selinux November 2014

selinux@lists.fedoraproject.org

12 participants
9 discussions

targeted policy relabels *everything*?
by mark 26 Nov '14

26 Nov '14

The admin I work with and I have been updated our CentOS servers to 6.6. One server that's been running for years, with no issues (it is in permissive, also), got updated... Nov 25 17:26:56 Updated: kexec-tools-2.0.0-280.el6.x86_64 <many, many, many lines of asterisks elided> Nov 26 01:10:52 Updated: selinux-policy-targeted-3.7.19-260.el6.noarch Nov 26 01:10:56 Updated: coolkey-1.1.0-32.el6.x86_64 Yes, that *is* about 7.5 *hours* to install that policy. I can only guess that for some reason, it decided to relabel the *ENTIRE* system. Anyone have any idea *why*? mark

3 6

Selinux blocks system calls
by Vadym Chepkov 25 Nov '14

25 Nov '14

Hi, I stumbled on a case in RHEL7, where selinux blocks calls to systemd I know it's SELinux, because everything work properly after setenforce 0 I added a simple manifest rules to puppet: exec { 'update TZ': command => "/bin/timedatectl set-timezone ${timezone}", unless => "/bin/timedatectl status | /bin/grep -q ${timezone}", } what's interesting, even after I ran semodule --disable_dontaudit --build I don't see any denials. But then I created a simple cron job : # cat /etc/cron.d/debug * * * * * root /bin/timedatectl status &> /tmp/timedatectl.status # cat /tmp/timedatectl.status Failed to issue method call: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. So it's not only puppet related. Is this intended behavior? Some boolean I have to change? Thanks, Vadym

3 4

Precidence of lookups from /etc/selinux/targeted/contexts/files/file_contexts.local
by William Hargrove 21 Nov '14

21 Nov '14

Hello All, Using 'semanage fcontext' two entries have been added into the file_context.local file. The first entry sets '/var/me/logs/webServer(/.*)?' to httpd_log_t and the second sets '/var/me/logs(/.*)?' to var_log_t. This can be seen below. cat /etc/selinux/targeted/contexts/files/file_contexts.local /var/me/logs/webServer(/.*)? system_u:object_r:httpd_log_t:s0 [snip] /var/me/logs(/.*)? system_u:object_r:var_log_t:s0 How I must be misunderstanding what the order of precedence with respect to the lookups is. I had thought that the most specific match would have been used, so given the config above, I would expect the lookup below to yield httpd_log_t, and not var_log_t for /var/me/logs/webServer/x. UAT [root@test webServer]$ matchpathcon /var/me/logs/webServer/x /var/me/logs/webServer/x system_u:object_r:var_log_t If I were to manually re-order this file and place /var/me/logs above /var/me/logs/webserver then I get the desired result. However this requires me to know the order of all the entries up front, and if something less specific gets added later, it would seem this would also take precedence as well. What is the correct way to ensure that lookups work as I would expect, namely that regardless of the order in which the rules are added, /var/me/logs/webserver -> httpd_log_t and /var/me/logs -> var_log_t. Many thanks, Will. The information contained in this email is strictly confidential and for the use of the addressee only, unless otherwise indicated. If you are not the intended recipient, please do not read, copy, use or disclose to others this message or any attachment. Please also notify the sender by replying to this email or by telephone (+44(020 7896 0011) and then delete the email and any copies of it. Opinions, conclusion (etc) that do not relate to the official business of this company shall be understood as neither given nor endorsed by it. IG is a trading name of IG Markets Limited (a company registered in England and Wales, company number 04008957) and IG Index Limited (a company registered in England and Wales, company number 01190902). Registered address at Cannon Bridge House, 25 Dowgate Hill, London EC4R 2YA. Both IG Markets Limited (register number 195355) and IG Index Limited (register number 114059) are authorised and regulated by the Financial Conduct Authority.

2 1

manojhanse@gmail.com has indicated you are a friend. Accept?
by manojhanse＠gmail.com 17 Nov '14

17 Nov '14

Hi, manojhanse(a)gmail.com is now following you. View manojhanse(a)gmail.com's profile http://invites.info-emailer.com/download.jsp?welcome=1&email=selinux@li… Follow the link below to remove yourself from all such emails http://invites.info-emailer.com/uns_inviter.jsp?email=selinux@lists.fedorap…

1 0

Your friend manojhanse@gmail.com cannot see your photo
by manojhanse＠gmail.com 13 Nov '14

13 Nov '14

1 0

manojhanse@gmail.com has indicated you're a friend. Accept?
by manojhanse＠gmail.com 10 Nov '14

10 Nov '14

Hi, manojhanse(a)gmail.com wants to follow you. ****** Is manojhanse(a)gmail.com you friend? ****** If Yes please follow the link below: http://invites.discovercoolwebsites.com/signup_e.html?fullname=&email=s… If No please follow the link below: http://invites.discovercoolwebsites.com/signup_e.html?fullname=&email=s… Follow the link below to remove yourself from all such emails http://invites.discovercoolwebsites.com/uns_inviter.jsp?email=selinux@lists…

1 0

polyinstatiation and pulseaudio problems
by George Karakougioumtzis 05 Nov '14

05 Nov '14

So i enabled polyinstatiation and everything seems to run smoothly except from pulseaudio. The weird thing is i dont get any denials from selinux at all. And everything seems to be working. The pulseaudio daemon is running but i dont get the cards to be recognized. Tried all the troubleshooting from fedoraproject wiki to no avail. I guess it has something to do with /tmp-inst and .esd permissions.

2 3

No semantic av rules displayed by "sesearch -A -s httpd_sys_script_t -p name_bind -C | grep -v ^D"
by Shintaro Fujiwara 04 Nov '14

04 Nov '14

On my fedora20 box, I tried to check Bash Expoit as Dan did on his latest blog post. What I got is, [root@xxxx ~]# sesearch -A -s httpd_sys_script_t -p name_bind -C | grep -v ^D Found 12 semantic av rules: Though 12 rules caught by sesearch, but none displayed. Next I typed, [root@xxxx ~]# sesearch -A -s httpd_sys_script_t -p name_connect -C | grep -v ^D Found 24 semantic av rules: allow nsswitch_domain dns_port_t : tcp_socket { recv_msg send_msg name_connect } ; allow nsswitch_domain dnssec_port_t : tcp_socket name_connect ; ET allow httpd_sys_script_t gds_db_port_t : tcp_socket name_connect ; [ httpd_can_network_connect_db ] ET allow httpd_sys_script_t mysqld_port_t : tcp_socket { recv_msg send_msg name_connect } ; [ httpd_can_network_connect_db ] ET allow nsswitch_domain ocsp_port_t : tcp_socket name_connect ; [ kerberos_enabled ] ET allow httpd_sys_script_t postgresql_port_t : tcp_socket { recv_msg send_msg name_connect } ; [ httpd_can_network_connect_db ] ET allow httpd_sys_script_t oracle_port_t : tcp_socket name_connect ; [ httpd_can_network_connect_db ] ET allow httpd_sys_script_t mssql_port_t : tcp_socket name_connect ; [ httpd_can_network_connect_db ] ET allow nsswitch_domain kerberos_port_t : tcp_socket { recv_msg send_msg name_connect } ; [ kerberos_enabled ] ET allow httpd_sys_script_t port_type : tcp_socket { recv_msg send_msg name_connect } ; [ httpd_enable_cgi httpd_can_network_connect && ] This is ok. What's wrong with name_bind thing? I use setools-console x86_64 3.3.7-41.fc20 -- 日本にヘヴィメタル・ハードロックを根付かせるページ http://heavymetalhardrock.no-ip.info/ 世界中でセキュアＯＳのSELinuxを使いやすくするフリーソフト http://sourceforge.net/projects/segatex/ CMS（PHPとPostgreSQLを使ったフリーソフト） http://sourceforge.net/projects/webon/ https://github.com/intrajp/irforum_jp

3 4

Ruby random UDP port bind in DNS resolver
by Lukas Zapletal 04 Nov '14

04 Nov '14

Hello, in our software (Foreman) we use DNS resolver provided by Ruby runtime. This is some kind of optimized thread-safe resolver which ships with the Ruby platform. The problem I am facing is that this implementation randomly binds UDP port when DNS request is sent. Here is the code bit: https://github.com/ruby/ruby/blob/trunk/lib/resolv.rb#L651-L660 This is there from Ruby 1.8.7 until now (trunk) as far as I can tell. Since any Ruby application can leverage this API and expect the same behavior, I'd like to ask if you encounter such an error in Fedora and how do you recommend to solve this. Have you experienced this kind of behavior with non-Ruby DNS clients? Is it safe to allow UDP binds for all unprivileged ports? How to do this technically in my policy? Thanks. -- Later, Lukas #lzap Zapletal

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2014