Hello. I started playing with SELinux on FC2, and recently moved to FC3, and I must say it's much better now, with the targeted policy. Congrats on this. I still had to change a few things in my policies, though. Following is a collection of the avc errors justifying my changes. I'm not experienced with SElinux yet, so I may be doing something wrong...please let me know if these changes are correct or not. Also, the unlink allow for httpd_t is because, for some reason, when I try to remove a file from within PHP, it uses httpd_t instead of httpd_sys_script_t . I would also like a rule(which I'm not sure how to write) to allow PHP programs to execute external programs, since I have a script which receives an uploaded file, does a lot of processing with it through external programs, and stores it in the database - when I run that, it gives me avc execute errors trying to run bash and the other utilities.
Apache: Nov 12 16:50:46 fireball kernel: audit(1100285446.637:0): avc: denied { connectto } for pid=2522 exe=/usr/sbin/httpd path=/tmp/.s.PGSQL.5432 scontext=user_u:system_r:httpd_t tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket
NTPd: Nov 11 19:51:49 fireball kernel: audit(1100209909.743:0): avc: denied { create } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { bind } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { getattr } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.747:0): avc: denied { write } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.749:0): avc: denied { net_admin } for pid=2293 exe=/usr/sbin/ntpd capability=12 scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=capability Nov 11 19:51:49 fireball kernel: audit(1100209909.750:0): avc: denied { nlmsg_read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.752:0): avc: denied { read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket
DHCPd: Nov 12 23:37:25 fireball kernel: audit(1100309845.314:0): avc: denied { create } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.317:0): avc: denied { bind } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.320:0): avc: denied { getattr } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.323:0): avc: denied { write } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.325:0): avc: denied { net_admin } for pid=10002 exe=/usr/sbin/dhcpd capability=12 scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=capability Nov 12 23:37:25 fireball kernel: audit(1100309845.326:0): avc: denied { nlmsg_read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.327:0): avc: denied { read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.909:0): avc: denied { unlink } for pid=10008 exe=/usr/sbin/dhcpd name=dhcpd.leases~ dev=hda1 ino=425472 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:file_t tclass=file
named: Nov 12 23:41:25 fireball kernel: audit(1100310085.797:0): avc: denied { create } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.798:0): avc: denied { bind } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.799:0): avc: denied { getattr } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.803:0): avc: denied { write } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.806:0): avc: denied { nlmsg_read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.809:0): avc: denied { read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket
Thanks, Rodrigo
Rodrigo Damazio wrote:
Hello. I started playing with SELinux on FC2, and recently movedto FC3, and I must say it's much better now, with the targeted policy. Congrats on this. I still had to change a few things in my policies, though. Following is a collection of the avc errors justifying my changes. I'm not experienced with SElinux yet, so I may be doing something wrong...please let me know if these changes are correct or not. Also, the unlink allow for httpd_t is because, for some reason, when I try to remove a file from within PHP, it uses httpd_t instead of httpd_sys_script_t . I would also like a rule(which I'm not sure how to write) to allow PHP programs to execute external programs, since I have a script which receives an uploaded file, does a lot of processing with it through external programs, and stores it in the database - when I run that, it gives me avc execute errors trying to run bash and the other utilities.
Apache: Nov 12 16:50:46 fireball kernel: audit(1100285446.637:0): avc: denied { connectto } for pid=2522 exe=/usr/sbin/httpd path=/tmp/.s.PGSQL.5432 scontext=user_u:system_r:httpd_t tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket
NTPd: Nov 11 19:51:49 fireball kernel: audit(1100209909.743:0): avc: denied { create } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { bind } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { getattr } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.747:0): avc: denied { write } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.749:0): avc: denied { net_admin } for pid=2293 exe=/usr/sbin/ntpd capability=12 scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=capability Nov 11 19:51:49 fireball kernel: audit(1100209909.750:0): avc: denied { nlmsg_read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.752:0): avc: denied { read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket
DHCPd: Nov 12 23:37:25 fireball kernel: audit(1100309845.314:0): avc: denied { create } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.317:0): avc: denied { bind } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.320:0): avc: denied { getattr } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.323:0): avc: denied { write } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.325:0): avc: denied { net_admin } for pid=10002 exe=/usr/sbin/dhcpd capability=12 scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=capability Nov 12 23:37:25 fireball kernel: audit(1100309845.326:0): avc: denied { nlmsg_read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.327:0): avc: denied { read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.909:0): avc: denied { unlink } for pid=10008 exe=/usr/sbin/dhcpd name=dhcpd.leases~ dev=hda1 ino=425472 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:file_t tclass=file
named: Nov 12 23:41:25 fireball kernel: audit(1100310085.797:0): avc: denied { create } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.798:0): avc: denied { bind } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.799:0): avc: denied { getattr } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.803:0): avc: denied { write } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.806:0): avc: denied { nlmsg_read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.809:0): avc: denied { read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket
Thanks, Rodrigo
diff -ru src.orig/policy/domains/program/apache.te src/policy/domains/program/apache.te --- src.orig/policy/domains/program/apache.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/apache.te 2004-11-12 23:54:36.127952796 -0200 @@ -285,6 +285,8 @@ # Allow httpd to work with postgresql # allow httpd_t tmp_t:sock_file rw_file_perms; +allow httpd_t tmp_t:unix_stream_socket rw_file_perms; +allow httpd_t unconfined_t:unix_stream_socket rw_file_perms; ') dnl targeted policy
This would allow httpd to talk to any unix_stream_socket (XWindows for example.) I am going to try to add postgresql.te (As we have with mysql.te) to targeted policy to see if it fixes this and does not cause other problems.
# diff -ru src.orig/policy/domains/program/dhcpd.te src/policy/domains/program/dhcpd.te --- src.orig/policy/domains/program/dhcpd.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/dhcpd.te 2004-11-12 23:38:18.000000000 -0200 @@ -33,13 +33,14 @@ can_ypbind(dhcpd_t) allow dhcpd_t self:unix_dgram_socket create_socket_perms; allow dhcpd_t self:unix_stream_socket create_socket_perms; +allow dhcpd_t self:netlink_route_socket r_netlink_socket_perms;
Added, but have never seen this before.
allow dhcpd_t var_lib_t:dir search;
allow dhcpd_t devtty_t:chr_file { read write };
# Use capabilities -allow dhcpd_t dhcpd_t:capability { net_raw net_bind_service }; +allow dhcpd_t dhcpd_t:capability { net_raw net_admin net_bind_service };
net_admin is a strong capability Allows you to bring up and down network interfaces, iptable rules. Do you have any idea what it is trying to do that would cause this? Could you try to dontaudit it and see what happens. dontaudit dhcpd_t self:capability net_admin;
# Allow access to the dhcpd file types type dhcp_state_t, file_type, sysadmfile; diff -ru src.orig/policy/domains/program/named.te src/policy/domains/program/named.te --- src.orig/policy/domains/program/named.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/named.te 2004-11-12 23:42:38.000000000 -0200 @@ -60,6 +60,7 @@ # Bind to the named port. allow named_t dns_port_t:udp_socket name_bind; allow named_t { dns_port_t rndc_port_t }:tcp_socket name_bind; +allow named_t self:netlink_route_socket r_netlink_socket_perms;
Added. but again have not seen this.
bool named_write_master_zones false;
diff -ru src.orig/policy/domains/program/ntpd.te src/policy/domains/program/ntpd.te --- src.orig/policy/domains/program/ntpd.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/ntpd.te 2004-11-12 23:33:18.000000000 -0200 @@ -22,7 +22,7 @@ # for SSP allow ntpd_t urandom_device_t:chr_file read;
-allow ntpd_t self:capability { setgid setuid sys_time net_bind_service ipc_lock sys_chroot }; +allow ntpd_t self:capability { setgid setuid sys_time net_bind_service ipc_lock sys_chroot net_admin };
This should definitely not be allowed. I can't see why ntpd would want to modify your network environment.
allow ntpd_t self:process { setcap setsched }; # ntpdate wants sys_nice dontaudit ntpd_t self:capability { fsetid sys_nice }; @@ -39,6 +39,7 @@ allow ntpd_t ntp_port_t:udp_socket name_bind; allow ntpd_t self:unix_dgram_socket create_socket_perms; allow ntpd_t self:unix_stream_socket create_socket_perms; +allow ntpd_t self:netlink_route_socket r_netlink_socket_perms;
Same as previous comments about netlink_sockets
# so the start script can change firewall entries allow initrc_t net_conf_t:file { getattr read ioctl }; diff -ru src.orig/policy/macros/program/apache_macros.te src/policy/macros/program/apache_macros.te --- src.orig/policy/macros/program/apache_macros.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/macros/program/apache_macros.te 2004-11-12 23:01:49.000000000 -0200 @@ -106,6 +106,7 @@ ############################################################################ r_dir_file(httpd_$1_script_t, httpd_$1_script_ro_t) create_dir_file(httpd_$1_script_t, httpd_$1_script_rw_t) +allow httpd_t { httpd_$1_script_rw_t }:{ file dir lnk_file } { unlink }; ra_dir_file(httpd_$1_script_t, httpd_$1_script_ra_t)
if (httpd_enable_cgi) && (httpd_unified) {
The update policy has the following which would cover this case.
r_dir_file(httpd_t, httpd_sys_script_ro_t) create_dir_file(httpd_t, httpd_sys_script_rw_t) ra_dir_file(httpd_t, httpd_sys_script_ra_t)
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-selinux-list
On Sat, 2004-11-13 at 08:05 -0500, Daniel J Walsh wrote:
r_dir_file(httpd_t, httpd_sys_script_ro_t) create_dir_file(httpd_t, httpd_sys_script_rw_t) ra_dir_file(httpd_t, httpd_sys_script_ra_t)
Hm, this does kind of invalidate the discussion at the end of section 7 in the Apache guide :/
On Mon, Nov 15, 2004 at 12:22:11PM -0500, Colin Walters wrote:
On Sat, 2004-11-13 at 08:05 -0500, Daniel J Walsh wrote:
r_dir_file(httpd_t, httpd_sys_script_ro_t) create_dir_file(httpd_t, httpd_sys_script_rw_t) ra_dir_file(httpd_t, httpd_sys_script_ra_t)
Hm, this does kind of invalidate the discussion at the end of section 7 in the Apache guide :/
Do you have a link to "section 7"?
On Mon, 2004-11-15 at 12:29 -0500, Charles R. Anderson wrote:
On Mon, Nov 15, 2004 at 12:22:11PM -0500, Colin Walters wrote:
On Sat, 2004-11-13 at 08:05 -0500, Daniel J Walsh wrote:
r_dir_file(httpd_t, httpd_sys_script_ro_t) create_dir_file(httpd_t, httpd_sys_script_rw_t) ra_dir_file(httpd_t, httpd_sys_script_ra_t)
Hm, this does kind of invalidate the discussion at the end of section 7 in the Apache guide :/
Do you have a link to "section 7"?
Sorry for the oblique reference. The document's still being reviewed for posting; it's not secret or anything (certainly you can find it if you search bugzilla or whatever), but I'd prefer people to see it *after* the docs team has fixed my embarrassing grammar :)
I've made the dontaudit changes you suggested and they everything seems to still work. However, I'm still having problems with apache - I use too many PHP functions which do various things such as executing external programs, opening sockets, connecting to postgres, etc. that generate avc denied errors. I tried, thus, to remove apache.te from domains/program, just to find out that mailman depended on it - it gives me an error about mailman_cgi_exec_t (which, indeed, is only defined if apache.te is defined, but it appears in the mailman.fc file without an ifdef - adding an ifdef made it all work perfectly. I wonder if there's a way to use selinux with apache without limiting php functions.
Rodrigo
Daniel J Walsh wrote:
Rodrigo Damazio wrote:
Hello. I started playing with SELinux on FC2, and recentlymoved to FC3, and I must say it's much better now, with the targeted policy. Congrats on this. I still had to change a few things in my policies, though. Following is a collection of the avc errors justifying my changes. I'm not experienced with SElinux yet, so I may be doing something wrong...please let me know if these changes are correct or not. Also, the unlink allow for httpd_t is because, for some reason, when I try to remove a file from within PHP, it uses httpd_t instead of httpd_sys_script_t . I would also like a rule(which I'm not sure how to write) to allow PHP programs to execute external programs, since I have a script which receives an uploaded file, does a lot of processing with it through external programs, and stores it in the database - when I run that, it gives me avc execute errors trying to run bash and the other utilities.
Apache: Nov 12 16:50:46 fireball kernel: audit(1100285446.637:0): avc: denied { connectto } for pid=2522 exe=/usr/sbin/httpd path=/tmp/.s.PGSQL.5432 scontext=user_u:system_r:httpd_t tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket
NTPd: Nov 11 19:51:49 fireball kernel: audit(1100209909.743:0): avc: denied { create } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { bind } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { getattr } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.747:0): avc: denied { write } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.749:0): avc: denied { net_admin } for pid=2293 exe=/usr/sbin/ntpd capability=12 scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=capability Nov 11 19:51:49 fireball kernel: audit(1100209909.750:0): avc: denied { nlmsg_read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.752:0): avc: denied { read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket
DHCPd: Nov 12 23:37:25 fireball kernel: audit(1100309845.314:0): avc: denied { create } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.317:0): avc: denied { bind } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.320:0): avc: denied { getattr } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.323:0): avc: denied { write } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.325:0): avc: denied { net_admin } for pid=10002 exe=/usr/sbin/dhcpd capability=12 scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=capability Nov 12 23:37:25 fireball kernel: audit(1100309845.326:0): avc: denied { nlmsg_read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.327:0): avc: denied { read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.909:0): avc: denied { unlink } for pid=10008 exe=/usr/sbin/dhcpd name=dhcpd.leases~ dev=hda1 ino=425472 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:file_t tclass=file
named: Nov 12 23:41:25 fireball kernel: audit(1100310085.797:0): avc: denied { create } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.798:0): avc: denied { bind } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.799:0): avc: denied { getattr } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.803:0): avc: denied { write } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.806:0): avc: denied { nlmsg_read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.809:0): avc: denied { read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket
Thanks, Rodrigo
diff -ru src.orig/policy/domains/program/apache.te src/policy/domains/program/apache.te --- src.orig/policy/domains/program/apache.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/apache.te 2004-11-12 23:54:36.127952796 -0200 @@ -285,6 +285,8 @@ # Allow httpd to work with postgresql # allow httpd_t tmp_t:sock_file rw_file_perms; +allow httpd_t tmp_t:unix_stream_socket rw_file_perms; +allow httpd_t unconfined_t:unix_stream_socket rw_file_perms; ') dnl targeted policy
This would allow httpd to talk to any unix_stream_socket (XWindows for example.) I am going to try to add postgresql.te (As we have with mysql.te) to targeted policy to see if it fixes this and does not cause other problems.
# diff -ru src.orig/policy/domains/program/dhcpd.te src/policy/domains/program/dhcpd.te --- src.orig/policy/domains/program/dhcpd.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/dhcpd.te 2004-11-12 23:38:18.000000000 -0200 @@ -33,13 +33,14 @@ can_ypbind(dhcpd_t) allow dhcpd_t self:unix_dgram_socket create_socket_perms; allow dhcpd_t self:unix_stream_socket create_socket_perms; +allow dhcpd_t self:netlink_route_socket r_netlink_socket_perms;
Added, but have never seen this before.
allow dhcpd_t var_lib_t:dir search;
allow dhcpd_t devtty_t:chr_file { read write };
# Use capabilities -allow dhcpd_t dhcpd_t:capability { net_raw net_bind_service }; +allow dhcpd_t dhcpd_t:capability { net_raw net_admin net_bind_service };
net_admin is a strong capability Allows you to bring up and down network interfaces, iptable rules. Do you have any idea what it is trying to do that would cause this? Could you try to dontaudit it and see what happens. dontaudit dhcpd_t self:capability net_admin;
# Allow access to the dhcpd file types type dhcp_state_t, file_type, sysadmfile; diff -ru src.orig/policy/domains/program/named.te src/policy/domains/program/named.te --- src.orig/policy/domains/program/named.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/named.te 2004-11-12 23:42:38.000000000 -0200 @@ -60,6 +60,7 @@ # Bind to the named port. allow named_t dns_port_t:udp_socket name_bind; allow named_t { dns_port_t rndc_port_t }:tcp_socket name_bind; +allow named_t self:netlink_route_socket r_netlink_socket_perms;
Added. but again have not seen this.
bool named_write_master_zones false;
diff -ru src.orig/policy/domains/program/ntpd.te src/policy/domains/program/ntpd.te --- src.orig/policy/domains/program/ntpd.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/domains/program/ntpd.te 2004-11-12 23:33:18.000000000 -0200 @@ -22,7 +22,7 @@ # for SSP allow ntpd_t urandom_device_t:chr_file read;
-allow ntpd_t self:capability { setgid setuid sys_time net_bind_service ipc_lock sys_chroot }; +allow ntpd_t self:capability { setgid setuid sys_time net_bind_service ipc_lock sys_chroot net_admin };
This should definitely not be allowed. I can't see why ntpd would want to modify your network environment.
allow ntpd_t self:process { setcap setsched }; # ntpdate wants sys_nice dontaudit ntpd_t self:capability { fsetid sys_nice }; @@ -39,6 +39,7 @@ allow ntpd_t ntp_port_t:udp_socket name_bind; allow ntpd_t self:unix_dgram_socket create_socket_perms; allow ntpd_t self:unix_stream_socket create_socket_perms; +allow ntpd_t self:netlink_route_socket r_netlink_socket_perms;
Same as previous comments about netlink_sockets
# so the start script can change firewall entries allow initrc_t net_conf_t:file { getattr read ioctl }; diff -ru src.orig/policy/macros/program/apache_macros.te src/policy/macros/program/apache_macros.te --- src.orig/policy/macros/program/apache_macros.te 2004-11-01 19:36:22.000000000 -0200 +++ src/policy/macros/program/apache_macros.te 2004-11-12 23:01:49.000000000 -0200 @@ -106,6 +106,7 @@ ############################################################################
r_dir_file(httpd_$1_script_t, httpd_$1_script_ro_t) create_dir_file(httpd_$1_script_t, httpd_$1_script_rw_t) +allow httpd_t { httpd_$1_script_rw_t }:{ file dir lnk_file } { unlink }; ra_dir_file(httpd_$1_script_t, httpd_$1_script_ra_t)
if (httpd_enable_cgi) && (httpd_unified) {
The update policy has the following which would cover this case.
r_dir_file(httpd_t, httpd_sys_script_ro_t) create_dir_file(httpd_t, httpd_sys_script_rw_t) ra_dir_file(httpd_t, httpd_sys_script_ra_t)
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-selinux-list
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-selinux-list
Rodrigo Damazio wrote:
I've made the dontaudit changes you suggested and theyeverything seems to still work. However, I'm still having problems with apache - I use too many PHP functions which do various things such as executing external programs, opening sockets, connecting to postgres, etc. that generate avc denied errors. I tried, thus, to remove apache.te from domains/program, just to find out that mailman depended on it - it gives me an error about mailman_cgi_exec_t (which, indeed, is only defined if apache.te is defined, but it appears in the mailman.fc file without an ifdef - adding an ifdef made it all work perfectly. I wonder if there's a way to use selinux with apache without limiting php functions.
Rodrigo
Not really, that is what httpd_unified boolean was to make apache work with most common environments. I would like to see the AVC messages you are getting on these though. Apache should be able to communicate with postgres using the latest policy. Are you running NIS on this machine?
Dan
selinux@lists.fedoraproject.org
-
Chuck Anderson -
Colin Walters -
Daniel J Walsh -
Rodrigo Damazio