On Mon, 2010-08-23 at 10:56 +0200, Dominick Grift wrote:
On 08/23/2010 10:47 AM, Arthur Dent wrote:
> On Mon, 2010-08-23 at 10:42 +0200, Dominick Grift wrote:
>> On 08/23/2010 10:40 AM, Arthur Dent wrote:
>>> On Mon, 2010-08-23 at 10:29 +0200, Dominick Grift wrote:
>>>> On 08/23/2010 10:09 AM, Arthur Dent wrote:
>>>>> On Sun, 2010-08-22 at 22:44 +0100, Arthur Dent wrote:
>>>>>> On Sun, 2010-08-22 at 23:07 +0200, Dominick Grift wrote:
>>>>>>> On 08/22/2010 08:24 PM, Arthur Dent wrote:
>>>>>> ----
>>>>> time->Mon Aug 23 08:57:07 2010
>>>>> type=SYSCALL msg=audit(1282550227.058:42734): arch=40000003
syscall=102 success=no exit=-13 a0=3 a1=bf800420 a2=3 a3=1 items=0 ppid=23912 pid=23920
auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12 sgid=12 fsgid=12 tty=(none)
ses=4294967295 comm="clamdscan" exe="/usr/local/bin/clamdscan"
subj=system_u:system_r:procmail_t:s0 key=(null)
>>>>> type=AVC msg=audit(1282550227.058:42734): avc: denied { search }
for pid=23920 comm="clamdscan" name="clamd" dev=sda6 ino=269280
scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0
tclass=dir
>>>>
>>>> This is still an issue:
>>>>
>>>> some process running in the procmail_t domain is running
>>>> /usr/bin/clamdscan (ls -alZ /usr/bin/clamdscan to verify its context),
>>>> but it is not domain transitioning to the clamscan_t domain.
>>>
>>> # which clamdscan
>>> /usr/local/bin/clamdscan
>>>
>>> # ls -laZ /usr/local/bin/clamdscan
>>> -rwxr-xr-x. root root system_u:object_r:bin_t:s0
/usr/local/bin/clamdscan
>>>
>>> Now, in actual fact, procmail does not call clamdscan directly (it
can't
>>> deal with emails), it calls a program called clamassassin which in turn
>>> calls clamdscan.
>>>
>>> # ls -laZ /usr/local/bin/clamassassin
>>> -r-xr-xr-x. root root system_u:object_r:bin_t:s0
/usr/local/bin/clamassassin
>>>
>>
>> Why are these files located there and not /usr/bin where they are
>> expected to be? The files are mislabelled.
>
> In both cases I compiled from source and accepted the defaults
> in ./configure.
>
> I guess I could try to recompile them in /usr/bin if it is a problem -
> but I'm no expert...
The problem there is; who knows what other locations owned by these apps
differ from the expected locations.
Why are you not using redhat supplied packages?
Well I started compiling clam from source about 3 or 4 years ago. I got
frustrated with the fact that (at that time - I don't know if it's
better now) it would take sometimes 3-4 weeks after a new release of
clam before the redhat package became available. In the meantime I would
have to put up with daily warnings in syslog.
Also, I am often unable to upgrade to the latest Fedora package until it
is already at end of life (viz - I have only just upgraded to F13 from
F11) and the clam packages would often not be available at all...
As for clamdscan; for now you could try the following to see if it would
work if this file is labelled correctly:
chcon -t clamscan_exec_t /usr/local/bin/clamdscan
See if that makes things work for you
Well I am still getting permission denied...
Latest messages:
----
time->Mon Aug 23 11:09:06 2010
type=SYSCALL msg=audit(1282558146.211:43246): arch=40000003 syscall=11
success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
ppid=24933 pid=24934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1282558146.211:43246): avc: denied { noatsecure }
for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558146.211:43246): avc: denied { siginh } for
pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558146.211:43246): avc: denied { rlimitinh }
for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
----
time->Mon Aug 23 11:12:05 2010
type=SYSCALL msg=audit(1282558325.997:43259): arch=40000003 syscall=11
success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
ppid=24953 pid=24954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1282558325.997:43259): avc: denied { noatsecure }
for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558325.997:43259): avc: denied { siginh } for
pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282558325.997:43259): avc: denied { rlimitinh }
for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.163:43260): arch=40000003 syscall=11
success=yes exit=0 a0=9d75660 a1=9d75538 a2=9d715b8 a3=9d75538 items=0
ppid=24956 pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.163:43260): avc: denied { noatsecure }
for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { siginh } for
pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { rlimitinh }
for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.163:43260): avc: denied { read } for
pid=24960 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.179:43261): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bfcfd440 a2=3 a3=0 items=0 ppid=24956
pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.179:43261): avc: denied { connectto }
for pid=24960 comm="clamdscan" path="/var/run/clamd/clamd.sock"
scontext=system_u:system_r:clamscan_t:s0
tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.209:43262): arch=40000003 syscall=11
success=yes exit=0 a0=9d75ab0 a1=9d75380 a2=9d715b8 a3=9d75380 items=0
ppid=24956 pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.209:43262): avc: denied { noatsecure }
for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { siginh } for
pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { rlimitinh }
for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
pid=24964 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
type=AVC msg=audit(1282558326.209:43262): avc: denied { write } for
pid=24964 comm="clamdscan" path="/tmp/clamassassinlog.9knHcazJ44"
dev=sda6 ino=86007 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
pid=24964 comm="clamdscan" path="/tmp/clamassassinmsg.fyU9qe9Rn4"
dev=sda6 ino=67816 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.213:43263): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bf9e8a30 a2=3 a3=1 items=0 ppid=24956
pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282558326.213:43263): avc: denied { connectto }
for pid=24964 comm="clamdscan" path="/var/run/clamd/clamd.sock"
scontext=system_u:system_r:clamscan_t:s0
tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.267:43264): arch=40000003 syscall=11
success=yes exit=0 a0=9e31dd0 a1=9e334c8 a2=9e33620 a3=9e334c8 items=0
ppid=24967 pid=24968 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="spamc"
exe="/usr/bin/spamc" subj=system_u:system_r:spamc_t:s0 key=(null)
type=AVC msg=audit(1282558326.267:43264): avc: denied { noatsecure }
for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282558326.267:43264): avc: denied { siginh } for
pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282558326.267:43264): avc: denied { rlimitinh }
for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
----
time->Mon Aug 23 11:12:06 2010
type=SYSCALL msg=audit(1282558326.309:43265): arch=40000003 syscall=5
success=no exit=-13 a0=606a29 a1=80000 a2=1b6 a3=6069c5 items=0
ppid=20953 pid=20954 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=772 comm="spamd" exe="/usr/bin/perl"
subj=unconfined_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1282558326.309:43265): avc: denied { read } for
pid=20954 comm="spamd" name="shadow" dev=sda6 ino=85497
scontext=unconfined_u:system_r:spamd_t:s0
tcontext=system_u:object_r:shadow_t:s0 tclass=file
----
time->Mon Aug 23 11:12:09 2010
type=SYSCALL msg=audit(1282558329.941:43268): arch=40000003 syscall=300
success=no exit=-13 a0=9 a1=243c883 a2=bf8d6de0 a3=0 items=0 ppid=1
pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1282558329.941:43268): avc: denied { getattr } for
pid=1228 comm="rpc.mountd" path="/proc/kcore" dev=proc ino=4026531989
scontext=system_u:system_r:nfsd_t:s0
tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
----
time->Mon Aug 23 11:12:09 2010
type=SYSCALL msg=audit(1282558329.947:43269): arch=40000003 syscall=5
success=no exit=-13 a0=243b978 a1=8000 a2=0 a3=243b938 items=0 ppid=1
pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1282558329.947:43269): avc: denied { read } for
pid=1228 comm="rpc.mountd" name="sda8" dev=devtmpfs ino=5613
scontext=system_u:system_r:nfsd_t:s0
tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
----
>>
>>>>
>>>> Policy defines that if a process running in the procmail_t domain runs
a
>>>> file labelled clamscan_exec_t, that procmail_t will domain transition
to
>>>> clamscan_t domain.
>>>>
>>>> This did not happen on your config.
>>>>
>>>> Either your clamdscan executable file is mislabelled or you are missing
>>>> a domain transition rule.
>>>>
>>>> Where is your "clamdscan" executable file located, and what is
it labelled?
>>>
>>> see above.
>>>
>>>> What does the following return:
>>>>
>>>> sesearch -SC --allow -s procmail_t -t clamscan_t -c process
>>>> sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
>>>
>>> # sesearch -SC --allow -s procmail_t -t clamscan_t -c process
>>> Found 1 semantic av rules:
>>> allow procmail_t clamscan_t : process transition ;
>>>
>>> # sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
>>> sesearch: invalid option -- 'f'
>>> Usage: sesearch [OPTIONS] RULE_TYPE [RULE_TYPE ...] [EXPESSION]
>>> [POLICY ...]
>>>
>>> Try sesearch --help for more help.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> --
>>> selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> --
>> selinux mailing list
>> selinux(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux