SELinux... a never ending story!

[Giuseppe Greco]

Hi all,

to solve the problems I described in my previous emails,
I've backed up my configuration and reinstalled FC3 from
scratch.

Now I'm not able to run squrrelmail... I always get the
following error message:

audit(1103219472.797:0): avc: denied { read } for pid=25107
  exe=/usr/sbin/httpd name=sh dev=dm-0 ino=96012
  scontext=root:system_r:httpd_t
  tcontext=system_u:object_r:bin_t tclass=lnk_file

Any idea how to help a poor desperate?
j3d.

[Daniel J Walsh]

Giuseppe Greco wrote:
> Hi all,
>
> to solve the problems I described in my previous emails,
> I've backed up my configuration and reinstalled FC3 from
> scratch.
>
> Now I'm not able to run squrrelmail... I always get the
> following error message:
>
> audit(1103219472.797:0): avc: denied { read } for pid=25107
>  exe=/usr/sbin/httpd name=sh dev=dm-0 ino=96012
>  scontext=root:system_r:httpd_t
>  tcontext=system_u:object_r:bin_t tclass=lnk_file
>
> Any idea how to help a poor desperate?
> j3d.

Update your policy file, via yum update.

[Giuseppe Greco]

On Thu, 2004-12-16 at 13:11 -0500, Daniel J Walsh wrote:
> Giuseppe Greco wrote:
> > Hi all,
> >
> > to solve the problems I described in my previous emails,
> > I've backed up my configuration and reinstalled FC3 from
> > scratch.
> >
> > Now I'm not able to run squrrelmail... I always get the
> > following error message:
> >
> > audit(1103219472.797:0): avc: denied { read } for pid=25107
> >  exe=/usr/sbin/httpd name=sh dev=dm-0 ino=96012
> >  scontext=root:system_r:httpd_t
> >  tcontext=system_u:object_r:bin_t tclass=lnk_file
> >
> > Any idea how to help a poor desperate?
> > j3d.
>
> Update your policy file, via yum update.

done... and now I get

audit(1103229440.677.0): avc: denied { unlink } for pid=2671
  exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
  scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
  tclass=file

j3d.
> --
> fedora-selinux-list mailing list
> [e-mail]
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

Giuseppe Greco wrote:
> On Thu, 2004-12-16 at 13:11 -0500, Daniel J Walsh wrote:
> > Giuseppe Greco wrote:
> > > Hi all,
> > >
> > > to solve the problems I described in my previous emails,
> > > I've backed up my configuration and reinstalled FC3 from
> > > scratch.
> > >
> > > Now I'm not able to run squrrelmail... I always get the
> > > following error message:
> > >
> > > audit(1103219472.797:0): avc: denied { read } for pid=25107
> > > exe=/usr/sbin/httpd name=sh dev=dm-0 ino=96012
> > > scontext=root:system_r:httpd_t
> > > tcontext=system_u:object_r:bin_t tclass=lnk_file
> > >
> > > Any idea how to help a poor desperate?
> > > j3d.
> >
> > Update your policy file, via yum update.
>
> done... and now I get
>
> audit(1103229440.677.0): avc: denied { unlink } for pid=2671
>  exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
>  scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
>  tclass=file
>
> j3d.

ugh,

Where is this mutex file being created?  In the log dir?  The probem 
with this
is it allows a hacker to unlink all the log files, if I allow this rule.
> > --
> > fedora-selinux-list mailing list
> > [e-mail]
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Joe Orton]

On Thu, Dec 16, 2004 at 10:50:56PM -0500, Daniel J Walsh wrote:
> Giuseppe Greco wrote:
> > done... and now I get
> >
> > audit(1103229440.677.0): avc: denied { unlink } for pid=2671
> > exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
> > scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
> > tclass=file

Giuseppe, can you post your /etc/httpd/conf.d/ssl.conf?  This shouldn't
happen in the default mod_ssl configuration.
> ugh,
>
> Where is this mutex file being created?  In the log dir?  The probem
> with this is it allows a hacker to unlink all the log files, if I
> allow this rule.

mod_ssl (and various other bits of httpd) can be configured to use
various types of semaphore: these will all be SysV semaphores in the
default configuration, but in non-default configurations, can be files
with fcntl locking.  So the rule shouldn't be needed by default, I'm
confused why people are seeing this.

joe

[Giuseppe Greco]

Joe,

here's may ssl.conf... I hope this helps.
j3d.

On Fri, 2004-12-17 at 09:55 +0000, Joe Orton wrote:
> On Thu, Dec 16, 2004 at 10:50:56PM -0500, Daniel J Walsh wrote:
> > Giuseppe Greco wrote:
> > > done... and now I get
> > >
> > > audit(1103229440.677.0): avc: denied { unlink } for pid=2671
> > > exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
> > > scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
> > > tclass=file
>
> Giuseppe, can you post your /etc/httpd/conf.d/ssl.conf?  This shouldn't
> happen in the default mod_ssl configuration.
> > ugh,
> >
> > Where is this mutex file being created?  In the log dir?  The probem
> > with this is it allows a hacker to unlink all the log files, if I
> > allow this rule.
>
> mod_ssl (and various other bits of httpd) can be configured to use
> various types of semaphore: these will all be SysV semaphores in the
> default configuration, but in non-default configurations, can be files
> with fcntl locking.  So the rule shouldn't be needed by default, I'm
> confused why people are seeing this.
>
> joe
>
> --
> fedora-selinux-list mailing list
> [e-mail]
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Joe Orton]

On Fri, Dec 17, 2004 at 01:42:13PM +0100, Giuseppe Greco wrote:
> Joe,
>
> here's may ssl.conf... I hope this helps.

Ah, you have upgraded from and early FC release.

Changing "SSLMutex file:logs/ssl_mutex" to "SSLMutex default" should
make this error go away.

joe

[Giuseppe Greco]

Joe,

I've modified line 66 in ssl.conf like this:

SSLMutex default (instead of SSLMutex file:logs/ssl_mutex)

Now I'm able to send emails via squirrelmail, but SELinux is
still complying:

audit(1103287307.997:0): avc: denied { search } for pid 7286
    exe=/bin/bash name=httpd dev=dm-0 ino=65076
    scontext=root:system_r:httpd_sys_script_t
    tcontext=system_u:object_r:httpd_config_t tclass=dir

I've installed squirrelmail via yum... and then added the
change-password plugin from its official web site. Of course,
to get the change-password plugin working, I had also to
compile and install poppassd (but I don't think this is the
problem).

j3d.

On Fri, 2004-12-17 at 13:42 +0100, Giuseppe Greco wrote:
> Joe,
>
> here's may ssl.conf... I hope this helps.
> j3d.
>
> On Fri, 2004-12-17 at 09:55 +0000, Joe Orton wrote:
> > On Thu, Dec 16, 2004 at 10:50:56PM -0500, Daniel J Walsh wrote:
> > > Giuseppe Greco wrote:
> > > > done... and now I get
> > > >
> > > > audit(1103229440.677.0): avc: denied { unlink } for pid=2671
> > > > exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
> > > > scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
> > > > tclass=file
> >
> > Giuseppe, can you post your /etc/httpd/conf.d/ssl.conf?  This shouldn't
> > happen in the default mod_ssl configuration.
> > > ugh,
> > >
> > > Where is this mutex file being created?  In the log dir?  The probem
> > > with this is it allows a hacker to unlink all the log files, if I
> > > allow this rule.
> >
> > mod_ssl (and various other bits of httpd) can be configured to use
> > various types of semaphore: these will all be SysV semaphores in the
> > default configuration, but in non-default configurations, can be files
> > with fcntl locking.  So the rule shouldn't be needed by default, I'm
> > confused why people are seeing this.
> >
> > joe
> >
> > --
> > fedora-selinux-list mailing list
> > [e-mail]
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
> --
> fedora-selinux-list mailing list
> [e-mail]
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

Giuseppe Greco wrote:
> Joe,
>
> I've modified line 66 in ssl.conf like this:
>
> SSLMutex default (instead of SSLMutex file:logs/ssl_mutex)
>
> Now I'm able to send emails via squirrelmail, but SELinux is
> still complying:
>
> audit(1103287307.997:0): avc: denied { search } for pid 7286
>    exe=/bin/bash name=httpd dev=dm-0 ino=65076
>    scontext=root:system_r:httpd_sys_script_t
>    tcontext=system_u:object_r:httpd_config_t tclass=dir

Ok we can probably don't audit this.
> I've installed squirrelmail via yum... and then added the
> change-password plugin from its official web site. Of course,
> to get the change-password plugin working, I had also to
> compile and install poppassd (but I don't think this is the
> problem).
>
> j3d.
>
> On Fri, 2004-12-17 at 13:42 +0100, Giuseppe Greco wrote:
> > Joe,
> >
> > here's may ssl.conf... I hope this helps.
> > j3d.
> >
> > On Fri, 2004-12-17 at 09:55 +0000, Joe Orton wrote:
> > > On Thu, Dec 16, 2004 at 10:50:56PM -0500, Daniel J Walsh wrote:
> > > > Giuseppe Greco wrote:
> > > > > done... and now I get
> > > > >
> > > > > audit(1103229440.677.0): avc: denied { unlink } for pid=2671
> > > > > exe=/usr/sbin/httpd name=ssl_mutex.2670 dev=dm-6 ino=192037
> > > > > scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t
> > > > > tclass=fi
> > >
> > > Giuseppe, can you post your /etc/httpd/conf.d/ssl.conf?  This shouldn't
> > > happen in the default mod_ssl configuration.
> > > > ugh,
> > > >
> > > > Where is this mutex file being created?  In the log dir?  The probem
> > > > with this is it allows a hacker to unlink all the log files, if I
> > > > allow this rule.
> > >
> > > mod_ssl (and various other bits of httpd) can be configured to use
> > > various types of semaphore: these will all be SysV semaphores in the
> > > default configuration, but in non-default configurations, can be files
> > > with fcntl locking.  So the rule shouldn't be needed by default, I'm
> > > confused why people are seeing this.
> > >
> > > joe
> > >
> > > --
> > > fedora-selinux-list mailing list
> > > [e-mail]
> > > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
> > --
> > fedora-selinux-list mailing list
> > [e-mail]
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list