June 2010 - selinux - Fedora Mailing-Lists

by Radha Venkatesh (radvenka)

During the startup of one of our process, I notice a lot of avc denial messages for ptrace, as shown below. I have tried the suggestions by audit2allow, used the various macros for ptrace (also pasted below), but nothing seems to work. Could you help? type=AVC msg=audit(1277403181.796:261073): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.796:261073): arch=40000003 syscall=3 success=yes exit=181 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.797:261074): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=system_u:system_r:setrans_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.797:261074): arch=40000003 syscall=3 success=yes exit=183 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.799:261075): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.799:261075): arch=40000003 syscall=3 success=yes exit=187 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.799:261076): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.799:261076): arch=40000003 syscall=3 success=yes exit=185 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.800:261077): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.800:261077): arch=40000003 syscall=3 success=yes exit=203 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.801:261078): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=root:system_r:auditd_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1277403181.801:261078): arch=40000003 syscall=3 success=yes exit=200 a0=7 a1=11f900 a2=3ff a3=11f8a0 items=0 ppid=27313 pid=27314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ps" exe="/bin/ps" subj=system_u:system_r:servm_t:s0 key=(null) type=AVC msg=audit(1277403181.801:261079): avc: denied { ptrace } for pid=27314 comm="ps" scontext=system_u:system_r:servm_t:s0 tcontext=root:system_r:audisp_t:s0-s0:c0.c1023 tclass=process The audit2allow tools suggests the below allow servm_t audisp_t:process ptrace; allow servm_t auditd_t:process ptrace; allow servm_t crond_t:process ptrace; allow servm_t setrans_t:process ptrace; allow servm_t sshd_t:process ptrace; allow servm_t sysadm_t:process ptrace; allow servm_t udev_t:process ptrace; However, when these rules were added, there was no change in the avc messages. I also tried the macro domain_ptrace_all_domains(servm_t) and allow servm_t self:capability { sys_ptrace }; But none of this makes a difference to the avc messages generated. Thanks, Radha.

13 years, 10 months

2
3
0 / 0

sound within sandbox_web_t type and permissive type sandbox_web_client_t

by Christoph A.

Hi, I can remember that while using F12 I had sound within sandbox_web_t running firefox. Since I'm using F13 sound within the sandbox disappeared and while running a sandbox I constantly (every 20 seconds) get abrt notifications that pulsaudio crashed. pulseaudio version: pulseaudio-0.9.21-6.fc13 audit.log contains following lines: type=ANOM_ABEND msg=audit(1277115690.389:210): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c633,c897 pid=5913 comm="pulseaudio" sig=6 type=ANOM_ABEND msg=audit(1277115695.613:211): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c633,c897 pid=5924 comm="pulseaudio" sig=6 type=ANOM_ABEND msg=audit(1277115700.998:212): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c633,c897 pid=5936 comm="pulseaudio" sig=6 type=ANOM_ABEND msg=audit(1277115706.240:213): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c633,c897 pid=5947 comm="pulseaudio" sig=6 [...] Is someone experiencing the same problem? If needed I can add the pulseaudio abrt backtrace. My second question also regarding sandboxes: This is an AVC I frequently come across: type=AVC msg=audit(1277029467.183:2147): avc: denied { read write } for pid=3038 comm="gvfs-fuse-daemo" name="fuse" dev=devtmpfs ino=9048 scontext=unconfined_u:unconfined_r:sandbox_web_client_t:s0:c503,c936 tcontext=system_u:object_r:fuse_device_t:s0 tclass=chr_file The troubleshooter tells me that this type is running in permissive mode. Is this supposed to be like that (default) or is this a misconfiguration on my side? [gvfs-fuse-daemo has a permissive type (sandbox_web_client_t). This access was not denied.] kind regards, Christoph

13 years, 10 months

3
4
0 / 0

Fwd: [ANNOUNCE] Linux Security Summit 2010 - Schedule Published

by Daniel J Walsh

-------- Original Message -------- Subject: [ANNOUNCE] Linux Security Summit 2010 - Schedule Published Date: Thu, 17 Jun 2010 09:12:09 +1000 (EST) From: James Morris <jmorris(a)namei.org> To: linux-security-module(a)vger.kernel.org CC: linux-kernel(a)vger.kernel.org, lwn(a)lwn.net, fedora-selinux-list(a)redhat.com, selinux(a)tycho.nsa.gov, "C. Craig Ross" <ccr(a)linuxfoundation.org>, ubuntu-hardened(a)lists.ubuntu.com, tomoyo-users-en(a)lists.sourceforge.jp, netfilter-devel(a)vger.kernel.org, linux-crypto(a)vger.kernel.org, Audit-ML <linux-audit(a)redhat.com>, lss-pc(a)ext.namei.org, gentoo-hardened(a)gentoo.org, Amanda McPherson <amanda.mcpherson(a)gmail.com> ========================================================================== LINUX SECURITY SUMMIT 2010 (BOSTON) PROGRAM SCHEDULE ========================================================================== SUMMARY This is to announce the program schedule for the upcoming Linux Security Summit [1], to be held on Monday 9th August in Boston in conjunction with LinuxCon [2]. Following a round of voting by the Program Committee, the following proposals were selected as main talks: * "Recent Advances in the SELinux Sandbox" Dan Walsh, Red Hat * "in ur webserver, writin ur logs" Joshua Brindle, Tresys * "Integrating Security into Vyatta" Stephen Hemminger, Vyatta * "MSF Security Framework Overview" Elena Reshetova, Nokia * "Access Control in the MSF Security Framework" Janne Karhunen, Nokia * "Linux Security in 10 Years" Brad Spengler, grsecurity * "Using EVM to protect security extended attributes" Mimi Zohar, IBM * "Secstate: Integrating SCAP and Puppet for System Lockdown" Karl MacMillan, Tresys * "Widely Used But Out-Of-Tree" Kees Cook, Canonical * "Linux Security Usability" Z. Cliffe Schreuders, Murdoch University * "System Security Services Daemon (SSSD)" Stephen Gallagher, Red Hat We will also hold a panel session, kicking off with a discussion on "The Viability of a Standard Linux Security API", followed by open Q&A and lightning talks. Full details of the program, including abstracts, may be found at: https://security.wiki.kernel.org/index.php/LinuxSecuritySummit2010/Schedule EVENT DESCRIPTION The Linux Security Summit is a technical forum for collaboration between Linux developers, researchers, and end users. Its primary aim is to foster community efforts in analyzing and solving Linux security challenges. The format of the summit will be: * Selected brief presentations * Lightning talks * Q&A panel sessions DATES / LOCATION The Linux Security Summit for 2010 will be held on the 9th of August in Boston, USA. It will be co-located with LinuxCon [2], at the Renaissance Boston Waterfront. Note that Linux Security Summit attendees must be registered to attend LinuxCon. See the LinuxCon site for details on registration, travel, and accommodation. http://events.linuxfoundation.org/events/linuxcon WHO SHOULD ATTEND The event is open to all registered LinuxCon attendees. You do not have to be a "security person" to attend -- we're seeking a diverse range of attendees, and welcome the participation of general developers, researchers, operations, and end-users. There will be panel and lightning talks sessions in addition to brief, selected presentations, with a strong focus on discussion. Lightning talks and discussion panel agendas will be coordinated closer to the event on the event mailing list, and on-site. MAILING LIST Everyone planning to attend should join the event mailing list: https://ext.namei.org/mailman/listinfo/linux-security-summit Coordination of panel discussions and lightning talks will occur on the list. Updates and announcements about the event will also be sent to the list. WEB SITE Please also note the Linux Security Summit web site: https://security.wiki.kernel.org/index.php/LinuxSecuritySummit2010 which will be kept updated with all available information on the event. PROGRAM COMMITTEE The Linux Security Summit for 2010 is organized by: * James Morris, Red Hat * Serge Hallyn, IBM * Paul Moore, HP * Stephen Smalley, NSA * Joshua Brindle, Tresys * Tetsuo Handa, NTT Data * Herbert Xu, Red Hat * John Johansen, Canonical * Kees Cook, Canonical * Casey Schaufler, Smack Project The program committee may be contacted as a group via email: lss-pc (_at_) ext.namei.org REFERENCES [1] LSS 2010: https://security.wiki.kernel.org/index.php/LinuxSecuritySummit2010 [2] LinuxCon: http://events.linuxfoundation.org/events/linuxcon ========================================================================== -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo(a)tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.

13 years, 10 months

1
0
0 / 0

[ANN] Linux Security Summit 2010 - Announcement and CFP

by James Morris

========================================================================== ANNOUNCEMENT AND CALL FOR PARTICIPATION LINUX SECURITY SUMMIT 2010 ========================================================================== DESCRIPTION The Linux Security Summit is a technical forum for collaboration between Linux developers, researchers, and end users. Its primary aim is to foster community efforts in analyzing and solving Linux security challenges. The format of the summit will be: * Selected brief presentations * Lightning talks * Q&A panel sessions DATES / LOCATION The Linux Security Summit for 2010 will be held on the 9th of August in Boston, USA. It will be co-located with LinuxCon [1], at the Renaissance Boston Waterfront. Note that Linux Security Summit attendees must be registered to attend LinuxCon. See the LinuxCon site for details on registration, travel, and accommodation. http://events.linuxfoundation.org/events/linuxcon The CFP is currently open, and will close on 4th of June (see below). Accepted speakers will be notified by 9th of June. WHO SHOULD ATTEND The event is open to all registered LinuxCon attendees. You do not have to be a "security person" to attend -- we're seeking a diverse range of attendees, and welcome the participation of general developers, researchers, operations, and end-users. There will be several panel sessions in addition to brief, selected presentations, with a strong focus on discussion. CALL FOR PARTICIPATION The program committee currently seeks proposals for: Presentations: Brief technical talks in 30 minute slots, including at least 10 minutes of discussion (i.e. the maximum length of the presentation alone is 20 minutes). Papers are encouraged, and slides should be minimal. Presentation abstracts should be approximately 150 words in length. Panel discussion topics: If you'd like to see an issue discussed in a Q&A style panel, send it in. Note that this may result in you volunteering to participate in a panel. Topic areas include, but are not limited to: * System hardening * Access control * Cryptography * Integrity control * Hardware security * Networking * Storage * Virtualization * Desktop * Tools * Management * Case studies * Emerging technologies, threats & techniques Proposals must be submitted before the end of June 4th, 2010. (That's not far away!) Accepted speakers will be notified by June 9th, 2010. We will probably receive more proposals than can be accommodated. If your talk is not accepted, you may wish to give a lightning talk or raise a topic in a discussion panel. Lightning talks and discussion panel agendas will be coordinated closer to the event on the event mailing list, and on-site. Proposals should be submitted in plain text via email to the program committee at: lss-pc (_at_) ext.namei.org MAILING LIST Everyone planning to attend should join the event mailing list: https://ext.namei.org/mailman/listinfo/linux-security-summit Coordination of panel discussions and lightning talks will occur on the list. Updates and announcements about the event will also be sent to the list. WEB SITE Please also note the Linux Security Summit web site: https://security.wiki.kernel.org/index.php/LinuxSecuritySummit2010 which will be kept updated with all available information on the event. PROGRAM COMMITTEE The Linux Security Summit for 2010 is organized by: * James Morris, Red Hat * Serge Hallyn, IBM * Paul Moore, HP * Stephen Smalley, NSA * Joshua Brindle, Tresys * Tetsuo Handa, NTT Data * Herbert Xu, Red Hat * John Johansen, Canonical * Andrew G. Morgan, Google * Kees Cook, Canonical * Casey Schaufler, Smack Project The program committee may be contacted as a group via email: lss-pc (_at_) ext.namei.org REFERENCES [1] LinuxCon: http://events.linuxfoundation.org/events/linuxcon

13 years, 10 months

1
1
0 / 0

Kernel error avc F13

by Frank Murphy

from logwatch --------------------- Kernel Begin ------------------------ WARNING: Kernel Errors Present type=1400 audit(1276553951.414:525): avc: denied { read append } for pid=2526 comm="polkit-agent-he" path="/home/user/.xsession-errors" dev=dm-7 ino=2 ...: 1 Time(s) ---------------------- Kernel End ------------------------- selinux-policy-3.7.19-28.fc13.noarch (from koji) kernel-PAE-2.6.33.5-128.fc13.i686 (from Koji) -- Regards, Frank Murphy UTF_8 Encoded Friend of Fedora

13 years, 10 months

3
8
0 / 0

Invitation to connect on LinkedIn

by Raj Kayshap

LinkedIn ------------ Fedora, I'd like to add you to my professional network on LinkedIn. - Raj Raj Kayshap Trainer at New Horizons India Limited Guwahati Area, India Confirm that you know Raj Kayshap https://www.linkedin.com/e/isd/1382987144/S2A080A6/ ------ (c) 2010, LinkedIn Corporation

13 years, 10 months

1
0
0 / 0

Problem with aiccu and radvd in /etc/NetworkManager/dispatcher.d/*

by Laurent Rineau

Hi, (My second post in this list in two years of lurking.) My machines run F-13. My selinux packages are: selinux-policy-3.7.19-23.fc13.noarch selinux-policy-targeted-3.7.19-23.fc13.noarch I want to trigger the services aiccu and radvd from NetworkManager, to get a Sixxs IPv6 tunnel and announce a Sixxs IPv6 subnet on the LAN. For that, I have created this file: $ cat /etc/NetworkManager/dispatcher.d/20-aiccu #!/bin/sh if [ "$2" = "up" ] ; then /sbin/service aiccu start && /sbin/service radvd start || : fi if [ "$2" = "down" ] ; then /sbin/service radvd stop || : /sbin/service aiccu stop || : fi It works in permissive mode but, I had to create the following local.te module using audit2allow in order to get that work in enforcing mode: ================================================================== module local 1.1; require { type insmod_exec_t; type modules_conf_t; type urandom_device_t; type syslogd_t; type ifconfig_exec_t; type sysfs_t; type port_t; type modules_dep_t; type shell_exec_t; type bin_t; type devlog_t; type proc_t; type random_device_t; type console_device_t; type modules_object_t; type aiccu_t; class tun_socket create; class chr_file { read open }; class capability { net_admin sys_module sys_tty_config }; class tcp_socket { write name_connect connect shutdown read create }; class file { execute read execute_no_trans getattr open }; class sock_file write; class netlink_route_socket { setopt nlmsg_write read bind create nlmsg_read write getattr }; class lnk_file read; class unix_dgram_socket { write create connect sendto }; class udp_socket { write read create connect }; class dir read; } #============= aiccu_t ============== allow aiccu_t bin_t:lnk_file read; allow aiccu_t devlog_t:sock_file write; allow aiccu_t ifconfig_exec_t:file { read getattr open execute execute_no_trans }; allow aiccu_t insmod_exec_t:file { read getattr open execute execute_no_trans }; allow aiccu_t modules_conf_t:dir read; allow aiccu_t modules_conf_t:file { read getattr open }; allow aiccu_t modules_dep_t:file { read getattr open }; allow aiccu_t modules_object_t:file { read open }; allow aiccu_t port_t:tcp_socket name_connect; allow aiccu_t proc_t:file { read getattr open }; allow aiccu_t random_device_t:chr_file read; allow aiccu_t self:capability net_admin; allow aiccu_t self:netlink_route_socket { setopt nlmsg_write read bind create nlmsg_read write getattr }; allow aiccu_t self:tcp_socket { read write create connect shutdown }; allow aiccu_t self:tun_socket create; allow aiccu_t self:udp_socket { write read create connect }; allow aiccu_t self:unix_dgram_socket { write create connect }; allow aiccu_t shell_exec_t:file { read execute open getattr execute_no_trans }; allow aiccu_t sysfs_t:file { read getattr open }; allow aiccu_t syslogd_t:unix_dgram_socket sendto; #!!!! This avc can be allowed using the boolean 'global_ssp' allow aiccu_t urandom_device_t:chr_file { read open }; allow aiccu_t console_device_t:chr_file open; allow aiccu_t modules_object_t:file getattr; allow aiccu_t self:capability { sys_module sys_tty_config }; ================================================================== The AVC audit log is attached (compressed with bzip2). To get it, I used this sort of command: cnetworkmanager -o off; DATE=`date '+%H:%M'`; cnetworkmanager -o on; sleep 10; sudo sh -c "/sbin/ausearch -ts $DATE -m avc | tee /root/audit.log" This shell one-liner disables the network, stores the current time in $DATE, then enables the network, and uses ausearch (after a sleep of 10 seconds) to get AVCs starting from the time $DATE. I do not understand the AVC. Both aiccu and radvd have their own modules. I am not really used to selinux context transitions. I wonder if it is possible that the AVCs are because radvd is running in the selinux context aiccu_t. -- Laurent Rineau http://fedoraproject.org/wiki/LaurentRineau

13 years, 11 months

2
3
0 / 0

Selinux - Clamav

by Frank Murphy

Running the lastest clamav. logwatch gives the following: libclamav JIT: Can't allocate RWX Memory: Permission denied libclamav JIT: SELinux is preventing 'execmem' access. Run 'setsebool -P clamd_use_jit on' to allow access libclamav JIT: falling back to interpreter mode setsebool -P clamd_use_jit on doesn't seem to stick, as I still get the warnings. selinux-policy-3.7.19-23.fc13.noarch selinux-policy-targeted-3.7.19-23.fc13.noarch clamav-0.96.1-1300.fc13.i686 -- Regards, Frank Murphy UTF_8 Encoded Friend of Fedora

13 years, 11 months

2
4
0 / 0

SELinux is preventing /bin/cp "relabelfrom" access on /var/lib/dhclient/yp.conf.predhclient.br0

by Paul Howarth

Thought I'd seen the last of these some time ago but it just popped up when the DHCP lease was renewed: ==> /var/log/messages <== Jun 4 13:29:14 roary dhclient[1737]: DHCPREQUEST on br0 to 10.9.0.3 port 67 Jun 4 13:29:14 roary dhclient[1737]: DHCPACK from 10.9.0.3 ==> /var/log/audit/audit.log <== type=AVC msg=audit(1275654554.163:46136): avc: denied { relabelfrom } for pid=2222 comm="cp" name="yp.conf.predhclient.br0" dev=dm-14 ino=128194 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:dhcpc_state_t:s0 tclass=file type=SYSCALL msg=audit(1275654554.163:46136): arch=c000003e syscall=190 success=yes exit=0 a0=4 a1=37ca815689 a2=21a28f0 a3=20 items=0 ppid=2205 pid=2222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cp" exe="/bin/cp" subj=system_u:system_r:dhcpc_t:s0 key=(null) ==> /var/log/messages <== Jun 4 13:29:14 roary dhclient[1737]: bound to 10.9.2.1 -- renewal in 126768 seconds. Jun 4 13:29:17 roary setroubleshoot: SELinux is preventing /bin/cp "relabelfrom" access on /var/lib/dhclient/yp.conf.predhclient.br0. For complete SELinux messages. run sealert -l 4f8e2517-aac3-4058-aed7-6081e112176b Paul.

13 years, 11 months

2
2
0 / 0

SELinux and XEN

by Tyler Durvik

I am interested in working with SELinux and XEN. I see that the reference policy supports XEN, but is it possible using the reference policy to have multiping VM's running in XEN at different levels. This would assume a MLS/MCS system. Thanks

13 years, 11 months

2
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2010