Re: using an interface defined in another loaded module
by SZIGETVÁRI János
Dear Gary,
Thanks a zillion times for your help, the building of the policy works fine
now that I have copied the .if file of the submodule to the directory you
mentioned!
I did not know I was reqired to copy the module's interface file to
SELinux's include dirs to make it available for other modules to use.
BTW, I was building my module from within my "policy builder and installer"
script using the "traditional" way of:
# make -f /usr/share/selinux/devel/Makefile A.pp
Now the build process works, thanks to your suggestion!
Best Regards,
János
--
Janos SZIGETVARI
RHCE, License no. 150-053-692
<https://www.redhat.com/rhtapps/verify/?certId=150-053-692>
LinkedIn: linkedin.com/in/janosszigetvari
E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com
Phone: +36209440412 (Hungary)
__@__˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp
Gary Tierney <gary.tierney(a)gmx.com> ezt írta (időpont: 2019. ápr. 3., Sze,
17:14):
> On Wed, Apr 03, 2019 at 10:34:08AM +0200, SZIGETVÁRI János wrote:
> >Could anyone please give me some insight on this?
> >
> >Thanks a lot!
> >
>
> Hi,
>
> How are you building and installing your policy modules? The interface
> definitions (.if files) aren't preserved in the compiled policy package,
> so are typically kept elsewhere. On Fedora this is under
> /usr/share/selinux/devel/include and its associated subdirectories
> (which are recursively walked to find .if files when building policy
> using the refpolicy framework, i.e., the selinux-policy-devel package).
>
> So it should be as simple as copying your .if files to:
> /usr/share/selinux/devel/include (though the "services" subdir is likely
> more appropriate).
>
> Thanks,
> Gary.
>
> >Best Regards,
> >János Szigetvári
> >
> >SZIGETVÁRI János <jszigetvari(a)gmail.com> ezt írta (időpont: 2019. márc.
> >31., V, 13:47):
> >
> >> ... snip ...
> >_______________________________________________
> >selinux mailing list -- selinux(a)lists.fedoraproject.org
> >To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> >List Archives:
> https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...
>
>
4 years, 7 months
Initial context for init
by Philip Seeley
Hi all,
Quick question is:
In the targeted policy should init run SystemHigh as it does in the mls
policy?
The background:
We're setting up a targeted system where we confine all users and remove
the unconfined policy module, but we also enable polyinstantiation of /tmp
and /var/tmp.
If we ssh in as a staff_u user phil and elevate to root/sysadm_r then we
have a context of:
staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
And therefore /var/tmp is:
drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp
Which is really:
drwxrwxrwt. root root
system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_phil
The real /var/tmp is:
drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp
Now if we use run_init to update an RPM that contains a post install
script, rpm can't create the temporary script file:
# run_init bash -c 'rpm -i
--force /root/libselinux-2.0.94-7.el6.x86_64.rpm'
Authenticating phil.
Password:
error: error creating temporary file /var/tmp/rpm-tmp.atkHTf: Permission
denied
error: Couldn't create temporary file for %post
(libselinux-2.0.94-7.el6.x86_64): Permission denied
Note: you need to use run_init as the rpm might restart a service, e.g. the
sssd rpm.
We've traced this to the /etc/selinux/targeted/contexts/initrc_context file
which contains:
system_u:system_r:initrc_t:s0
So we transition to initrc_t and then to rpm_t without any categories, but
because the polyinstantiated /var/tmp directory has c0.c1023 we get denied.
Normally in targeted init runs unconfined, but we've removed this.
type=AVC msg=audit(1467342325.016:716): avc: denied { read } for
pid=2779 comm="rpm" name="system_u:object_r:tmp_t:s0-s0:c0.c1023_phil"
dev=dm-0 ino=1966082 scontext=system_u:system_r:rpm_t:s0
tcontext=system_u:object_r:tmp_t:s0-s0:c0.c1023 tclass=dir
It works if we change initrc_context to:
system_u:system_r:initrc_t:s0-s0:c0.c1023
We don't see the issue under mls because the default initrc_context is:
system_u:system_r:initrc_t:s0-s15:c0.c1023
We've traces this back through the selinux-policy src RPM and to the
upstream refpolicy and see that config/appconfig-mcs/initrc_context is:
system_u:system_r:initrc_t:s0
whereas config/appconfig-mls/initrc_context is:
system_u:system_r:initrc_t:s0-mls_systemhigh
So under mls init's context is SystemHigh, but under mcs/targeted it
doesn't have any categories.
So the long question is should config/appconfig-mcs/initrc_context really
be:
system_u:system_r:initrc_t:mcs_systemhigh
as it seems odd that the more secure mls policy would run init at
SystemHigh but targeted doesn't.
Thanks
Phil Seeley
4 years, 10 months
unconfined_service_t
by Marko Rauhamaa
When I start a random systemd service written by myself on Fedora, I
notice that the service gets
system_u:system_r:unconfined_service_t
That's without me configuring SELinux for my service in any way.
Furthermore, I notice that my service has the right to access all files
freely across all file systems.
Again, without any special setup, my service executable gets this label:
system_u:object_r:bin_t:s0
I thought SELinux was about granting minimal access (and no access by
default), but Fedora has granted my service maximal access by default.
What have I not understood?
Marko
4 years, 11 months
SELinux and AppArmor.
by Jason Long
Hello,
Can AppArmor affect SELinux? I mean is discontinued SELinux.
Thanks.
5 years
Allow a Linux account to read a tag named var_log_t
by LOEWENTHAL Sophie (EEAS-EXT)
Hi everybody,
Can a tag named var_log_t be assigned to Linux account instead of a Selinux user?
e.g I want the Linux account named logread to be able to read all files in /var/log(/.*)?
Or should a new Selinux be created with permission to read var_log_t, and this Selinux user be assigned to the Linux user logread?
O/S is CentOS, but imagine not too much difference from Fedora.
Best wishes,
Sophie
The views expressed are purely those of the writer and may not in any circumstances be regarded as stating an official position of the EEAS. Les avis exprimés n'engagent que leur auteur et ne peuvent en aucun cas être considérés comme une position officielle du SEAE.
5 years
Labeling conflict?
by Marko Rauhamaa
When a file gets created, it gets a label based on some mysterious
distro policy ("antivirus_db_t"). I define a specific custom policy that
should give the file a different label (say, "bin_t").
What ends up happening is that no matter how I *create* the file, it
always gets "antivirus_db_t" as its label. However, if I run restorecon
on the file, the label changes to "bin_t".
How can this symptom be explained?
Marko
5 years
antivirus_exec_t shunned on Fedora
by Marko Rauhamaa
I have a service I want to start from systemd. The service startup goes
like this:
systemd ----> prog1[label: usr_t] ----> prog2[label: antivirus_exec_t]
However, Fedora's SELinux policies prevent prog2 from starting. If I
change prog2's label to bin_t or usr_t, the service starts fine.
What in Fedora's policies bans antivirus_exec_t from running?
Should I introduce a custom policy that allows that startup combination?
If so, can you tell me what that rule would look like (or what document
would give me the instructions). I already have a simple .te policy so I
know the very basics.
Or should I just label the file with bin_t and be done with it?
BTW, this is not a sysadmin question. Rather it's a product installation
question; the product should work out of the box on Fedora.
Marko
5 years
module removal fails
by lejeczek
$ semanage module -r ganesha
libsemanage.semanage_direct_remove_key: Unable to remove module ganesha
at priority 400. (No such file or directory).
OSError: No such file or directory
hi guys,
how to fix the above?
many thanks, L.
5 years
a boolean which does not work?
by lejeczek
hi everyone
I have this:
virt_use_fusefs --> on
virt_use_glusterd --> on
on centos 7.6 with selinux-policy-3.13.1-229.el7_6.12.noarch.
When I tell pacemaker to start a virt guest resource with xml config off
a fuse mounted gluster vol I get a denial and audit2allow sees:
allow virsh_t fusefs_t:dir search;
Should above boolean be all I (pacemaker) need or I'm missing something?
many thanks, L.
5 years
Re: SELinux and AppArmor.
by Jason Long
No, I meant was can AppArmor become a replacement for SELinux?
--------------------------------------------
On Mon, 6/10/19, Lukas Vrabec <lvrabec(a)redhat.com> wrote:
Subject: Re: SELinux and AppArmor.
To: selinux(a)lists.fedoraproject.org
Date: Monday, June 10, 2019, 2:00 PM
On 6/8/19 5:24 PM, Jason Long
wrote:
> Hello,
Hello,
It's not really easy to have SELinux
enabled together with AppArmor on
one
system.
AppArmor is not
supported on Fedora.
Thanks,
Lukas.
> Can AppArmor affect SELinux? I mean is
discontinued SELinux.
>
> Thanks.
>
_______________________________________________
> selinux mailing list -- selinux(a)lists.fedoraproject.org
> To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...
>
--
Lukas Vrabec
Senior Software Engineer, Security
Technologies
Red Hat, Inc.
_______________________________________________
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...
-----Inline Attachment Follows-----
5 years
