selinux June 2009

selinux@lists.fedoraproject.org

36 participants
53 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

SELinux and gitosis (FC11)
by Jonathan Stott 13 Jul '09

13 Jul '09

Hi all Today I updated to FC11 and gitosis stopped working (gitosis is a collection of scripts for easing multiuser access to git repositories over ssh). I can tell it's an SELinux problem, because '/sbin/setenforcing 0' clears it up. On the server, the git repositories are managed by the 'git' user, which has the guest_u selinux type (though it also fails when given the user_u user). The home directory (/home/git) has the correct selinux context (user_home_t) as far as I can tell and I've run 'restorecon -Rvv' anyway, just to be sure. gitosis works by calling a system binary, gitosis-serve, which lives in /usr/bin/ and has the type of 'bin_t' so guest_u should be able to execute it. Even with 'setenforcing 0' no AVC denials are created though. Checking /var/log/secure shows that the key is being accepted, and it seems like the process then hangs. Any suggestions appreciated, Regards Jon

4 10

Supporting multiple OS releases
by Rob Crittenden 01 Jul '09

01 Jul '09

In the freeIPA project we have our own SELinux policy. We support RHEL 5 up through Fedora Rawhide. With Fedora 11 we saw some problems compiling our SELinux module which Dan Walsh provided a patch for. I haven't tried this on older releases yet but I'm guessing it won't work as expected (some policies seem to have been renamed, such as corenet_non_ipsec_sendrecv() -> corenet_all_recvfrom_unlabeled() My question is, how can we handle this in our source tree? Are we going to need to maintain per-release policies or does SELinux support some sort of versioning conditionals? thanks rob

5 10

Re: memcached policy
by Vadym Chepkov 30 Jun '09

30 Jun '09

well, this packages needs to be obsoleted then. It was an honest mistake, I did yum search memcached and found it. anyway, I did yum erase memcached-selinux yum reinstall selinux-policy-targeted But still get avc: type=AVC msg=audit(1246399071.104:235): avc: denied { read } for pid=23185 comm="memcached" name="cpuinfo" dev=proc ino=4026531978 scontext=unconfined_u:system_r:memcached_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file Sincerely yours, Vadym Chepkov

2 1

cgi script needs to write to a cache location
by Chuck Anderson 30 Jun '09

30 Jun '09

I have a cgi script /usr/share/cricket/cgi-bin/grapher.cgi which needs to write generated images to a cache in /var/cache/cricket. I'm using these file contexts to get the cgi script and static files working: /usr/share/[^/]*/www(/.*)? system_u:object_r:httpd_sys_content_t:s0 /usr/share/[^/]*/html(/.*)? system_u:object_r:httpd_sys_content_t:s0 /usr/share/[^/]*/cgi-bin(/.*)? system_u:object_r:httpd_sys_script_exec_t:s0 so grapher.cgi is running as httpd_sys_script_exec_t. What type should I make /var/cache/cricket(/.*)? to allow the cgi to read/write/create files in this directory? I tried making /var/cache/cricket system_u:object_r:httpd_cache_t. Here is the output of audit2allow after running this under "setenforce 0": #============= httpd_sys_script_t ============== allow httpd_sys_script_t httpd_cache_t:dir { write search getattr setattr add_name }; allow httpd_sys_script_t httpd_cache_t:file { write read create ioctl getattr }; Is there a better type in the standard policy than httpd_cache_t that will allow httpd_sys_script_exec_t to write/create, or will I need to define this policy myself? Thanks.

2 1

constraints
by Shintaro Fujiwara 30 Jun '09

30 Jun '09

Hi, I want to yum install or update from certain domain (segatex_t), but although I set segatex.te right permission even I dontaudit disabled in vain. So, I followed Mr. Walsh lecture, asking audit2why. I still don't know how to solve the problem so please help. [root@notepc ~]# audit2why -i /var/log/audit/audit.log type=AVC msg=audit(1246361092.291:17): avc: denied { transition } for pid=3116 comm="segatex" path="/usr/bin/yum" dev=dm-0 ino=594330 scontext=unconfined_u:unconfined_r:segatex_t:s0 tcontext=unconfined_u:system_r:rpm_t:s0 tclass=process Was caused by: Policy constraint violation. May require adding a type attribute to the domain or type to satisfy the constraint. Constraints are defined in the policy sources in policy/constraints (general), policy/mcs (MCS), and policy/mls (MLS). type=AVC msg=audit(1246361092.303:18): avc: denied { transition } for pid=3117 comm="segatex" path="/usr/bin/yum" dev=dm-0 ino=594330 scontext=unconfined_u:unconfined_r:segatex_t:s0 tcontext=unconfined_u:system_r:rpm_t:s0 tclass=process Was caused by: Policy constraint violation. May require adding a type attribute to the domain or type to satisfy the constraint. Constraints are defined in the policy sources in policy/constraints (general), policy/mcs (MCS), and policy/mls (MLS). -- http://intrajp.no-ip.com/ Home Page

2 2

memcached policy
by Vadym Chepkov 30 Jun '09

30 Jun '09

It seems selinux memcache module has bugs in it or do I miss some boolean? I seriously doubt about first one. memcached-selinux-1.2.8-1.fc11.i586 type=AVC msg=audit(1246327827.194:59): avc: denied { write } for pid=2559 comm="memcached" name="memcached.pid" dev=dm-3 ino=699 scontext=unconfined_u:system_r:memcached_t:s0 tcontext=unconfined_u:object_r:memcached_var_run_t:s0 tclass=file type=AVC msg=audit(1246332806.070:95): avc: denied { write } for pid=3780 comm="memcached" scontext=unconfined_u:system_r:memcached_t:s0 tcontext=unconfined_u:system_r:memcached_t:s0 tclass=netlink_route_socket type=AVC msg=audit(1246332806.070:97): avc: denied { name_bind } for pid=3780 comm="memcached" src=11211 scontext=unconfined_u:system_r:memcached_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket type=AVC msg=audit(1246332806.071:98): avc: denied { name_bind } for pid=3780 comm="memcached" src=11211 scontext=unconfined_u:system_r:memcached_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=udp_socket Sincerely yours, Vadym Chepkov

3 4

"Big Thanks To The SELinux Team"
by James Morris 30 Jun '09

30 Jun '09

http://californiaquantum.wordpress.com/2009/06/30/big-thanks-to-the-selinux… "Ive now been running Fedora 11 for three weeks and havent had a single SELinux issue at all. Maybe I am unique, but from what I can tell SELinux with Fedora 11 no longer has any annoying issues while running in enforcing mode." -- James Morris <jmorris(a)namei.org>

1 0

ifconfig SELinux alert in Fedora 11
by Rahul Sundaram 26 Jun '09

26 Jun '09

Hi SELinux is preventing ifconfig (ifconfig_t) "read" security_t. Audit message: node=localhost.localdomain type=AVC msg=audit(1245262097.577:19): avc: denied { read } for pid=3269 comm="ifconfig" name="mls" dev=selinuxfs ino=12 scontext=unconfined_u:unconfined_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1245262097.577:19): arch=40000003 syscall=5 success=no exit=-13 a0=bfbcfdb8 a1=8000 a2=0 a3=bfbcfdb8 items=0 ppid=3253 pid=3269 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:unconfined_r:ifconfig_t:s0-s0:c0.c1023 key=(null) --- Rahul

7 14

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2009