After some trouble getting the file-system relabelled - which was eventually solved by Daniel's suggestion to change to a 5.3 preview release of the policy packages - I now have (only) a couple of intractable denials.
One seems to be related to procmail running spamc. The other seems to be webalizer being denied access to squid logs. Here is some representative troubledhooter output:
Summary SELinux is preventing spamc (procmail_t) "execute" to ./spamc (spamc_exec_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by spamc. It is not expected that this access is required by spamc and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./spamc,
restorecon -v './spamc'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: system_u:system_r:procmail_t Target Context: system_u:object_r:spamc_exec_t Target Objects: ./spamc [ file ] Source: spamc Source Path: /usr/bin/spamc Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: spamassassin-3.2.4-1.el5 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 199 First Seen: Wed Jan 7 21:12:56 2009 Last Seen: Sat Jan 10 13:50:07 2009 Local ID: 72201679-d161-4d2d-8423-44b1b65a211f Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null)
Summary SELinux is preventing webalizer (webalizer_t) "search" to ./webalizer (bin_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by webalizer. It is not expected that this access is required by webalizer and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./webalizer,
restorecon -v './webalizer'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: root:system_r:webalizer_t:SystemLow-SystemHigh Target Context: system_u:object_r:bin_t Target Objects: ./webalizer [ dir ] Source: webalizer Source Path: /usr/bin/webalizer Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: webalizer-2.01_10-30.1 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 119 First Seen: Wed Jan 7 22:00:02 2009 Last Seen: Sat Jan 10 14:00:01 2009 Local ID: fd879861-abb1-4e67-a190-0a721c66dc0e Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null)
I didn't think I was doing anything unusual here - so I am surprised these aren't covered by standard policy. Am I don't something strange - and if so - do I need to write my own local policy. Is there a more standard way to run spamc and/.or webalizer which will prevent these denials?
Thanks
Richard.
Richard Chapman wrote:
After some trouble getting the file-system relabelled - which was eventually solved by Daniel's suggestion to change to a 5.3 preview release of the policy packages - I now have (only) a couple of intractable denials.
One seems to be related to procmail running spamc. The other seems to be webalizer being denied access to squid logs. Here is some representative troubledhooter output:
Summary SELinux is preventing spamc (procmail_t) "execute" to ./spamc (spamc_exec_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by spamc. It is not expected that this access is required by spamc and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./spamc,
restorecon -v './spamc'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: system_u:system_r:procmail_t Target Context: system_u:object_r:spamc_exec_t Target Objects: ./spamc [ file ] Source: spamc Source Path: /usr/bin/spamc Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: spamassassin-3.2.4-1.el5 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 199 First Seen: Wed Jan 7 21:12:56 2009 Last Seen: Sat Jan 10 13:50:07 2009 Local ID: 72201679-d161-4d2d-8423-44b1b65a211f Line Numbers:
Fedora 10 has a rule that looks like it would resolve this issue:
$ sesearch --allow -s procmail_t -t spamc_exec_t WARNING: This policy contained disabled aliases; they have been removed. Found 1 semantic av rules: allow procmail_t spamc_exec_t : file { ioctl read getattr execute } ;
selinux-policy-3.5.13-38.fc10.noarch selinux-policy-targeted-3.5.13-38.fc10.noarch
Do you have this rule when running the 5.3 preview packages? I am not sure about your webalizer issue...
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null)
Summary SELinux is preventing webalizer (webalizer_t) "search" to ./webalizer (bin_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by webalizer. It is not expected that this access is required by webalizer and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./webalizer,
restorecon -v './webalizer'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: root:system_r:webalizer_t:SystemLow-SystemHigh Target Context: system_u:object_r:bin_t Target Objects: ./webalizer [ dir ] Source: webalizer Source Path: /usr/bin/webalizer Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: webalizer-2.01_10-30.1 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 119 First Seen: Wed Jan 7 22:00:02 2009 Last Seen: Sat Jan 10 14:00:01 2009 Local ID: fd879861-abb1-4e67-a190-0a721c66dc0e Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null)
I didn't think I was doing anything unusual here - so I am surprised these aren't covered by standard policy. Am I don't something strange - and if so - do I need to write my own local policy. Is there a more standard way to run spamc and/.or webalizer which will prevent these denials?
Thanks
Richard.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Thanks Murray... It looks to me like Centos 5.2 and/or the 5.3 preview policy release doesn;'t have that rule:
-------- [root@C5 ~]# sesearch --allow -s procmail_t -t spamc_exec_t
[root@C5 ~]# --------
Can you advise me the easiest and/or best way to add this rule to to my system?
Richard
Murray McAllister wrote:
Richard Chapman wrote:
After some trouble getting the file-system relabelled - which was eventually solved by Daniel's suggestion to change to a 5.3 preview release of the policy packages - I now have (only) a couple of intractable denials.
One seems to be related to procmail running spamc. The other seems to be webalizer being denied access to squid logs. Here is some representative troubledhooter output:
Summary SELinux is preventing spamc (procmail_t) "execute" to ./spamc (spamc_exec_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by spamc. It is not expected that this access is required by spamc and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./spamc,
restorecon -v './spamc'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: system_u:system_r:procmail_t Target Context: system_u:object_r:spamc_exec_t Target Objects: ./spamc [ file ] Source: spamc Source Path: /usr/bin/spamc Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: spamassassin-3.2.4-1.el5 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 199 First Seen: Wed Jan 7 21:12:56 2009 Last Seen: Sat Jan 10 13:50:07 2009 Local ID: 72201679-d161-4d2d-8423-44b1b65a211f Line Numbers:
Fedora 10 has a rule that looks like it would resolve this issue:
$ sesearch --allow -s procmail_t -t spamc_exec_t WARNING: This policy contained disabled aliases; they have been removed. Found 1 semantic av rules: allow procmail_t spamc_exec_t : file { ioctl read getattr execute } ;
selinux-policy-3.5.13-38.fc10.noarch selinux-policy-targeted-3.5.13-38.fc10.noarch
Do you have this rule when running the 5.3 preview packages? I am not sure about your webalizer issue...
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute } for pid=16474 comm="procmail" name="spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { execute_no_trans } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=AVC msg=audit(1231563007.814:8005): avc: denied { read } for pid=16474 comm="procmail" path="/usr/bin/spamc" dev=dm-0 ino=31336954 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563007.814:8005): arch=c000003e syscall=59 success=yes exit=0 a0=196772e0 a1=196792a0 a2=196791f0 a3=8 items=0 ppid=16473 pid=16474 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" subj=system_u:system_r:procmail_t:s0 key=(null)
Summary SELinux is preventing webalizer (webalizer_t) "search" to ./webalizer (bin_t). Detailed Description [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux denied access requested by webalizer. It is not expected that this access is required by webalizer and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.
Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./webalizer,
restorecon -v './webalizer'
If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context: root:system_r:webalizer_t:SystemLow-SystemHigh Target Context: system_u:object_r:bin_t Target Objects: ./webalizer [ dir ] Source: webalizer Source Path: /usr/bin/webalizer Port: <Unknown> Host: C5.aardvark.com.au Source RPM Packages: webalizer-2.01_10-30.1 Target RPM Packages: Policy RPM: selinux-policy-2.4.6-203.el5 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Permissive Plugin Name: catchall_file Host Name: C5.aardvark.com.au Platform: Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count: 119 First Seen: Wed Jan 7 22:00:02 2009 Last Seen: Sat Jan 10 14:00:01 2009 Local ID: fd879861-abb1-4e67-a190-0a721c66dc0e Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=AVC msg=audit(1231563601.389:8027): avc: denied { search } for pid=16510 comm="webalizer" name="webalizer" dev=dm-0 ino=32479105 scontext=root:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=dir host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null) host=C5.aardvark.com.au type=SYSCALL msg=audit(1231563601.389:8027): arch=c000003e syscall=4 success=no exit=-2 a0=4171ee a1=7fff7d310db0 a2=7fff7d310db0 a3=21000 items=0 ppid=16509 pid=16510 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=730 comm="webalizer" exe="/usr/bin/webalizer" subj=root:system_r:webalizer_t:s0-s0:c0.c1023 key=(null)
I didn't think I was doing anything unusual here - so I am surprised these aren't covered by standard policy. Am I don't something strange
- and if so - do I need to write my own local policy. Is there a more
standard way to run spamc and/.or webalizer which will prevent these denials?
Thanks
Richard.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
I am running SElinux in permissive mode. I want to allow samba access to user home directories. At setroubleshooters suggestion (see below) - I did the following at a shell prompt:
Ø *setsebool -P samba_enable_home_dirs=1
*
This seemed to solve the problem. But after a reboot the denials are back. I assume the boolean is not carried across a reboot.
If my assumption is correct - where is the recommended place to put the:
setsebool -P samba_enable_home_dirs=1
command? Should I create a local policy module and put it there - or is there some other recommended place? If anyone can point me to a recommended procedure ...
Thanks
Richard.
Summary:
SELinux is preventing the samba daemon from reading users' home directories.
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux has denied the samba daemon access to users' home directories. Someone is attempting to access your home directories via your samba daemon. If you only setup samba to share non-home directories, this probably signals a intrusion attempt. For more information on SELinux integration with samba, look at the samba_selinux man page. (man samba_selinux)
Allowing Access:
If you want samba to share home directories you need to turn on the samba_enable_home_dirs boolean: "setsebool -P samba_enable_home_dirs=1"
The following command will allow this access:
setsebool -P samba_enable_home_dirs=1
Additional Information:
Source Context system_u:system_r:smbd_t Target Context user_u:object_r:spamassassin_home_t Target Objects ./.spamassassin [ dir ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host C5.aardvark.com.au Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name samba_enable_home_dirs Host Name C5.aardvark.com.au Platform Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue 13 Jan 2009 10:59:19 PM WST Last Seen Tue 13 Jan 2009 10:59:23 PM WST Local ID 70f6525d-ce9d-40a4-a558-c3db06781ae9 Line Numbers
Raw Audit Messages
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
Richard Chapman wrote:
I am running SElinux in permissive mode. I want to allow samba access to user home directories. At setroubleshooters suggestion (see below) - I did the following at a shell prompt:
Ø *setsebool -P samba_enable_home_dirs=1
This seemed to solve the problem. But after a reboot the denials are back. I assume the boolean is not carried across a reboot.
If my assumption is correct - where is the recommended place to put the:
setsebool -P samba_enable_home_dirs=1
command? Should I create a local policy module and put it there - or is there some other recommended place? If anyone can point me to a recommended procedure ...
Thanks
Richard.
You've done what you needed to do already - the -P option makes the boolean persist across reboots.
Summary:
SELinux is preventing the samba daemon from reading users' home directories.
This summary is actually slightly misleading in this case.
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux has denied the samba daemon access to users' home directories. Someone is attempting to access your home directories via your samba daemon. If you only setup samba to share non-home directories, this probably signals a intrusion attempt. For more information on SELinux integration with samba, look at the samba_selinux man page. (man samba_selinux)
Allowing Access:
If you want samba to share home directories you need to turn on the samba_enable_home_dirs boolean: "setsebool -P samba_enable_home_dirs=1"
The following command will allow this access:
setsebool -P samba_enable_home_dirs=1
Additional Information:
Source Context system_u:system_r:smbd_t Target Context user_u:object_r:spamassassin_home_t Target Objects ./.spamassassin [ dir ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host C5.aardvark.com.au Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name samba_enable_home_dirs Host Name C5.aardvark.com.au Platform Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue 13 Jan 2009 10:59:19 PM WST Last Seen Tue 13 Jan 2009 10:59:23 PM WST Local ID 70f6525d-ce9d-40a4-a558-c3db06781ae9 Line Numbers Raw Audit Messages host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
These denials are all for the ~/.spamassassin directory and its contents, not the home directory in general. Browsing the majority of the home directory would work just fine in enforcing mode.
Paul.
Thanks Paul. Your observation that the problem is the ~/.spamassassin directory is very enlightening. Nonetheless - I imagine that in enforcing mode - I will get lots of errors - and possibly samba delays - so it probably still needs fixing. Can y0u suggest why I might have this problem - and how best to fix it?
Richard.
Paul Howarth wrote:
Richard Chapman wrote:
I am running SElinux in permissive mode. I want to allow samba access to user home directories. At setroubleshooters suggestion (see below) - I did the following at a shell prompt:
Ø *setsebool -P samba_enable_home_dirs=1
This seemed to solve the problem. But after a reboot the denials are back. I assume the boolean is not carried across a reboot.
If my assumption is correct - where is the recommended place to put the:
setsebool -P samba_enable_home_dirs=1
command? Should I create a local policy module and put it there - or is there some other recommended place? If anyone can point me to a recommended procedure ...
Thanks
Richard.
You've done what you needed to do already - the -P option makes the boolean persist across reboots.
Summary:
SELinux is preventing the samba daemon from reading users' home directories.
This summary is actually slightly misleading in this case.
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux has denied the samba daemon access to users' home directories. Someone is attempting to access your home directories via your samba daemon. If you only setup samba to share non-home directories, this probably signals a intrusion attempt. For more information on SELinux integration with samba, look at the samba_selinux man page. (man samba_selinux)
Allowing Access:
If you want samba to share home directories you need to turn on the samba_enable_home_dirs boolean: "setsebool -P samba_enable_home_dirs=1"
The following command will allow this access:
setsebool -P samba_enable_home_dirs=1
Additional Information:
Source Context system_u:system_r:smbd_t Target Context user_u:object_r:spamassassin_home_t Target Objects ./.spamassassin [ dir ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host C5.aardvark.com.au Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name samba_enable_home_dirs Host Name C5.aardvark.com.au Platform Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue 13 Jan 2009 10:59:19 PM WST Last Seen Tue 13 Jan 2009 10:59:23 PM WST Local ID 70f6525d-ce9d-40a4-a558-c3db06781ae9 Line Numbers Raw Audit Messages host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
These denials are all for the ~/.spamassassin directory and its contents, not the home directory in general. Browsing the majority of the home directory would work just fine in enforcing mode.
Paul.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Richard Chapman wrote:
Thanks Paul. Your observation that the problem is the ~/.spamassassin directory is very enlightening. Nonetheless - I imagine that in enforcing mode - I will get lots of errors - and possibly samba delays - so it probably still needs fixing. Can y0u suggest why I might have this problem - and how best to fix it?
Richard.
Paul Howarth wrote:
Richard Chapman wrote:
I am running SElinux in permissive mode. I want to allow samba access to user home directories. At setroubleshooters suggestion (see below) - I did the following at a shell prompt:
Ø *setsebool -P samba_enable_home_dirs=1
This seemed to solve the problem. But after a reboot the denials are back. I assume the boolean is not carried across a reboot.
If my assumption is correct - where is the recommended place to put the:
setsebool -P samba_enable_home_dirs=1
command? Should I create a local policy module and put it there - or is there some other recommended place? If anyone can point me to a recommended procedure ...
Thanks
Richard.
You've done what you needed to do already - the -P option makes the boolean persist across reboots.
Summary:
SELinux is preventing the samba daemon from reading users' home directories.
This summary is actually slightly misleading in this case.
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.]
SELinux has denied the samba daemon access to users' home directories. Someone is attempting to access your home directories via your samba daemon. If you only setup samba to share non-home directories, this probably signals a intrusion attempt. For more information on SELinux integration with samba, look at the samba_selinux man page. (man samba_selinux)
Allowing Access:
If you want samba to share home directories you need to turn on the samba_enable_home_dirs boolean: "setsebool -P samba_enable_home_dirs=1"
The following command will allow this access:
setsebool -P samba_enable_home_dirs=1
Additional Information:
Source Context system_u:system_r:smbd_t Target Context user_u:object_r:spamassassin_home_t Target Objects ./.spamassassin [ dir ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host C5.aardvark.com.au Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-203.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name samba_enable_home_dirs Host Name C5.aardvark.com.au Platform Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 2 First Seen Tue 13 Jan 2009 10:59:19 PM WST Last Seen Tue 13 Jan 2009 10:59:23 PM WST Local ID 70f6525d-ce9d-40a4-a558-c3db06781ae9 Line Numbers Raw Audit Messages host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { search } for pid=8841 comm="smbd" name=".spamassassin" dev=dm-0 ino=26155019 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:spamassassin_home_t:s0 tclass=dir
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1231855163.997:6624): avc: denied { getattr } for pid=8841 comm="smbd" path="/home/tim/.spamassassin/bayes_journal" dev=dm-0 ino=26149415 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:spamassassin_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1231855163.997:6624): arch=c000003e syscall=4 success=yes exit=0 a0=7ffff7628aa0 a1=7ffff76281d0 a2=7ffff76281d0 a3=7ffff76286a0 items=0 ppid=3510 pid=8841 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
These denials are all for the ~/.spamassassin directory and its contents, not the home directory in general. Browsing the majority of the home directory would work just fine in enforcing mode.
Paul.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
THis is a bug in policy.
Samba should be able to read all content in the home directory.
Really need a new interface designed. ####################################### ## <summary> ## Manage any content in the home directory ## </summary> ## <param name="userdomain"> ## <summary> ## The user domain ## </summary> ## </param> ## <rolebase/> # interface(`userdom_manage_home_content',` gen_require(` type user_home_dir_t; attribute user_home_type; ')
files_list_home($1) manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type) manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type) manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type) manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type) manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type) filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
')
And
tunable_policy(`samba_enable_home_dirs',` userdom_manage_home_content(smbd_t) ')
I have added this to rawhide, please open a bugzilla for this in F10.
selinux@lists.fedoraproject.org