selinux July 2015

selinux@lists.fedoraproject.org

12 participants
9 discussions

transition from init_rc
by Tracy Reed 08 Dec '15

08 Dec '15

I think I'm really close to having this policy finished and working, just a couple things to work out... When I exercise my app and then run audit2allow and it says: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow myapp_t default_t:dir search; allow myapp_t default_t:dir read; allow myapp_t default_t:file execmod; allow myapp_t myapp_bin_t:file write; does it mean only the first line is an constraint violation? Or are all of those constraint violations? How does one typically deal with constraint violations? By attribute above I suppose it means a type attribue but how do I know which one to add? Then I have these: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow initrc_t default_t:file relabelto; #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow initrc_t myapp_api_t:file relabelto; The init script which starts the service relabels the files when the service starts. I suspect this is a bad idea and I'm not sure why they are doing it. I think they may be applying security categories here. We may have to find a different way to approach that. But how would I allow this if I wanted to? Similarly: #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow setfiles_t default_t:file relabelfrom; #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow setfiles_t myapp_api_t:file relabelfrom; etc... This is all on CentOS 6.5. Thanks! -- Tracy Reed

4 5

Conflict between local module and local fcontext
by Robin Lee Powell 31 Jul '15

31 Jul '15

So I have a custom module that includes: type lojban_logger_t; type lojban_logger_exec_t; application_domain( lojban_logger_t, lojban_logger_exec_t) init_daemon_domain(lojban_logger_t, lojban_logger_exec_t) (not sure if those are redundant?) and: /srv/lojban/irclogs(/.*)? system_u:object_r:lojban_logger_t:s0 I've made a variety of changes with "semodule fcontext", including: /srv/lojban system_u:object_r:httpd_user_content_t:s0 /srv/lojban(/.*)? system_u:object_r:httpd_user_content_t:s0 As a result, the changes in my module are ignored, and the files end up with httpd_user_content_t So I tried: $ sudo semanage fcontext -a -t lojban_logger_t '/srv/lojban/irclogs(/.*)?' ValueError: Type lojban_logger_t is invalid, must be a file or device type Uhh. I guess this means that the custom module's types can't be seen by semanage? So, what's the correct solution here? -- http://intelligence.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

4 13

[HEADS UP] policycoreutils - python3 and utilities moved to policycoreutils-python-utils
by Petr Lautrbach 24 Jul '15

24 Jul '15

Hi, I've just pushed an update of policycoreutils which defaults to python 3 and with python utilities moved from policycoreutils-python to policycoreutils-python-utils. Both changes were requested by Python team as part of their Fedora Change [1]. Since the conversion to python 3 is in its early phase and probably not complete yet, there might occur problems with update and with the implementation. Please test and file bugs which should be set to block the change tracker bug [2] so the python team can provide fixes and help. [1] https://fedoraproject.org/wiki/Changes/Python_3_as_Default [2] https://bugzilla.redhat.com/show_bug.cgi?id=1076441 Thanks, Petr -- Petr Lautrbach

1 0

man pages are in -devel package
by Ian Pilcher 22 Jul '15

22 Jul '15

Can someone please look at/fix this bug: https://bugzilla.redhat.com/show_bug.cgi?id=815137 This is a longstanding annoyance, and it should be a straightforward packaging fix. If there's a reason that isn't the case, please not it in the bug. Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

1 0

fedora 22
by mark 22 Jul '15

22 Jul '15

Hi, folks, My manager just updated his fedora box from 20 to 22, and it appears as though selinux, in permissive mode, is logging *EVERY* command run by the system as root to syslog, even though the auditd's running. I am talking successes, not failures. I've been googling, but haven't yet found how to change that so that it's more normal, with only avc's showing in syslog. Just looked, and see that setroubleshootd is installed, but not how to tell systemd (which should die) to start it (if that's my answer). mark

3 3

[HEADS UP] SELinux policy store migration in Rawhide
by Petr Lautrbach 22 Jul '15

22 Jul '15

Hi everybody, we will do an update of SELinux userspace tools to 2015-02-02 release and selinux-policy packages as it was proposed in "SELinux policy store migration" Fedora system wide change [1]. What does it mean for you: 1. You use only Fedora default SELinux policy. You shouldn't notice any change but some performance improvements during regular policy updates. 2. You have local changes in policy like changed booleans, adjusted SELinux users, added or changed port or file contexts definitions made via "semanage" command. You shouldn't notice any change. All local modifications should be handled by migration process during packages update. You can backup your setting using the command below before the update will happen. # semanage export -f semanage.mods 3. You have your local SELinux policy modules You shouldn't notice any change again. All modules should be migrated during selinux-policy update. Some of modules could be incompatible with the new policy so they'll need to be migrated manually. If they are part of any Fedora package, we will help with the migration. Just file a bug to a component and add us do CC field. We are ready to help with other modules or issues with migration on selinux(a)lists.fedoraproject.org mailing list. [1] https://fedoraproject.org/wiki/Changes/SELinuxPolicyStoreMigration Petr -- Petr Lautrbach

2 1

How to (or should I?) change unconfined_u to system_u for a file
by Jeff Boyce 21 Jul '15

21 Jul '15

Greetings - I essentially have two questions here. First, I have a file that needs the context changed and I don't have a clear understanding of the proper syntax that should be used. Second, after doing some additional reading through the SELinux manual and some Google searching, I realized that I may be taking the wrong approach with this file. Then I ran across Dan Walsh's blog dated April 23, 2013 (Subject: What is the differences between user_home_dir_t and user_home_t) and realize that I am likely not doing something the appropriate way. So I am looking for someone to educate me on my error, the risks involved, and the proper approach I should be using. The issue: I have two shell files run by cron that rsync our file server directories to two backup servers, one on-site (Bison) and one off-site. The on-site cron has worked fine for years. I just setup the off-site cron and it is blocked by SELinux. Looking at the context of the files, the one that works is listed as system_u, while the one that fails is listed as unconfined_u. So my first question is, what is the proper syntax for changing the context of the second file so that it matches the first one. [root@sequoia home]# pwd /home [root@sequoia home]# ls -lZ | grep RsyncS -rwxr--r--. root root system_u:object_r:home_root_t:s0 RsyncSequoiaToBison.sh -rwxr--r--. root root unconfined_u:object_r:home_root_t:s0 RsyncSequoiaToOffsite.sh Looking from a wider perspective, I have these shell files located in /home. I am speculating now that for my objective, this might not be the appropriate location for them, and is probably why SELinux is blocking the new one I created for the off-site backup. So my second question is more philosophical regarding what should be the location for a shell file that is used by cron to rsync our files to a backup server. Thanks, and please cc me directly as I only receive the daily digest from the mailing list. Jeff -- Jeff Boyce Meridian Environmental www.meridianenv.com

5 7

Sandbox Firefox
by Robert Gabriel 20 Jul '15

20 Jul '15

Hi, I'm on Fedora 22 and trying: sandbox -X -H home_sandbox -T tmp_sandbox -t sandbox_web_t firefox danwalsh.livejournal.com which results in "Unable to connect" in the opened browser window. First I had to: grep Xephyr /var/log/audit/audit.log | audit2allow -M mypol to get that working so far. I thought "sandbox_web_t" allowed access to HTTP ports? Trying "sandbox_net_t" yields no joy and only a "setenforce 0" allows connections. Any help appreciated. Thank you.

2 1

lvrabec-selinux BLOG
by Lukas Vrabec 15 Jul '15

15 Jul '15

Hi! I would like to introduce my new blog about SELinux! I'll try to keep it updated and share my ideas and solutions for problems in selinux-policy component. http://lvrabec-selinux.rhcloud.com/ My first post is about creating rpm package for custom policies. http://lvrabec-selinux.rhcloud.com/2015/07/07/how-to-create-selinux-product… If you have any idea about new post related to selinux-policy feel free to contact me! -- Lukas Vrabec SELinux Solutions Red Hat, Inc.

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2015