selinux August 2014

selinux@lists.fedoraproject.org

10 participants
9 discussions

Activate a SELinux Module at Initial Install
by Dustin C. Hatch 08 Sep '14

08 Sep '14

Hello, I have a SELinux module that I've packaged following the SELinux Policy Modules Packaging Draft[1] on the Fedora wiki. This module is fairly simple and just adjusts the contexts of some files. The package works well, and automatically activates the module and fixes file labels when it is installed on the running machine using Yum. Unfortunately, it does not work as smoothly if it is installed during initial setup by Anaconda. In this case, the module is available but not activated automatically; I have to manually run `semodule -i …` and `restorecon` on the first boot. Is there a recommended way to automatically activate a module that was installed from an additional package by Anaconda? Any ideas or pointers would be greatly appreciated. [1] http://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft Regards, -- Dustin C. Hatch

3 6

MCS File store protection
by David Compton 30 Aug '14

30 Aug '14

I am considering using SELinux to secure the file system of a server that will be used as a multiple category file store. The individual categories cannot have the ability to access data in a directory of a different category. Users for each category will need to access the server via samba and NFS. Additional user interfaces my become necessary in the future (http(s), (s)ftp, etc). I am new to writing SELinux policies and was hoping that someone could point me in the direction of a template for a similar design that I could use as a base. Thank you, David

2 1

Re: MCS File store protection
by David Compton 25 Aug '14

25 Aug '14

Agreed. The group who blesses systems in my environment recommended that we look into the use of MAC to guarantee separation. On Mon, Aug 25, 2014 at 10:33 AM, <m.roth(a)5-cent.us> wrote: > David Compton wrote: > > I am considering using SELinux to secure the file system of a server that > > will be used as a multiple category file store. The individual > categories > > cannot have the ability to access data in a directory of a different > > category. Users for each category will need to access the server via > > samba > > and NFS. Additional user interfaces my become necessary in the future > > (http(s), (s)ftp, etc). > > > > I am new to writing SELinux policies and was hoping that someone could > > point me in the direction of a template for a similar design that I could > > use as a base. > > > I suppose, though regular *Nix groups would seem to work just as well, > along with the samba configuration. > > mark > >

1 0

sandbox -X broken on FC20?
by Robert Horovitz 16 Aug '14

16 Aug '14

Hi, I'm using firefox in a sandbox. It doesn't work anymore since today: sandbox -X -t sandbox_web_t firefox Failed to execute command /usr/share/sandbox/sandboxX.sh: Operation not permitted My installed versions: policycoreutils-sandbox-2.2.5-3.fc20.x86_64 selinux-policy-targeted-3.12.1-153.fc20.noarch libselinux-2.2.1-6.fc20.x86_64 libselinux-python-2.2.1-6.fc20.x86_64 libselinux-utils-2.2.1-6.fc20.x86_64 selinux-policy-3.12.1-153.fc20.noarch Anyone having the same problem? Or a fix? thanks! Robert

4 8

cron issues with bash source (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 14 Aug '14

14 Aug '14

Classification: UNCLASSIFIED Caveats: NONE Background info: running RHEL6 with the latest updates, so selinux-policy-targeted-3.7.19-231.el6_5.3.noarch. When moving from Permissive to Enforcing, two scripts in /etc/cron.daily that use the bash "." operator to include a functions file can no longer do so. The functions file sets $PATH and other environment variables, so subsequent commands in the scripts fail. Interestingly, when run out of root's crontab, the scripts work just fine. The context when doing that (gathered by placing id -Z in the script) is: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Not sure why; the script itself isn't unlabeled: bash-4.1# ls -lZ /usr/local/sbin/puppet-state -rwx------. root root system_u:object_r:bin_t:s0 /usr/local/sbin/puppet-state When run from /etc/cron.daily (or cron.hourly, where I placed a copy for faster testing), the context is: system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 bash-4.1# ls -lZ /etc/cron.hourly/puppet-state -rwx------. root root system_u:object_r:bin_t:s0 /etc/cron.hourly/puppet-state The exact command in question it's failing to run is: . /opt/puppet/scripts/functions Which is labeled thusly: bash-4.1# ls -lZ /opt/puppet/scripts/functions -r-x------. root root unconfined_u:object_r:usr_t:s0 /opt/puppet/scripts/functions In either Enforcing or Permissive, I wasn't seeing anything that looked relevant, so I ran semodule -DB. This is the only thing cron-related, but (and I'm not very experienced with SELinux, so maybe I'm missing something) that doesn't seem like it: bash-4.1# cat /var/log/audit/audit.log-20140814 | grep cron | audit2allow -w type=AVC msg=audit(1407915503.212:155119): avc: denied { rlimitinh } for pid=26239 comm="prelink" scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=system_u:system_r:prelink_t:s0-s0:c0.c1023 tclass=process Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1407915503.212:155119): avc: denied { siginh } for pid=26239 comm="prelink" scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=system_u:system_r:prelink_t:s0-s0:c0.c1023 tclass=process Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. I suppose we could run them out of root's crontab, but they're easier to manage in cron.daily, and I'd like to solve the problem. Any assistance is greatly appreciated. A search of the list archives didn't turn up this issue; sorry if I've missed it. -- Ray Shaw (Contractor, STG) Army Research Laboratory Classification: UNCLASSIFIED Caveats: NONE

2 3

Multiple same specifications
by Maria Iano 12 Aug '14

12 Aug '14

My logs are full of an error about multiple same specifications like these: Aug 10 04:07:46 node1 netlogon: /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /cmshome/cms/Baskets/In(/.*)*. Aug 10 04:07:46 node1 netlogon: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /cmshome/cms/Baskets/In (system_u:object_r:public_content_rw_t:s0 and system_u:object_r:home_root_t:s0). Aug 10 05:03:17 node1 netlogon: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /cmshome/cms/Baskets/In/[^/]* (system_u:object_r:public_content_rw_t:s0 and user_u:object_r:user_home_dir_t:s0). When I change into /etc/selinux/targeted/contexts/files and grep for /cmshome/cms/Baskets/In I get this: file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/.+ user_u:object_r:user_home_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/.virtinst(/.*)? user_u:object_r:virt_content_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/.*/plugins/nprhapengine\.so.* -- user_u:object_r:textrel_shlib_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/.*/plugins/libflashplayer\.so.* -- user_u:object_r:textrel_shlib_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/((www)|(web)|(public_html)|(public_git))(/.+)? user_u:object_r:httpd_user_content_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/bin(/.*)? user_u:object_r:home_bin_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/\.ssh(/.*)? user_u:object_r:sshd_key_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- user_u:object_r:textrel_shlib_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/\.spamassassin(/.*)? user_u:object_r:spamassassin_home_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/VirtualMachines(/.*)? user_u:object_r:virt_image_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/cxoffice/bin/wine.+ -- user_u:object_r:wine_exec_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/VirtualMachines/isos(/.*)? user_u:object_r:virt_content_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]* -d user_u:object_r:user_home_dir_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/\.k5login -- user_u:object_r:krb5_home_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/[^/]*/\.fetchmailrc -- user_u:object_r:fetchmail_home_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/lost\+found/.* <<none>> file_contexts.homedirs:/cmshome/cms/Baskets/In -d system_u:object_r:home_root_t:s0 file_contexts.homedirs:/cmshome/cms/Baskets/In/\.journal <<none>> file_contexts.homedirs:/cmshome/cms/Baskets/In/lost\+found -d system_u:object_r:lost_found_t:s0 file_contexts.local:/cmshome/cms/Baskets/In -d system_u:object_r:public_content_rw_t:s0 file_contexts.local:/cmshome/cms/Baskets/In(/.*)* -d system_u:object_r:public_content_rw_t:s0 file_contexts.local:/cmshome/cms/Baskets/In/[^/]* -d system_u:object_r:public_content_rw_t:s0 file_contexts.local:/cmshome/cms/Baskets/In(/.*)* system_u:object_r:public_content_rw_t:s0 When I try to remove the home_dir specification I get this: [root@node1 files]# /usr/sbin/semanage fcontext -d -t user_home_dir_t -d "/cmshome/cms/Baskets/In/[^/]*" /usr/sbin/semanage: File context for /cmshome/cms/Baskets/In/[^/]* is not defined From googling I think that's because semanage only manages local definitions and the user_home_dir_t is coming from the policy module because the following directories are home directories from various different accounts in the system (they are part of the application that runs on there). These are home directories in /etc/passwd of some accounts: /cmshome/cms /cmshome/cms/Baskets/In/Mails /cmshome/cms/Baskets/In/AdImport /cmshome/cms/Baskets/In/Photos /cmshome/cms/Baskets/Out/AdReports /cmshome/cms/Baskets/Out/WebExport /cmshome/cms/Baskets/Out/HiResProofer /cmshome/cms/Baskets/Out/Typeset /cmshome/cms/Baskets/In/Graphics /cmshome/cms/Baskets/In/XMLPlanner /cmshome/cms/Baskets/Out/Archive I want to make sure everything under /cmshome/cms/Baskets/In is public_content_rw_t. Fortunately my local policy is winning when relabeling occurs. How can I resolve this error or can I? Thanks, Maria

1 0

libcap-ng 0.7.4-1 reached F19 -> now sandboxes are also broken in F19
by Robert Horovitz 05 Aug '14

05 Aug '14

Why is libcap-ng not postponed until #1103622 is fixed? (which probably won't be tomorrow) https://bugzilla.redhat.com/show_bug.cgi?id=1103622 http://people.redhat.com/sgrubb/libcap-ng/ChangeLog

2 2

Two questions: Mailman and staff_u starting a process
by Jeremy Young 04 Aug '14

04 Aug '14

Hello everyone, and thank you in advance for any help or information that you can offer me. I'm configuring a server to run Postfix and Mailman for our development team's test environment. I've installed and configured Apache and Mailman, having no problems with either program. In addition to DISA STIGS, I'm trying to implement some best practices and make better use of the security that SELinux can provide. My first, and more general question, is can a process started by a user mapped to staff_u could potentially run into any undesirable AVCs? I've mapped all server administrators to the staff_u SELinux user: root@DOMAIN-mailman01 in /root >> semanage login -l | grep -i admins %DOMAIN-LinuxAdmins staff_u s0-s0:c0.c1023 These users are allowed to transition to unconfined_t via sudo: root@DOMAIN-mailman01 in /home/jyoung_sa >> cat /etc/sudoers.d/linuxadmins %DOMAIN-LinuxAdmins ALL=(ALL) ROLE=unconfined_r TYPE=unconfined_t ALL Using "# service $NAME stop|start|restart" as a user in this group, if I perform an action on, let's say auditd, I notice that the service gets started with my user context and not as system_u as I would expect. Am I correct in thinking that since the staff_u SELinux user has the same roles (unconfined_r and system_r) as the system_u user, that this is a non-issue, and the service should perform as normal? root@DOMAIN-mailman01 in /home/jyoung_sa >> ps auxZ | grep auditd$ staff_u:system_r:auditd_t:s0 root 1830 0.0 0.0 31892 888 ? S<sl 10:12 0:00 auditd My second question is more specific to Mailman and Apache. I've toggled many of the unnecessary SELinux booleans to off, and am able to view the Apache welcome page with the following being true: root@DOMAIN-mailman01 in /home/jyoung_sa >> rpm -qa | grep selinux libselinux-2.0.94-5.3.el6_4.1.x86_64 libselinux-python-2.0.94-5.3.el6_4.1.x86_64 libselinux-utils-2.0.94-5.3.el6_4.1.x86_64 selinux-policy-3.7.19-231.el6_5.1.noarch selinux-policy-targeted-3.7.19-231.el6_5.1.noarch root@DOMAIN-mailman01 in /home/jyoung_sa >> sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted root@DOMAIN-mailman01 in /home/jyoung_sa >> semanage boolean -l | grep "(on" allow_staff_exec_content (on , on) allow_staff_exec_content unconfined_login (on , on) Allow a user to login as an unconfined domain allow_postfix_local_write_mail_spool (on , on) Allow postfix_local domain full write access to mail_spool directories init_upstart (on , on) Enable support for upstart as the init program. allow_kerberos (on , on) Allow confined applications to run with kerberos. allow_domain_fd_use (on , on) Allow all domains to use other domains file descriptors When attempting to visit the mailman webpage, however, I would get a 500 error from Apache, producing this AVC in the audit log: root@DOMAIN-mailman01 in /home/jyoung_sa >> ausearch -m avc -ts recent ---- time->Fri Aug 1 10:03:50 2014 node=DOMAIN-mailman01 type=PATH msg=audit(1406905430.337:1109): item=0 name="/usr/lib/mailman/cgi-bin/listinfo" inode=268184 dev=fd:00 mode=0102755 ouid=0 ogid=41 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL node=DOMAIN-mailman01 type=CWD msg=audit(1406905430.337:1109): cwd="/usr/lib/mailman/cgi-bin" node=DOMAIN-mailman01 type=SYSCALL msg=audit(1406905430.337:1109): arch=c000003e syscall=59 success=no exit=-13 a0=7f9d3732c920 a1=7f9d3732dd98 a2=7f9d3732ddb0 a3=7fffbecc4860 items=1 ppid=1595 pid=1777 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) node=DOMAIN-mailman01 type=AVC msg=audit(1406905430.337:1109): avc: denied { execute_no_trans } for pid=1777 comm="httpd" path="/usr/lib/mailman/cgi-bin/listinfo" dev=dm-0 ino=268184 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file audit2allow generates this module for me: module mailman 1.0; require { type var_log_t; type lib_t; type httpd_t; class file { read execute_no_trans }; } #============= httpd_t ============== allow httpd_t lib_t:file execute_no_trans; allow httpd_t var_log_t:file read; I tried using "# chcon -t bin_t /usr/lib/mailman/cgi-bin/*" to test, and I got a different denial message: ---- time->Fri Aug 1 10:27:23 2014 node=ues-mailman01 type=PATH msg=audit(1406906843.430:2887): item=1 name=(null) inode=2097286 dev=fd:02 mode=0100664 ouid=41 ogid=41 rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=NORMAL node=ues-mailman01 type=PATH msg=audit(1406906843.430:2887): item=0 name="/var/log/mailman/" inode=2097282 dev=fd:02 mode=042775 ouid=0 ogid=41 rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=PARENT node=ues-mailman01 type=CWD msg=audit(1406906843.430:2887): cwd="/usr/lib/mailman/cgi-bin" node=ues-mailman01 type=SYSCALL msg=audit(1406906843.430:2887): arch=c000003e syscall=2 success=no exit=-13 a0=7204f0 a1=442 a2=1b6 a3=0 items=2 ppid=1731 pid=1901 auid=4294967295 uid=48 gid=41 euid=48 suid=48 fsuid=48 egid=41 sgid=41 fsgid=41 tty=(none) ses=4294967295 comm="python" exe="/usr/bin/python" subj=system_u:system_r:httpd_t:s0 key=(null) node=ues-mailman01 type=AVC msg=audit(1406906843.430:2887): avc: denied { read } for pid=1901 comm="python" name="error" dev=dm-2 ino=2097286 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file Because this is a development environment and is not affecting production, I'm not terribly concerned with installing the module. If I'm instructed to perform the same configuration to our production servers, though, the SELinux module would require Federal approval. Can I have someone's opinion about this module? Is this required, or could I change the context of the files stored in /usr/lib/mailman/cgi-bin to something that Apache is allowed to use? Have I turned off too many booleans that could have prevented this? Thank you! -- Jeremy Young <jrm16020(a)gmail.com>, M.S., RHCSA

2 5

Executables run by httpd
by Matthew Saltzman 02 Aug '14

02 Aug '14

SubGit is a system that keeps a Subversion repository and a Git repository in sync. In order to do that, it includes a program called fast-pre-commit (C, I believe) that is run as part of Subversion's pre-commit process. It lives in the Subversion repository's hooks/ directory. If Subversion commits are handled by httpd, then the pre-commit script is run, but its call to the fast-pre-commit program fails because it doesn't see fast-pre-commit as executable. Local commits (not using httpd) work as expected. The pre-commit script and the fast-pre-commit program both have context unconfined_u:object_r:httpd_sys_rw_content_t:s0 although restorecon wants to reset the user to system_u (which doesn't solve the problem), and both have permissions -rwxrwxr-x. What should fast-pre-commit's context be in order for it to execute properly? Or what is the best way to make a particular executable run when invoked from httpd? TIA. -- Matthew Saltzman Clemson University Math Sciences mjs AT clemson DOT edu

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2014