selinux September 2020

selinux@lists.fedoraproject.org

9 participants
5 discussions

Fedora 32 and SELinux : syntax errors for mlsconstrain
by Cătălin George Feștilă 25 Oct '20

25 Oct '20

I have last update and default SELinux install, but I got many syntax errors for mlsconstrain. Any idea ? Thank you. [root@desk mythcat]# uname -a Linux desk 5.8.4-200.fc32.x86_64 #1 SMP Wed Aug 26 22:28:08 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux ausearch -c 'updatedb' --raw | audit2allow -M my-updatedb compilation failed: my-updatedb.te:25:ERROR 'syntax error' at token 'mlsconstrain' on line 25: # mlsconstrain dir { read getattr execute } ((l1 dom l2 -Fail-) or (t1 == mlsfilereadtoclr -Fail-) and (h1 dom l2) or (t1 == mlsfileread -Fail-) or (t2 == mlstrustedobject -Fail-) ); Constraint DENIED mlsconstrain dir { search } ((l1 dom l2 -Fail-) or (t1 == mlsfilereadtoclr -Fail-) and (h1 dom l2) or (t1 == mlsfileread -Fail-) or (t2 == mlstrustedobject -Fail-) ); Constraint DENIED /usr/bin/checkmodule: error(s) encountered while parsing configuration ... [root@desk mythcat]# ausearch -c 'ausearch' --raw | audit2allow -M my-ausearch compilation failed: my-ausearch.te:28:ERROR 'syntax error' at token 'mlsconstrain' on line 28: mlsconstrain file { write create setattr relabelfrom append unlink link rename mounton } ((l1 eq l2 -Fail-) or (t1 == mlsfilewritetoclr -Fail-) and (h1 dom l2 -Fail-) and (l1 domby l2) or (t2 == mlsfilewriteinrange -Fail-) and (l1 dom l2 -Fail-) an # mlsconstrain file { read getattr execute } ((l1 dom l2 -Fail-) or (t1 == mlsfilereadtoclr -Fail-) and (h1 dom l2 -Fail-) or (t1 == mlsfileread -Fail-) or (t2 == mlstrustedobject -Fail-) ); Constraint DENIED /usr/bin/checkmodule: error(s) encountered while parsing configuration ...

2 4

SELinux and Reverse Shell.
by Jason Long 30 Sep '20

30 Sep '20

Hello, Could SELinux protect a server from Reverse Shell attacks? When hackers access to the CMSes like WordPress then they do a Reverse Shell for access to the server. Could SELinux block it? Thank you.

4 3

SELinux and Xorg error .
by Cătălin George Feștilă 23 Sep '20

23 Sep '20

After a relabel I got this , any idea ? [root@desk mythcat]# ausearch -c 'Xorg' --raw | audit2allow -M my-Xorg libsepol.sepol_string_to_security_class: unrecognized class lockdown ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i my-Xorg.pp [root@desk mythcat]# semodule -X 300 -i my-Xorg.pp Failed to resolve allow statement at /var/lib/selinux/mls/tmp/modules/300/my-Xorg/cil:7 semodule: Failed! [root@desk mythcat]# semodule -X 300 -i my-Xorg.pp Failed to resolve allow statement at /var/lib/selinux/mls/tmp/modules/300/my-Xorg/cil:7 semodule: Failed! [root@desk mythcat]# ausearch -c 'X' --raw | audit2allow -M my-X libsepol.sepol_string_to_security_class: unrecognized class lockdown ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i my-X.pp [root@desk mythcat]# semodule -X 300 -i my-X.pp Failed to resolve allow statement at /var/lib/selinux/mls/tmp/modules/300/my-X/cil:11 semodule: Failed!

3 4

Is my SELinux configuration wrong and dangerous?
by Jason Long 20 Sep '20

20 Sep '20

Hello,I'm using CentOS 8 as a web server that hosting a WordPress website. I have two questions. 1- I defined SELinux for WordPress directory as below: # ls -lZ /var/www/drwxrwxr-x. 7 apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 4096 Sep 19 23:37 wp I created an account for a remote developer that working on WordPress. On some websites, I saw that the OK permission forwp directory is "httpd_sys_r_content_t" and not "httpd_sys_rw_content_t" and someone recommended to back permission via below command: # restorecon -rv /var/www/wp Is it true? Is "httpd_sys_rw_content_t" a dangerous permission and can lead to hacking? 2- WordPress can't update and showed me "cURL Error (7): couldn't connect to host" error. I did below command to solve it: # setsebool -P httpd_can_network_connect on Can this command make Apache insecure and must I turn it to "off" ? Thank you.

2 2

Is my SELinux configuration wrong and dangerous?
by Silvan Nagl 20 Sep '20

20 Sep '20

https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o…

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2020