selinux

selinux@lists.fedoraproject.org

1 participants
4894 discussions

zabbix agent?
by lejeczek 18 Jun '25

18 Jun '25

Hi guys. Zabbix on Centos anyone? I'm on Centos 9 with: zabbix-agent-6.0.39-1.el9.x86_64 zabbix-server-6.0.39-1.el9.noarch zabbix-selinux-6.0.39-1.el9.noarch with some SE denials: ... SELinux is preventing /usr/bin/who from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.DynamicUser. For complete SELinux messages run: sealert -l d7152358-4998-4950-aec4-fb9e5b0e7b49 allow zabbix_agent_t kernel_t:unix_stream_socket connectto; and I wonder if perhaps someone has seen it before and knows if this is can be helped with zabbix's config? Or if not - should a policy addition allow that 'agent' is asking for ? though Zabbix - from EPEL - comes with its own policies. thanks, L.

1 0

Apologies, wrong forum!
by Kalevi Kolttonen 13 May '25

13 May '25

Hello! ChatGPT lied to me again. It told me to send patches to this list. I now know I will have to send them to selinux(a)vger.kernel.org instead. Sorry for the noise. br, KK

1 0

[PATCH] Trivial fix comment
by Kalevi Kolttonen 12 May '25

12 May '25

The patch is attached.

1 0

Could early_security_init(void) return void?
by Kalevi Kolttonen 12 May '25

12 May '25

Hello! I am just going through the file linux/security/security.c. Could the function early_security_init(void) return void instead of int? After all, it always returns 0 and the only call site in init/main.c does not care about the return value. br, KK

1 1

[PATCH] Fix variable type to be 'bool' instead of incorrect 'int'.
by Kalevi Kolttonen 12 May '25

12 May '25

The patch is attached.

1 0

[PATCH] A trivial simplification to shorten the code a bit.
by Kalevi Kolttonen 12 May '25

12 May '25

The trivial simplification patch is attached. br, KK

1 0

SELINUX_ERR op=security_compute_sid invalid_context while running /etc/init.d script of my app
by chaitanya singh 28 Apr '25

28 Apr '25

Doing this on a RHEL8.10 distro. I've created a user with staff_u role: # useradd -Z staff_u testadm And provided this user elevated permissions, for which did following steps: 1. created: /etc/sudoers.d/mysudoers 2. added this: %testadm ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL Did reboot. Installed my app's selinux policy module(rpm). Then logged in with this testadm user, and ran command to elevate to sysadm_r:sysadm_t: # sudo runcon -r sysadm_r -t sysadm_t -- su - Now, on this console, with selinux Enforcing, I try running my application's executable (maconfig) and I'm getting this permission denied error: [root@6H0RHEL810 ~]# /opt/McAfee/agent/bin/maconfig -stop 2025-04-25 11:43:12.768 (50811.50811) maconfig.Info: Stopping Trellix agent. sh: /etc/init.d/ma: /bin/sh: bad interpreter: Permission denied 2025-04-25 11:43:12.770 (50811.50811) maconfig.Info: configuration finished So naturally, I looked for denials in var/log/audit/audit.log but got this instead: type=SELINUX_ERR msg=audit(1745581392.769:2056): op=security_compute_sid invalid_context="staff_u:system_r:initrc_t:s0" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=process type=SYSCALL msg=audit(1745581392.769:2056): arch=c000003e syscall=59 success=no exit=-13 a0=5587d7a7b540 a1=5587d7a7c700 a2=5587d7a79e40 a3=0 items=0 ppid=50811 pid=50812 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=8 comm="sh" exe="/usr/bin/bash" subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="testadm" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=PROCTITLE msg=audit(1745581392.769:2056): proctitle=7368002D63002F6574632F696E69742E642F6D612073746F70 ..which is not a straighforward avc denial. So searched for ways to tackle this. Found the explanation for the log - a process running as sysadm_t (maconfig) tried to run a file labeled initrc_exec_t (/etc/init.d/ma - my application's script), and SELinux said "nope" because it would result in an invalid context transition to initrc_t. So tried a couple of other things: -Switched selinux to Permissive mode, got some user_avc denials. Added rules in policy for allowing those, but didn't work. -Added this domain transition rule to my policy (didn't work): domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t); -Tried adding these role-type statements in policy (which I thought would work for sure but nope): require { role system_r, sysadm_r } role system_r types initrc_t; #AND role sysadm_r types initrc_t; Also got to know some more stuff from these pages : https://wiki.gentoo.org/wiki/SELinux/Tutorials/Linux_services_and_the_system... https://github.com/SELinuxProject/selinux-notebook/blob/main/src/auditing.md ..but still not sure how to proceed. Pls help out if u can. Thanks in advance!

2 1

SELinux is preventing systemd-tmpfile from using the sys_resource capability.
by Manfred Lotz 23 Apr '25

23 Apr '25

Hi there, Running Fedora 31 and SELinux still in permissive mode I got SELinux is preventing systemd-tmpfile from using the sys_resource capability. ***** Plugin sys_resource (91.4 confidence) suggests ********************** If you do not want processes to require capabilities to use up all the system resources on your syste> Then you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h, sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ Do fix the cause of the SYS_RESOURCE on your system. ***** Plugin catchall (9.59 confidence) suggests ************************** If you believe that systemd-tmpfile should have the sys_resource capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-tmpfile' --raw | audit2allow -M my-systemdtmpfile # semodule -X 300 -i my-systemdtmpfile.pp I also see type=AVC msg=audit(1569414241.452:321): avc: denied { sys_resource } for pid=17409 comm="systemd-tmpfile" capability=24 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability permissive=1 type=AVC msg=audit(1569414241.452:322): avc: denied { setrlimit } for pid=17409 comm="systemd-tmpfile" scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=process permissive=1 I have to admit I don't know how to judge this. Before I do anything here I like to understand. -- Manfred

3 3

Importctl/machinctl Issue and PR review
by Wolfe, Caleb 10 Apr '25

10 Apr '25

Hello all, My name is Caleb Wolfe and I am from Amazon Linux. A few weeks ago, we found in Amazon Linux 2023 that when we tried to use systemd-importd with SELinux enabled, SELinux denials would occur. We were able to create a patch for Amazon Linuxs selinux-policy package, and I also tested this patch in Fedora 41 by downloading the selinux-policy srcrpm and applying the patch and in both distros the patch seems to work. I've also noticed that a few others independently found issues with importctl/importd and created PRs to help correct the issue. It seems appropriate that we coordinate our efforts and find a policy that works for Fedora and that can be backported to our various distros. Would you all mind reviewing this issue and the linked PRs and sharing your thoughts? https://github.com/fedora-selinux/selinux-policy/issues/2622 Thanks! Caleb

2 1

Fixing denials
by justina colmena ~biz 16 Jan '25

16 Jan '25

Mostly I have been running fedora on a home desktop and laptop for a long time with SELinux enabled, with very minimal workarounds needed. Otherwise I am new to policies etc. I have just enabled SELinux in permissive mode on a web server and followed the instructions here to create a "local_policy.cil" policy module file containing a few simple rules, and install it. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/ using_selinux/troubleshooting-problems-related-to-selinux_using- selinux#proc_creating-a-local-selinux-policy-module_troubleshooting-problems- related-to-selinux Why is PostgreSQL running in unconfined_service_t, and what do I need to do to allow php-fpm to connect to it? Isn't there a boolean for that? [root@blanco ~]# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent ---- time->Mon Jan 13 13:36:10 2025 type=AVC msg=audit(1736775370.067:3485): avc: denied { connectto } for pid=1425 comm="php-fpm" path="/run/postgresql/.s.PGSQL.5432" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 ---- ... Do I need a ".cil" rule like this? (allow httpd_t unconfined_service_t (unix_stream_socket (connectto)))

9 20

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux