Re: FC5 - problems setting context
by Paul Howarth
Hello,
On Tue, 2006-06-13 at 16:44 -0400, Sandra Julieta Rueda Rodriguez wrote:
> Hello,
>
> About my previous message:
>
> Paul: Your idea was really effective, FC5 requires the additional field.
> The command works fine now, Thanks.
>
> Does this behavior have to do with the fact that FC5 have the mcs/mls
> option enabled by default? Is it possible to disable it?
You shouldn't need to supply the extra field; there is a translation
facility in libselinux that can supply a default value for it. It looks
like a similar issue in setkey to the one I found in mount:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186915
I think it's worth raising a bug on ipsec-tools.
Paul.
18 years
New installation of FC5 with strict policy
by Stefan
Hi,
I did a fresh installation of FC5 and upgraded to the strict policy.
After creating a new user via "adduser" I get the following avc
denials when I try to login via ssh.
audit(1150198407.761:2862): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
audit(1150198411.552:2863): avc: denied { getattr } for pid=3717
comm="sshd" name="stefan" dev=hda2 ino=58667
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir
audit(1150198411.624:2864): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=process
audit(1150198411.624:2865): avc: denied { execute_no_trans } for
pid=3721 comm="sshd" name="bash" dev=hda2 ino=29283
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
audit(1150198411.628:2866): avc: denied { execute } for pid=3721
comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.628:2867): avc: denied { read } for pid=3722
comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.628:2868): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.628:2869): avc: denied { execute_no_trans } for
pid=3723 comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.632:2870): avc: denied { execute } for pid=3725
comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.632:2871): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=process
audit(1150198411.632:2872): avc: denied { execute_no_trans } for
pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.632:2873): avc: denied { read } for pid=3725
comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.636:2874): avc: denied { execute } for pid=3721
comm="bash" name="colorls.sh" dev=hda2 ino=175700
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=file
audit(1150198411.636:2875): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.640:2876): avc: denied { read } for pid=3721
comm="bash" name="stefan" dev=hda2 ino=58667
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir
audit(1150198411.640:2877): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.644:2878): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.644:2879): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.648:2880): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.652:2881): avc: denied { read } for pid=3721
comm="bash" name=".bash_profile" dev=hda2 ino=58595
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_t:s0 tclass=file
audit(1150198411.652:2882): avc: denied { getattr } for pid=3721
comm="bash" name=".bash_profile" dev=hda2 ino=58595
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_t:s0 tclass=file
audit(1150198411.656:2883): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.660:2884): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
I know that the strict policy is quiet not perfect but I thought a
ssh login should went fine, shouldn't it? My question is, is this the
default behaviour or did I something wrong? I get also a lot of avc
denials after a reboot with the strict policy. Shouldn't the strict
policy work quiet fine with a default installation (I know it's not
perfect but ... ;-))?
Best regards,
Stefan
18 years
AVC's and Xen
by Gawain Lynch
I have turned on selinux on my dom0 and relabelled my file system but am
getting the following avc's that are causing me grief:
audit(1150199625.630:325): avc: denied { search } for pid=7068
comm="python" name="data" dev=dm-0 ino=720897
scontext=system_u:system_r:xend_t:s0
tcontext=system_u:object_r:default_t:s0 tclass=dir
audit(1150200957.379:95): avc: denied { use } for pid=4853 comm="xm"
name="console" dev=tmpfs ino=838 scontext=system_u:system_r:xm_t:s0
tcontext=system_u:system_r:init_t:s0 tclass=fd
In the first one, I presume "data" is the /data mount point which was
crated before the relabel.
Any ideas how to fix?
Take care,
Gawain
18 years
FC5 - problems setting context
by Sandra Rueda
Hello,
I am new with selinux and I have a problem:
My system: Fedora Core 5, FC5 - 2.6.16-1.2122 SMP
I am trying to set communication policies between two machines and I am
using the set of commands implemented by ipsec-tools.
I am running the command: setkey -v -f set.conf
Contents of the file set.conf (it had more things at the beginning but I
reduced it while looking for the cause of the error):
flush;
spdflush;
spdadd src dest any -ctx 1 1 "user_u:object_r:user_t" -P out ipsec
esp/transport//require ;
I always receive the same output at the end: "Invalid Argument".
sadb_msg{ version=2 type=9 errno=0 satype=0
len=2 reserved=0 seq=0 pid=16090
sadb_msg{ version=2 type=9 errno=0 satype=0
len=2 reserved=0 seq=0 pid=16090
sadb_msg{ version=2 type=19 errno=0 satype=0
len=2 reserved=0 seq=0 pid=16090
sadb_msg{ version=2 type=19 errno=0 satype=0
len=2 reserved=0 seq=0 pid=16090
sadb_msg{ version=2 type=14 errno=0 satype=0
len=16 reserved=0 seq=0 pid=16090
sadb_ext{ len=4 type=18 }
sadb_x_policy{ type=2 dir=2 id=0 priority=2147483648 }
{ len=16 proto=50 mode=1 level=2 reqid=0
}
sadb_ext{ len=3 type=5 }
sadb_address{ proto=255 prefixlen=32 reserved=0x0000 }
sockaddr{ len=16 family=2 port=0
82cb2034 }
sadb_ext{ len=3 type=6 }
sadb_address{ proto=255 prefixlen=32 reserved=0x0000 }
sockaddr{ len=16 family=2 port=0
82cb2035 }
sadb_ext{ len=4 type=24 }
sadb_x_sec_ctx{ doi=1 alg=1 length=23,
context:user_u:object_r:user_t}
sadb_msg{ version=2 type=14 errno=22 satype=0
len=2 reserved=0 seq=0 pid=16090
The result of line 4: Invalid argument.
I followed the procedure and it looks like the problem is not related to
ipsec-tools but to something in the kernel, because it returns errno=22.
Running the same command without the ctx extension works fine.
Does anyone have any idea?
Thanks,
Sandra
18 years
semanage translation -a is not working
by omok
Dear, Folks,
My environment is;
FC5 (yum updated on 6/12/2006 JST)
policycoreutils-1.30.10-1.fc5
libselinux-python-1.30-1.fc5
selinux-policy-2.2.40-1.fc5
libselinux-1.30-1.fc5
libselinux-devel-1.30-1.fc5
selinux-policy-2.2.38-1.fc5
selinux-policy-targeted-2.2.40-1.fc5
When I try to add additional translations to my FC5 in
permissive mode, I got error messages as follow;
----------------------------------------------------------------
[root@vmfc5omo ~]# semanage translation -a -T blahblahblah s0:c6
Traceback (most recent call last):
File "/usr/sbin/semanage", line 239, in ?
OBJECT.add(target, setrans)
File "/usr/lib/python2.4/site-packages/seobject.py", line 180, in add
self.save()
File "/usr/lib/python2.4/site-packages/seobject.py", line 198, in save
fd.write(self.out())
AttributeError: 'int' object has no attribute 'write'
----------------------------------------------------------------
and can't add any lines on setrans.conf.
"-l" option seems working correctly;
----------------------------------------------------------------
[root@vmfc5omo ~]# semanage translation -l
Level Translation
s0
s0-s0:c0.c255 SystemLow-SystemHigh
s0:c0.c255 SystemHigh
----------------------------------------------------------------
I checked "How do I add additional translations to my MCS/MLS system?"
on http://fedora.redhat.com/docs/selinux-faq-fc5/#id2964683.
Is this a bug?
Regards,
--
Kazuki Omo: omok(a)honto.info
LIDS Japanese Information:
Japanese: http://www.selinux.gr.jp/LIDS-JP/index.html
English: http://www.selinux.gr.jp/LIDS-JP/LIDS_en/index.html
18 years
vsftpd problems
by CodeHeads
Hello all,
I have a problem getting vsftpd working with SELinux. I opened up ports 20 and
21 on the firewall, plus disabled the firewall to see if that was the problem
and it still did not work.
I am not using home directories, is that part of the problem???
I tried google but that really did not turn anything up that I wanted.
Thanks,
Will
18 years
proftpd and ftpdctl
by Paul Howarth
The recent update of proftpd in Extras to 1.3.0 has introduced a new
feature, an "ftpdctl" program allowing some run-time control of the FTP
daemon, somewhat akin to rndc with named. This needs new policy. Below
is what's working for me:
===== proftpd.if =====
## <summary>FTP Daemon Control Program.</summary>
########################################
## <summary>
## Execute the ftpdctl program in the ftpdctl domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`ftpdctl_domtrans',`
gen_require(`
type ftpdctl_t, ftpdctl_exec_t;
')
corecmd_search_bin($1)
domain_auto_trans($1, ftpdctl_exec_t, ftpdctl_t)
allow $1 ftpdctl_t:fd use;
allow ftpdctl_t $1:fd use;
allow ftpdctl_t $1:fifo_file rw_file_perms;
allow ftpdctl_t $1:process sigchld;
')
===== proftpd.fc =====
/usr/bin/ftpdctl --
gen_context(system_u:object_r:ftpdctl_exec_t,s0)
===== proftpd.te =====
policy_module(proftpd, 0.4.0)
########################################
#
# Declarations
#
require {
type ftpd_t;
type ftpd_var_run_t;
type xferlog_t;
};
# run ftpdctl in its own domain
type ftpdctl_t;
type ftpdctl_exec_t;
init_system_domain(ftpdctl_t,ftpdctl_exec_t)
role system_r types ftpdctl_t;
# ftpdctl control sockets have their own domain
# When ftpdctl is run, it creates a socket in /tmp and then binds it
# to the control socket for the running proftpd server, usually at
# /var/run/proftpd/proftpd.sock
type ftpdctl_tmp_t;
files_tmp_file(ftpdctl_tmp_t)
########################################
#
# Local policy
#
# Temporary sockets created by ftpdctl are ftpdctl_tmp_t
files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, { sock_file })
# Fixed in selinux-policy 2.2.29-6
#allow ftpd_t xferlog_t:dir { getattr search };
# Allow proftpd to read the routing table
allow ftpd_t self:netlink_route_socket { r_netlink_socket_perms };
# Allow proftpd to create and use a control socket
(/var/run/proftpd/proftpd.sock)
allow ftpd_t self:unix_stream_socket listen;
allow ftpd_t ftpd_var_run_t:sock_file { create setattr unlink };
# Allow proftpd to remove temporary communications sockets created by
ftpdctl
allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink };
# Transition to ftpdctl_t from unconfined_t
ftpdctl_domtrans(unconfined_t)
libs_use_ld_so(ftpdctl_t)
libs_use_shared_libs(ftpdctl_t)
term_use_generic_ptys(ftpdctl_t)
# Allow ftpdctl to read config files
files_read_etc_files(ftpdctl_t)
# Allow ftpdctl to create and use temporary sockets
allow ftpdctl_t ftpdctl_tmp_t:sock_file { create setattr };
# Allow ftpdctl to talk to ftpd over a socket connection
allow ftpdctl_t ftpd_t:unix_stream_socket connectto;
allow ftpdctl_t ftpd_var_run_t:dir search;
allow ftpdctl_t ftpd_var_run_t:sock_file write;
Paul.
18 years
Re: httpd can't execute bash?
by Jouni Viikari
On Tue, 6 Jun 2006, James Antill wrote:
> On Mon, 2006-05-29 at 19:47 +0300, Jouni Viikari wrote:
>> On Sun, 2006-05-28 at 10:58 +0100, Paul Howarth wrote:
>>> On Sun, 2006-05-28 at 12:43 +0300, Jouni Viikari wrote:
>>>> I have the same problem:
>>>>
>>>> type=AVC msg=audit(1148808793.986:30189): avc: denied { execute } for
>>>> pid=18644 comm="httpd" name="bash" dev=dm-0 ino=3440979
>>>> scontext=user_u:system_r:httpd_t:s0
>>>> tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
> [...]
>> It is a php-script doing basically ugly 'system("cat xyz");'
>>
>> #ls -Z
>> system_u:object_r:httpd_sys_content_t
>>
>> This is just a testing_something.php where I happened to notice a change
>> in a behavior.
>
> See "man httpd_selinux" ... summary is you need at least:
>
> chcon -t httpd_sys_exec_t
Yeah, I thought the context might not be rigth. Anyway the behaviour
has changed.
However, there seems not to be httpd_sys_exec_t (trying above gives
"Invalid argument"). If I try httpd_sys_script_exec_t it does not work
either.
Biggest problem I just found out is that I can not send mail any more from
SquirrelMail (standard FC5 package):
type=AVC msg=audit(1149674474.840:81196): avc: denied { execute } for
pid=20207 comm="httpd" name="bash" dev=dm-0 ino=3440979
scontext=user_u:system_r:httpd_t:s0
tcontext=system_u:object_r:shell_exec_t:s0
tclass=file
-Jouni
18 years
setsebool generates error message....
by Tom London
Running today's rawhide, targeted/enforcing:
[root@localhost files]# setsebool allow_execmem=1
libsemanage.semanage_install_active: setfiles returned error code 1.
libsemanage.semanage_install_active: setfiles returned error code 1.
Could not change policy booleans
[root@localhost files]#
Appears that boolean has changed:
[root@localhost files]# getsebool -a | grep exec
allow_execheap --> off
allow_execmem --> on
allow_execmod --> off
allow_execstack --> on
allow_java_execstack --> on
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
[root@localhost files]#
tom
--
Tom London
18 years
FC5/SELinux: Possibilty to enforce an "second set of eyes" method for admins?
by Michael Decker
Hi!
I wonder, if I can setup this kind of scenario:
An admin has to change e.g. some SELinux policies. But if an admin can
change all SELinux policies, he could change his own or others in a way,
so he can do anything. So a second admin/user has to allow that action.
Is there a way to setup that?
Thanks...
--
Michael Decker Michael.Decker(a)tesis.de
TESIS SYSware GmbH http://www.tesis.de
Baierbrunnerstr. 15 * 81379 Muenchen * Tel. +49 89 747377-0
18 years
