selinux June 2019

selinux@lists.fedoraproject.org

15 participants
13 discussions

Re: using an interface defined in another loaded module
by SZIGETVÁRI János 07 Nov '19

07 Nov '19

Dear Gary, Thanks a zillion times for your help, the building of the policy works fine now that I have copied the .if file of the submodule to the directory you mentioned! I did not know I was reqired to copy the module's interface file to SELinux's include dirs to make it available for other modules to use. BTW, I was building my module from within my "policy builder and installer" script using the "traditional" way of: # make -f /usr/share/selinux/devel/Makefile A.pp Now the build process works, thanks to your suggestion! Best Regards, János -- Janos SZIGETVARI RHCE, License no. 150-053-692 <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> LinkedIn: linkedin.com/in/janosszigetvari E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com Phone: +36209440412 (Hungary) __@__˚V˚ Make the switch to open (source) applications, protocols, formats now: - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice - msn -> jabber protocol (Pidgin, Google Talk) - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp Gary Tierney <gary.tierney(a)gmx.com> ezt írta (időpont: 2019. ápr. 3., Sze, 17:14): > On Wed, Apr 03, 2019 at 10:34:08AM +0200, SZIGETVÁRI János wrote: > >Could anyone please give me some insight on this? > > > >Thanks a lot! > > > > Hi, > > How are you building and installing your policy modules? The interface > definitions (.if files) aren't preserved in the compiled policy package, > so are typically kept elsewhere. On Fedora this is under > /usr/share/selinux/devel/include and its associated subdirectories > (which are recursively walked to find .if files when building policy > using the refpolicy framework, i.e., the selinux-policy-devel package). > > So it should be as simple as copying your .if files to: > /usr/share/selinux/devel/include (though the "services" subdir is likely > more appropriate). > > Thanks, > Gary. > > >Best Regards, > >János Szigetvári > > > >SZIGETVÁRI János <jszigetvari(a)gmail.com> ezt írta (időpont: 2019. márc. > >31., V, 13:47): > > > >> ... snip ... > >_______________________________________________ > >selinux mailing list -- selinux(a)lists.fedoraproject.org > >To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org > >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > >List Archives: > https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o… > >

4 9

Initial context for init
by Philip Seeley 01 Aug '19

01 Aug '19

Hi all, Quick question is: In the targeted policy should init run SystemHigh as it does in the mls policy? The background: We're setting up a targeted system where we confine all users and remove the unconfined policy module, but we also enable polyinstantiation of /tmp and /var/tmp. If we ssh in as a staff_u user phil and elevate to root/sysadm_r then we have a context of: staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 And therefore /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp Which is really: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_phil The real /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp Now if we use run_init to update an RPM that contains a post install script, rpm can't create the temporary script file: # run_init bash -c 'rpm -i --force /root/libselinux-2.0.94-7.el6.x86_64.rpm' Authenticating phil. Password: error: error creating temporary file /var/tmp/rpm-tmp.atkHTf: Permission denied error: Couldn't create temporary file for %post (libselinux-2.0.94-7.el6.x86_64): Permission denied Note: you need to use run_init as the rpm might restart a service, e.g. the sssd rpm. We've traced this to the /etc/selinux/targeted/contexts/initrc_context file which contains: system_u:system_r:initrc_t:s0 So we transition to initrc_t and then to rpm_t without any categories, but because the polyinstantiated /var/tmp directory has c0.c1023 we get denied. Normally in targeted init runs unconfined, but we've removed this. type=AVC msg=audit(1467342325.016:716): avc: denied { read } for pid=2779 comm="rpm" name="system_u:object_r:tmp_t:s0-s0:c0.c1023_phil" dev=dm-0 ino=1966082 scontext=system_u:system_r:rpm_t:s0 tcontext=system_u:object_r:tmp_t:s0-s0:c0.c1023 tclass=dir It works if we change initrc_context to: system_u:system_r:initrc_t:s0-s0:c0.c1023 We don't see the issue under mls because the default initrc_context is: system_u:system_r:initrc_t:s0-s15:c0.c1023 We've traces this back through the selinux-policy src RPM and to the upstream refpolicy and see that config/appconfig-mcs/initrc_context is: system_u:system_r:initrc_t:s0 whereas config/appconfig-mls/initrc_context is: system_u:system_r:initrc_t:s0-mls_systemhigh So under mls init's context is SystemHigh, but under mcs/targeted it doesn't have any categories. So the long question is should config/appconfig-mcs/initrc_context really be: system_u:system_r:initrc_t:mcs_systemhigh as it seems odd that the more secure mls policy would run init at SystemHigh but targeted doesn't. Thanks Phil Seeley

3 3

unconfined_service_t
by Marko Rauhamaa 29 Jun '19

29 Jun '19

When I start a random systemd service written by myself on Fedora, I notice that the service gets system_u:system_r:unconfined_service_t That's without me configuring SELinux for my service in any way. Furthermore, I notice that my service has the right to access all files freely across all file systems. Again, without any special setup, my service executable gets this label: system_u:object_r:bin_t:s0 I thought SELinux was about granting minimal access (and no access by default), but Fedora has granted my service maximal access by default. What have I not understood? Marko

2 2

SELinux and AppArmor.
by Jason Long 19 Jun '19

19 Jun '19

Hello, Can AppArmor affect SELinux? I mean is discontinued SELinux. Thanks.

8 15

Allow a Linux account to read a tag named var_log_t
by LOEWENTHAL Sophie (EEAS-EXT) 13 Jun '19

13 Jun '19

Hi everybody, Can a tag named var_log_t be assigned to Linux account instead of a Selinux user? e.g I want the Linux account named logread to be able to read all files in /var/log(/.*)? Or should a new Selinux be created with permission to read var_log_t, and this Selinux user be assigned to the Linux user logread? O/S is CentOS, but imagine not too much difference from Fedora. Best wishes, Sophie The views expressed are purely those of the writer and may not in any circumstances be regarded as stating an official position of the EEAS. Les avis exprimés n'engagent que leur auteur et ne peuvent en aucun cas être considérés comme une position officielle du SEAE.

1 0

Labeling conflict?
by Marko Rauhamaa 11 Jun '19

11 Jun '19

When a file gets created, it gets a label based on some mysterious distro policy ("antivirus_db_t"). I define a specific custom policy that should give the file a different label (say, "bin_t"). What ends up happening is that no matter how I *create* the file, it always gets "antivirus_db_t" as its label. However, if I run restorecon on the file, the label changes to "bin_t". How can this symptom be explained? Marko

2 4

antivirus_exec_t shunned on Fedora
by Marko Rauhamaa 10 Jun '19

10 Jun '19

I have a service I want to start from systemd. The service startup goes like this: systemd ----> prog1[label: usr_t] ----> prog2[label: antivirus_exec_t] However, Fedora's SELinux policies prevent prog2 from starting. If I change prog2's label to bin_t or usr_t, the service starts fine. What in Fedora's policies bans antivirus_exec_t from running? Should I introduce a custom policy that allows that startup combination? If so, can you tell me what that rule would look like (or what document would give me the instructions). I already have a simple .te policy so I know the very basics. Or should I just label the file with bin_t and be done with it? BTW, this is not a sysadmin question. Rather it's a product installation question; the product should work out of the box on Fedora. Marko

3 2

module removal fails
by lejeczek 10 Jun '19

10 Jun '19

$ semanage module -r ganesha libsemanage.semanage_direct_remove_key: Unable to remove module ganesha at priority 400. (No such file or directory). OSError: No such file or directory hi guys, how to fix the above? many thanks, L.

2 3

a boolean which does not work?
by lejeczek 10 Jun '19

10 Jun '19

hi everyone I have this: virt_use_fusefs --> on virt_use_glusterd --> on on centos 7.6 with selinux-policy-3.13.1-229.el7_6.12.noarch. When I tell pacemaker to start a virt guest resource with xml config off a fuse mounted gluster vol I get a denial and audit2allow sees: allow virsh_t fusefs_t:dir search; Should above boolean be all I (pacemaker) need or I'm missing something? many thanks, L.

3 5

Re: SELinux and AppArmor.
by Jason Long 10 Jun '19

10 Jun '19

No, I meant was can AppArmor become a replacement for SELinux? -------------------------------------------- On Mon, 6/10/19, Lukas Vrabec <lvrabec(a)redhat.com> wrote: Subject: Re: SELinux and AppArmor. To: selinux(a)lists.fedoraproject.org Date: Monday, June 10, 2019, 2:00 PM On 6/8/19 5:24 PM, Jason Long wrote: > Hello, Hello, It's not really easy to have SELinux enabled together with AppArmor on one system. AppArmor is not supported on Fedora. Thanks, Lukas. > Can AppArmor affect SELinux? I mean is discontinued SELinux. > > Thanks. > _______________________________________________ > selinux mailing list -- selinux(a)lists.fedoraproject.org > To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o… > -- Lukas Vrabec Senior Software Engineer, Security Technologies Red Hat, Inc. _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o… -----Inline Attachment Follows-----

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2019