimage 31 Jul '13

31 Jul '13

Hi, i have tried disabling SElinux ,because i didnt had selinux module enabled in my kernel. i have tried changing /etc/selinux/config: from SELINUX=permissive to SELINUX=disabled but still i get error "Failed to load SELinux policy." during bootup i have referred to "https://bugzilla.redhat.com/show_bug.cgi?id=692573 " and tried to solve this problem, but no positive results also sometimes i get I/O errors on my hard disk (during boot) after one or two boots . i am not sure whether its because of SElinux or not,but while searching this I/O error i came across few cases where these I/O errors were because of SElinux policies. other details: arch:x86 selinux version:libselinux-2.0.99-4.fc15.i686

7 19

Sharing a network port between types
by Tim Verhoeven 29 Jun '13

29 Jun '13

Hello, I'm having a interresting SELinux problem that I can't figure out how to solve. The context: This is on a server running in our DMZ and it is providing file transfer services to our client using different protocols. The machine has a system IP and a service IP. The service IP is used to receive all customer traffic (a external IP is NAT'ed to the service IP by the firewall). The system IP is used by us to do all management. We first setup FTPS access over the regular FTP ports, but as most of you know FTP is not the most firewall friendly protocol because the need of a seperate data channel and using encryption prevents firewalls to open up the needed port automatically. Se we also started to setup SFTP access to the same repository. We initially tried to do this using the regular OpenSSH setup, but the way OpenSSH does chroot'ing (we enable chroot in all setups) is not compatible with the way we have setup our data repository. So we switched to using ProFTPD for the SFTP service. This of course means that we have bind OpenSSH to the internal system IP on port 22 and ProFTPD to the service IP also on port 22. The problem: The problem is that I cannot get SELinux to allow the use of port 22 by these 2 daemons which run under different types (sshd_t & ftpd_t). I can use the semanage command to allow one type to use port 22, but not both at the same time. I use this command: semanage port -m -t ssh_port_t -p tcp 22 Since this is a system accessible on the internet and because of the protocols used I ofcourse do not want to disable SELinux here. So how can I allow SELinux to let both openssh and proftpd use port 22 at the same time? Thank you, Tim -- Tim Verhoeven - tim.verhoeven.be(a)gmail.com - 0479 / 88 11 83 Hoping the problem magically goes away by ignoring it is the "microsoft approach to programming" and should never be allowed. (Linus Torvalds)

6 9

Latest chrome causing AVC
by Ed Greshko 18 Jun '13

18 Jun '13

The latest chrome from Google was just installed on F18 (Version 28.0.1500.45) It causes AVC .... type=SYSCALL msg=audit(1371510820.873:4036): arch=c000003e syscall=56 success=yes exit=7579 a0=60000011 a1=0 a2=0 a3=0 items=0 ppid=7569 pid=7575 auid=1001 uid=1001 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 ses=6 tty=(none) comm="chrome-sandbox" exe="/opt/google/chrome/chrome-sandbox" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1371510821.165:4037): avc: denied { create } for pid=7579 comm="chrome" name="libpeerconnection.log" scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file type=SYSCALL msg=audit(1371510821.165:4037): arch=c000003e syscall=2 success=no exit=-13 a0=7f8c1b51e738 a1=441 a2=1b6 a3=ffffe000 items=0 ppid=0 pid=7579 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 ses=6 tty=(none) comm="chrome" exe="/opt/google/chrome/chrome" subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023 key=(null) The suggestion in the troubleshooter fails so.... [root@meimei tmp]# grep chrome /var/log/audit/audit.log | audit2allow -M chrome ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i chrome.pp [root@meimei tmp]# semodule -i chrome.pp libsepol.print_missing_requirements: chrome's global requirements were not met: type/attribute chrome_sandbox_t (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). semodule: Failed! Suggestion as to how to fix? -- The only thing worse than a poorly asked question is a cryptic answer.

2 3

GNOME Running with MLS
by Anschuetz, Eric R CTR NAWCTSD, 4.6.2 17 Jun '13

17 Jun '13

Hey all, For the past week or so I've been attempting to get MLS running with a graphical environment on RHEL 6.2, but I can't seem to figure out how a user with an elevated level (say, a user running at level s2) can log in graphically. Users running at level s0 work fine. I've tried giving gnome and X binaries in /usr/bin s0-s15 privileges, but still immediately get booted out after attempting to login. Even if I'm in permissive mode and login, running setenforce 1 will immediately log me out and prevent me from logging back in. I guess in short I'm wondering--does anyone have any tips for running a desktop environment with MLS? Thanks! Eric

3 3

avc granted - dontaudit?
by mark 11 Jun '13

11 Jun '13

CentOS 6.4. I'm getting those annoying avc granted's in connection with matlab, still (again?). I see in audit.log it saying "allowed". Would dontaudit shut that up? The one doc I've found seemed to suggest it would silently deny, but said nothing about silently allow. mark

2 1

sealerts
by mark 07 Jun '13

07 Jun '13

Two issues: first, I've noticed a number of times that selinux is there, which we usually have in permissive, but setroubleshoot is *not* installed. Is there be some kind of dependency or group that it should be part of that's missing? I don't see why I need to manually install it.... Second - and I thought I knew the answer to this, but guess I don't - I see AVC's in the log file, but no sealerts - how do I start it up to give me them in messages? I see auditd is running.... mark

2 4

kernel 3.9.4 on Centos6
by Vadym Chepkov 05 Jun '13

05 Jun '13

Hi, Unfortunately, Linode.com VPS provider doesn't include SELinux support in their kernels, so I had to recompile my kernel with SELinux enabled. Due to some other limitations they do not support stock centos6 kernel (2.6.32) and told me to install the latest 3.x, which I did. But now I see these messages in the kernel boot log, which makes me to think my SELinux is "broken" dracut: Loading SELinux policy type=1404 audit(1370460658.483:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 SELinux: Permission audit_access in class file not defined in policy. SELinux: Permission audit_access in class dir not defined in policy. SELinux: Permission execmod in class dir not defined in policy. SELinux: Permission audit_access in class lnk_file not defined in policy. SELinux: Permission open in class lnk_file not defined in policy. SELinux: Permission execmod in class lnk_file not defined in policy. SELinux: Permission audit_access in class chr_file not defined in policy. SELinux: Permission audit_access in class blk_file not defined in policy. SELinux: Permission execmod in class blk_file not defined in policy. SELinux: Permission audit_access in class sock_file not defined in policy. SELinux: Permission execmod in class sock_file not defined in policy. SELinux: Permission audit_access in class fifo_file not defined in policy. SELinux: Permission execmod in class fifo_file not defined in policy. SELinux: Permission syslog in class capability2 not defined in policy. SELinux: Permission wake_alarm in class capability2 not defined in policy. SELinux: Permission block_suspend in class capability2 not defined in policy. SELinux: Permission attach_queue in class tun_socket not defined in policy. SELinux: the above unknown classes and permissions will be allowed type=1403 audit(1370460659.259:3): policy loaded auid=4294967295 ses=4294967295 Is there anything I can do besides changing provider? Thanks, Vadym

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2013