Creating and packaging a new policy module
by Juan Orti Alcaine
Hello, I'm the package mantainer of gogoc, and I'm creating my first policy
module for it following the instructions of this draft in the wiki [1].
It says you must build your module for three policies: mls, scritct and
targeted, but I don't see any strict policy, is this information still
correct? Must I build it also for minimum?
Also I have doubts if the module will always live in the gogoc package or it
will be migrated sometime to the main selinux-policy-targeted package.
If you can take a look at the policy to find any possible error it would be
great. It's already in the git repository of gogoc [2]
Kind regards.
[1] https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft
[2] http://pkgs.fedoraproject.org/cgit/gogoc.git/tree/
10 years, 10 months
Issue with semodule after fedup to Fedora 19
by David Highley
After doing a fedup upgrade process from Fedora 18 to Fedora 19 I'm
getting the following error when trying to install a local policy to fix
some avc issue:
semodule -i *.te
libsepol.module_package_read_offsets: wrong magic number for module
package: expected 0xf97cff8f, got 0x75646f6d
libsemanage.parse_module_headers: Could not parse module data.
semodule: Failed on my_sosreport.te!
The te file looks like this:
module my_sosreport 1.0;
require {
type sosreport_t;
type configfs_t;
type devpts_t;
type initctl_t;
class chr_file { getattr };
class dir { getattr };
class fifo_file { getattr };
}
#============= sosreport_t ==============
allow sosreport_t configfs_t:dir getattr;
allow sosreport_t devpts_t:chr_file getattr;
allow sosreport_t initctl_t:fifo_file getattr;
The audit avc look like the following:
----
time->Sat Aug 10 16:38:22 2013
type=SYSCALL msg=audit(1376177902.497:110): arch=c000003e syscall=16
success=no
exit=-65 a0=3 a1=8940 a2=7fff72ed5bf0 a3=7fff72ed59a0 items=0 ppid=3710
pid=3736
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
ses=429
4967295 tty=(none) comm="brctl" exe="/usr/sbin/brctl"
subj=system_u:system_r:sos
report_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1376177902.497:110): avc: denied { module_request }
for pi
d=3736 comm="brctl" kmod="bridge"
scontext=system_u:system_r:sosreport_t:s0-s0:c
0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system
----
time->Sat Aug 10 16:38:22 2013
type=SYSCALL msg=audit(1376177902.968:111): arch=c000003e syscall=6
success=no e
xit=-13 a0=7fff425f9af0 a1=1dcd140 a2=1dcd140 a3=fffff800 items=0
ppid=3710 pid=
3764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 ses
=4294967295 tty=(none) comm="ls" exe="/usr/bin/ls"
subj=system_u:system_r:sosrep
ort_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1376177902.968:111): avc: denied { getattr } for
pid=3764
comm="ls" path="/dev/initctl" dev="devtmpfs" ino=8906
scontext=system_u:system_r
:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initctl_t:s0
tclass=fifo_
file
----
----
time->Sat Aug 10 16:38:22 2013
type=SYSCALL msg=audit(1376177902.980:112): arch=c000003e syscall=6
success=no exit=-13 a0=7fff425f9af0 a1=1ddbb30 a2=1ddbb30 a3=fffffff8
items=0 ppid=3710 pid=3764 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ls"
exe="/usr/bin/ls" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023
key=(null)
type=AVC msg=audit(1376177902.980:112): avc: denied { getattr } for
pid=3764 comm="ls" path="/dev/pts/ptmx" dev="devpts" ino=2
scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023
tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
----
time->Sat Aug 10 16:38:23 2013
type=SYSCALL msg=audit(1376177903.375:113): arch=c000003e syscall=4
success=no exit=-13 a0=2051cb0 a1=7fff82adf0c0 a2=7fff82adf0c0 a3=0
items=0 ppid=3710 pid=3772 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="df"
exe="/usr/bin/df" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023
key=(null)
type=AVC msg=audit(1376177903.375:113): avc: denied { getattr } for
pid=3772 comm="df" path="/sys/fs/pstore" dev="pstore" ino=9238
scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023
tcontext=system_u:object_r:pstorefs_t:s0 tclass=dir
----
time->Sat Aug 10 16:38:23 2013
type=SYSCALL msg=audit(1376177903.408:114): arch=c000003e syscall=4
success=no exit=-13 a0=2052470 a1=7fff82adf0c0 a2=7fff82adf0c0 a3=0
items=0 ppid=3710 pid=3772 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="df"
exe="/usr/bin/df" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023
key=(null)
type=AVC msg=audit(1376177903.408:114): avc: denied { getattr } for
pid=3772 comm="df" path="/sys/kernel/config" dev="configfs" ino=15409
scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023
tcontext=system_u:object_r:configfs_t:s0 tclass=dir
----
time->Sat Aug 10 16:38:24 2013
type=SYSCALL msg=audit(1376177904.575:115): arch=c000003e syscall=41
success=no exit=-13 a0=10 a1=80803 a2=f a3=d2be50 items=0 ppid=3710
pid=3803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 ses=4294967295 tty=(none) comm="lsusb" exe="/usr/bin/lsusb"
subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1376177904.575:115): avc: denied { create } for
pid=3803 comm="lsusb"
scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023
tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023
tclass=netlink_kobject_uevent_socket
10 years, 10 months
Puppet 3 troubles on F19
by Robin Lee Powell
So I just upgraded to F19, which means I get Puppet 3 (yay!).
I'm running with unconfined disabled.
Unfortunately, it looks like the policy hasn't been updated for
puppet in quite a while. For example, from
serefpolicy-contrib-3.12.1/puppet.fc (which I got from
selinux-policy-3.12.1-66.fc19.src.rpm ) I see:
/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0)
/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0)
/usr/sbin/puppetca -- gen_context(system_u:object_r:puppetca_exec_t,s0)
/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
Not a one of those files exists anymore.
This means that things go quite poorly. For example, "sudo
systemctl restart puppetmaster.service" gets me:
type=AVC msg=audit(07/29/2013 22:07:49.780:2300368) : avc: denied { open } for pid=28302 comm=ruby-mri path=/var/lib/puppet/ssl/ca/ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
type=AVC msg=audit(07/29/2013 22:07:49.780:2300368) : avc: denied { read } for pid=28302 comm=ruby-mri name=ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
----
type=AVC msg=audit(07/29/2013 22:07:49.780:2300369) : avc: denied { ioctl } for pid=28302 comm=ruby-mri path=/var/lib/puppet/ssl/ca/ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
----
type=AVC msg=audit(07/29/2013 22:07:49.966:2300370) : avc: denied { create } for pid=28307 comm=ruby-mri name=master.pid scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=file
type=AVC msg=audit(07/29/2013 22:07:49.966:2300370) : avc: denied { add_name } for pid=28307 comm=ruby-mri name=master.pid scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=dir
----
type=SOCKADDR msg=audit(07/29/2013 22:07:49.982:2300371) : saddr=inet host:0.0.0.0 serv:8140
type=AVC msg=audit(07/29/2013 22:07:49.982:2300371) : avc: denied { name_bind } for pid=28307 comm=ruby-mri src=8140 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_port_t:s0 tclass=tcp_socket
because it's running as initrc_t instead of puppetmaster_t:
system_u:system_r:initrc_t:s0 puppet 28307 0.0 0.5 309556 43464 ? Ssl 22:07 0:00 /usr/bin/ruby-mri /usr/bin/puppet master
My knowledge of puppet is considerable, but my selinux is only
decent. In particular, the Right Thing here is for the systemd
launch of puppetmaster to put things into the right context, but
I've no idea how to accomplish that.
Is there someone I can work with to fix up this policy?
-Robin
10 years, 10 months
Executables in a home directory
by mark
We've got a service (motion) that has an NFS-mounted home directory. In
that directory is ./bin, and some executables. Is there a boolean to allow
that to be executed, or do I have to add a policy to allow that on every
system that is running the service?
Btw, the system it just showed up on is a newly updated FC19.
mark
10 years, 10 months
Oracle d/b file and dumpfile contexts
by mark
Hi, folks,
Googling is just getting me how to set the contexts on the Oracle
executables and libraries; I have yet to find anything that tells me
the appropriate context for the database files and dumpfiles
themselves.
Clues for the poor?
mark
10 years, 11 months