selinux October 2022

selinux@lists.fedoraproject.org

6 participants
9 discussions

Setting context in early boot
by Frederick Grose 11 Dec '25

11 Dec '25

I have a general scoping question on setting SELinux context on files/directories during early boot. I'm working on a feature in dracut to implement general stacking of filesystem hierarchies via OverlayFS for the root filesystem within the dmsquash-live-root module. How should I address the setting of context for new files, directories, or links needed to assemble the components for the OverlayFS mount? For example, when I mkdir -m 0755 -p --context=system_u:object_r:root_t:s0 /run/somemountpoint I get this warning in the journal: mkdir: warning: ignoring --context; it requires an SELinux/SMACK-enabled kernel If the SELinux code is not active at this early stage, what is to be done?

3 3

SELinux is preventing systemd-tmpfile from using the sys_resource capability.
by Manfred Lotz 31 Jul '25

31 Jul '25

Hi there, Running Fedora 31 and SELinux still in permissive mode I got SELinux is preventing systemd-tmpfile from using the sys_resource capability. ***** Plugin sys_resource (91.4 confidence) suggests ********************** If you do not want processes to require capabilities to use up all the system resources on your syste> Then you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h, sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ Do fix the cause of the SYS_RESOURCE on your system. ***** Plugin catchall (9.59 confidence) suggests ************************** If you believe that systemd-tmpfile should have the sys_resource capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-tmpfile' --raw | audit2allow -M my-systemdtmpfile # semodule -X 300 -i my-systemdtmpfile.pp I also see type=AVC msg=audit(1569414241.452:321): avc: denied { sys_resource } for pid=17409 comm="systemd-tmpfile" capability=24 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability permissive=1 type=AVC msg=audit(1569414241.452:322): avc: denied { setrlimit } for pid=17409 comm="systemd-tmpfile" scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=process permissive=1 I have to admit I don't know how to judge this. Before I do anything here I like to understand. -- Manfred

5 5

Not possible to specify smtp password for setroubleshootd?
by Matt Kinni 09 Jun '24

09 Jun '24

Hello, I run a Fedora 35 server and would like setroubleshootd to send email alerts for avc denials, but I'm having trouble configuring this due to the apparent lack of support for configuring an smtp password. The out of the box setroubleshoot.conf sets > smtp_host = localhost > smtp_port = 25 > from_address = SELinux_Troubleshoot , but there is no config parameter for smtp password. For this to actually work on a machine acting as an MTA (I have postfix running locally), the mail server would have to be configured to allow unauthenticated port 25 connections to masquerade as any local system user, which no decent postfix setup would allow. I am not a python programmer, but in my reading of https://pagure.io/setroubleshoot/blob/main/f/framework/src/setroubleshoot/e…, it doesn't appear there is any built in way to support authenticated email sending despite the underlying smtplib being able to do it. I would suggest either a) adding password support for smtplib, or/and b) adding an option to send mail using the sendmail binary, which allows postfix to recognize the running user without any password needed. Has anyone else run into problems deploying the setroubleshootd email alerts in practice? email_alert.py appears simple enough to hack in password support, but I feel a security oriented project like selinux shouldn't require an insecure mail setup in order to send its alerts. Any tips are welcome, Thanks, Matt

2 4

certmonger post-save scripts & certmonger_unconfined_t domain
by Sam Morris 06 Jun '24

06 Jun '24

Certmonger allows for the configuration of a post-save command to be run after it has obtained new certificates. This can be used to copy the key & certificates out of wherever certmonger is allowed to put them, and save them elsewhere with a particular owner/group, combine the certificate & chain into a single file as required by some software, etc. The problem comes with SELinux which prevents my post-save scripts from being able to do all of that. I thought the solution was to give the scripts the context of certmonger_unconfined_exec_t, which would cause a transition to the certmonger_unconfined_t domain which is as its name suggests unconfined; but I can't get this to work. I'm trying to use runcon to simulate certmonger executing a fake script: # cat /tmp/fakescript #!/bin/bash set -eu id -Z # /tmp/fakescript unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 # ls -Z /tmp/fakescript unconfined_u:object_r:certmonger_unconfined_exec_t:s0 /tmp/fakescript # runcon system_u:system_r:certmonger_t:s0 /tmp/fakescript runcon: ‘/tmp/fakescript’: Permission denied Here is the avc denial: ---- type=PROCTITLE msg=audit(27/04/21 16:16:47.156:153492) : proctitle=runcon system_u:system_r:certmonger_t:s0 /tmp/fakescript type=SYSCALL msg=audit(27/04/21 16:16:47.156:153492) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x7ffd8aa768ab a1=0x7ffd8aa75888 a2=0x7ffd8aa75898 a3=0x0 items=0 ppid=177795 pid=177796 auid=sam.admin uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts5 ses=103 comm=runcon exe=/usr/bin/runcon subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(27/04/21 16:16:47.156:153492) : avc: denied { entrypoint } for pid=177796 comm=runcon path=/tmp/fakescript dev="dm-0" ino=33563064 scontext=system_u:system_r:certmonger_t:s0 tcontext=unconfined_u:object_r:certmonger_unconfined_exec_t:s0 tclass=file permissive=0 Even though: # sepolicy transition -s certmonger_t -t certmonger_unconfined_t certmonger_t @ certmonger_unconfined_exec_t --> certmonger_unconfined_t Diving in a little deeper, I can see that certmonger can execute the file: # sesearch -s certmonger_t -t certmonger_unconfined_exec_t -c file -p execute -A allow certmonger_t certmonger_unconfined_exec_t:file { execute execute_no_trans getattr ioctl map open read }; ... and that the file type is an entrypoint for the certmonger_unconfined_t domain: # sesearch -s certmonger_unconfined_t -t certmonger_unconfined_exec_t -c file -p entrypoint -A allow certmonger_unconfined_t certmonger_unconfined_exec_t:file { entrypoint execute getattr ioctl lock map open read }; ... and that transition is permitted from certmonger_t: # sesearch -s certmonger_t -t certmonger_unconfined_t -c process -p transition -A allow certmonger_t certmonger_unconfined_t:process transition; Which leaves me scratching my head, unsure why it doesn't work in practice... -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 4

Allow file access to two different domains
by Gionatan Danti 01 Nov '22

01 Nov '22

Hi all, as one file/dir can have one and only one selinux label, I wonder if/how one can allow processes from different domains to access the same files/dirs. I know that for specific executable and directory one can use the appropriate bools, for example samba_enable_home_dirs enables smbd to read/write home_root_t types. I also know that one can create and load a custom policy to allow the required access. However, I wonder if an easier approach exists to let processes with different domains to access the same set of files or directories. Any clue? Thanks. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

5 9

Re: Allow file access to two different domains
by Gionatan Danti 31 Oct '22

31 Oct '22

Il 2022-10-31 18:14 Petr Lautrbach ha scritto: > If you need to share files between 2 different generic domains, you > need > to add rules to allow the access. For example, for the domain > myprocess_t and files in /var/www/html, which is labeled as > httpd_sys_content_t, you would use a module like this: > > # cat > myprocess_httpd.cil <<EOF > (allow myprocess_t httpd_sys_content_t (dir ( getattr open search ))) > (allow myprocess_t httpd_sys_content_t (file ( getattr ioctl lock open > read ))) > EOF > > # semodule -i myprocess_httpd.cil Hi Petr, thanks for confirming. Regards. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

1 0

亚洲人毛茸茸,亚洲人毛茸茸_锱铢必较影院
by Stephen Korando 29 Oct '22

29 Oct '22

亚洲人毛茸茸众人都是一呆，这么多年过去了，武王容貌不变，看起来只有四十几岁的样子，很神武，比真实年龄小太多了。 --》点击后面地址进入看午@夜大片: http://hjnfgl891.fedop1028.xyz/#fedora1029 --》点击后面地址进入看午@夜视频: http://hjnfgl891.fedop1028.xyz/#fedora1029 亚洲人毛茸茸事实上，那不是真正的河流，而是一条条丝绦同时，不少人眼中露出火热，那可都是宝骨啊，足有数十具，不说其他，光是这笔财富就很惊人。亚洲人毛茸茸,亚洲人毛茸茸_锱铢必较影院宝骨发光，一片又一片符在地面交织，在空中密布，形成天罗地网，将要石子陵镇压在当中。显然，这样一鼎药液，小不点一个人喝不了，一群孩子举着小碗都分到了，迅速倒进口中。只是他们的肉身与小不点比起来差距可就大了，刚喝下一大口就口鼻喷霞光，跟着火了一般。其中肉身成灵最为重要，是根基，但这一步只能无限接近，很难彻底功成，真要是可以圆满，那将是非常可怕的。最终一击，它浑身是血，差点断为两截，坠落进大海中，一个摆尾，冲进深海，就此消失不见。这场战斗影响深远，随着六块宝骨出现，汪洋大崩，这些金字塔最顶端的存在都坐不住了。在这里血拼。石昊掌心再次发光，一头金色鹏鸟飞出，与其掌指凝结，轮动巴掌就拍了下来。挑战极限啊，去写第五章。: 她们几人衣裙飘舞，玉体修长，凹凸有致，曲线起伏，每一个人都腰若细柳，姿容靓丽，且朝气蓬勃，跟胖一点都不搭边。亚洲人毛茸茸

1 0

97综合网_97综合网-行尸走肉影院
by Latina Ferratt 28 Oct '22

28 Oct '22

97综合网他们只能远远的看着，帮不上什么帮。 --》点击后面地址进入看午@夜大片: http://xpuefx397.fedop1028.xyz/#fedora1028 --》点击后面地址进入看午@夜视频: http://xpuefx397.fedop1028.xyz/#fedora1028 97综合网金蛟剪刹那冲了过去，发出阵阵龙吟蛟啸的声音，让万灵皆颤，忍不住要跪下来臣服 “湮灭”雨王大吼。97综合网_97综合网-行尸走肉影院 “噗噗”声不断传来，这个地方人头不断滚落，也伴着凶兽的哀鸣，眨眼间雨王府门前便留下成片的尸体。在石昊陪着孩子们野游时，山脉另一边重瞳者也在漫步，一个人独行，踏着草木，踩在树梢上，登临巍峨山脉之巅，一览众山小。: “噗” “回我族真正的祖地，等你养好伤，顺便调理一下身体，待我实力更强大一些，我们再去补天阁。” 少女眼睛发光，一副要流口水的样子。他站在这里，慢慢消化所得到的信息停了很长时间才离去。量的积累，到时候必然会引发质变，那种爆发出来的力量一旦展现，必将是日月无光，鬼哭神嚎。他再次变换容貌，以毛球的宝术改变身高，像是个竹竿似的，跟以前大不一样了，而后熬唠一嗓子，道：“熊孩子没死，我刚才听到有人低语，说见到过他。”97综合网

1 0

SELinux is preventing systemd-gpt-aut from using the sys_admin capability.
by Phillip Arthur Keith Dunstall 15 Oct '22

15 Oct '22

SELinux is preventing systemd-gpt-aut from using the sys_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd-gpt-aut should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-gpt-aut' --raw | audit2allow -M my-systemdgptaut # semodule -X 300 -i my-systemdgptaut.pp Additional Information: Source Context system_u:system_r:systemd_gpt_generator_t:s0 Target Context system_u:system_r:systemd_gpt_generator_t:s0 Target Objects Unknown [ capability ] Source systemd-gpt-aut Source Path systemd-gpt-aut Port Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-37.12-2.fc37.noarch Local Policy RPM selinux-policy-targeted-37.12-2.fc37.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux fedora 5.19.13-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Oct 4 15:54:24 UTC 2022 x86_64 x86_64 Alert Count 4 First Seen 2022-10-15 11:21:33 BST Last Seen 2022-10-15 12:15:14 BST Local ID bcad9e6b-08c8-4f7f-a333-198d0de61382 Raw Audit Messages type=AVC msg=audit(1665832514.326:364): avc: denied { sys_admin } for pid=65635 comm="systemd-gpt-aut" capability=21 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:systemd_gpt_generator_t:s0 tclass=capability permissive=0 Hash: systemd-gpt-aut,systemd_gpt_generator_t,systemd_gpt_generator_t,capability,sys_admin

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2022