July 2009 - selinux - Fedora mailing-lists

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

add a transition rule
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you. Sincerely yours, Vadym Chepkov

4 5

ausearch and terminal
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I observe a very strange behavior of the ausearch utility. audit-1.7.7-6.el5_3.3 # cat /root/bin/autest.sh /sbin/ausearch -m avc| wc -l If I run it, I get expected results: # /root/bin/autest.sh 1563 But if I run it from cron, I get this in e-mail: <no matches> 0 Why?? Sincerely yours, Vadym Chepkov

2 3

Help with SELinux Policy for Usability Study
by Cliffe 30 Jul '09

30 Jul '09

Dear SELinux Gurus, I am a PhD candidate conducting research into the usability of security mechanisms. I would really appreciate some help regarding the use of SELinux. Let me know if this is not the right place to be asking these types of questions. I generated a policy for opera using polgengui. I then ran the generated ./opera.sh. Although SELinux was still set to enforcing mode opera seemed to run unconfined. The executable and process was labelled as expected (unconfined_u:unconfined_r:opera_t). AVCs were generated, but not enforced. I added to opera.te using grep opera /var/log/audit/audit.log | audit2allow >> opera.te and reran ./opera.sh until no AVCs were generated. Looking at opera.te I noticed the line "permissive opera_t", and not knowing exactly what this line does, I thought it may be placing this domain into permissive mode (although the gui tools suggest otherwise). Removing the line causes "/bin/sh: /usr/bin/opera: Permission denied". No AVCs are generated. So I am not sure why opera seams to be unconfined, or if removing the permissive line was on the right track. Any advice? Also I tried creating a policy for kwrite. This time the created policy seemed to be in effect as soon as I ran the kwrite.sh script. I set setenforce 0 and added to kwrite.te (as above for opera) until no error msgs were generated. Then I reran ./kwrite.sh. Now kwrite exists with "kwrite(2533): Couldn't register name '"org.kate-editor.kwrite-2533'" with DBUS -- another process owns it already!". When setenforce 0 it runs without AVCs. Again I am sure I am missing something simple and your advice will help a lot. I need to resolve this asap and will really appreciate any advice. Soon I will be running a comparative study comparing a number of security mechanisms and I need to sort this out. Thank you, Cliffe.

4 5

Selinux Audit "Unmatched Entries"?
by Frank Murphy 30 Jul '09

30 Jul '09

Waht does all this mean from logwatch, What are in plain speak unmatched entries? --------------------- Selinux Audit Begin ------------------------ Number of audit daemon starts: 5 Number of audit daemon stops: 6 **Unmatched Entries** audit(1248863231.539:55834): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248863231.539:55835): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248865986.300:28653): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248865986.300:28654): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248867118.172:28695): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248867118.172:28696): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 config change requested by pid=9598 auid=500 subj=unconfined_u:system_r:initrc_t:s0 audit(1248871767.418:3339) config changed, auid=500 pid=9598 subj=unconfined_u:system_r:initrc_t:s0 res=success ---------------------- Selinux Audit End ------------------------- -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

2 3

latest fc10 kernel and policy seem to be out of sync (kernel_service)
by Ted Toth 30 Jul '09

30 Jul '09

With kernel-2.6.29.6-93.fc10 we are seeing errors in dmesg about kernel_service class not defined in policy. Looking at the selinux-policy source I find no definition of this class. Ted

1 0

Rawhide F12 and Skype AVC
by Frank Murphy 27 Jul '09

27 Jul '09

Following is AVC Do I replace '<unknown>' with skype? > Summary: > > SELinux is preventing skype from changing a writable memory segment executable. > > Detailed Description: > > The skype application attempted to change the access protection of memory (e.g., > allocated using malloc). This is a potential security problem. Applications > should not be doing this. Applications are sometimes coded incorrectly and > request this permission. The SELinux Memory Protection Tests > (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to > remove this requirement. If skype does not work and you need it to work, you can > configure SELinux temporarily to allow this access until the application is > fixed. Please file a bug report > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. > > Allowing Access: > > If you trust skype to run correctly, you can change the context of the > executable to execmem_exec_t. "chcon -t execmem_exec_t '<Unknown>'". You must > also change the default file context files on the system in order to preserve > them even on a full relabel. "semanage fcontext -a -t execmem_exec_t '<Unknown>'" > > Fix Command: > > chcon -t execmem_exec_t '<Unknown>' > > Additional Information: > > Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Objects None [ process ] > Source skype > Source Path <Unknown> > Port <Unknown> > Host (removed) > Source RPM Packages > Target RPM Packages > Policy RPM selinux-policy-3.6.22-2.fc12 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name allow_execmem > Host Name (removed) > Platform Linux internet01.frankly3d.local > 2.6.31-0.86.rc3.git5.fc12.x86_64 #1 SMP Wed Jul 22 > 15:31:34 EDT 2009 x86_64 x86_64 > Alert Count 1 > First Seen Fri 24 Jul 2009 17:38:51 IST > Last Seen Fri 24 Jul 2009 17:38:51 IST > Local ID 6c5beb61-0671-4497-b86d-cd1bf0944901 > Line Numbers > > Raw Audit Messages > > node=internet01.frankly3d.local type=AVC msg=audit(1248453531.351:24900): avc: denied { execmem } for pid=2079 comm="skype" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process > > node=internet01.frankly3d.local type=SYSCALL msg=audit(1248453531.351:24900): arch=c000003e syscall=59 per=400000 success=no exit=-13 a0=1dae08f a1=1c0bcd0 a2=7fff70be3b38 a3=7fff70be2410 items=0 ppid=2078 pid=2079 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="skype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) > > -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

3 3

postfix_smtp_t
by Christoph Höger 27 Jul '09

27 Jul '09

Hi, this is a rather special use case, but I think it is valid. According to Pauls hints at http://marilyn.frields.org:8080/~paul/wordpress/?p=2616 I configured postfix to relay my local mail via some mail servers. But since I like a clean approach I did not want the sasl_password files in /etc/ so that the admin (me) has to handle plain text passwords there. Postfix seems to support multiple db files at arbitrary positions. But SELinux does not. I guess the transition to postfix_smtp_t is a little too early (before chroot). So I changed the context of my sasl_passwd files to postfix_smtp_t, just to notice that: 1. I (as a user) cannot do this 2. After I did it nevertheless I cannot edit those files So here is my proposal: Introduce postfix_userconfig_t and let postfix_smtp_t read it, and allow transitions and read/write access from unconfined_t to it. I know that this is suboptimal because it effectively becomes unconfinded_t, but since the admin _must_ add those files to /etc/postfix/main.cf (and should allow only harmless files) I guess that this is ok. any objections or shall I try to write a patch for the policy?

2 3

SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t
by Edward Kuns 25 Jul '09

25 Jul '09

Just in the past few days I've received seven of this AVC complaint, and I haven't seen any of this complaint before that. On 11 July, I updated selinux to 3.6.12-62.fc11. I currently have clamav-0.95.1-2.fc11.i586, installed on 1 July. I am not aware of anything that changed on or just before the 17th. Any ideas? Here's the sealert: Thanks Eddie Summary: SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t. Detailed Description: SELinux denied access requested by clamd.scan. It is not expected that this access is required by clamd.scan and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_cronjob_t:s0 Target Context system_u:system_r:crond_t:s0-s0:c0.c1023 Target Objects pipe [ fifo_file ] Source clamd.scan Source Path /bin/bash Port <Unknown> Host kilroy.chi.il.us Source RPM Packages bash-4.0-6.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-62.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.29.5-191.fc11.i686.PAE #1 SMP Tue Jun 16 23:19:53 EDT 2009 i686 i686 Alert Count 7 First Seen Fri Jul 17 10:36:13 2009 Last Seen Mon Jul 20 16:36:12 2009 Local ID 39c625f5-4b31-49f2-bb14-57835e8afc61 Line Numbers Raw Audit Messages node=kilroy.chi.il.us type=AVC msg=audit(1248125772.619:80082): avc: denied { write } for pid=3642 comm="clamd.scan" path="pipe:[8230868]" dev=pipefs ino=8230868 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file node=kilroy.chi.il.us type=SYSCALL msg=audit(1248125772.619:80082): arch=40000003 syscall=11 success=yes exit=0 a0=9ef08f0 a1=9ef0910 a2=9eeecb8 a3=9ef0910 items=0 ppid=509 pid=3642 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2000 comm="clamd.scan" exe="/bin/bash" subj=system_u:system_r:system_cronjob_t:s0 key=(null)

4 5

restorecon question
by Vadym Chepkov 23 Jul '09

23 Jul '09

Hi, Could you explain me, please, the behavior of the restorecon utility. I added the following in the local.fc file # phpbb /var/www/phpbb/cache(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) /var/www/phpbb/files(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) compiled and installed policy, seems to be in place. # semanage fcontext -l|grep phpbb /var/www/phpbb/cache(/.*)? all files system_u:object_r:httpd_sys_script_rw_t:s0 /var/www/phpbb/files(/.*)? all files system_u:object_r:httpd_sys_script_rw_t:s0 But when now I run restorecon -vR /var/www/phpbb/ it doesn't do anything. I would expect it to changed context on two directories and files in them. Only if I specify -F (force) I relabel everything. I can't quite grasp why sometimes I don't have to supply -F and sometimes I do. Thank you. Sincerely yours, Vadym Chepkov

5 9

httpd interface question
by Vadym Chepkov 21 Jul '09

21 Jul '09

Hi, I have a question about httpd interface on RedHat 5.3 selinux-policy-targeted-2.4.6-203.el5 I have httpd_unified --> off and I defined domain for subversion: apache_content_template(svn) I labeled my subversion hooks as httpd_svn_script_exec_t and I expected it will be able to read files labeled as httpd_svn_content_t, but it is not the case: type=AVC msg=audit(1247931060.612:40993): avc: denied { read } for pid=21405 comm="svn-mailer" name="svn-mailer.cfg" dev=sda1 ino=773360 scontext=user_u:system_r:httpd_svn_script_t:s0 tcontext=system_u:object_r:httpd_svn_content_t:s0 tclass=file # sesearch -a -s httpd_svn_script_t -t httpd_svn_content_t Found 1 av rules: allow httpd_svn_script_t httpd_svn_content_t : dir { getattr search }; The question is, why only this and nothing else? Sincerely yours, Vadym Chepkov

2 2

policy database
by Stefano Carucci 21 Jul '09

21 Jul '09

Hello all! I would like to ask you experts some details about how the policy binary is managed by the security server. While looking through the code I noticed that the avtab (in security/selinux/ss/avtab.h/c) stores all the needed information about the rules in a hash-table. Then, on the other side there is a policy database, that, as far as I understood is meant for configuration parameters only. So my question is: what is the link betweem the policy binary file and the avtab? Are all the rules loaded into the avtab from the binary file? Is there any mechanism to fast policy lookup from the binary file? Thank you in advance. Stefano _________________________________________________________________ 25 GB di spazio sempre con te. Accedi a SkyDrive! http://www.windowslive.it/skyDrive.aspx

1 0

Trying to cause a denial with rsync and SELinux
by Scott Radvan 19 Jul '09

19 Jul '09

Hello all, I'm having troubles invoking _any_ denial whatsoever for rsync related tasks, in order for me to demonstrate in my book how to then work around it. I've made a custom init script for rsync as there is no existing one in Fedora 11, so I labeled it initrc_exec_t so that the rsync daemon transitions to rsync_t: # ps -eZ | grep rsync unconfined_u:system_r:rsync_t:s0 326 ? 00:00:00 rsync According to the information I have, now that it's running as rsync_t, the following Booleans should have an effect: allow_rsync_anon_write No mattter the state of this Boolean, I can still write to public_content_rw_t files, locally or over the LAN. rsync_client I have very little information on this Boolean and what it actually implies, what it requires in terms of labels, etc. but no matter its state, rsync operates normally as a client reading and writing to a daemonized process on another machine. rsync_export_all_ro Perhaps I'm misinterpreting this one as well, but no matter its state, I can read _and_ write the test files in the directory specified by the rsync daemon, locally and over the network. Really, I'm probably misinterpreting these Booleans and their actual implications, or doing something completely wrong. I simply need a way that I can get SELinux to give me a denial related to rsync (running as a daemon) which I can then document and demonstrate the work-around for. My problem remains that everything works too _well_ and SELinux doesn't seem to be denying any of the access or transfers I'm performing, whatever the state of these Booleans, based on my limited understanding of them. Does anyone have a better understanding of these particular Booleans, what they actually imply, what labels the files need in order to be affected by them, any other condition they require to enforce upon the system...and mainly how I can intentionally invoke a denial based on one of them? Thanks in advance, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

1 0

Would SELinux prevent that with the current policy?
by Christoph Höger 19 Jul '09

19 Jul '09

Hi, after looking at: http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html I wondered if SELinux would not be the right answer to those re-exec exploits. I guess that pulseaudio should run as something like pulseaudio_t which has all caps it needs. Re-exec should not change that as pulseaudio does not need any transformation of context. So short question: Does it work that way?

4 5

Re: spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

--- On Mon, 7/13/09, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > Vadym, can you create a patch for them to add a restorecon > after they create the libraries. You mean to the Fedora package? Sure, I can try, I will cc you on it. It's a perl script so I am not sure how keen maintainer will be to include it 'system' call.

1 0

Re: spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

sa-compile scripts puts them there, it runs manually from the cron. sa-compile call is not part of the standard Fedora package and as I said earlier, this context already exists in the standard policy, furthermore, Dan, you added it the by my request :) But even though it exists, it is being ignored when the library is created, I am not really sure how sa-compile script does it, but 'restorecon -R' afterward seems like an appropriate workaround. Sincerely yours, Vadym Chepkov --- On Mon, 7/13/09, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > From: Daniel J Walsh <dwalsh(a)redhat.com> > Subject: Re: spamassassin pre-compiled rules > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Monday, July 13, 2009, 11:06 AM > On 07/11/2009 08:06 AM, Vadym Chepkov > wrote: > > spamassassin rules got updated recently and I got this > avc > > > > type=AVC msg=audit(1247216252.200:31900): avc: > denied { execute } for pid=24001 comm="spamd" > path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" > dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 > tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file > > > > audit2allow suggests this > > #============= spamd_t ============== > > allow spamd_t spamd_var_lib_t:file execute; > > seems reasonable, but why is it missing in standard > policy? > > > > Sincerely yours, > > Vadym Chepkov > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Vadym, What puts the files in this directory? Are > they all shared libraries? > > One solution would be to label this directory > > # semanage fcontext -a -t lib_t > '/var/lib/spamassassin/compiled(/.*)?' > # restorecon -R -v /var/lib/spamassassin > > >

2 1

semodule/dbus
by Vadym Chepkov 13 Jul '09

13 Jul '09

Everytime I install or update a local selinux module I get a log entry, like this. Jul 11 08:10:36 hut dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=5)#012: exe="?" (sauid=81, hostname=?, addr=?, terminal=?) I wonder what is it about? It doesn't seem to affect anything, but still. Sincerely yours, Vadym Chepkov

3 2

spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

spamassassin rules got updated recently and I got this avc type=AVC msg=audit(1247216252.200:31900): avc: denied { execute } for pid=24001 comm="spamd" path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file audit2allow suggests this #============= spamd_t ============== allow spamd_t spamd_var_lib_t:file execute; seems reasonable, but why is it missing in standard policy? Sincerely yours, Vadym Chepkov

3 3

selinux denying ifconfig, Fedora 11
by Antonio Olivares 13 Jul '09

13 Jul '09

[olivares@ET1161-05 ~]$ dmesg | grep 'avc' type=1400 audit(1247281500.625:4): avc: denied { read } for pid=871 comm="ifconfig" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file [olivares@ET1161-05 ~]$ [olivares@ET1161-05 ~]$ cat /etc/fedora-release Fedora release 11 (Leonidas) [olivares@ET1161-05 ~]$ uname -r 2.6.30.1 smoltProfile here after install if it is useful? http://www.smolts.org/client/show/pub_bf6b4475-b2d9-4796-8965-112b094912de I only called command to check that I was connected while using dialup # ifconfig -a That was it, I saw setroubleshoot pop up but my fonts are very small, and I used above command to give me back avc. Regards, Antonio

3 2

dhclient denial F-11
by Paul Howarth 13 Jul '09

13 Jul '09

I get one of these every time my DHCP lease is renewed: type=AVC msg=audit(1247181873.317:23522): avc: denied { create } for pid=31499 comm="mv" name="yp.conf.predhclient.br0" scontext=unconfined_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file type=SYSCALL msg=audit(1247181873.317:23522): arch=c000003e syscall=2 success=no exit=-13 a0=7fff9e36ebcc a1=c1 a2=180 a3=65726373662f7274 items=0 ppid=31485 pid=31499 auid=1012 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="mv" exe="/bin/mv" subj=unconfined_u:system_r:dhcpc_t:s0 key=(null) It originates from /etc/dhcp/dhclient.d/nis.sh in the ypbind package. Paul..

4 6

Re: Domain transition missing
by Vadym Chepkov 13 Jul '09

13 Jul '09

It would be nice if the interface would be smart enough and allow output from the cron job to be sent, but no one is perfect :) ---- type=AVC msg=audit(1246715821.417:10142): avc: denied { write } for pid=11916 comm="winbind" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file ---- type=AVC msg=audit(1246715821.780:10143): avc: denied { write } for pid=11925 comm="winbindd" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:winbind_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Vadym Chepkov <chepkov(a)yahoo.com> wrote: > From: Vadym Chepkov <chepkov(a)yahoo.com> > Subject: Re: Domain transition missing > To: "Dominick Grift" <domg472(a)gmail.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 10:00 AM > This worked well too, thank you > > system_u:system_r:winbind_t:SystemLow root > 11926 1 0 09:57 ? > 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11928 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11954 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11956 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11957 > 11926 0 09:57 ? 00:00:00 winbindd > > > Sincerely yours, > Vadym Chepkov > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > From: Dominick Grift <domg472(a)gmail.com> > > Subject: Re: Domain transition missing > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > Date: Saturday, July 4, 2009, 9:28 AM > > On Sat, 2009-07-04 at 06:18 -0700, > > Vadym Chepkov wrote: > > > That would be unfortunate. Mine approach is not > > uncommon. If you look closely you will see the same > > technique in wast scripts. spamassassin restarts > itself when > > it updates anti-spam rules, clamav does that > (antivirus) and > > on and on. I use Fedora 11, by the way. > > > > > > For now, instead of creating a new policy I just > added > > 'runcon -t unconfind_t ' in the cron, and it seemed to > did > > the trick. > > > > > > Sincerely yours, > > > Vadym Chepkov > > > > > > > Looking here: > > http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/servi… > > line 235 to line 269. > > > > That seems like a interface one might use in your > > situation: > > > > cron_system_entry(winbind_t, winbind_exec_t) > > > > I admit that using cron with SELinux is not very easy > > currently > > > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > > wrote: > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > Subject: Re: Domain transition missing > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > Date: Saturday, July 4, 2009, 8:57 AM > > > > On Sat, 2009-07-04 at 05:48 -0700, > > > > Vadym Chepkov wrote: > > > > > I really get used to running my > scripts > > unconfined, > > > > how I can accomplish it in this scenario? > > > > > > > > > > Sincerely yours, > > > > > Vadym Chepkov > > > > > > > > > > > > > if you want the system to run jobs you will > need > > to write > > > > some policy or > > > > extend the system_cronjob_t domain i think > > > > > > > > > > > > Were those the only avc denial you got? I > would > > expect more > > > > denials. > > > > > > > > > --- On Sat, 7/4/09, Dominick Grift > <domg472(a)gmail.com> > > > > wrote: > > > > > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > > > Subject: Re: Domain transition > missing > > > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > > > Date: Saturday, July 4, 2009, 8:41 > AM > > > > > > On Sat, 2009-07-04 at 14:38 > +0200, > > > > > > Dominick Grift wrote: > > > > > > > On Sat, 2009-07-04 at 05:11 > -0700, > > Vadym > > > > Chepkov > > > > > > wrote: > > > > > > > > Hi, > > > > > > > > > > > > > > > > Last night I got a > nasty > > surprise from > > > > selinux. I > > > > > > am using winbind for external > > authentication and > > > > since it > > > > > > has history of failures I have a > simple > > watchdog > > > > implemented > > > > > > to check the status and restart it > if > > necessary. > > > > That > > > > > > is what happened last night and > > as a law > > > > abiding > > > > > > selinux citizen I used 'service > winbind > > restart', > > > > but it > > > > > > seems the proper domain > transitions is > > missing > > > > and winbind > > > > > > was started in system_cronjob_t > domain > > instead of > > > > winbind_t > > > > > > and none of other domains could > connect > > to it. > > > > > > > > > > > > > > > > I think jobs running > from > > cron should > > > > be granted > > > > > > the same transition rules as > > from > > > > unconfined_t. > > > > > > > > > > > > > > > > I will file bugzilla > report > > about it, > > > > but could > > > > > > somebody help me with modifying > my > > local policy > > > > until/if it > > > > > > gets implemented, please? Thank > you. > > > > > > > > > > > > > > > > Sincerely yours, > > > > > > > > Vadym > > Chepkov > > > > > > > > > > > > > > A domain transition would > be: > > > > > > > > > > > > > > policy_module(mywinbind, > 0.0.1) > > > > > > > > > > > > > > require { type > system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t; } > > > > > > > > > domain_auto_trans(system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t) > > > > > > > > > > > > > > Can you show us the full raw > avc > > denial? > > > > > > > > > > > > > > > > > > But personally would deal with > this in > > a > > > > different way. I > > > > > > would write > > > > > > policy for the script that > restarts > > winbind and > > > > then i > > > > > > would create a > > > > > > domain transition for the domain > in > > which the > > > > script runs > > > > > > to winbind_t. > > > > > > > > > > > > Mainly because i wouldnt want to > > extend/modify > > > > > > system_cronjob_t > > > > > > > > > > > > So: system_cronjob_t -> > > myscript_exec_t -> > > > > myscript_t > > > > > > -> winbind_exec_t > > > > > > -> winbind_t > > > > > > > > > > > > > > -- > > > > > > > > fedora-selinux-list > mailing > > list > > > > > > > > fedora-selinux-list(a)redhat.com > > > > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

3 2

SELinux and gitosis (FC11)
by Jonathan Stott 13 Jul '09

13 Jul '09

Hi all Today I updated to FC11 and gitosis stopped working (gitosis is a collection of scripts for easing multiuser access to git repositories over ssh). I can tell it's an SELinux problem, because '/sbin/setenforcing 0' clears it up. On the server, the git repositories are managed by the 'git' user, which has the guest_u selinux type (though it also fails when given the user_u user). The home directory (/home/git) has the correct selinux context (user_home_t) as far as I can tell and I've run 'restorecon -Rvv' anyway, just to be sure. gitosis works by calling a system binary, gitosis-serve, which lives in /usr/bin/ and has the type of 'bin_t' so guest_u should be able to execute it. Even with 'setenforcing 0' no AVC denials are created though. Checking /var/log/secure shows that the key is being accepted, and it seems like the process then hangs. Any suggestions appreciated, Regards Jon

4 10

Re: spamassassin pre-compiled rules
by Vadym Chepkov 12 Jul '09

12 Jul '09

I figured it out. There is a proper label in the policy /var/lib/spamassassin/compiled/.*\.so.* regular file system_u:object_r:lib_t:s0 It seems when a script that compiles this library runs, it creates shared libraries with spamd_var_lib_t instead. So I guess the only way to fix this issue is to run restorecon -R /var/lib/spamassassin/compiled/ right after sa-compile finishes. Sincerely yours, Vadym Chepkov --- On Sat, 7/11/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: spamassassin pre-compiled rules > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 11, 2009, 12:38 PM > On Sat, 2009-07-11 at 05:06 -0700, > Vadym Chepkov wrote: > > spamassassin rules got updated recently and I got this > avc > > > > type=AVC msg=audit(1247216252.200:31900): avc: > denied { execute } for pid=24001 comm="spamd" > path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" > dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 > tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file > > > > audit2allow suggests this > > #============= spamd_t ============== > > allow spamd_t spamd_var_lib_t:file execute; > > seems reasonable, but why is it missing in standard > policy? > > > > Sincerely yours, > > Vadym Chepkov > > Is that file part of the package? > /var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so > > It is probably created by spamd_t. > > The problem is that if you allow spamd_t to execute files > with type > spamd_var_lib_t then spamd_t can run everything > in /var/lib/spamassassin. > > This is not so nice but it might not be a problem either > > Looking at the path it appears that spamd put compiled > stuff > under /var/lib/spamassassin/compiled/ > > assuming that all stuff under there should be executable by > spamd_t, one > could consider to introduce a new type for spamd_t > executable files > there. > > That would look something like this: > > myspamd.te: > policy_module(myspamd, 0.0.1) > type spamd_var_lib_exec_t; > files_type(spamd_var_lib_exec_t) > require { type spamd_t; } > filetrans_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t, > { dir file }) > manage_dirs_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > manage_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > exec_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > > myspamd.fc: > /var/lib/spamassassin/compiled(/.*)? -- > gen_context(system_u:object_r:spamd_var_lib_exec_t, s0) > > But i guess that depends on your security requirements > > For now this could be considered a bug in selinux-policy > > > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list >

2 2

SELinux is preventing gconf-defaults- (gconfdefaultsm_t) "read" security_t.
by Robert Nichols 11 Jul '09

11 Jul '09

When trying to set a new default for Power Management Preferences: Detailed Description: SELinux denied access requested by gconf-defaults-. It is not expected that this access is required by gconf-defaults- and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 Target Context system_u:object_r:security_t:s0 Target Objects mls [ file ] Source gconf-defaults- Source Path /usr/libexec/gconf-defaults-mechanism Port <Unknown> Host omega-3p.local Source RPM Packages GConf2-2.26.2-1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-53.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name omega-3p.local Platform Linux omega-3p.local 2.6.29.5-191.fc11.i586 #1 SMP Tue Jun 16 23:11:39 EDT 2009 i686 i686 Alert Count 2 First Seen Fri 10 Jul 2009 04:20:11 PM CDT Last Seen Fri 10 Jul 2009 04:20:11 PM CDT Local ID de1d32d5-dded-47ec-9eb5-9dc8167a8685 Line Numbers Raw Audit Messages node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { read } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { open } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=SYSCALL msg=audit(1247260811.959:37): arch=40000003 syscall=5 success=yes exit=3 a0=bfd414e8 a1=8000 a2=0 a3=bfd414e8 items=0 ppid=3540 pid=3541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gconf-defaults-" exe="/usr/libexec/gconf-defaults-mechanism" subj=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 key=(null) -- Bob Nichols "NOSPAM" is really part of my email address. Do NOT delete it.

2 2

Question about split betweeen delivered and local policy
by David Highley 10 Jul '09

10 Jul '09

Seems with every new version of Fedora there are several modifications to selinux policy that we need to do. So were trying to understand where the split is between creating a bug report and when we need to create local policy modifications. For example, email seems to always need selinux policy changes so that avc's are not blocking spamassassin and pyzor. We did a tar with option --xattrs on a Fedora 10 system for home directories and were not able to restore the tar on a Fedora 11 until we did a policy change. Still ended up needing to a restorecon on the home directories. We wonder if poking these holes in the delivered policies is the correct fix or are we opening up unnecessary security holes.

3 4

selinux and rsync
by Scott Radvan 09 Jul '09

09 Jul '09

Hi all, Having a bit of trouble with rsync on F11 for the managing confined services book I am working on. I am trying to demonstrate the allow_rsync_anon_write boolean as a configuration example by invoking a denial and detailing the subsequent work-around, but rsyncd is happily letting me anonymously read and write files across the network no matter the state of the boolean. The default install of F11 I'm using as a server has a simple 'files' rsyncd module (in daemon mode) set up in rsyncd.conf which by itself should allow access anonymously, but my understanding is that SELinux should still over-ride this and stop anonymous writes even with this loose rsyncd setup. /etc/rsyncd.conf: log file = /var/log/rsyncd.log pid file = /var/run/rsyncd.pid local file = /var/run/rsync.lock [files] path = /srv/files comment = file area read only = false >From the F11 client: $ rsync -avHPAX 100M_file <server_addr>::files sending incremental file list 100M_file 104857600 100% 52.37MB/s 0:00:01 (xfer#1, to-check=0/1) sent 104870493 bytes received 27 bytes 41948208.00 bytes/sec total size is 104857600 speedup is 1.00 $ My rsync command is entered so that it will preserve extended attributes (-X) and ACLs (-A), as shown in rsync(1). But I am getting no denials or errors, SELinux does not seem to be having a problem with me doing anonymous writes/reads with allow_rsync_anon_write --> off Perhaps I'm doing something wrong altogether, or misinterpreting this boolean, but I would have thought SELinux would have a problem with me performing this rsync operation while that boolean is off. Further, rsync_selinux(8) says: "SELinux requires files to have an extended attribute to define the file type. Policy governs the access daemons have to these files. If you want to share files using the rsync daemon, you must label the files and directories public_content_t" But my manually-created path for rsync files is var_t, as is the file I copied over, with no denial mentioning public_content_t - is this man page out of date? My problem is that it all works too easily! I would have thought SELinux would not at all be happy with what I'm doing, but I'm yet to get a single denial. What am I doing wrong? Thanks, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

2 1

removing context
by Brian Krusic 08 Jul '09

08 Jul '09

Hi, When doing an ls -lZ, some files show a security context like; root:object_r:user_home_t:s0 ... while some don't. Does any one know how to remove this context either on a file, dir or file system level? This would solve my dump/restore issue as even though they work, dump level 9 for example is being treated as a 0 because of the error. - Brian

3 4

getpwnam and SELinux
by Brian Ginn 08 Jul '09

08 Jul '09

I have an app that I'm trying to confine. In enforcing mode, getpwnam() returns "X" for the pw_passwd field. Is there SELinux policy to allow this app to get the shadow passwd? I've tried the following without success: auth_can_read_shadow_passwords( ) auth_read_shadow( ) auth_tunable_read_shadow( ) auth_use_nsswitch( ) Thanks, Brian

2 6

dump/restore EA errors
by Brian Krusic 08 Jul '09

08 Jul '09

Hi, Not sure if even this is were I should post so forgive the mis- posting. I did a search for selinux help and this is were I got. I'm running RHEL 5 and am having SE linux issues even though I have SE Linux disabled. I have basic support and they really are of no help on this matter. My scenario; RHEL 5 NFS server (although it can be a Centos NFS server or even a BlueArc). Centos 5 NFS client. Dump/Restore. From my NFS client I do; dump -f - / | restore -r -r - I can get screen loads of stuff like; restore: ./etc/ysyconfig/network-scripts/ifcfg-eth0: EA set security.selinux:system_u:object_r:etc_t:s0 failed: Operation not supported. This happens on various files in various folders. The dump/restore does complete and the files do get restored. lsattr shows nothing set on the source files and when doing it on the NFS share, I get; lsattr: Inappropriate ioctl for device While reading flags on .... (this is various dirs). Any clues are appreciated. Thanks in advance, - Brian

2 3

rpm post install can't install pp files
by Shintaro Fujiwara 07 Jul '09

07 Jul '09

Hi, when I tried to install my.pp by post install script in my.rpm, I go semodule: my.pp Failed ! But I could succeed in tar-ball file, why ? Thanks in advance. -- http://intrajp.no-ip.com/ Home Page

2 2

sVirt
by Gene Czarcinski 07 Jul '09

07 Jul '09

I am having some problems with the design/implementation of sVirt for Fedora- virtualization on Fedora 11. 1. I am a longtime user of Fedora since FC1 and, prior to that, I used Red Hat Linux. 2. I am a big fan of SELinux and have been using it since FC3 and always run in enforcing mode. I get upset/angry when someone suggests disabling SELinux to "fix" my problems. If there is a "bug", report it and get it fixed ... do not ignore it. 3. I have also been a longtime user of VMware. However, with Fedora- virtualization on Fedora 11, I decided to "change my problem set" and give Fedora-virtualization a try ... especially since I now have an AMD Phenom II 940 which supports hardware virtualization. I have researched and found a number of documents which provide some of the goals, etc. for sVirt. However, I have hit some undesirable characteristics and bad side effects in dealing with ISO images. First of all, sVirt changes/sets the file context for any virtual disk, ISO image, or device (e.g., /dev/sr0) ... I am not sure what happens with LVM logical volumes because I have not tried them yet. I understand that, with mandatory access control, a process should be denied access to all resources except those which have been explicitly permitted. I assume this is the reason for setting/changing the file context. For ISO images, this is BAD! I have an apache (httpd) server running which has access to my repository of ISO images. After I create a virtual guest and point to an ISO image in the repository, the apache server can no longer see that ISO image! Bad, BAD! Yes, I know restorecon will fix things up but this should not happen in the first place. Another (related) problem is that I cannot use an ISO image file on a read-only mounted file system. Why? Just what is being protected here? As currently implemented, there is no protection between guests with respect to their individual virtual disk files. This really does need doing and it will be interesting to see how it will be done by SELinux (assuming this is protected by Fedora-virtualization applications software is not good enough). Some suggestions: 1. I am not sure what should be done with real devices such as /dev/sr0. 2. For files on read-only file systems, don't do anything ... they are protected about as much as they can be. 3. For files in /var/lib/libvirt/images, set the file context as is now done. This is also true if I locate my read/write virtual disk (file) elsewhere. 4. For ISO files, maybe there should be a new/special file context which allows sharing between processes ... it would be explicit but it would allow sharing ... maybe something like "public_content_t". 5. Maybe implement a switch which disables SELinux enforcing (and does not change the file context of ISO files) for Fedora-virtualization. 6. Maybe the switch should be by guest. - - - - - OK, I can see where locking down Fedora-virtualization with mandatory access control would be very interesting to some organizations such as NSA but that this would be used in a very rigidly controlled and limited system. But, this stuff has to be usable in other environments too. - - - - - - Finally ... IMHO, the design/implementation of SELinux for Fedora- virtualization was a bit of a quick-and-dirty approach ... do what we know how to do. I suggest that maybe some SELinux folks and some key Fedora- virtualization (especially libvirt) folks should take a week off (or maybe just a weekend), go off somewhere where you will not be bothered, and the figure out what should be done ... not "how" ... just the "should" at first. Then after some time has passed so that folks have had time to think about it, have another "session" where the "how" is considered and a roadmap is created. Just some food for thought. Gene

7 16

Confining stunnel started from init script
by Allen Kistler 06 Jul '09

06 Jul '09

Since F7, I've started stunnel as a daemon from an init script. In F11, I'm confining it using SELinux, instead of just letting it run as initrc_t. However, I've got two questions. First: I think at some point, it might be worth submitting what I've done as an enhancement, minor though it may be, to stunnel. In my case, I use stunnel to establish an SSL tunnel to my ISP's smtps port from sendmail. Since I bind stunnel locally to tcp/465, I can't define stunnel_port_t (the pre-existing label for whatever port the end user chooses to use) as tcp/465 because tcp/465 is already labeled as smtp_port_t. What I've done is: bool stunnel_can_sendmail false; if (stunnel_can_sendmail) { allow stunnel_t smtp_port_t : tcp_socket name_bind; }; Does this seem the most reasonable way to do things with ports already labeled? For a more general policy, that would mean a Boolean for every port label. Hmm.... Second: What's the syntax in the TE file to get descriptive text attached to a Boolean declaration? Right now I get: # semanage boolean -l | grep stunnel_can_sendmail stunnel_can_sendmail -> on stunnel_can_sendmail But I'd prefer something more informative and cosmetically pleasing like: # semanage boolean -l | grep xen_use_nfs xen_use_nfs -> off Allow xen to manage nfs files Thanks for any info and assistance.

3 5

Re: Domain transition missing
by Vadym Chepkov 06 Jul '09

06 Jul '09

I really get used to running my scripts unconfined, how I can accomplish it in this scenario? Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 8:41 AM > On Sat, 2009-07-04 at 14:38 +0200, > Dominick Grift wrote: > > On Sat, 2009-07-04 at 05:11 -0700, Vadym Chepkov > wrote: > > > Hi, > > > > > > Last night I got a nasty surprise from selinux. I > am using winbind for external authentication and since it > has history of failures I have a simple watchdog implemented > to check the status and restart it if necessary. That > is what happened last night and as a law abiding > selinux citizen I used 'service winbind restart', but it > seems the proper domain transitions is missing and winbind > was started in system_cronjob_t domain instead of winbind_t > and none of other domains could connect to it. > > > > > > I think jobs running from cron should be granted > the same transition rules as from unconfined_t. > > > > > > I will file bugzilla report about it, but could > somebody help me with modifying my local policy until/if it > gets implemented, please? Thank you. > > > > > > Sincerely yours, > > > Vadym Chepkov > > > > A domain transition would be: > > > > policy_module(mywinbind, 0.0.1) > > > > require { type system_cronjob_t, winbind_exec_t, > winbind_t; } > > domain_auto_trans(system_cronjob_t, winbind_exec_t, > winbind_t) > > > > Can you show us the full raw avc denial? > > > But personally would deal with this in a different way. I > would write > policy for the script that restarts winbind and then i > would create a > domain transition for the domain in which the script runs > to winbind_t. > > Mainly because i wouldnt want to extend/modify > system_cronjob_t > > So: system_cronjob_t -> myscript_exec_t -> myscript_t > -> winbind_exec_t > -> winbind_t > > > > -- > > > fedora-selinux-list mailing list > > > fedora-selinux-list(a)redhat.com > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > >

3 2

Re: Strange denials
by Vadym Chepkov 06 Jul '09

06 Jul '09

I barely redirect output of a cron job to /dev/null :( Is the a way to run cron unconfined? I don't see any boolean anymore. Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Kévin GUERIN <leguerinos(a)gmail.com> wrote: > From: Kévin GUERIN <leguerinos(a)gmail.com> > Subject: Re: Strange denials > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 10:55 AM > winbindd is running with no MCS > categories and tries to access a file with c0.c0123. > > Access will be granted only if winbindd runs with all the > categories that has the file it wants to interact with. > > Kévin > > > 2009/7/4 Vadym Chepkov <chepkov(a)yahoo.com> > > > > Ok, I am lost > > > > I clearly allowed this. > > > > allow winbind_t crond_t:fifo_file write; > > > > I can see it in the policy: > > sesearch --all --source winbind_t --target crond_t > > Found 3 semantic av rules: > > allow winbind_t crond_t : process sigchld ; > > allow winbind_t crond_t : fd use ; > > allow winbind_t crond_t : fifo_file { ioctl read write > getattr lock append open } ; > > > > Why do I get denial anyway? > > > > time->Sat Jul 4 10:28:01 2009 > > type=SYSCALL msg=audit(1246717681.676:10436): arch=40000003 > syscall=11 success=yes exit=0 a0=9073c10 a1=9073358 > a2=90732a8 a3=9073358 items=0 ppid=20323 pid=20324 auid=0 > uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=(none) ses=777 comm="winbindd" > exe="/usr/sbin/winbindd" > subj=system_u:system_r:winbind_t:s0 key=(null) > > > type=AVC msg=audit(1246717681.676:10436): avc: denied { > write } for pid=20324 comm="winbindd" > path="pipe:[611496]" dev=pipefs ino=611496 > scontext=system_u:system_r:winbind_t:s0 > tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 > tclass=fifo_file > > > > > > > Sincerely yours, > > Vadym Chepkov > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > >

2 1

Strange denials
by Vadym Chepkov 06 Jul '09

06 Jul '09

Ok, I am lost I clearly allowed this. allow winbind_t crond_t:fifo_file write; I can see it in the policy: sesearch --all --source winbind_t --target crond_t Found 3 semantic av rules: allow winbind_t crond_t : process sigchld ; allow winbind_t crond_t : fd use ; allow winbind_t crond_t : fifo_file { ioctl read write getattr lock append open } ; Why do I get denial anyway? time->Sat Jul 4 10:28:01 2009 type=SYSCALL msg=audit(1246717681.676:10436): arch=40000003 syscall=11 success=yes exit=0 a0=9073c10 a1=9073358 a2=90732a8 a3=9073358 items=0 ppid=20323 pid=20324 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=777 comm="winbindd" exe="/usr/sbin/winbindd" subj=system_u:system_r:winbind_t:s0 key=(null) type=AVC msg=audit(1246717681.676:10436): avc: denied { write } for pid=20324 comm="winbindd" path="pipe:[611496]" dev=pipefs ino=611496 scontext=system_u:system_r:winbind_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file Sincerely yours, Vadym Chepkov

3 2

QEMU in Fedora 10
by John Smith 06 Jul '09

06 Jul '09

Hello, I'm working on QEMU right now on Fedora 10. Interestingly I QEMU runs in qemu_unconfined_t. as I have not changed any of the labelling of my qemu files ( chroot directory, qemu filesystem image). I find it working with them with no denial messages. I have checked the policy for qemu on tresys refpolicy trunk, which somehow make the QEMU unconfined. Is this true? _________________________________________________________________ With Windows Live, you can organise, edit, and share your photos. http://clk.atdmt.com/UKM/go/134665338/direct/01/

2 1

sysstat policy
by Vadym Chepkov 06 Jul '09

06 Jul '09

It seems sysstat policy in Fedora 11 needs adjustment, it didn't happen before: type=AVC msg=audit(1246506781.781:1687): avc: denied { read } for pid=16924 comm="find" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:sysstat_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file Sincerely yours, Vadym Chepkov

3 2

kismet - DBUS AVCs
by Christoph A. 05 Jul '09

05 Jul '09

Hi, I'm running fedora 11. rpm -qa selinux* selinux-policy-3.6.12-53.fc11.noarch selinux-policy-targeted-3.6.12-53.fc11.noarch When I try to start kismet it failes with this error: WARNING: Failed to connect to DBUS system, will not be able to control networkmanager: Failed to connect to socket /var/run/dbus/system_bus_socket: Permission denied WARNING: Failed to send 'sleep' command to networkmanager via DBUS, NM may try to take control of the interfaces still.FATAL: Dump file error: Unable to open dump file /home/kismet/dump/Jul-05-2009-14-26-09.dump (No such file or directory) Sending termination request to channel control child 10743... WARNING: Error disabling monitor mode: mode set ioctl failed 16:Device or resource busy WARNING: WIFI5100AGN (wlan0) left in an unknown state. You may need to manually restart or reconfigure it for normal operation. WARNING: Sometimes cards don't always come out of monitor mode cleanly. If your card is not fully working, you may need to restart or reconfigure it for normal operation. Waiting for channel control child 10743 to exit... Trying to wake networkmanager back up... WARNING: Failed to connect to DBUS system, will not be able to control networkmanager: Failed to connect to socket /var/run/dbus/system_bus_socket: Permission denied WARNING: Failed to send 'wake' command to networkmanager via DBUS, NM may still be inactive.Kismet exiting. log: node=localhost.localdomain type=AVC msg=audit(1246795836.328:420): avc: denied { search } for pid=10334 comm="kismet_server" name="dbus" dev=dm-1 ino=2000053 scontext=unconfined_u:unconfined_r:kismet_t:s0-s0:c0.c1023 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=dir node=localhost.localdomain type=SYSCALL msg=audit(1246795836.328:420): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfe50b20 a2=bbeff4 a3=bfe50ccc items=0 ppid=10333 pid=10334 auid=500 uid=492 gid=496 euid=492 suid=492 fsuid=492 egid=496 sgid=496 fsgid=496 tty=pts0 ses=1 comm="kismet_server" exe="/usr/bin/kismet_server" subj=unconfined_u:unconfined_r:kismet_t:s0-s0:c0.c1023 key=(null) while searching the web I found a old but similar issue: http://www.linux-archive.org/fedora-selinux-support/195736-further-selinux-… What should I do to successfully start kismet (without disabling SELinux)? thanks Christoph (kismet.conf attached)

2 7

Re: Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

This worked well too, thank you system_u:system_r:winbind_t:SystemLow root 11926 1 0 09:57 ? 00:00:00 winbindd system_u:system_r:winbind_t:SystemLow root 11928 11926 0 09:57 ? 00:00:00 winbindd system_u:system_r:winbind_t:SystemLow root 11954 11926 0 09:57 ? 00:00:00 winbindd system_u:system_r:winbind_t:SystemLow root 11956 11926 0 09:57 ? 00:00:00 winbindd system_u:system_r:winbind_t:SystemLow root 11957 11926 0 09:57 ? 00:00:00 winbindd Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 9:28 AM > On Sat, 2009-07-04 at 06:18 -0700, > Vadym Chepkov wrote: > > That would be unfortunate. Mine approach is not > uncommon. If you look closely you will see the same > technique in wast scripts. spamassassin restarts itself when > it updates anti-spam rules, clamav does that (antivirus) and > on and on. I use Fedora 11, by the way. > > > > For now, instead of creating a new policy I just added > 'runcon -t unconfind_t ' in the cron, and it seemed to did > the trick. > > > > Sincerely yours, > > Vadym Chepkov > > > > Looking here: > http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/servi… > line 235 to line 269. > > That seems like a interface one might use in your > situation: > > cron_system_entry(winbind_t, winbind_exec_t) > > I admit that using cron with SELinux is not very easy > currently > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > Subject: Re: Domain transition missing > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > Date: Saturday, July 4, 2009, 8:57 AM > > > On Sat, 2009-07-04 at 05:48 -0700, > > > Vadym Chepkov wrote: > > > > I really get used to running my scripts > unconfined, > > > how I can accomplish it in this scenario? > > > > > > > > Sincerely yours, > > > > Vadym Chepkov > > > > > > > > > > if you want the system to run jobs you will need > to write > > > some policy or > > > extend the system_cronjob_t domain i think > > > > > > > > > Were those the only avc denial you got? I would > expect more > > > denials. > > > > > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > > > wrote: > > > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > > Subject: Re: Domain transition missing > > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > > Date: Saturday, July 4, 2009, 8:41 AM > > > > > On Sat, 2009-07-04 at 14:38 +0200, > > > > > Dominick Grift wrote: > > > > > > On Sat, 2009-07-04 at 05:11 -0700, > Vadym > > > Chepkov > > > > > wrote: > > > > > > > Hi, > > > > > > > > > > > > > > Last night I got a nasty > surprise from > > > selinux. I > > > > > am using winbind for external > authentication and > > > since it > > > > > has history of failures I have a simple > watchdog > > > implemented > > > > > to check the status and restart it if > necessary. > > > That > > > > > is what happened last night and > as a law > > > abiding > > > > > selinux citizen I used 'service winbind > restart', > > > but it > > > > > seems the proper domain transitions is > missing > > > and winbind > > > > > was started in system_cronjob_t domain > instead of > > > winbind_t > > > > > and none of other domains could connect > to it. > > > > > > > > > > > > > > I think jobs running from > cron should > > > be granted > > > > > the same transition rules as > from > > > unconfined_t. > > > > > > > > > > > > > > I will file bugzilla report > about it, > > > but could > > > > > somebody help me with modifying my > local policy > > > until/if it > > > > > gets implemented, please? Thank you. > > > > > > > > > > > > > > Sincerely yours, > > > > > > > Vadym > Chepkov > > > > > > > > > > > > A domain transition would be: > > > > > > > > > > > > policy_module(mywinbind, 0.0.1) > > > > > > > > > > > > require { type system_cronjob_t, > > > winbind_exec_t, > > > > > winbind_t; } > > > > > > > domain_auto_trans(system_cronjob_t, > > > winbind_exec_t, > > > > > winbind_t) > > > > > > > > > > > > Can you show us the full raw avc > denial? > > > > > > > > > > > > > > > But personally would deal with this in > a > > > different way. I > > > > > would write > > > > > policy for the script that restarts > winbind and > > > then i > > > > > would create a > > > > > domain transition for the domain in > which the > > > script runs > > > > > to winbind_t. > > > > > > > > > > Mainly because i wouldnt want to > extend/modify > > > > > system_cronjob_t > > > > > > > > > > So: system_cronjob_t -> > myscript_exec_t -> > > > myscript_t > > > > > -> winbind_exec_t > > > > > -> winbind_t > > > > > > > > > > > > -- > > > > > > > fedora-selinux-list mailing > list > > > > > > > fedora-selinux-list(a)redhat.com > > > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > > > > > > > > > > > > > >

1 0

Re: Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

That would be unfortunate. Mine approach is not uncommon. If you look closely you will see the same technique in wast scripts. spamassassin restarts itself when it updates anti-spam rules, clamav does that (antivirus) and on and on. I use Fedora 11, by the way. For now, instead of creating a new policy I just added 'runcon -t unconfind_t ' in the cron, and it seemed to did the trick. Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 8:57 AM > On Sat, 2009-07-04 at 05:48 -0700, > Vadym Chepkov wrote: > > I really get used to running my scripts unconfined, > how I can accomplish it in this scenario? > > > > Sincerely yours, > > Vadym Chepkov > > > > if you want the system to run jobs you will need to write > some policy or > extend the system_cronjob_t domain i think > > > Were those the only avc denial you got? I would expect more > denials. > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > Subject: Re: Domain transition missing > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > Date: Saturday, July 4, 2009, 8:41 AM > > > On Sat, 2009-07-04 at 14:38 +0200, > > > Dominick Grift wrote: > > > > On Sat, 2009-07-04 at 05:11 -0700, Vadym > Chepkov > > > wrote: > > > > > Hi, > > > > > > > > > > Last night I got a nasty surprise from > selinux. I > > > am using winbind for external authentication and > since it > > > has history of failures I have a simple watchdog > implemented > > > to check the status and restart it if necessary. > That > > > is what happened last night and as a law > abiding > > > selinux citizen I used 'service winbind restart', > but it > > > seems the proper domain transitions is missing > and winbind > > > was started in system_cronjob_t domain instead of > winbind_t > > > and none of other domains could connect to it. > > > > > > > > > > I think jobs running from cron should > be granted > > > the same transition rules as from > unconfined_t. > > > > > > > > > > I will file bugzilla report about it, > but could > > > somebody help me with modifying my local policy > until/if it > > > gets implemented, please? Thank you. > > > > > > > > > > Sincerely yours, > > > > > Vadym Chepkov > > > > > > > > A domain transition would be: > > > > > > > > policy_module(mywinbind, 0.0.1) > > > > > > > > require { type system_cronjob_t, > winbind_exec_t, > > > winbind_t; } > > > > domain_auto_trans(system_cronjob_t, > winbind_exec_t, > > > winbind_t) > > > > > > > > Can you show us the full raw avc denial? > > > > > > > > > But personally would deal with this in a > different way. I > > > would write > > > policy for the script that restarts winbind and > then i > > > would create a > > > domain transition for the domain in which the > script runs > > > to winbind_t. > > > > > > Mainly because i wouldnt want to extend/modify > > > system_cronjob_t > > > > > > So: system_cronjob_t -> myscript_exec_t -> > myscript_t > > > -> winbind_exec_t > > > -> winbind_t > > > > > > > > -- > > > > > fedora-selinux-list mailing list > > > > > fedora-selinux-list(a)redhat.com > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > >

2 1

Re: Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

Thank you Every single daemon out there was choking, just a few: type=AVC msg=audit(1246707387.606:8922): avc: denied { connectto } for pid=1313 comm="dovecot-auth" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:dovecot_auth_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707463.608:8931): avc: denied { connectto } for pid=6828 comm="sendmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707468.105:8932): avc: denied { connectto } for pid=6841 comm="procmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:procmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707508.622:8935): avc: denied { connectto } for pid=6847 comm="sendmail" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707508.629:8936): avc: denied { connectto } for pid=6851 comm="dbus-daemon-lau" path="/var/run/winbindd/pipe" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707632.720:8963): avc: denied { connectto } for pid=7855 comm="pop3" path="/var/run/winbindd/pipe" scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1246707632.732:8964): avc: denied { connectto } for pid=7857 comm="dbus-daemon-lau" path="/var/run/winbindd/pipe" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_cronjob_t:s0 tclass=unix_stream_socket Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: Domain transition missing > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 8:38 AM > On Sat, 2009-07-04 at 05:11 -0700, > Vadym Chepkov wrote: > > Hi, > > > > Last night I got a nasty surprise from selinux. I am > using winbind for external authentication and since it has > history of failures I have a simple watchdog implemented to > check the status and restart it if necessary. That is > what happened last night and as a law abiding selinux > citizen I used 'service winbind restart', but it seems the > proper domain transitions is missing and winbind was started > in system_cronjob_t domain instead of winbind_t and none of > other domains could connect to it. > > > > I think jobs running from cron should be granted the > same transition rules as from unconfined_t. > > > > I will file bugzilla report about it, but could > somebody help me with modifying my local policy until/if it > gets implemented, please? Thank you. > > > > Sincerely yours, > > Vadym Chepkov > > A domain transition would be: > > policy_module(mywinbind, 0.0.1) > > require { type system_cronjob_t, winbind_exec_t, winbind_t; > } > domain_auto_trans(system_cronjob_t, winbind_exec_t, > winbind_t) > > Can you show us the full raw avc denial? > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > >

2 1

Domain transition missing
by Vadym Chepkov 04 Jul '09

04 Jul '09

Hi, Last night I got a nasty surprise from selinux. I am using winbind for external authentication and since it has history of failures I have a simple watchdog implemented to check the status and restart it if necessary. That is what happened last night and as a law abiding selinux citizen I used 'service winbind restart', but it seems the proper domain transitions is missing and winbind was started in system_cronjob_t domain instead of winbind_t and none of other domains could connect to it. I think jobs running from cron should be granted the same transition rules as from unconfined_t. I will file bugzilla report about it, but could somebody help me with modifying my local policy until/if it gets implemented, please? Thank you. Sincerely yours, Vadym Chepkov

2 2

proftpd and mod_ban
by Paul Howarth 03 Jul '09

03 Jul '09

proftpd's mod_ban uses shared memory, so I needed to add this policy locally on F-11: # Proftpd needs shared memory for mod_ban allow ftpd_t self:shm create_shm_perms; Paul.

2 1

Supporting multiple OS releases
by Rob Crittenden 01 Jul '09

01 Jul '09

In the freeIPA project we have our own SELinux policy. We support RHEL 5 up through Fedora Rawhide. With Fedora 11 we saw some problems compiling our SELinux module which Dan Walsh provided a patch for. I haven't tried this on older releases yet but I'm guessing it won't work as expected (some policies seem to have been renamed, such as corenet_non_ipsec_sendrecv() -> corenet_all_recvfrom_unlabeled() My question is, how can we handle this in our source tree? Are we going to need to maintain per-release policies or does SELinux support some sort of versioning conditionals? thanks rob

5 10

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2009