selinux December 2007

selinux@lists.fedoraproject.org

38 participants
66 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

xinetd rsync --daemon problems
by Chuck Anderson 03 Jul '08

03 Jul '08

I'm using Fedora Core 6, and trying to start a rsync daemon via xinetd. The default configuration is: # default: off # description: The rsync server is a good addition to an ftp server, as it \ # allows crc checksumming etc. service rsync { disable = no socket_type = stream wait = no user = root server = /usr/bin/rsync server_args = --daemon log_on_failure += USERID } With this rsyncd.conf: motd file = /etc/rsyncd.motd pid file = /var/run/rsyncd.pid port = 873 uid = rsyncd gid = mirror use chroot = yes max connections = 10 log file = /var/log/rsyncd.log read only = yes hosts allow = 127.0.0.1, ::1, etc.... #hosts deny = 0.0.0.0/0, :: ignore nonreadable = yes transfer logging = yes timeout = 600 dont compress = * [fedora-linux-core] path = /srv/ftp/pub/fedora/linux/core comment = Fedora Linux Core [fedora-linux-core-updates] path = /srv/ftp/pub/fedora/linux/core/updates comment = Fedora Linux Core Updates [fedora-linux-extras] path = /srv/ftp/pub/fedora/linux/extras comment = Fedora Linux Extras [fedora-linux-core-test] path = /srv/ftp/pub/fedora/linux/core/test comment = Fedora Linux Core Test [fedora-linux-releases] path = /srv/ftp/pub/fedora/linux/releases comment = Fedora Linux Releases [fedora-linux-development] path = /srv/ftp/pub/fedora/linux/development comment = Fedora Linux Development [fedora-enchilada] path = /srv/ftp/pub/fedora comment = Fedora - The whole enchilada [fedora-linux-updates] path = /srv/ftp/pub/fedora/linux/updates comment = Fedora Linux Updates [fedora-web] path = /srv/ftp/pub/fedora/web comment = Web content for Fedora Linux mirrors I get these AVCs when running from xinetd and making a client connection that I don't get if I start the daemon directly via "rsync --daemon" as root: type=AVC msg=audit(1192132336.713:3464): avc: denied { lock } for pid=8488 comm="rsync" name="rsyncd.lock" dev=dm-4 ino=2064435 scontext=user_u:system_r:rsync_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file type=SYSCALL msg=audit(1192132336.713:3464): arch=40000003 syscall=221 success=no exit=-13 a0=4 a1=d a2=bff80730 a3=bff80730 items=0 ppid=8167 pid=8488 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) type=AVC_PATH msg=audit(1192132336.713:3464): path="/var/run/rsyncd.lock" type=AVC msg=audit(1192132400.044:3465): avc: denied { bind } for pid=8499 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192132400.044:3465): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf8f4674 a2=4df50ff4 a3=3 items=0 ppid=8167 pid=8499 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) I tried creating and loading a policy module: # grep "rsync" /var/log/audit/audit.log | audit2allow -M rsyncd # semodule -i rsyncd.pp Here is rsyncd.te: module rsyncd 1.0; require { type var_run_t; type rsync_t; class netlink_route_socket create; class file { read write }; } #============= rsync_t ============== allow rsync_t self:netlink_route_socket create; allow rsync_t var_run_t:file { read write }; But I still get these AVCs: type=AVC msg=audit(1192139751.238:3586): avc: denied { bind } for pid=9311 comm="rsync" scontext=user_u:system_r:rsync_t:s0 tcontext=user_u:system_r:rsync_t:s0 tclass=netlink_route_socket type=SYSCALL msg=audit(1192139751.238:3586): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfbb6144 a2=4df50ff4 a3=3 items=0 ppid=8732 pid=9311 auid=10002 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rsync" exe="/usr/bin/rsync" subj=user_u:system_r:rsync_t:s0 key=(null) Additionally, when using xinetd I don't ever get any log messages in /var/log/rsyncd.log like I do when I run "rsync --daemon" directly: 2007/10/11 17:08:01 [8613] rsyncd version 2.6.9 starting, listening on port 873 2007/10/11 17:08:13 [8616] connect from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 17:08:13 [8616] rsync on fedora-enchilada/linux/ from dustpuppy.wpi.edu (2001:468:616:8c9:213:72ff:fe74:da15) 2007/10/11 21:08:13 [8616] building file list 2007/10/11 21:08:13 [8616] sent 1629 bytes received 106 bytes total size 19

2 2

Feature request: Tomcat5-Policy
by Christoph Höger 16 Jan '08

16 Jan '08

Hi, here is a sample policy for Tomcat5. Could we integrate this (or a reviewed and much better version) into fedora? regards christoph

3 6

Sendmail 8.14 selinux
by Harley Race 03 Jan '08

03 Jan '08

Ladies and Gentlemen, If I can get some help here. I am running Fedora 8 with sendmail 8.14.2. I have been getting the following messages in audit.log. I am not really sure what to make of them either. Sendmail runs. Errors are listed below: type=AVC msg=audit(1198878517.713:16): avc: denied { signull } for pid=3153 comm="sendmail" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:sendmail_t:s0 tclass=process type=SYSCALL msg=audit(1198878517.713:16): arch=40000003 syscall=37 success=no exit=-13 a0=10fd a1=0 a2=b7f3731c a3=84 items=0 ppid=1 pid=3153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0 key=(null) Sorry about the formatting, this webmail interface does not support elaborate formatting. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 2

SELinux enforcing, an external ntfs-3g mount, Samba and Fedora 8
by Craig Niederberger 31 Dec '07

31 Dec '07

Hi Fedora SELinux gurus, question from a very perplexed newbie. I'm trying to access an external ntfs-3g drive from vmware on Fedora, with the drive seen through vmware as a networked samba drive. I have Fedora 8 as the host, VMware Workstation 6.0.2 with Windows XP Pro as the guest OS, and SELinux set to enforcing. I have the host visible as a networked drive in My Network Places on the guest, and can access files in my Fedora 8 home directory, so SELinux is at least allowing that. The external ntfs-3g drive that I'd like to also access is visible in My Network Places on the guest. However, whenever I click on it, I get an SELinux AVC Denial, which says SELinux is preventing the samba daemon from serving r/o local files to remote clients, and tells me that I need to turn on the samba_export_all_ro boolean, which is already on. The raw audit message that I get in the SELinux popup is: avc: denied { read } for comm=smbd dev=sdd1 name=/ pid=4347 scontext=system_u:system_r:smbd_t:s0 tclass=dir tcontext=system_u:object_r:fusefs_t:s0 I have mounted the ntfs-3g drive so that it matches the ownership of my home drive, e.g. the fstab entry is: /dev/sdd1 /mnt/media ntfs-3g rw,locale=en_US.utf8,uid=500,gid=1000 0 0 $ ls -al media total 233 drwxrwxrwx 1 craign family 4096 2007-12-12 23:04 . drwxr-xr-x 6 root root 4096 2007-12-02 14:13 .. drwxrwxrwx 1 craign family 0 2007-09-16 11:31 Craig ... Can anyone help? Many TIA, Craig

4 6

gdm + selinux problem
by Dr. Michael J. Chudobiak 31 Dec '07

31 Dec '07

Hi all, After an F7 -> F8 upgrade, I can't start the xorg server in enforcing mode. Logs say things like: type=AVC msg=audit(1195824979.681:23): avc: denied { getattr } for pid=2585 comm="gdm-binary" path="/tmp/.X11-unix" dev=dm-0 ino=8871462 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1195824979.681:23): arch=40000003 syscall=196 success=yes exit=0 a0=8090daf a1=bfb4d320 a2=c2bff4 a3=3 items=0 ppid=1 pid=2585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) audit2allow says: #============= cupsd_t ============== allow cupsd_t nscd_t:nscd shmemserv; #============= iptables_t ============== allow iptables_t nscd_t:nscd shmemserv; #============= nfsd_t ============== allow nfsd_t nscd_t:nscd { shmemserv getserv }; #============= ntpd_t ============== allow ntpd_t nscd_t:nscd shmemserv; #============= sendmail_t ============== allow sendmail_t fail2ban_log_t:file append; allow sendmail_t initrc_t:unix_stream_socket { read write }; allow sendmail_t nscd_t:nscd shmemserv; #============= system_mail_t ============== allow system_mail_t nscd_t:nscd shmemserv; #============= xdm_t ============== allow xdm_t initrc_tmp_t:dir { getattr setattr }; #============= xdm_xserver_t ============== allow xdm_xserver_t initrc_tmp_t:dir { write getattr search add_name }; allow xdm_xserver_t initrc_tmp_t:sock_file create; Now... how would this have happened? Should I just run the above commands to fix everything, or is there a deeper bug / issue? Help appreciated! - Mike

2 3

Multiple same specifications in selinux-policy-3.2.5-6.fc9
by Tom London 31 Dec '07

31 Dec '07

Minor nit in selinux-policy-3.2.5-6.fc9: Updating : selinux-policy-targeted ####################### [14/36] /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /home/[^/]*/\.mozilla(/.*)?/plugins/libflashplayer\.so.*. /etc/selinux/targeted/contexts/files/file_contexts: Multiple same specifications for /root/\.mozilla(/.*)?/plugins/libflashplayer\.so.*. tom -- Tom London

2 1

logrotate_t wants { rename write } to NetworkManager_log_t
by Tom London 31 Dec '07

31 Dec '07

Running selinux-policy-3.2.5-5.fc9, targeted/enforcing. Been seeing these lately: type=AVC msg=audit(1198863940.082:38): avc: denied { rename } for pid=7287 comm="logrotate" name="wpa_supplicant.log" dev=dm-0 ino=66102 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:NetworkManager_log_t:s0 tclass=file type=SYSCALL msg=audit(1198863940.082:38): arch=40000003 syscall=38 success=no exit=-13 a0=96d01d8 a1=96cdcd0 a2=96d0dc0 a3=96cdcb8 items=0 ppid=7285 pid=7287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null) type=AVC msg=audit(1198863940.082:39): avc: denied { write } for pid=7287 comm="logrotate" name="wpa_supplicant.log" dev=dm-0 ino=66102 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:NetworkManager_log_t:s0 tclass=file type=SYSCALL msg=audit(1198863940.082:39): arch=40000003 syscall=5 success=no exit=-13 a0=96d01d8 a1=8042 a2=180 a3=8042 items=0 ppid=7285 pid=7287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null) tom -- Tom London

2 1

need module advice
by Christoph Höger 27 Dec '07

27 Dec '07

Hi, I am writing a selinux module for tomcat5. This is what I currently got: type tomcat5_log_t; logging_log_file(tomcat5_log_t) type tomcat5_tmp_t; files_tmp_file(tomcat5_tmp_t) role system_r types tomcat5_java_t; ######################################## # # local policy # init_daemon_domain(tomcat5_t, tomcat5_exec_t) allow tomcat5_t tomcat5_log_t:file ra_file_perms; manage_files_pattern(tomcat5_t, tomcat5_log_t, tomcat5_log_t) allow tomcat5_t tomcat5_tmp_t:file manage_file_perms; files_tmp_filetrans(tomcat5_t,tomcat5_tmp_t,file) # neccessary for startup files_search_etc(tomcat5_t) files_search_usr(tomcat5_t) libs_search_lib(tomcat5_t) libs_use_shared_libs(tomcat5_t) miscfiles_read_localization(tomcat5_t) libs_use_ld_so(tomcat5_t) kernel_read_system_state(tomcat5_t) corecmd_search_bin(tomcat5_t) corecmd_getattr_bin_files(tomcat5_t) corecmd_exec_bin(tomcat5_t) init_write_utmp(tomcat5_t) files_read_usr_files(tomcat5_t) corecmd_exec_shell(tomcat5_t) rw_fifo_files_pattern(tomcat5_t, tomcat5_t, tomcat5_t) files_read_etc_files(tomcat5_t) logging_search_logs(tomcat5_t) # run java as tomcat5_java_t #java_spec_domtrans(tomcat5_t, tomcat5_java_t) domain_auto_trans(tomcat5_t, java_exec_t, tomcat5_java_t) # privileges for tomcat java applications allow tomcat5_t tomcat5_java_t:process { rlimitinh siginh noatsecure }; allow tomcat5_java_t tomcat5_t:process { sigchld getsched sigkill execheap execmem execstack }; libs_search_lib(tomcat5_java_t) libs_use_shared_libs(tomcat5_java_t) files_search_usr(tomcat5_java_t) files_read_usr_files(tomcat5_java_t) files_search_etc(tomcat5_java_t) files_read_etc_files(tomcat5_java_t) rw_fifo_files_pattern(tomcat5_java_t,tomcat5_t,tomcat5_t) libs_use_ld_so(tomcat5_java_t) write_files_pattern(tomcat5_java_t, tomcat5_log_t, tomcat5_log_t) unconfined_dontaudit_use_terminals(tomcat5_java_t) The idea is to 'sandbox' all java applications run by tomcat5 to avoid damage by exploits in webservices and stuff. The problem is, when I try to start tomcat I got the error that libjli.so is not found, which seems to occur because the environment variable ORIGIN is not resolved (I find a lot of open($ORIGIN/../libjli.so in strace). I have no idea what causes this behavior and I have no audits even with dontaudit disabled. Has anyone any advise please? I'm running really out of ideas here! regards christoph

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2007