January 2008 - selinux - Fedora Mailing-Lists

by Clarkson, Mike R (US SSA)

I've been testing dynamic transitions with a simple test program that uses setcon to change from one mls level to another, as well as one domain to another. I wrote a policy for this test program and provided all the rules necessary to remove all of the avc denials from the audit log. When I run my program in permissive mode, it works as expected without adding any avc denial messages to the audit log. But when I switch to enforcing mode, the setcon call fails. Maybe there are some dontaudit statements that come with the policy causing this. I'm using RHEL5.1 with the mls policy.Any ideas as to what may be causing this? Since the subject of dynamic transitions seems to raise much angst and gnashing of teeth, I thought I'd ask if there is a better way to solve the problem that we have? I'm investigating dynamic transitions for the following purpose. We have services that we run that take a long time to start up, too long to start them up on demand. We want to have a pool of them up and running, waiting to be tasked by a server. But we'll be running an MLS system with many compartments and possible combinations of compartments so it is not feasible to have services up and running for all the compartment combinations. The idea is to have a pool of services initialize at some default level, and then assign them to the correct level/compartment when tasked. Upon completing a task, a service would shut down and a new service would be started to replace it, at the default level. Two domains would be used. A service initialization domain, and a service running domain. The service initialization domain would have the capability of dynamic transitions. The service running domain would not. Therefore, when the service is tasked, it also dynamically transitions to the correct level and to the service running domain. From that point on it no longer has the capability of further dynamic transitions. If there is a better way to solve this problem, I'd like to know. Thanks

16 years, 4 months

3
7
0 / 0

ALSA problems.

by Dan Thurman

I was forced to install ALSA manually in my F8 system and unfortunately, I discovered that setting /.autorelabel did not correctly set ALSA permissions. I did note that a bug report was filed for this. Meanwhile, I would like a solution to solve my issue, if there is one? Kind regards, Dan No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1213 - Release Date: 1/7/2008 9:14 AM

16 years, 4 months

2
1
0 / 0

sendmail/smrsh f8 avc error

by Tim Fenn

After updating from f7 to f8, it appears smrsh might be mislabelled (using selinux-policy-3.0.8-72.fc8) - or am I missing something? type=AVC msg=audit(1199408924.325:1608): avc: denied { getattr } for pid=10777 comm="sendmail" path="/usr/sbin/smrsh" dev=dm-0 ino=3785966 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1199408924.325:1608): arch=c000003e syscall=4 success=no exit=-13 a0=7fff6e1c7d90 a1=7fff6e1c7c70 a2=7fff6e1c7c70 a3=7fff6e1c7d9f items=0 ppid=10776 pid=10777 auid=4294967295 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0 key=(null) type=AVC msg=audit(1199408924.333:1609): avc: denied { execute } for pid=10777 comm="sendmail" name="smrsh" dev=dm-0 ino=3785966 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1199408924.333:1609): arch=c000003e syscall=59 success=no exit=-13 a0=2aaaaae7a7a0 a1=7fff6e1c8f00 a2=2aaaaadb4b00 a3=0 items=0 ppid=10776 pid=10777 auid=4294967295 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0 key=(null) -Tim -- CAPS LOCK IS THE CRUISE CONTROL OF AWESOMNESS

16 years, 4 months

2
2
0 / 0

Re: miss-match between needs and setroubleshooter's output recommendations

by Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gene Heskett wrote: > On Monday 07 January 2008, Daniel J Walsh wrote: >> ausearch -m avc > > That returned a bunch of stuff starting on the 5th, and includes a whole bunch > of hits from procmail, log related I think, but the /var/log/procmail.log is > being generated ok ANAICT. I have a tail sitting on it now. > > So I trimmed that output to just today and its attached. Still 170kb though. > > And yes, FF is being run as root. I'm working on fixing me to do all this, > but its damnedably difficult to do when I am being denied su and sudo, > despite putting myself in the sudoers list with visudo, when logged in as me, > so I have to run as root in order to actually get anything done. Yes, I am > doing a lot of copying, and chown'ing while trying to get an environment > setup for me that duplicates what root can do. > > Also, none of you guys have headers that allow me to reply all, the addresses > are missing, so I have to do a simple reply which goes to you, and then add > the fedora-selinux-list(a)redhat.com address by hand. I'm assuming you want > this in the archive anyway. > > Also what OS version is this? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkeDVBEACgkQrlYvE4MpobMnhACfQcebVPnBIRIXG8xbDXm7wvdP fsgAoIswstUar3WNI/z07ouTcqFcrXlH =b4zT -----END PGP SIGNATURE-----

16 years, 4 months

2
1
0 / 0

UNCLASSIFIED - Developing Policies for SELinux on Embedded Systems

by HAWKER, Dan 2 (external)

Hi All, Am very much a SELinux Policy Newbie, so please be gentle :) Have been tasked with generating a series of SELinux policies for some embedded Linux devices we are developing. Naturally, time is not in abundance :( The target system is a special stripped-down FC4 variant (i386, about 80MB footprint), we have developed in-house for our embedded platform and runs a custom 2.6.12ish kernel with some modifications for the target hardware. I planned to start with the base reference policy, strip out the bits we don't need (it only runs our own apps plus the minimum to boot) and then add policies for our apps. All presuming the relatively old kernel we are using can handle the ref policy and subsequent libselinux, etc updates of course. Obviously with time being of the essence, I'd like a quick and easy way of developing the appropriate policies. I have looked at the tools that are available at present (SLIDE, SETools, etc) however tbh am a bit confused about what would be the best way forward and whether it'll all work as expected before I spend days/weeks of development time down a dead end. Naturally the embedded nature of the hardware means I am unable to develop directly on the target and as such SLIDE seems a good tool and with the SLIDERemote, would seem a good fit, (install SLIDE on my RHEL5 DevBox and connect to my remote target, which has network access but limited onboard resources). However am just unsure as to whether it will work as expected or indeed if there is another better route or toolset I should take. Any ideas/insights gratefully received :) Thanks for any help Dan -- Dan Hawker Linux System Administrator Astrium http://www.astrium.eads.net -- This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system. Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified. --------------------------------------------------------------------- Astrium Limited, Registered in England and Wales No. 2449259 REGISTERED OFFICE:- Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England

16 years, 4 months

1
0
0 / 0

su user -c problem

by Gene Heskett

Greetings; For years, I have been starting fetchmail as a background daemon by having the line: su user -c "fetchmail -d etc etc" in my rc.local script. Forced to re-install because something wiped the partition table on my boot drive, I installed F8 and I believe its was uptodate as of last night. But, its not running anymore via that procedure, and setroubleshoot's gui will display that it was denied at the time of the boot. It still works perfectly if I cut/paste that line into a root shell after I'm logged in. How can I address this? I've also bz'd it. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) I've found my niche. If you're wondering why I'm not there, there was this little hole in the bottom ... -- John Croll

16 years, 4 months

5
12
0 / 0

miss-match between needs and setroubleshooter's output recommendations

by Gene Heskett

Greetings; I have now been in the center ring of this circus about long enough. selinux is about to get made permissive or disabled. I have now issued these commands: [root@coyote ~]# semanage fcontext -a -t textrel_shlib_t /root/.mozilla/plugins/vorbisrend.so [root@coyote ~]# chcon -t textrel_shlib_t /root/.mozilla/plugins/vorbisrend.so [root@coyote ~]# semanage fcontext -a -t textrel_shlib_t /root/.mozilla/plugins/vorbisrend.so [root@coyote ~]# chcon -t textrel_shlib_t /root/.mozilla/plugins/vorbisrend.so Twice as can be seen, and restarted firefox each time, and each time selinux denies firefox a plugin it needs to pay this site: <http://ed-tharp.kicks-ass.org/ridingmower.mpg> I now have the third denial showing in the setroubleshooter's screen. ----------------- How can I fix this? Thanks. -- Cheers, Gene "There are four boxes to be used in defense of liberty:<> soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Q: How many Zen masters does it take to screw in a light bulb? A: None. The Universe spins the bulb, and the Zen master stays out of the way.

16 years, 4 months

3
2
0 / 0

Any idea what causes this message?

by Knute Johnson

Jan 5 03:19:30 www kernel: audit(1199531970.371:42): avc: denied { append } for pid=29639 comm="sshd" name="btmp" dev=dm-0 ino=2130022 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file I get these once in a while. Can anybody tell what causes them from this? F8 i386. Thanks, -- Knute Johnson Molon Labe...

16 years, 4 months

5
5
0 / 0

Funny AVC from USB CD plugin

by Tom London

Running latest Rawhide, targeted/enforcing. Plugging in an 'old USB CD drive', I got the following audit message: [root@localhost ~]# sealert -l fb77e7e0-3515-4866-9a8f-e1db99f9b4b8 Summary: SELinux is preventing ln(/bin/ln) (udev_t) "create" to <Unknown> (etc_t). Detailed Description: SELinux denied access requested by ln(/bin/ln). It is not expected that this access is required by ln(/bin/ln) and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:udev_t:SystemLow-SystemHigh Target Context system_u:object_r:etc_t Target Objects None [ lnk_file ] Source ln(/bin/ln) Port <Unknown> Host localhost.localdomain Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.2.5-8.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.24-0.136.rc6.git12.fc9 #1 SMP Sat Jan 5 12:46:45 EST 2008 i686 i686 Alert Count 2 First Seen Sun Jan 6 10:30:15 2008 Last Seen Sun Jan 6 10:30:15 2008 Local ID fb77e7e0-3515-4866-9a8f-e1db99f9b4b8 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1199644215.878:31): avc: denied { create } for pid=6933 comm="ln" name=".is-writeable" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file host=localhost.localdomain type=SYSCALL msg=audit(1199644215.878:31): arch=40000003 syscall=83 success=no exit=-13 a0=bff3ddc3 a1=bff3ddcd a2=804f77c a3=0 items=0 ppid=6931 pid=6933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ln" exe="/bin/ln" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) Here are the messages from /var/log/messages: Jan 6 10:30:05 localhost kernel: usb 2-2: new full speed USB device using uhci_hcd and address 4 Jan 6 10:30:06 localhost kernel: usb 2-2: configuration #1 chosen from 1 choice Jan 6 10:30:06 localhost kernel: scsi8 : SCSI emulation for USB Mass Storage devices Jan 6 10:30:06 localhost kernel: usb-storage: device found at 4 Jan 6 10:30:06 localhost kernel: usb-storage: waiting for device to settle before scanning Jan 6 10:30:11 localhost kernel: usb-storage: device scan complete Jan 6 10:30:11 localhost kernel: scsi 8:0:0:0: CD-ROM IBM USB CD-ROM 20A4 PQ: 0 ANSI: 0 CCS Jan 6 10:30:11 localhost kernel: sr1: scsi3-mmc drive: 10x/10x cd/rw xa/form2 cdda pop-up Jan 6 10:30:11 localhost kernel: sr 8:0:0:0: Attached scsi CD-ROM sr1 Jan 6 10:30:11 localhost kernel: sr 8:0:0:0: Attached scsi generic sg2 type 5 Jan 6 10:30:18 localhost setroubleshoot: #012 SELinux is preventing ln(/bin/ln) (udev_t) "create" to <Unknown> (etc_t).#012 For complete SELinux messages. run sealert -l fb77e7e0-3515-4866-9a8f-e1db99f9b4b8 Putting system in permissive mode, I get these: type=AVC msg=audit(1199645179.126:34): avc: denied { create } for pid=7782 comm="ln" name=".is-writeable" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file type=SYSCALL msg=audit(1199645179.126:34): arch=40000003 syscall=83 success=yes exit=0 a0=bfb56db6 a1=bfb56dc0 a2=804f77c a3=0 items=0 ppid=7780 pid=7782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ln" exe="/bin/ln" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1199645179.245:35): avc: denied { unlink } for pid=7783 comm="rm" name=".is-writeable" dev=dm-0 ino=11076747 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file type=SYSCALL msg=audit(1199645179.245:35): arch=40000003 syscall=301 success=yes exit=0 a0=ffffff9c a1=bfa17dc0 a2=0 a3=bfa17dc0 items=0 ppid=7780 pid=7783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rm" exe="/bin/rm" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1199645179.255:36): avc: denied { append } for pid=7780 comm="write_cd_rules" name="70-persistent-cd.rules" dev=dm-0 ino=11076866 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file type=SYSCALL msg=audit(1199645179.255:36): arch=40000003 syscall=5 success=yes exit=3 a0=8a98400 a1=8441 a2=1b6 a3=8441 items=0 ppid=7761 pid=7780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="write_cd_rules" exe="/bin/bash" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) udev issue? tom -- Tom London

16 years, 4 months

2
2
0 / 0

two questions

by Clarkson, Mike R (US SSA)

Is there someplace I can go to find a description of the libselinux API? Is there a way to change the context of an existing process, without having to execute a new process? Thanks

16 years, 4 months

5
9
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2008