August 2010 - selinux - Fedora mailing-lists

sandbox cleanup?
by Christoph A. 20 Jun '11

20 Jun '11

Hi, I just noticed that I have over 100 processes running in the sandbox_web_client_t domain, although I closed all my sandbox windows. ps auxZ|grep sandbox_web_client_t|grep -c /usr/libexec/gvfsd 52 ps auxZ|grep sandbox_web_client_t|grep -c '/bin/dbus-daemon --fork --print-pid 5 --print-address 7 --session' 51 Shouldn't they be killed after I closed all sandbox windows? Kind regards, Christoph

5 11

SELinux and Shorewall with IPSets
by Mr Dash Four 17 Jan '11

17 Jan '11

Problems combining these 2 to run while SELinux is in 'enforced' mode (policy running is the 'stock' targeted one supplied with FC13). I get 2 audit alerts when Shorewall starts (and fails!) - see logs below. I have x86_64 arch machine with FC13 running. Stock Shorewall is installed. IPSet (xtunnels) is compiled in (though with the 'stock' rpm I am getting the same errors). The problem seems to be caused by the Shorewall init script (see further below). The relevant part of my syslog when SELinux is in enforced mode is: =========SELinux=Enforcing================================ Jun 26 23:18:38 dev1 shorewall[2456]: Compiling... Jun 26 23:18:38 dev1 kernel: type=1400 audit(1277590718.634:29543): avc: denied { create } for pid=2577 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:18:38 dev1 kernel: type=1400 audit(1277590718.637:29544): avc: denied { create } for pid=2579 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/zones... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/interfaces... Jun 26 23:18:38 dev1 shorewall[2456]: Determining Hosts in Zones... Jun 26 23:18:38 dev1 shorewall[2456]: Preprocessing Action Files... Jun 26 23:18:38 dev1 shorewall[2456]: Pre-processing /usr/share/shorewall/action.Drop... Jun 26 23:18:38 dev1 shorewall[2456]: Pre-processing /usr/share/shorewall/action.Reject... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/policy... Jun 26 23:18:38 dev1 shorewall[2456]: Compiling /etc/shorewall/blacklist... Jun 26 23:18:38 dev1 shorewall[2456]: ERROR: ipset names in Shorewall configuration files require Ipset Match in your kernel and iptables : /etc/shorewall/blacklist (line 11) Jun 26 23:18:38 dev1 shorewall[2456]: ERROR: Shorewall start failed ========================================================== When I switch SELinux to Permissive I get two further errors: =========SELinux=Permissive=============================== Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29551): avc: denied { create } for pid=3799 comm="ipset" scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29552): avc: denied { getopt } for pid=3799 comm="ipset" lport=255 scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 kernel: type=1400 audit(1277591565.629:29553): avc: denied { setopt } for pid=3799 comm="ipset" lport=255 scontext=unconfined_u:system_r:shorewall_t:s0 tcontext=unconfined_u:system_r:shorewall_t:s0 tclass=rawip_socket Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/zones... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/interfaces... Jun 26 23:32:45 dev1 shorewall[3678]: Determining Hosts in Zones... Jun 26 23:32:45 dev1 shorewall[3678]: Preprocessing Action Files... Jun 26 23:32:45 dev1 shorewall[3678]: Pre-processing /usr/share/shorewall/action.Drop... Jun 26 23:32:45 dev1 shorewall[3678]: Pre-processing /usr/share/shorewall/action.Reject... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/policy... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/blacklist... Jun 26 23:32:45 dev1 shorewall[3678]: Adding Anti-smurf Rules Jun 26 23:32:45 dev1 shorewall[3678]: Compiling TCP Flags filtering... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling Kernel Route Filtering... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling Martian Logging... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling MAC Filtration -- Phase 1... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling /etc/shorewall/rules... Jun 26 23:32:45 dev1 shorewall[3678]: Generating Transitive Closure of Used-action List... Jun 26 23:32:45 dev1 shorewall[3678]: Processing /usr/share/shorewall/action.Reject for chain Reject... Jun 26 23:32:45 dev1 shorewall[3678]: Processing /usr/share/shorewall/action.Drop for chain Drop... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling MAC Filtration -- Phase 2... Jun 26 23:32:45 dev1 shorewall[3678]: Applying Policies... Jun 26 23:32:45 dev1 shorewall[3678]: Generating Rule Matrix... Jun 26 23:32:45 dev1 shorewall[3678]: Creating iptables-restore input... Jun 26 23:32:45 dev1 shorewall[3678]: Compiling iptables-restore input for chains blacklst mangle:... Jun 26 23:32:45 dev1 shorewall[3678]: Shorewall configuration compiled to /var/lib/shorewall/.start Jun 26 23:32:45 dev1 shorewall[3678]: Starting Shorewall.... Jun 26 23:32:45 dev1 shorewall[3678]: Initializing... Jun 26 23:32:46 dev1 kernel: u32 classifier Jun 26 23:32:46 dev1 kernel: Performance counters on Jun 26 23:32:46 dev1 kernel: input device check on Jun 26 23:32:46 dev1 kernel: Actions configured Jun 26 23:32:46 dev1 shorewall[3678]: Processing /etc/shorewall/init ... Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-x1.ips Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-x2.ips Jun 26 23:32:46 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-z1.ips Jun 26 23:32:47 dev1 shorewall[3678]: loading /etc/shorewall/ips/blacklist-z2.ips Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/tcclear ... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Route Filtering... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Martian Logging... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Proxy ARP... Jun 26 23:32:49 dev1 shorewall[3678]: Setting up Traffic Control... Jun 26 23:32:49 dev1 shorewall[3678]: Preparing iptables-restore input... Jun 26 23:32:49 dev1 shorewall[3678]: Running /sbin/iptables-restore... Jun 26 23:32:49 dev1 shorewall[3678]: IPv4 Forwarding Enabled Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/start ... Jun 26 23:32:49 dev1 shorewall[3678]: Processing /etc/shorewall/started ... Jun 26 23:32:49 dev1 shorewall[3678]: Shorewall started ========================================================== The problem seems to be caused by the shorewall init script, which is: ===========Shorewall init script========================== modprobe ifb numifbs=1 ip link set dev ifb0 up # configure the ipsets sw_ips_mask='/etc/shorewall/ips/*.ips' ipset_exec='/usr/sbin/ipset' if [ "$COMMAND" = start ]; then $ipset_exec -F $ipset_exec -X for c in `/bin/ls $sw_ips_mask 2>/dev/null`; do echo loading $c $ipset_exec -R < $c done fi ========================================================== The above script executes /usr/sbin/ipset to create my IP Sets needed for running Shorewall (all IP set commands are contained in those *.ips files). These IP sets comprise mainly of IP subnets which are part of my blacklists (banned IP subnets), though they also contain some IP Port sets as well. Don't know why SELinux denies "create" (and then "getopt" and "setopt") on a, what seems to be, raw ip socket (IPSet do not use/need one as far as I know!)? If I remove the IP Set part of the init script above and rearrange Shorewall to run without IPSets all is well, though its functionality is VERY limited and barely useful to me! Two questions to the SELinux gurus on here: 1) Why am I getting these alerts? and 2) How can I fix the problem so that I could run both Shorewall and IPSets with SELinux in Enforced mode? This is important for me as this is a production server and a lot of stuff runs on it and needs to be available 24/7. Many thanks in advance!

4 57

netif labelling
by Mr Dash Four 09 Sep '10

09 Sep '10

I am trying to restrict an application I have installed to have access to a specific network interface only (tun0). Are all network interfaces labelled 'automatically' by SELinux with 'netif_xx_t' or do I have to label them manually from the policy file? If I have to do that manually is it done with the network_interface(...) macro? Also, if I relabel the interface would I have to amend all other policies for applications which need access to that interface (applications which use the 'generic' naming - netif_t) or is this not necessary? I've seen there is a macro in corenetwork.if.in called 'corenet_all_recvfrom_labelled' - is that macro allowing me to receive packets from labelled interface? Thanks in advance!

3 16

sandbox window size
by Christoph A. 07 Sep '10

07 Sep '10

Hi, as far as I have seen and read it is not possible to resize a SELinux sandbox window. Is it possible to specify the size of the sandbox at start-time? kind regards, Christoph

3 8

.autorelabel on mounted filesystems
by Dan Thurman 07 Sep '10

07 Sep '10

I have several versions of root distro partitions of which I do mount via fstab, but of course only one / and /boot partition is to be defined for the version to be booted. What I would like to know is, if I do an /.autorelabel, for one boot/root partition, does this mean that every mounted filesystem that appears in /etc/fstab also gets relabeled? If so, this is not what I want especially if other root distro partitions are being mounted for example, say: /md/{distro1, distro2, ...} So, How do I get around this? I could comment out all entries in /etc/fstab except / and /boot (plus the required entries), touch /.autorelabel, reboot, and once relabeling is completed, then add back in the commented out fstab entries, then issue a mount -a. Could I add an option entry say: NO_RELABEL to certain fstab entries? Since I was introduced to the /media since F9, I never could figure out how to add mounted "media" filesystems, which is why I added them instead to fstab. How do I solve this issue?

3 8

avc { module_request, relabelfrom }: openvpn->tun
by Mr Dash Four 04 Sep '10

04 Sep '10

When trying to start openvpn with 'service openvpn start' (selinux=enforced) I get the following avc (audit.log): ----audit.log--------------- type=AVC msg=audit(1281803077.151:21): avc: denied { module_request } for pid=1943 comm="openvpn" kmod="char-major-10-200" scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system type=SYSCALL msg=audit(1281803077.151:21): arch=40000003 syscall=5 success=no exit=-19 a0=80bf7b8 a1=2 a2=38 a3=96bd804 items=0 ppid=1 pid=1943 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="openvpn" exe="/usr/sbin/openvpn" subj=unconfined_u:system_r:openvpn_t:s0 key=(null) ------------------- -----var/log/messages------- Aug 14 17:24:37 test1 openvpn[1943]: Note: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19) Aug 14 17:24:37 test1 openvpn[1943]: Note: Attempting fallback to kernel 2.2 TUN/TAP interface Aug 14 17:24:37 test1 openvpn[1943]: Cannot open TUN/TAP dev /dev/tun0: No such file or directory (errno=2) Aug 14 17:24:37 test1 openvpn[1943]: Exiting ------------------- When I try to execute 'openvpn --mktun --dev tun0 --user nobody --group nobody' it works OK, but when I try to start openvpn it again fails with the following avc: ----audit.log--------------- type=AVC msg=audit(1281803362.451:23): avc: denied { relabelfrom } for pid=2007 comm="openvpn" scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tun_socket type=SYSCALL msg=audit(1281803362.451:23): arch=40000003 syscall=54 success=no exit=-13 a0=5 a1=400454ca a2=bfb4c26c a3=87e4804 items=0 ppid=1 pid=2007 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="openvpn" exe="/usr/sbin/openvpn" subj=unconfined_u:system_r:openvpn_t:s0 key=(null) ------------------- -----var/log/messages------- Aug 14 17:29:22 test1 openvpn[2007]: Note: Cannot ioctl TUNSETIFF tun0: Permission denied (errno=13) Aug 14 17:29:22 test1 openvpn[2007]: Note: Attempting fallback to kernel 2.2 TUN/TAP interface Aug 14 17:29:22 test1 openvpn[2007]: Cannot open TUN/TAP dev /dev/tun0: No such file or directory (errno=2) Aug 14 17:29:22 test1 openvpn[2007]: Exiting ------------------- Any idea what might be the cause of this problem? openvpn normally tries to open tun0, assign its IP address, net mask and broadcast address, then reassign the routing on this particular machine - nothing suspicious really!

3 4

.autorelabel on mounted filesystems
by Dan Thurman 02 Sep '10

02 Sep '10

I have several versions of root distro partitions of which I do mount via fstab, but of course only one / and /boot partition is to be defined for the version to be booted. What I would like to know is, if I do an /.autorelabel, for one boot/root partition, does this mean that every mounted filesystem that appears in /etc/fstab also gets relabeled? If so, this is not what I want especially if other root distro partitions are being mounted for example, say: /md/{distro1, distro2, ...} So, How do I get around this? I could comment out all entries in /etc/fstab except / and /boot (plus the required entries), touch /.autorelabel, reboot, and once relabeling is completed, then add back in the commented out fstab entries, then issue a mount -a. Could I add an option entry say: NO_RELABEL to certain fstab entries? Since I was introduced to the /media since F9, I never could figure out how to add mounted "media" filesystems, which is why I added them instead to fstab. How do I solve this issue? -- selinux mailing list selinux(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux

3 2

Mlogc problem after aupgrade to F13
by Arthur Dent 31 Aug '10

31 Aug '10

Hello all, Back in April Dominick Grift kindly helped me to create a new policy module for mlogc on my Fedora11 installation. (The original correspondence can be seen here: http://lists.fedoraproject.org/pipermail/selinux/2010-April/012353.html) In the last couple of days I have upgraded to F13 and, despite copying and rebuilding the relevant policy modules, I am now getting another raft of AVCs relating to mlogc. To Summarise: ============= ModSecurity Log Collector (mlogc) is used to send ModSecurity audit log data to a console. It is installed as part of the Fedora rpm mod_security-2.5.12-1.fc13.i686 which I installed as part of the upgrade. The Actual Modsecurity Console (which receives the data) was installed from source using the same tarball as was used on my F11 install. With Dominick's help, these are the modules I created on the F11 box: ===========8<======================================================= # cat mymlogc.te policy_module(mymlogc, 1.0.10) type mlogc_t; type mlogc_exec_t; type mlogc_var_log_t; type mlogc_etc_t; logging_log_file(mlogc_var_log_t); logging_log_filetrans(mlogc_t, mlogc_var_log_t, { dir file }) application_domain(mlogc_t, mlogc_exec_t); role system_r types mlogc_t; # permissive mlogc_t; manage_dirs_pattern(mlogc_t, mlogc_var_log_t, mlogc_var_log_t) manage_files_pattern(mlogc_t, mlogc_var_log_t, mlogc_var_log_t) read_files_pattern(mlogc_t, mlogc_etc_t, mlogc_etc_t) files_search_etc(mlogc_t) files_config_file(mlogc_etc_t) files_read_usr_symlinks(mlogc_t) files_read_etc_files(mlogc_t) files_list_tmp(mlogc_t) pcscd_read_pub_files(mlogc_t); pcscd_stream_connect(mlogc_t) miscfiles_read_localization(mlogc_t) miscfiles_read_certs(mlogc_t) dev_read_urand(mlogc_t) userdom_use_user_terminals(mlogc_t) #apache_manage_log(mlogc_t); kernel_read_system_state(mlogc_t) allow mlogc_t self:tcp_socket create_socket_perms; allow mlogc_t self:udp_socket create_socket_perms; allow mlogc_t self:netlink_route_socket create_netlink_socket_perms; allow mlogc_t self:process { setsched getsched }; allow mlogc_t self:capability { sys_nice dac_override }; allow mlogc_t self:sem create_sem_perms; corenet_all_recvfrom_netlabel(mlogc_t) corenet_all_recvfrom_unlabeled(mlogc_t) corenet_tcp_sendrecv_generic_if(mlogc_t) corenet_tcp_sendrecv_generic_node(mlogc_t) corenet_tcp_sendrecv_generic_port(mlogc_t) corenet_tcp_bind_generic_node(mlogc_t) corenet_sendrecv_generic_client_packets(mlogc_t) corenet_tcp_connect_generic_port(mlogc_t) ===========8<======================================================= ===========8<======================================================= # cat myapche.te policy_module(myapache, 1.0.2) gen_require(` type httpd_t; ') mlogc_domtrans(httpd_t) mlogc_manage_log(httpd_t) mlogc_signal(httpd_t) ===========8<======================================================= And these are the new denials. Some worrying ones such as requiring access to key files... There were 12 AVCs relating to a single incident, but I have removed ones I think are duplicates: Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.635:29370): avc: denied { write } for pid=3512 comm="mlogc" name="cert9.db" dev=sda6 ino=91782 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file node=troodos type=SYSCALL msg=audit(1281734421.635:29370): arch=40000003 syscall=5 success=no exit=-13 a0=b5926308 a1=8042 a2=1a4 a3=0 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.847:29371): avc: denied { write } for pid=3512 comm="mlogc" name="tmp" dev=sda6 ino=1549 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir node=troodos type=SYSCALL msg=audit(1281734421.847:29371): arch=40000003 syscall=33 success=no exit=-13 a0=1e6774 a1=7 a2=1fca64 a3=2 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.847:29373): avc: denied { write } for pid=3512 comm="mlogc" name="tmp" dev=sda6 ino=310 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir node=troodos type=SYSCALL msg=audit(1281734421.847:29373): arch=40000003 syscall=33 success=no exit=-13 a0=1e6778 a1=7 a2=1fca64 a3=4 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.847:29374): avc: denied { write } for pid=3512 comm="mlogc" name="/" dev=sda6 ino=2 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir node=troodos type=SYSCALL msg=audit(1281734421.847:29374): arch=40000003 syscall=33 success=no exit=-13 a0=1e4d73 a1=7 a2=1fca64 a3=5 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.852:29376): avc: denied { write } for pid=3512 comm="mlogc" name="key4.db" dev=sda6 ino=19637 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file node=troodos type=SYSCALL msg=audit(1281734421.852:29376): arch=40000003 syscall=5 success=no exit=-13 a0=b5933cf8 a1=8042 a2=1a4 a3=0 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) Raw Audit Messages : node=troodos type=AVC msg=audit(1281734421.861:29380): avc: denied { write } for pid=3512 comm="mlogc" name="/" dev=sda6 ino=2 scontext=system_u:system_r:mlogc_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir node=troodos type=SYSCALL msg=audit(1281734421.861:29380): arch=40000003 syscall=33 success=no exit=-13 a0=1e4d73 a1=7 a2=1fca64 a3=5 items=0 ppid=1506 pid=3512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mlogc" exe="/usr/bin/mlogc" subj=system_u:system_r:mlogc_t:s0 key=(null) And this is what audit2allow makes of them... require { type mlogc_t; } #============= mlogc_t ============== files_delete_root_dir_entry(mlogc_t) files_delete_tmp_dir_entry(mlogc_t) miscfiles_manage_cert_files(mlogc_t) Should I add these to the above policy, or is there some other way? Thanks in advance for any help or suggestions... Mark

2 7

sandbox: close one window -> closes them all
by Christoph A. 31 Aug '10

31 Aug '10

Hi, I'm experiencing severe problems my sandboxes. In some cases when I close a sandbox window, all other sandbox instances get closed/killed too. I can reproduce it as follows: - click on multiple random urls (not in the browser) -> multiple sandboxed firefox windows fire up (that is my default browser) - close one of these sandboxes -> all sandboxes get killed However I can not reproduce it by opening multiple sandboxes in the terminal. I'm currently using: policycoreutils-2.0.83-20.fc13.x86_64 to see if one of the latest updates introduced this issue I wanted to downgrade that package but that failed (dependencies) Is someone else (using the same version) experiencing the same behaviour? kind regards, Christoph

2 2

sandbox: firefox
by Christoph A. 31 Aug '10

31 Aug '10

Hi, I regularly use firefox in a SELinux sandbox. Sometimes some strange behaviour arises: - scrolling results in zooming - every click on a link results in 'Save As' dialog - mouse can't leave the sandbox window (until the window gets closed with ctrl-w) - lets call it "strange" keyboard mapping: pressing keys results in actions within the firefox menu Somehow it looks like ctrl is pressed all the time. These symptoms don't come togheter. The 'mouse can' t leave' - problem occurred only twice. These symptoms usually occur while many tabs are open. Is anyone else experiencing similar behaviour? btw: If you are using a sandboxed firefox as your default browser through 'System' -> 'Preferences' -> 'Preferred Applications' -> Internet -> Command consider double quoting %s in the command -> '"%s"' or you might just get a black Xephyr window without firefox if your URL contains special chars. I guess this happens because these parameters get passed around (sandbox -> sandboxX.sh). Don't know if this should be considered a bug. kind regards, Christoph A.

2 4

setroubleshootd dead but pid file exists
by Radha Venkatesh (radvenka) 31 Aug '10

31 Aug '10

Hi, The problem we face is >>service setroubleshoot status setroubleshootd dead but pid file exists We are running into Bug 480432 <https://bugzilla.redhat.com/show_bug.cgi?id=480432> - setroubleshootd killed - apparently by selinux on our system. The kernel we are running on is 2.6.18-194.el5PAE and the selinux, setroubleshoot rpms being used are libselinux-1.33.4-5.5.el5 selinux-policy-strict-2.4.6-279.el5 platform-selinux-2.0.0.0-1 cm-selinux-2.0.0.0-0 libselinux-python-1.33.4-5.5.el5 libselinux-utils-1.33.4-5.5.el5 selinux-policy-2.4.6-279.el5 setroubleshoot-server-2.0.5-5.el5 setroubleshoot-plugins-2.0.4-2.el5 Is there a workaround for the above issue, if we cannot go to the latest kernel? Thanks, Radha.

2 4

pipefs AVC
by Mr Dash Four 29 Aug '10

29 Aug '10

I am currently writing a policy file for an application which listens to a particular port and also communicates with mysqld. During its start-up (from a script executed in init.d) I am getting the following AVCs: ================================= type=AVC msg=audit(1283028441.852:19): avc: denied { read } for pid=1868 comm="voip_sandbox" path="pipe:[11951]" dev=pipefs ino=11951 scontext=unconfined_u:system_r:voip_sandbox_t:s0 tcontext=unconfined_u:system_r:voip_sandbox_t:s0 tclass=fifo_file type=AVC msg=audit(1283028441.851:18): avc: denied { write } for pid=1866 comm="voip_sandbox" path="pipe:[11951]" dev=pipefs ino=11951 scontext=unconfined_u:system_r:voip_sandbox_t:s0 tcontext=unconfined_u:system_r:voip_sandbox_t:s0 tclass=fifo_file type=SYSCALL msg=audit(1283028441.852:19): arch=40000003 syscall=3 per=400000 success=no exit=-13 a0=6 a1=9d58864 a2=94 a3=0 items=0 ppid=1866 pid=1868 auid=0 uid=496 gid=496 euid=496 suid=496 fsuid=496 egid=496 sgid=496 fsgid=496 tty=(none) ses=1 comm="voip_sandbox" exe="/usr/local/bin/voip_sandbox" subj=unconfined_u:system_r:voip_sandbox_t:s0 key=(null) type=SYSCALL msg=audit(1283028441.851:18): arch=40000003 syscall=4 per=400000 success=no exit=-13 a0=7 a1=bf894480 a2=94 a3=bf894480 items=0 ppid=1 pid=1866 auid=0 uid=496 gid=496 euid=496 suid=496 fsuid=496 egid=496 sgid=496 fsgid=496 tty=(none) ses=1 comm="voip_sandbox" exe="/usr/local/bin/voip_sandbox" subj=unconfined_u:system_r:voip_sandbox_t:s0 key=(null) type=AVC msg=audit(1283028441.863:20): avc: denied { write } for pid=1866 comm="voip_sandbox" path="pipe:[11951]" dev=pipefs ino=11951 scontext=unconfined_u:system_r:voip_sandbox_t:s0 tcontext=unconfined_u:system_r:voip_sandbox_t:s0 tclass=fifo_file type=SYSCALL msg=audit(1283028441.863:20): arch=40000003 syscall=4 per=400000 success=no exit=-13 a0=7 a1=bf8945c0 a2=94 a3=bf8945c0 items=0 ppid=1 pid=1866 auid=0 uid=496 gid=496 euid=496 suid=496 fsuid=496 egid=496 sgid=496 fsgid=496 tty=(none) ses=1 comm="voip_sandbox" exe="/usr/local/bin/voip_sandbox" subj=unconfined_u:system_r:voip_sandbox_t:s0 key=(null) ================================= Both pids 1868 and 1866 are related and spawned by the main application. I take it there is a pipe which needs to be created and accessible to both processes. How do I find out what pipe it is (name, location) and how do I prevent this AVCs from happening? Many thanks!

2 12

Issue with Gnome setting?
by Dan Thurman 27 Aug '10

27 Aug '10

Yes, I know F9 is obsolete but I still use it! BTW: for some reason I am not getting back selinux emails that I posted which is why I sent it twice - was the a burp in the mailing system? Just need to figure out what this means and a fix for it please? ================================================= Summary: SELinux is preventing the gnome-settings- from using potentially mislabeled files (socket). Detailed Description: SELinux has denied gnome-settings- access to potentially mislabeled file(s) (socket). This means that SELinux will not allow gnome-settings- to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want gnome-settings- to access this files, you need to relabel them using restorecon -v 'socket'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'. Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:tmp_t:s0 Target Objects socket [ sock_file ] Source gnome-settings- Source Path /usr/libexec/gnome-settings-daemon Port <Unknown> Host gold.cdkkt.com Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-135.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name gold.cdkkt.com Platform Linux gold.cdkkt.com 2.6.27.25-78.2.56.fc9.i686 #1 SMP Thu Jun 18 12:47:50 EDT 2009 i686 i686 Alert Count 378 First Seen Fri 27 Aug 2010 11:09:22 AM PDT Last Seen Fri 27 Aug 2010 11:09:26 AM PDT Local ID bdb33ade-aa41-4dec-a430-ae0ad4594254 Line Numbers Raw Audit Messages node=gold.cdkkt.com type=AVC msg=audit(1282932566.767:3581): avc: denied { read write } for pid=3079 comm="gnome-settings-" name="socket" dev=sda8 ino=245843 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=sock_file =================================================

2 1

NFSD warning?
by Arthur Dent 26 Aug '10

26 Aug '10

Hello all, Working with Dominick to solve my clamd denial problem has caused me to use ausearch more often than I normally would. This has revealed a large and constant amount of these messages: ---- time->Thu Aug 26 10:31:37 2010 type=SYSCALL msg=audit(1282815097.754:55608): arch=40000003 syscall=300 success=no exit=-13 a0=9 a1=243c883 a2=bf8d6de0 a3=0 items=0 ppid=1 pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd" exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1282815097.754:55608): avc: denied { getattr } for pid=1228 comm="rpc.mountd" path="/proc/kcore" dev=proc ino=4026531989 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file ---- time->Thu Aug 26 10:31:37 2010 type=SYSCALL msg=audit(1282815097.756:55609): arch=40000003 syscall=5 success=no exit=-13 a0=243bca8 a1=8000 a2=0 a3=243bc68 items=0 ppid=1 pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd" exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1282815097.756:55609): avc: denied { read } for pid=1228 comm="rpc.mountd" name="sda11" dev=devtmpfs ino=5616 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.028:55622): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.028:55623): avc: denied { 0x400000 } for pid=1221 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.063:55624): avc: denied { 0x400000 } for pid=1221 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.076:55625): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.101:55626): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.122:55627): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.136:55628): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:37:51 2010 type=AVC msg=audit(1282815471.154:55629): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:43:30 2010 type=AVC msg=audit(1282815810.307:55648): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:43:30 2010 type=AVC msg=audit(1282815810.321:55649): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:43:30 2010 type=AVC msg=audit(1282815810.335:55650): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:43:30 2010 type=AVC msg=audit(1282815810.354:55651): avc: denied { 0x400000 } for pid=1223 comm="nfsd" name="" dev=sda11 ino=28365 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file ---- time->Thu Aug 26 10:45:04 2010 type=SYSCALL msg=audit(1282815904.588:55656): arch=40000003 syscall=11 success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0 ppid=3571 pid=3572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1282815904.588:55656): avc: denied { noatsecure } for pid=3572 comm="procmail" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:procmail_t:s0 tclass=process type=AVC msg=audit(1282815904.588:55656): avc: denied { siginh } for pid=3572 comm="procmail" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:procmail_t:s0 tclass=process type=AVC msg=audit(1282815904.588:55656): avc: denied { rlimitinh } for pid=3572 comm="procmail" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:procmail_t:s0 tclass=process /dev/sda11 is a Fat32 partition mounted in /etc/fstab with the line: /dev/sda11 /mnt/tempstore vfat users,rw,uid=mark 0 2 and shared as an NFS mount on my desktop. # cat /etc/exports /home/mark 192.168.2.4(rw,async,no_subtree_check,nohide,no_root_squash) /mnt/tempstore 192.168.2.4(rw,async,no_subtree_check,nohide,no_root_squash) /mnt/datastore 192.168.2.4(rw,async,no_subtree_check,nohide,no_root_squash) /mnt/f11 192.168.2.4(rw,async,no_subtree_check,nohide,no_root_squash) Are the avcs a problem and how do I stop them? Audit2allow does not produce anything on these messages.... Thanks Mark

2 3

Clamd - again...
by Arthur Dent 26 Aug '10

26 Aug '10

Hello all, Since upgrading from F11 to F13 I still have 3 outstanding issues. 1 is my earlier thread about mlogc which is still the subject of some correspondence on the modsecurity list, another is a mysterious "leaked file descriptor" AVC which has a permissive type anyway so I will worry about that later (and may have stopped since the latest selinux policy release) and that just leaves clamd... sigh... The relationship between procmail and clamd and selinux always seems to be a troubled one and I don't know why it should be so, but hey... Every time I upgrade Fedora I go through this little dance - remove my old home made clamd policy, run my fetchmail->procmail->clamd( and spamd)-> dovecot mail-chain and see what AVCs emerge. I create a policy using audit2allow, rinse, repeat until all AVCs go away. Well I have done that as usual, all the AVCs have gone away, but still I get this message in my logs: X-virus-report: /usr/local/bin/clamdscan error 2 X-virus-checker-version: clamassassin 1.2.4 with clamdscan / ERROR: Can't connect to clamd: Permission denied But NO AVCs I have proved that selinux is the culprit. Putting SEL into permissive mode temporarily allows clamd to work as it should (but still no AVCs). I am a little reluctant to do the "semodule -DB" to reveal any silent denials as I get swamped with stuff (but if that's what it takes...) In the meantime can anyone suggest any other approach? Here is my current clamd module as created by audit2allow: =========================8<======================================== # cat selinux/myclamd.te module myclamd 13.1.3; require { type unconfined_t; type var_run_t; type clamd_var_run_t; type initrc_t; type procmail_t; class sock_file write; class unix_stream_socket connectto; } #============= procmail_t ============== allow procmail_t initrc_t:unix_stream_socket connectto; #!!!! This avc is allowed in the current policy allow procmail_t unconfined_t:unix_stream_socket connectto; #!!!! This avc is allowed in the current policy allow procmail_t var_run_t:sock_file write; allow procmail_t clamd_var_run_t:sock_file write; #!!!! This avc is allowed in the current policy =========================8<======================================== Note - those comments are created by audit2allow. Thanks in advance... Mark

3 44

[sandbox] uid 0 <- Xorg <- Xephyr <- $program <- $exploit
by Christoph A. 24 Aug '10

24 Aug '10

Hi, I assumed sandboxed application run within there own embedded X server instance (Xephyr) to protect Xorg against attacks originating from the sandbox. My assumption seams to be wrong as the recent security issue showed [1]. [1] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2240 My question is: Why do sandboxed X application run within Xephyr? Is the attack surface smaller if an application runs within Xephyr even if Xephyr must be allowed to talk to Xorg? kind regards, Christoph

2 3

Re: This isn't nice
by mark 22 Aug '10

22 Aug '10

Stephen John Smoogen wrote: > On Wed, Aug 18, 2010 at 14:51, <m.roth(a)5-cent.us> wrote: >> Well, I dunno if this is a bug with fedora or selinux, but my FC13 system >> crashed earlier today with: >> >> Aug 18 13:01:56 argo kernel: SELinux: Invalid class 0 >> Aug 18 13:11:23 argo kernel: BUG: unable to handle kernel NULL pointer >> dereference at 0000000000000008 >> Aug 18 13:11:23 argo kernel: IP: [<ffffffff811c73b6>] >> selinux_inode_free_security+0x3f/0x77 >> Aug 18 13:11:23 argo kernel: PGD 139db9067 PUD 12dde6067 PMD 0 >> Aug 18 13:11:23 argo kernel: Oops: 0002 [#1] SMP >> Aug 18 13:11:23 argo kernel: last sysfs file: >> /sys/devices/pci0000:00/0000:00:1c.0/0000:0b:00.0/local_cpus >> Aug 18 13:11:23 argo kernel: CPU 2 >> Aug 18 13:11:23 argo kernel: Pid: 50, comm: kswapd0 Tainted: P > > # P: A module with a Proprietary license has been loaded, i.e. a > module that is not licensed under the GNU General Public License (GPL) > or a compatible license. This may indicate that source code for this > module is not available to the Linux kernel developers or to Novell's > developers. > Um, not so far as I know. I used preupgrade to bring an FC10 system to FC13. Other than the drives being encrypted (LUKS works), to the best of my knowledge - and I was the one who did the upgrade, there is *nothing* non-standard. mark > Whats loaded to cause that? > >> mark, very unhappy with FC13.... -- O'Leary, O'Reilly, O'Hare and O'Hara, there's no one as Irish as Barack O'Bama..." - "There's no one as Irish as Barack O'Bama, the Corrigan Bros.

1 0

using port (sub)ranges
by Mr Dash Four 21 Aug '10

21 Aug '10

I am trying to build a custom policy for one of my applications, which needs to: 1. Listen on a predefined range of tcp/udp ports (49200-49232); and 2. Connect to 25, 465, 110, 143, 993 & 995 tcp and 443, 1194 udp ports All is done on the local (lo) interface, NOT ethX (this should be prevented, if attempted!). The above port ranges cannot be changed! There are a couple of difficulties I am facing, however: 1. The first range of ports already form part of the 'virt' port ranges (49152-49216) in corenetwork.te.in. How do I define/use my own set of ranges (even if it clashes with another range type defined elsewhere) in order to allow 'corenet_tcp_bind' and 'corenet_udp_bind' macros to do their job and use them in my custom.te? Is there another way of doing name_bind? 2. The second port ranges form part of the 'pop', 'smtp' and 'openvpn' (as defined in corenetwork.te.in), but I do not wish to use the whole ranges when allowing a connection to be made. I also want to restrict these connections to be on the local interface only. Is there a way I could do that in my custom.te? Thanks in advance!

1 0

This isn't nice
by mark 20 Aug '10

20 Aug '10

Well, I dunno if this is a bug with fedora or selinux, but my FC13 system crashed earlier today with: Aug 18 13:01:56 argo kernel: SELinux: Invalid class 0 Aug 18 13:11:23 argo kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 Aug 18 13:11:23 argo kernel: IP: [<ffffffff811c73b6>] selinux_inode_free_security+0x3f/0x77 Aug 18 13:11:23 argo kernel: PGD 139db9067 PUD 12dde6067 PMD 0 Aug 18 13:11:23 argo kernel: Oops: 0002 [#1] SMP Aug 18 13:11:23 argo kernel: last sysfs file: /sys/devices/pci0000:00/0000:00:1c.0/0000:0b:00.0/local_cpus Aug 18 13:11:23 argo kernel: CPU 2 Aug 18 13:11:23 argo kernel: Pid: 50, comm: kswapd0 Tainted: P 2.6.33.6-147.fc13.x86_64 #1 0GU083/Precision WorkStation 490 Aug 18 13:11:23 argo kernel: RIP: 0010:[<ffffffff811c73b6>] [<ffffffff811c73b6>] selinux_inode_free_security+0x3f/0x77 Aug 18 13:11:23 argo kernel: RSP: 0018:ffff88013a0e7bf0 EFLAGS: 00010213 Aug 18 13:11:23 argo kernel: RAX: ffff880126f15008 RBX: ffff880126f15000 RCX: 0000000000000000 Aug 18 13:11:23 argo kernel: RDX: 0000000000000000 RSI: ffff880005890500 RDI: ffff880137156860 Aug 18 13:11:23 argo kernel: RBP: ffff88013a0e7c10 R08: ffff880011d2e980 R09: 0000000000000005 Aug 18 13:11:23 argo kernel: R10: ffff880011d2e860 R11: ffff880011d2e650 R12: ffff880011d2e970 Aug 18 13:11:23 argo kernel: R13: ffff880137156800 R14: ffff88013a0e7cb0 R15: 0000000000000080 Aug 18 13:11:23 argo kernel: FS: 0000000000000000(0000) GS:ffff880005880000(0000) knlGS:0000000000000000 Aug 18 13:11:23 argo kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b Aug 18 13:11:23 argo kernel: CR2: 0000000000000008 CR3: 000000012ddfd000 CR4: 00000000000006e0 Aug 18 13:11:23 argo kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Aug 18 13:11:23 argo kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Aug 18 13:11:23 argo kernel: Process kswapd0 (pid: 50, threadinfo ffff88013a0e6000, task ffff88013b0f2ea0) Aug 18 13:11:23 argo kernel: Stack: Aug 18 13:11:23 argo kernel: ffff88013a0e7c10 ffff880011d2e970 ffff880011d2e980 000000000000007d Aug 18 13:11:23 argo kernel: <0> ffff88013a0e7c30 ffffffff811be70b 0000000000000000 ffff880011d2e970 Aug 18 13:11:23 argo kernel: <0> ffff88013a0e7c50 ffffffff811130d4 ffff880011d2eb80 ffff880011d2e970 Aug 18 13:11:23 argo kernel: Call Trace: Aug 18 13:11:23 argo kernel: [<ffffffff811be70b>] security_inode_free+0x21/0x25 Aug 18 13:11:23 argo kernel: [<ffffffff811130d4>] __destroy_inode+0x21/0x78 Aug 18 13:11:23 argo kernel: [<ffffffff8111313c>] destroy_inode+0x11/0x40 Aug 18 13:11:23 argo kernel: [<ffffffff811135d4>] dispose_list+0xbe/0xed Aug 18 13:11:23 argo kernel: [<ffffffff811137d1>] shrink_icache_memory+0x1ce/0x1fe Aug 18 13:11:23 argo kernel: [<ffffffff810cb017>] shrink_slab+0xd3/0x157 Aug 18 13:11:23 argo kernel: [<ffffffff810cd0db>] balance_pgdat+0x3af/0x5e3 Aug 18 13:11:23 argo kernel: [<ffffffff810ca7ae>] ? isolate_pages_global+0x0/0x1f2 Aug 18 13:11:23 argo kernel: [<ffffffff810cd550>] kswapd+0x241/0x26d Aug 18 13:11:23 argo kernel: [<ffffffff810641bf>] ? autoremove_wake_function+0x0/0x34 Aug 18 13:11:23 argo kernel: [<ffffffff810cd30f>] ? kswapd+0x0/0x26d Aug 18 13:11:23 argo kernel: [<ffffffff81063d6f>] kthread+0x7a/0x82 Aug 18 13:11:23 argo kernel: [<ffffffff8100a924>] kernel_thread_helper+0x4/0x10 Aug 18 13:11:23 argo kernel: [<ffffffff81063cf5>] ? kthread+0x0/0x82 Aug 18 13:11:23 argo kernel: [<ffffffff8100a920>] ? kernel_thread_helper+0x0/0x10 Aug 18 13:11:23 argo kernel: Code: 01 00 00 48 8b 9f 28 02 00 00 4c 8b a8 c0 00 00 00 49 8d 7d 60 e8 ec 2c 26 00 48 8b 53 08 48 8d 43 08 48 39 c2 74 13 48 8b 4b 10 <48> 89 4a 08 48 89 11 48 89 43 08 48 89 43 10 66 41 ff 45 60 49 Aug 18 13:11:23 argo kernel: RIP [<ffffffff811c73b6>] selinux_inode_free_security+0x3f/0x77 Aug 18 13:11:23 argo kernel: RSP <ffff88013a0e7bf0> Aug 18 13:11:23 argo kernel: CR2: 0000000000000008 Aug 18 13:11:23 argo kernel: ---[ end trace 4543cd894c4be801 ]--- mark, very unhappy with FC13....

2 1

Create denial on nshadow when logging in with an expired password
by Patrice GILLET (Ingenico Partner) 20 Aug '10

20 Aug '10

Hi everyone, I'm running selinux-policy-strict 2.4.6-279.el5_5.1 (Redhat), and I get a denial when a user logs on (via SSH) with an expired password. The procedure for getting the new password goes fine, but the update of shadow fails and the login is refused. The audit messages are the following: type=USER_AUTH msg=audit(1282326913.918:472): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: authentication acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=failed)' type=USER_LOGIN msg=audit(1282326913.918:473): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='acct="testupgrader": exe="/usr/sbin/sshd" (hostname=?, addr=xx.xx.xx.xx, terminal=sshd res=failed)' type=USER_AUTH msg=audit(1282326917.387:474): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: authentication acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_ACCT msg=audit(1282326917.388:475): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: accounting acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=failed)' type=CRED_ACQ msg=audit(1282326917.393:476): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=LOGIN msg=audit(1282326917.393:477): login pid=14136 uid=0 old auid=4294967295 new auid=508 old ses=4294967295 new ses=26 type=USER_START msg=audit(1282326917.393:478): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: session open acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=CRED_REFR msg=audit(1282326917.394:479): user pid=14138 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_LOGIN msg=audit(1282326917.397:480): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='uid=508: exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=/dev/pts/7 res=success)' type=AVC msg=audit(1282326929.157:481): avc: denied { create } for pid=14139 comm="passwd" name="nshadow" scontext=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file type=SYSCALL msg=audit(1282326929.157:481): arch=c000003e syscall=2 success=no exit=-13 a0=2ad97d295a33 a1=241 a2=1b6 a3=241 items=0 ppid=14138 pid=14139 auid=508 uid=508 gid=508 euid=0 suid=0 fsuid=0 egid=508 sgid=508 fsgid=508 tty=pts7 ses=26 comm="passwd" exe="/usr/bin/passwd" subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 key=(null) type=USER_CHAUTHTOK msg=audit(1282326931.330:482): user pid=14139 uid=508 auid=508 subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 msg='PAM: chauthtok acct="testupgrader" : exe="/usr/bin/passwd" (hostname=?, addr=?, terminal=pts/7 res=failed)' type=USER_CHAUTHTOK msg=audit(1282326931.330:483): user pid=14139 uid=508 auid=508 subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 msg='op=change password id=508 exe="/usr/bin/passwd" (hostname=?, addr=?, terminal=pts/7 res=failed)' type=CRED_DISP msg=audit(1282326931.332:484): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_END msg=audit(1282326931.332:485): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: session close acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' Audit2allow suggests to add auth_manage_shadow(e2ee_upgrader_t) to the local policy, but that doesn't change anything. Neither does adding allow e2ee_upgrader_t shadow_t:file { create }. What is really strange is that the very same user (after its password has been changed by root) can run passwd and set its password without any problem. Any idea? Thanks in advance for any suggestion, Patrice.

2 1

Sample Passenger/Rails policy for review
by Moray Henderson (ICT) 19 Aug '10

19 Aug '10

Hi all, I've been looking at getting a Ruby on Rails app working through Passenger under CentOS 5.5. I felt it should run in its own security context, so I came up with the following sample module. Please comment. Summary ------- The policy creates a new set of apache content types using apache_content_template. The Passenger ApplicationPoolServerExecutable is given type httpd_myapp_script_exec_t, so the app will execute in httpd_myapp_script_t. The remaining Passenger files, and the Rails app itself, are httpd_myapp_content_t. PassengerTempDir is set to /var/run/passenger, and given httpd_myapp_script_rw_t to allow the sockets and stuff to be created. Source ------ #### myapp.te #### policy_module(myapp,1.0) # Create a set of apache content types for myapp apache_content_template(myapp); # Give running app access to system things it will ask for kernel_read_kernel_sysctls(httpd_myapp_script_t); miscfiles_read_certs(httpd_myapp_script_t); term_use_all_user_ptys(httpd_myapp_script_t); # Allow apache to create and communicate with Passenger allow httpd_t self:capability { fowner fsetid }; allow httpd_t httpd_myapp_script_t:unix_stream_socket rw_socket_perms; allow httpd_t httpd_myapp_script_t:process { siginh rlimitinh noatsecure }; allow httpd_t httpd_myapp_script_rw_t:fifo_file manage_file_perms; allow httpd_t httpd_myapp_script_rw_t:sock_file { setattr unlink }; # Access that Passenger will need allow httpd_myapp_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid }; allow httpd_myapp_script_t httpd_t:unix_stream_socket { read write }; #### myapp.fc #### /usr/lib/ruby/gems/1.9.1/gems/passenger-2.2.15/lib/phusion_passenger/App licationPoolServerExecutable -- gen_context(system_u:object_r:httpd_myapp_script_exec_t, s0) /usr/lib/ruby/gems/1.9.1/gems/passenger-2.2.15(/.*)? gen_context(system_u:object_r:httpd_myapp_content_t, s0) /usr/local/lib/myapp(/.*)? gen_context(system_u:object_r:httpd_myapp_content_t, s0) /var/run/passenger(/.*)? gen_context(system_u:object_r:httpd_myapp_script_rw_t, s0) Moray. "To err is human. To purr, feline"

3 9

F12/3: SELinux is preventing /usr/bin/perl from binding to port XXXXX
by Dan Thurman 18 Aug '10

18 Aug '10

Every once in awhile I get these spurious message, high CPU usage, repeated denials > 512 times and then it quits. I do not have ypbind, nis, nor nfs installed. I even tried /.autorelabel and same issue comes up. I do have spamassassin installed though. So how do I resolve this? =================================================== Summary: SELinux is preventing /usr/bin/perl from binding to port 32726. Detailed Description: SELinux has denied the spamassassin from binding to a network port 32726 which does not have an SELinux type associated with it. If spamassassin should be allowed to listen on 32726, use the semanage command to assign 32726 to a port type that spamc_t can bind to (). If spamassassin is not supposed to bind to 32726, this could signal an intrusion attempt. Allowing Access: If you want to allow spamassassin to bind to port 32726, you can execute # semanage port -a -t PORT_TYPE -p udp 32726 where PORT_TYPE is one of the following: . If this system is running as an NIS Client, turning on the allow_ypbind boolean may fix the problem. setsebool -P allow_ypbind=1. Additional Information: Source Context system_u:system_r:spamc_t:s0 Target Context system_u:object_r:port_t:s0 Target Objects None [ udp_socket ] Source spamassassin Source Path /usr/bin/perl Port 32726 Host (removed) Source RPM Packages perl-5.10.1-116.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-44.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name bind_ports Host Name (removed) Platform Linux (removed) 2.6.33.6-147.2.4.fc13.i686 #1 SMP Fri Jul 23 17:27:40 UTC 2010 i686 i686 Alert Count 512 First Seen Tue 17 Aug 2010 02:00:10 PM PDT Last Seen Tue 17 Aug 2010 04:05:25 PM PDT Local ID 280d928d-03f6-42c5-99f8-eb23cb24a236 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1282086325.907:81309): avc: denied { name_bind } for pid=23536 comm="spamassassin" src=32726 scontext=system_u:system_r:spamc_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket node=(removed) type=SYSCALL msg=audit(1282086325.907:81309): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfae7100 a2=654b4d4 a3=9fd1008 items=0 ppid=23535 pid=23536 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="spamassassin" exe="/usr/bin/perl" subj=system_u:system_r:spamc_t:s0 key=(null)

4 6

Re: Sample Passenger/Rails policy for review
by Jason Axelson 18 Aug '10

18 Aug '10

Hi Moray, On Tue, Aug 17, 2010 at 5:34 AM, Moray Henderson <Moray.Henderson(a)ict-software.org> wrote: > Are any of the macros in /usr/share/selinux/devel/include/support/ > documented anywhere? I couldn't find them in the Tresys Refpolicy API > documentation or the selinuxproject.org wiki. Have you tried doing a "make html" in the refpolicy source? That will generate a nice html interface to the macros, although there are many so it can still be hard to tell which one would be best to use. Not sure if you'll have it with your distribution but if you download from tresys directly [1] you will be fine. 1. http://oss.tresys.com/projects/refpolicy Jason

3 2

Re: avc { module_request, relabelfrom }: openvpn->tun
by Mr Dash Four 18 Aug '10

18 Aug '10

>>>>> kernel_request_load_module(openvpn_t) >>>>> >>> create module that allows openvpn_t to request the kernel to load a module: >>> >>> mkdir ~/myopenvpn; cd ~/myopenvpn; >>> echo "policy_module(myopenvpn, 1.0.0)" > myopenvpn.te; >>> echo "gen_require(\`" >> myopenvpn.te; >>> echo "type openvpn_t;" >> myopenvpn.te; >>> echo "')" >> myopenvpn.te; >>> echo "kernel_request_load_module(openvpn_t)" >> myopenvpn.te; >>> make -f /usr/share/selinux/devel/Makefile myopenvpn.pp >>> sudo semodule -i myopenvpn.pp >>> I see that this change has been adopted with the -47 version of the policy (FC13) - that was pretty quick! There was a suggestion for change to tor.te a while ago as well (see tor: dac_override, dac_read_search, name_bind and net_bind_service thread) - the new version of tor (2.x) provides dns resolution as part of the service it runs, so it needs to bind to udp/53 and the statement: corenet_udp_bind_dns_port(tor_t) does the trick when it is included in tor.te. Currently I do this with patching, but it would be nice to have it as part of the policy in a similar way it was done with openvpn.

2 2

Re: [refpolicy] [PATCH] revise roles/dbadm.te (Re: dbadm.pp is not available in selinux-policy package)
by KaiGai Kohei 18 Aug '10

18 Aug '10

(2010/08/18 3:00), Chris PeBenito wrote: > On 08/16/10 19:37, KaiGai Kohei wrote: >> (2010/08/17 4:42), Christopher J. PeBenito wrote: >>> On 08/16/10 05:11, KaiGai Kohei wrote: >>>> Sorry for this long silent on the topic. >>>> >>>> IIRC, we have already agreed most part of the patch, haven't we? >>>> >>>> - The dbadm_t domain shall be launched via sudo, not a login shell, >>>> so, userdom_base_user_template() is used to grant basic privileges >>>> to dbadm_t instead of userdom_unpriv_user_template(). >>>> - It allows too much privileges to dbadm_t, if we allows him to launch >>>> setfiles, so we removed seutil_domtrans_setfiles(). >>>> >>>> Did we have any more issues? >>>> >>>> The attached patch is same as the last version except for it was >>>> rebased >>>> to the latest reference policy. >>> >>> I only have two issues: >>> >>> 1. Why should dbadm be allowed to set enforce mode? >> >> It uses selinux_get_enforce_mode(), not selinux_set_enforce_mode(). >> We just allow dbadm_t to see the current working mode. > > My mistake, I misread it. You're right, its fine. > >>> 2. Why does dbadm need to manage generic locks? >> >> It was originally copied from webadb.te, but PostgreSQL also makes >> its lockfile on the /var/lock/subsys/postgresql. If server process >> unexpectedly crashed, dbadm_t need to remove it by hand, doesn't it? > > Based on what I see in the policy, my guess is this file is created by > the init script, right? If not, then it sounds like PostgreSQL needs a > lock type. > Yes, this file is created by the init script. In addition, postgresql_lock_t is defined, but type_transition rule is defined on a pair of postgresql_t and var_lock_t, so the lockfile shall be labeled as var_lock_t. [root@saba ~]# ls -Z /var/lock/subsys/postgresql -rw-r--r--. root root dbadm_u:object_r:var_lock_t:s0 /var/lock/subsys/postgresql Maybe, init script should relabel it to postgresql_lock_t, ideally? > I'd rather it just have delete permissions, rather than full manage > permissions. Something like files_delete_all_locks(), but for var_lock_t > instead. > I tried to define files_delete_generic_locks(), instead of the manage. Thanks, -- KaiGai Kohei <kaigai(a)ak.jp.nec.com>

1 0

SELinux integration in LDAP
by Matthias Imsand 17 Aug '10

17 Aug '10

Hello, I’m referring to an older post (may 2008) http://lists.fedoraproject.org/pipermail/selinux/2008-May/009449.html The question is, if it’s possible to administer SELinux users and RBAC stuff (like roles) in LDAP? Are there some developments on this? What about FreeIPA, do they have some sample code / libraries that I could integrate in our company? In our company everything relies on LDAP. So I must have a solution for integrating SELinux in LDAP. Thanks in advance imsand

2 1

Re: [refpolicy] [PATCH] revise roles/dbadm.te (Re: dbadm.pp is not available in selinux-policy package)
by KaiGai Kohei 16 Aug '10

16 Aug '10

(2010/08/17 4:42), Christopher J. PeBenito wrote: > On 08/16/10 05:11, KaiGai Kohei wrote: >> Sorry for this long silent on the topic. >> >> IIRC, we have already agreed most part of the patch, haven't we? >> >> - The dbadm_t domain shall be launched via sudo, not a login shell, >> so, userdom_base_user_template() is used to grant basic privileges >> to dbadm_t instead of userdom_unpriv_user_template(). >> - It allows too much privileges to dbadm_t, if we allows him to launch >> setfiles, so we removed seutil_domtrans_setfiles(). >> >> Did we have any more issues? >> >> The attached patch is same as the last version except for it was rebased >> to the latest reference policy. > > I only have two issues: > > 1. Why should dbadm be allowed to set enforce mode? It uses selinux_get_enforce_mode(), not selinux_set_enforce_mode(). We just allow dbadm_t to see the current working mode. > 2. Why does dbadm need to manage generic locks? It was originally copied from webadb.te, but PostgreSQL also makes its lockfile on the /var/lock/subsys/postgresql. If server process unexpectedly crashed, dbadm_t need to remove it by hand, doesn't it? Thanks, > After those are resolved, it can be merged. > >> (2010/04/15 15:02), KaiGai Kohei wrote: >>> (2010/04/14 0:57), Christopher J. PeBenito wrote: >>>> On Tue, 2010-04-13 at 11:15 -0400, Daniel J Walsh wrote: >>>>> -----BEGIN PGP SIGNED MESSAGE----- >>>>> Hash: SHA1 >>>>> >>>>> On 04/13/2010 09:17 AM, Christopher J. PeBenito wrote: >>>>>> On Tue, 2010-04-13 at 09:28 +0900, KaiGai Kohei wrote: >>>>>>> (2010/04/12 23:09), Christopher J. PeBenito wrote: >>>>>>>> On Fri, 2010-04-09 at 14:29 +0900, KaiGai Kohei wrote: >>>>>>>>> (2010/04/08 21:15), Daniel J Walsh wrote: >>>>>>>>>> As Dominick stated. I prefer to think in terms of two >>>>>>>>>> different roles. >>>>>>>>>> Login Roles, and Roles to execute in when you have privileges >>>>>>>>>> (IE Root). >>>>>>>>>> >>>>>>>>>> Login Roles/Types >>>>>>>>>> staff_t, user_t, unconfined_t, xguest_t, guest_t >>>>>>>>>> >>>>>>>>>> Three interfaces can be used to create confined login users. >>>>>>>>>> >>>>>>>>>> userdom_restricted_user_template(guest) >>>>>>>>>> userdom_restricted_xwindows_user_template(xguest) >>>>>>>>>> userdom_unpriv_user_template(staff) >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Admin Roles/Types >>>>>>>>>> logadm_t, webadm_t, secadm_t, auditadm_t >>>>>>>>>> >>>>>>>>>> The following interface can be used to create an Admin ROle >>>>>>>>>> userdom_base_user_template(logadm) >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> sysadm_t is sort of a hybrid, most people use it as an Admin >>>>>>>>>> Role. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I imagine that you login as a confined user and then use >>>>>>>>>> sudo/newrole to >>>>>>>>>> switch roles to one of the admin roles. >>>>>>>>> >>>>>>>>> The attached patch revises roles/dbadm.te (to be applied on the >>>>>>>>> upstream >>>>>>>>> reference policy). It uses userdom_base_user_template() instead >>>>>>>>> of the >>>>>>>>> userdom_unpriv_user_template(), and should be launched via >>>>>>>>> sudo/newrole. >>>>>>>>> In the default, it intends the dbadm_r role to be launched by >>>>>>>>> staff_r role. >>>>>>>> >>>>>>>> Why does dbadm need to run setfiles? >>>>>>> >>>>>>> The database files (typically, /var/lib/(se)?pgsql/*) have to be >>>>>>> labeled >>>>>>> correctly, so I thought dbadm needs to run setfiles. >>>>>>> However, as long as they initialize database files using init >>>>>>> script, >>>>>>> initrc_t domain performs this initial labeling, so it might not >>>>>>> be necessary. >>>>>>> >>>>>>> On the other hand, PostgreSQL support a feature to use multiple >>>>>>> disks >>>>>>> within a single database instance for performance utilization. >>>>>>> (Called TABLESPACE; I don't know whether MySQL has such a feature.) >>>>>>> >>>>>>> http://archives.postgresql.org/pgsql-general/2006-08/msg00142.php >>>>>>> >>>>>>> It requires administrators to assign proper security context on >>>>>>> the secondary >>>>>>> directory, or to mount the secondary disk with context='...' option. >>>>>>> >>>>>>> Is there any good idea? >>>>>>> >>>>>>> Or, it should not be a task for dbadm? >>>>>> >>>>>> Ok, the transition for setfiles is fine. >>>>>> >>>>> >>>>> I would be carefull with this. Since setfiles can take a parameter >>>>> of a >>>>> file context file. I think it would be better to only give >>>>> relabefrom/relabelto privs for all labels dbadm_t can manage. Then >>>>> figure out what access is required to mount. >>>> >>>> Good point. We should probably reconsider the setfiles usage from >>>> webadm too. >>> >>> The attached patch is a revised one. >>> - seutil_domtrans_setfiles() was removed >>> - staff_role_change_to() was removed, and I put dbadm_role_change() >>> on the staff.te >>> - Fix an obvious typo. >>> >>> It is not clear for me whether the idea to allow relabelfrom/relabelto >>> for all the files dbadm_t can manage, because it is eventually necessary >>> someone to relabel (or assign initial labels) files from unlabeled one >>> to managed labels when we mount a new disk. >>> >>> If so, should it be a task of sysadm_t to mount new disk and assign >>> security context correctly, instead of webadm_t/dbadm_t? >>> >>> Thanks, > -- KaiGai Kohei <kaigai(a)ak.jp.nec.com>

1 0

Re: avc { module_request, relabelfrom }: openvpn->tun
by Mr Dash Four 16 Aug '10

16 Aug '10

The proposed modifications were tested and work without a hitch, so I am making the changes permanent as part of my custom policy. Many thanks Dominick for your input. It is interesting though that when openvpn is restarted (which forces the 'closure' of the tun device, which is then opened again by openvpn) I do not get the 'relablefrom' avcs, but if I do open the tun device 'manually' (using 'openvpn --mktun') I do get these. This modification also helped me find a bug in the openvpn config file I was using (I have chrooted openvpn, but forgot to reset the SELinux permissions on the 'local' copy of ip, so that caused problems as well - easily fixed though), so that was an added bonus for me.

1 0

Selinux + ruby + httpd
by Erinn Looney-Triggs 16 Aug '10

16 Aug '10

In trying to develop some SELinux exceptions (via audit2allow) for a ruby application I came up with the following: module myruby 1.0; require { type httpd_tmp_t; type lib_t; type httpd_t; type tmp_t; class sock_file { write create unlink getattr setattr }; class capability { fowner fsetid }; class file { read getattr execute_no_trans }; class fifo_file { create unlink getattr setattr }; } #============= httpd_t ============== allow httpd_t httpd_tmp_t:fifo_file { create unlink getattr setattr }; allow httpd_t httpd_tmp_t:sock_file { write create unlink getattr setattr }; allow httpd_t lib_t:file execute_no_trans; #This one is due to mod_passenger being labelled lib_t allow httpd_t self:capability { fowner fsetid }; allow httpd_t tmp_t:file { read getattr }; Now the first question I have, is there anything egregiously bad in there? Aside from lib_t execute due to auto label labelling mod_passenger as lib_t. My second question is, I have this policy working on one machine, moved it to another machine and everything worked, this application was then deployed on a third machine and I figured, I would just insert the module again. Well installing the module worked fine but apache is trying to use a different type on this machine, from audit2allow: #============= httpd_sys_script_t ============== allow httpd_sys_script_t devpts_t:chr_file { read write }; allow httpd_sys_script_t httpd_tmp_t:fifo_file setattr; allow httpd_sys_script_t self:capability { setuid setgid }; Why all the sudden is this machine using httpd_sys_script_t instead of httpd_t which my other systems use? All the boxes are RHEL 5.5 x64 fully patched running selinux-policy-2.4.6-279.el5. Now it is possible that the myruby.pp module mentioned above is working just fine, but why then would this one system need these extra privileges? Exact same codebase for the ruby application across the systems. Any insight would be appreciated. Thanks, -Erinn

3 3

Re: [refpolicy] [PATCH] revise roles/dbadm.te (Re: dbadm.pp is not available in selinux-policy package)
by KaiGai Kohei 16 Aug '10

16 Aug '10

(2010/04/14 0:57), Christopher J. PeBenito wrote: > On Tue, 2010-04-13 at 11:15 -0400, Daniel J Walsh wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On 04/13/2010 09:17 AM, Christopher J. PeBenito wrote: >>> On Tue, 2010-04-13 at 09:28 +0900, KaiGai Kohei wrote: >>>> (2010/04/12 23:09), Christopher J. PeBenito wrote: >>>>> On Fri, 2010-04-09 at 14:29 +0900, KaiGai Kohei wrote: >>>>>> (2010/04/08 21:15), Daniel J Walsh wrote: >>>>>>> As Dominick stated. I prefer to think in terms of two different roles. >>>>>>> Login Roles, and Roles to execute in when you have privileges (IE Root). >>>>>>> >>>>>>> Login Roles/Types >>>>>>> staff_t, user_t, unconfined_t, xguest_t, guest_t >>>>>>> >>>>>>> Three interfaces can be used to create confined login users. >>>>>>> >>>>>>> userdom_restricted_user_template(guest) >>>>>>> userdom_restricted_xwindows_user_template(xguest) >>>>>>> userdom_unpriv_user_template(staff) >>>>>>> >>>>>>> >>>>>>> Admin Roles/Types >>>>>>> logadm_t, webadm_t, secadm_t, auditadm_t >>>>>>> >>>>>>> The following interface can be used to create an Admin ROle >>>>>>> userdom_base_user_template(logadm) >>>>>>> >>>>>>> >>>>>>> sysadm_t is sort of a hybrid, most people use it as an Admin Role. >>>>>>> >>>>>>> >>>>>>> I imagine that you login as a confined user and then use sudo/newrole to >>>>>>> switch roles to one of the admin roles. >>>>>> >>>>>> The attached patch revises roles/dbadm.te (to be applied on the upstream >>>>>> reference policy). It uses userdom_base_user_template() instead of the >>>>>> userdom_unpriv_user_template(), and should be launched via sudo/newrole. >>>>>> In the default, it intends the dbadm_r role to be launched by staff_r role. >>>>> >>>>> Why does dbadm need to run setfiles? >>>> >>>> The database files (typically, /var/lib/(se)?pgsql/*) have to be labeled >>>> correctly, so I thought dbadm needs to run setfiles. >>>> However, as long as they initialize database files using init script, >>>> initrc_t domain performs this initial labeling, so it might not be necessary. >>>> >>>> On the other hand, PostgreSQL support a feature to use multiple disks >>>> within a single database instance for performance utilization. >>>> (Called TABLESPACE; I don't know whether MySQL has such a feature.) >>>> >>>> http://archives.postgresql.org/pgsql-general/2006-08/msg00142.php >>>> >>>> It requires administrators to assign proper security context on the secondary >>>> directory, or to mount the secondary disk with context='...' option. >>>> >>>> Is there any good idea? >>>> >>>> Or, it should not be a task for dbadm? >>> >>> Ok, the transition for setfiles is fine. >>> >> >> I would be carefull with this. Since setfiles can take a parameter of a >> file context file. I think it would be better to only give >> relabefrom/relabelto privs for all labels dbadm_t can manage. Then >> figure out what access is required to mount. > > Good point. We should probably reconsider the setfiles usage from > webadm too. The attached patch is a revised one. - seutil_domtrans_setfiles() was removed - staff_role_change_to() was removed, and I put dbadm_role_change() on the staff.te - Fix an obvious typo. It is not clear for me whether the idea to allow relabelfrom/relabelto for all the files dbadm_t can manage, because it is eventually necessary someone to relabel (or assign initial labels) files from unlabeled one to managed labels when we mount a new disk. If so, should it be a task of sysadm_t to mount new disk and assign security context correctly, instead of webadm_t/dbadm_t? Thanks, -- KaiGai Kohei <kaigai(a)ak.jp.nec.com>

3 3

Re: avc { module_request, relabelfrom }: openvpn->tun
by Mr Dash Four 15 Aug '10

15 Aug '10

>> That did the trick! >> >> It was good that you've included this as a separate module so that I >> could test it, otherwise I had to patch and recompile the whole >> policy, then rebuild the image in order to test it and see whether >> it works. >> >> I take it to make this a 'permanent' solution I have to patch and >> include 'kernel_request_load_module(openvpn_t)' in openvpn.te >> (forming part of the -44 policy), is that right? >> > > Yes but Fedora should fix this. It is already fixed in f14 (v3.8.8-14). they just need to back port this to f13/f12 > Agreed. I am waiting to see if this patch is going to work in the event of connection reset/time out (in situations when the connection needs to be re-established - with/without closing the tun device and possibly re-establishing the ip address, routing and all other parameters) - in that case the tun kernel module should already be loaded so if anything goes wrong I am expecting 'relablefrom' avc to pop up. If not, then all is well and I am applying this patch permanently.

1 0

Re: avc { module_request, relabelfrom }: openvpn->tun
by Mr Dash Four 14 Aug '10

14 Aug '10

> koji.fedoraproject.org/koji but i guess its for f14, so instead: > > >>> kernel_request_load_module(openvpn_t) >>> > create module that allows openvpn_t to request the kernel to load a module: > > mkdir ~/myopenvpn; cd ~/myopenvpn; > echo "policy_module(myopenvpn, 1.0.0)" > myopenvpn.te; > echo "gen_require(\`" >> myopenvpn.te; > echo "type openvpn_t;" >> myopenvpn.te; > echo "')" >> myopenvpn.te; > echo "kernel_request_load_module(openvpn_t)" >> myopenvpn.te; > make -f /usr/share/selinux/devel/Makefile myopenvpn.pp > sudo semodule -i myopenvpn.pp > That did the trick! It was good that you've included this as a separate module so that I could test it, otherwise I had to patch and recompile the whole policy, then rebuild the image in order to test it and see whether it works. I take it to make this a 'permanent' solution I have to patch and include 'kernel_request_load_module(openvpn_t)' in openvpn.te (forming part of the -44 policy), is that right? > You can not define this rule for just a single particular module. > That's a pity, but I could live with that - auditd gives me a detailed info when a module is loaded, so I can trace this anyway, so no big loss. > See if you can reproduce it. unconfined_t (you) transition to the rc > script domain when you run an rc script, the rc script domain in turn > runs the openvpn executables. > > So with that in mind why would openvpn need to relabel unconfined_t > tun_sockets? > I take it this gets called only if loading of the tun/tap module fails. May be in a similar way as to when dac_* gets called - only in case the 'normal' permissions are too restrictive.

1 0

dac_override and dac_read_search ... again!
by Mr Dash Four 13 Aug '10

13 Aug '10

Having upgraded selinux-policy(-targeted) from 3.7.19-37 to 3.7.19-39 I started getting heaps of the two avc types from variety of programs/processes. Logs follow below. I have not done anything unusual apart from upgrading and patching 3 policy module files (though I am getting exactly the same avcs if using the pre-built policies packages!). The OS image is built in exactly the same way (with kickstart file and using livecd tools) as it was with the 3.7.19-37 version (and it worked there without any problems). I first though that it might be labelling problem, but as is evident from the file label listings below that appear not to be the case. When I try and boot from that image, the first sign of trouble comes when the auditd service does not start, hence why I do not have audit.log listing to include. The only way I could activate auditd is to force selinux into permissive mode (echo 0 > /selinux/enforce) and then execute "service auditd start". What could be the cause for this? I can't see the file permissions to be too restrictive either (which was the root cause of my previous dac_* problems). Any ideas as to how to solve this sorry mess are welcome! ====================/var/log/messages Aug 1 12:13:57 test1 kernel: type=1400 audit(1280664734.151:4): avc: denied { dac_override } for pid=378 comm="hostname" capability=1 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:system_r:hostname_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280664734.152:5): avc: denied { dac_read_search } for pid=378 comm="hostname" capability=2 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:system_r:hostname_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280664738.378:8): avc: denied { dac_override } for pid=386 comm="dmesg" capability=1 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:system_r:dmesg_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280664738.378:9): avc: denied { dac_read_search } for pid=386 comm="dmesg" capability=2 scontext=system_u:system_r:dmesg_t:s0 tcontext=system_u:system_r:dmesg_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661191.023:12): avc: denied { dac_override } for pid=689 comm="ip" capability=1 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661191.027:13): avc: denied { dac_read_search } for pid=689 comm="ip" capability=2 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661193.668:16): avc: denied { dac_override } for pid=714 comm="ifconfig" capability=1 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661193.671:17): avc: denied { dac_read_search } for pid=714 comm="ifconfig" capability=2 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661197.508:20): avc: denied { dac_override } for pid=729 comm="hostname" capability=1 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:system_r:hostname_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661197.510:21): avc: denied { dac_read_search } for pid=729 comm="hostname" capability=2 scontext=system_u:system_r:hostname_t:s0 tcontext=system_u:system_r:hostname_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661229.399:54): avc: denied { dac_override } for pid=922 comm="arping" capability=1 scontext=system_u:system_r:netutils_t:s0 tcontext=system_u:system_r:netutils_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661229.399:55): avc: denied { dac_read_search } for pid=922 comm="arping" capability=2 scontext=system_u:system_r:netutils_t:s0 tcontext=system_u:system_r:netutils_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661235.258:116): avc: denied { dac_override } for pid=973 comm="auditd" capability=1 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=capability Aug 1 12:13:57 test1 kernel: type=1400 audit(1280661235.260:117): avc: denied { dac_read_search } for pid=973 comm="auditd" capability=2 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=capability Aug 1 12:14:49 test1 kernel: type=1400 audit(1280661289.020:124): avc: denied { dac_override } for pid=1300 comm="ip" capability=1 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:14:49 test1 kernel: type=1400 audit(1280661289.025:125): avc: denied { dac_read_search } for pid=1300 comm="ip" capability=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:40 test1 kernel: type=1400 audit(1280661340.105:130): avc: denied { dac_override } for pid=1350 comm="ip" capability=1 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:40 test1 kernel: type=1400 audit(1280661340.108:131): avc: denied { dac_read_search } for pid=1350 comm="ip" capability=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:41 test1 kernel: type=1400 audit(1280661341.058:138): avc: denied { dac_override } for pid=1364 comm="ip" capability=1 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:41 test1 kernel: type=1400 audit(1280661341.058:139): avc: denied { dac_read_search } for pid=1364 comm="ip" capability=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:45 test1 kernel: type=1400 audit(1280661345.145:350): avc: denied { dac_override } for pid=1418 comm="tc" capability=1 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:15:45 test1 kernel: type=1400 audit(1280661345.146:351): avc: denied { dac_read_search } for pid=1418 comm="tc" capability=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability Aug 1 12:16:09 test1 kernel: type=1400 audit(1280661369.758:1176): avc: denied { dac_override } for pid=1615 comm="smartd" capability=1 scontext=system_u:system_r:fsdaemon_t:s0 tcontext=system_u:system_r:fsdaemon_t:s0 tclass=capability Aug 1 12:16:09 test1 kernel: type=1400 audit(1280661369.759:1177): avc: denied { dac_read_search } for pid=1615 comm="smartd" capability=2 scontext=system_u:system_r:fsdaemon_t:s0 tcontext=system_u:system_r:fsdaemon_t:s0 tclass=capability ==================== ====================service start auditd Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.362:1226): avc: denied { dac_override } for pid=1583 comm="auditd" capability=1 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.364:1227): avc: denied { dac_read_search } for pid=1583 comm="auditd" capability=2 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.370:1228): avc: denied { dac_override } for pid=1583 comm="auditd" capability=1 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.371:1229): avc: denied { dac_read_search } for pid=1583 comm="auditd" capability=2 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.436:1230): avc: denied { dac_override } for pid=1583 comm="auditd" capability=1 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.436:1231): avc: denied { dac_read_search } for pid=1583 comm="auditd" capability=2 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.443:1232): avc: denied { dac_override } for pid=1583 comm="auditd" capability=1 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 kernel: type=1400 audit(1280664845.443:1233): avc: denied { dac_read_search } for pid=1583 comm="auditd" capability=2 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:system_r:auditd_t:s0 tclass=capability Aug 1 13:14:05 test1 auditd: Error opening config file (Permission denied) Aug 1 13:14:05 test1 auditd: The audit daemon is exiting. ==================== ====================echo 0 > /selinux/enforce && service auditd start && service smartd start type=AVC msg=audit(1280608935.230:327): avc: denied { dac_override } for pid=1368 comm="smartd" capability=1 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=unconfined_u:system_r:fsdaemon_t:s0 tclass=capability type=AVC msg=audit(1280608935.230:327): avc: denied { dac_read_search } for pid=1368 comm="smartd" capability=2 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=unconfined_u:system_r:fsdaemon_t:s0 tclass=capability type=SYSCALL msg=audit(1280608935.230:327): arch=40000003 syscall=33 success=no exit=-13 a0=21a814 a1=4 a2=21ffc4 a3=2208f8 items=0 ppid=1367 pid=1368 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smartd" exe="/usr/sbin/smartd" subj=unconfined_u:system_r:fsdaemon_t:s0 key=(null) type=AVC msg=audit(1280608935.245:328): avc: denied { dac_override } for pid=1368 comm="smartd" capability=1 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=unconfined_u:system_r:fsdaemon_t:s0 tclass=capability type=AVC msg=audit(1280608935.245:328): avc: denied { dac_read_search } for pid=1368 comm="smartd" capability=2 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=unconfined_u:system_r:fsdaemon_t:s0 tclass=capability type=SYSCALL msg=audit(1280608935.245:328): arch=40000003 syscall=5 success=no exit=-13 a0=21a9fe a1=0 a2=0 a3=220880 items=0 ppid=1367 pid=1368 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smartd" exe="/usr/sbin/smartd" subj=unconfined_u:system_r:fsdaemon_t:s0 key=(null) ==================== ====================ls -lasZ /etc | grep audit drwxr-x---. root root system_u:object_r:auditd_etc_t:s0 audit -rw-r-----. root root system_u:object_r:etc_t:s0 libaudit.conf ==================== ====================ls -lasZ /etc/audit drwxr-x---. root root system_u:object_r:auditd_etc_t:s0 . drw-r--r--. root root system_u:object_r:etc_t:s0 .. -rw-r-----. root root system_u:object_r:auditd_etc_t:s0 auditd.conf -rw-r-----. root root system_u:object_r:auditd_etc_t:s0 audit.rules ==================== ====================ls -lasZ /etc/init.d/auditd -rwxr-xr-x. root root system_u:object_r:auditd_initrc_exec_t:s0 /etc/init.d/auditd ==================== ====================ls -lasZ /sbin/auditd -rwxr-x---. root root system_u:object_r:auditd_exec_t:s0 /sbin/auditd ==================== ====================ls -lasZ /var/log | grep audit drwxr-xr-x. root root system_u:object_r:auditd_log_t:s0 audit ==================== ====================ls -lasZ /var/log/audit drwxr-xr-x. root root system_u:object_r:auditd_log_t:s0 . drwxr-xr-x. root root system_u:object_r:var_log_t:s0 .. -rw-------. root root system_u:object_r:auditd_log_t:s0 audit.log ====================

2 6

A sendmail problem
by mark 10 Aug '10

10 Aug '10

The last few days - I think there was a policy update to FC13 - I started seeing /etc/cron.daily/0logwatch: > > Can't exec "sendmail": Permission denied at /usr/sbin/logwatch line > 1032, <TESTFILE> line 2. > Can't execute sendmail -t: Permission denied Mentioned this to my manager, and he didn't see anything in messages, but saw this audit message: type=SELINUX_ERR msg=audit(1281423963.394:71003): security_compute_sid: invalid context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 for scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=process Why would a policy prevent logwatch from using sendmail to forward a log? mark

3 3

SELINUX_ERR about sendmail (postfix version) on F-13
by Laurent Rineau 05 Aug '10

05 Aug '10

For a few days (maybe two weeks), my cron deamon keeps sending me error emails, once a day: > /etc/cron.daily/0logwatch: > > Can't exec "/usr/sbin/sendmail": Permission denied at /usr/sbin/logwatch line 1032, <TESTFILE> line 2. > Can't execute /usr/sbin/sendmail -t: Permission denied I have suspected SELinux, but the setroubleshot stuff did not say anything. And I eventually found that: lrineau@matisse ~ $ sudo ausearch -ts yesterday -m SELINUX_ERR ---- time->Tue Aug 3 03:16:04 2010 type=SYSCALL msg=audit(1280798164.966:454): arch=c000003e syscall=59 success=no exit=-13 a0=1dfe430 a1=1dfe3c0 a2=1e01240 a3=8 items=0 ppid=17968 pid=18278 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=31 comm="logwatch" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null) type=SELINUX_ERR msg=audit(1280798164.966:454): security_compute_sid: invalid context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 for scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=process ---- time->Wed Aug 4 03:19:04 2010 type=SYSCALL msg=audit(1280884744.246:135): arch=c000003e syscall=59 success=no exit=-13 a0=187b190 a1=187b120 a2=187ac30 a3=7ffff2dc3ec0 items=0 ppid=14696 pid=15085 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21 comm="logwatch" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null) type=SELINUX_ERR msg=audit(1280884744.246:135): security_compute_sid: invalid context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 for scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=process I did not know about SELINUX_ERR before that error. Maybe setroubleshotd should be aware of it, so that one can report bugs about SELINUX_ERR easily with the applet. My configuration is this one: lrineau@matisse ~ $ rpm -qa postfix selinux\* selinux-policy-3.7.19-39.fc13.noarch selinux-policy-targeted-3.7.19-39.fc13.noarch postfix-2.7.0-1.fc13.x86_64 logwatch and postfix are configured with the default configurations, tweak only the simpliest way. -- Laurent Rineau http://fedoraproject.org/wiki/LaurentRineau

4 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2010