How to use other LSM modules
by Bruno Castro da Silva
Hi,
I'm trying to install, on fedora core 2, some modules which
also use the LSM framework. Currently selinux is disabled
(/usr/bin/selinuxenabled returns 1), but I can't seem to
load any other modules.
I always get the "There is already a security framework
initialized, register_security failed" error.
Is there anyway to completly disable selinux or to allow
other LSM-based software to run?
Also, I think this problem wouldn't exist if selinux was
compiled as a module. Is there any reason why this isn't so?
Thanks in advance!
Bruno
19 years, 9 months
Fedora Project Mailing Lists reminder
by Elliot Lee
This is a reminder of the mailing lists for the Fedora Project, and
the purpose of each list. You can view this information at
http://fedora.redhat.com/participate/communicate/
When you're using these mailing lists, please take the time to choose
the one that is most appropriate to your post. If you don't know the
right mailing list to use for a question or discussion, please contact
me. This will help you get the best possible answer for your question,
and keep other list subscribers happy!
Mailing Lists
Mailing lists are email addresses which send email to all users
subscribed to the mailing list. Sending an email to a mailing list
reaches all users interested in discussing a specific topic and users
available to help other users with the topic.
The following mailing lists are available. To subscribe, send email to <listname>-request(a)redhat.com
(replace <listname> with the desired mailing list name such as
fedora-list) with the word subscribe in the subject.
fedora-announce-list - Announcements of changes and events. To stay
aware of news, subscribe to this list.
fedora-list - For users of releases. If you want help with a problem
installing or using , this is the list for you.
fedora-test-list - For testers of test releases. If you would like to
discuss experiences using TEST releases, this is the list for you.
fedora-devel-list - For developers, developers, developers. If you are
interested in helping create releases, this is the list for you.
fedora-docs-list - For participants of the docs project
fedora-desktop-list - For discussions about desktop issues such as user
interfaces, artwork, and usability
fedora-config-list - For discussions about the development of
configuration tools
fedora-legacy-announce - For announcements about the Fedora Legacy
Project
fedora-legacy-list - For discussions about the Fedora Legacy Project
fedora-selinux-list - For discussions about the Fedora SELinux Project
fedora-de-list - For discussions about Fedora in the German language
fedora-es-list - For discussions about Fedora in the Spanish language
fedora-ja-list - For discussions about Fedora in the Japanese language
fedora-i18n-list - For discussions about the internationalization of
Fedora Core
fedora-trans-list - For discussions about translating the software and
documentation associated with the Fedora Project
German: fedora-trans-de
French: fedora-trans-fr
Spanish: fedora-trans-es
Italian: fedora-trans-it
Brazilian Portuguese: fedora-trans-pt_br
Japanese: fedora-trans-ja
Korean: fedora-trans-ko
Simplified Chinese: fedora-trans-zh_cn
Traditional Chinese: fedora-trans-zh_tw
19 years, 9 months
mozilla-1.7 startup, lib_t vs. shlib_t?
by Tom London
[running latest FC3T1 w/ mods from devel tree, strict/enforcing]
When starting up mozilla as normal user, I noticed the following avc's:
Jul 22 06:58:24 fedora kernel: audit(1090504704.981:0): avc: denied {
execute } for pid=3527
path=/usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so dev=hda2
ino=4279850 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:lib_t tclass=file
Jul 22 06:58:34 fedora kernel: audit(1090504714.317:0): avc: denied {
execute } for pid=3517
path=/usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so dev=hda2
ino=4279868 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:lib_t tclass=file
Jul 22 06:59:06 fedora kernel: audit(1090504746.751:0): avc: denied {
read } for pid=3517 exe=/usr/lib/mozilla-1.7/mozilla-bin name=tmp
dev=hda2 ino=4112506 scontext=user_u:user_r:user_mozilla_t
tcontext=system_u:object_r:tmp_t tclass=lnk_file
The last of these describes an access to the link '/usr/tmp->../var/tmp'.
[I can't tell if this is 'breaking' anything, so I don't know if anything
needs to change here. Help anyone?]
The first 2 denials appear to interfere with plugins.
Going into permissive mode identifies the following list of
'java library executes' from scontext=user_u:user_r:user_mozilla_t:
/usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so
/usr/java/j2sdk1.5.0/jre/lib/i386/native_threads/libhpi.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libverify.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libjava.so
/usr/java/j2sdk1.5.0/jre/lib/i386/libzip.so
I changed their contexts to 'system_u:object_r:shlib_t'
and plugins started working again.
The j2 entries in types.fc are:
/usr/java/j2.*/bin(/.*)? system_u:object_r:bin_t
/usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:lib_t
/usr/java/j2.*/plugin/i386(/.*)?/lib[^/]*\.so(\.[^/]*)* --
system_u:object_r:shlib_t
I admit to not really understanding what needs to be here.
Is it appropriate to change the second line to
/usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:shlib_t
or something more specific to 1.5.0?
tom
19 years, 9 months
sshd....denied transition...funny looking avc
by Tom London
[running latest FC3T1 w/ latest mods from devel tree, strict/enforcing
kernel-2.6.7-1.494, openssh-3.8.1p1-4]
Attempting to scp into this host fails with
'Read from remote host HOST: connection reset by peer'
/var/log/messages on this host shows:
Jul 22 12:05:18 fedora sshd(pam_unix)[13899]: session opened for user
root by (uid=0)
Jul 22 12:05:18 fedora
kernel:
audit(1090523118.784:0): avc: denied { transition } for pid=13899
exe=/usr/sbin/sshd
Jul 22 12:05:26 fedora sshd(pam_unix)[13902]: session opened for user
root by (uid=0)
Jul 22 12:05:26 fedora
kernel:
audit(1090523126.143:0): avc: denied { transition } for pid=13902
exe=/usr/sbin/sshd
[There appear to be 145 blank characters after 'kernel:' and before 'audit('
on the lines above.]
/usr/sbin/sshd appears to be labeled correctly;
-rwxr-xr-x root root system_u:object_r:sshd_exec_t
/usr/sbin/sshd
tom
19 years, 9 months
auxv entry ?
by Alexis Wagner
Hi,
How do I check if my glibc have the auxv entry for AT_SECURE ?
By the way, what is a auxv entry !
Thank you.
19 years, 9 months
rhgb - bootup denials
by Tom London
With strict/enforcing, I get the following avcs at bootup.
Looks like rhgb does not 'run'; I get a text-style boot
display.
Jul 21 10:47:52 fedora kernel: audit(1090406834.263:0): avc: denied {
mounton } for pid=533 exe=/usr/bin/rhgb path=/initrd dev=ram0 ino=2
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:file_t
tclass=dir
Jul 21 10:47:52 fedora kernel: audit(1090406834.263:0): avc: denied {
sys_admin } for pid=533 exe=/usr/bin/rhgb capability=21
scontext=system_u:system_r:rhgb_t tcontext=system_u:system_r:rhgb_t
tclass=capability
audit2allow on this yields:
allow rhgb_t file_t:dir { mounton };
allow rhgb_t rhgb_t:capability { sys_admin };
but this seems a bit too 'heavy'.....
tom
19 years, 9 months
/dev/jsflash -> mouse_device_t ??
by Tom London
I think the latest file_contexts is mislabeling /dev/jsflash....
The problem line is
types.fc:/u?dev/js.* -c system_u:object_r:mouse_device_t
It overrides earlier lines:
types.fc:/u?dev/jsfd -b
system_u:object_r:fixed_disk_device_t
types.fc:/u?dev/jsflash -c
system_u:object_r:fixed_disk_device_t
tom
19 years, 9 months
.udev.tdb ?
by Tom London
I'm getting lots of of 'denied' avc for /dev/.udev.tdb from /sbin/udev.
I see an entry in file_contexts for '/dev/udev.tbl' (which doesn't
seem to exist on my system). Has .udev.tbd replaced udev.tbl?
(udev_db in /etc/udev/udev.conf is set to /dev/.udev.tdb).
tom
[udev-029-4, selinux-policy-strict-1.15.7-1]
----------------------------------------------------------------
Jul 19 18:58:54 fedora kernel: audit(1090288734.253:0): avc: denied {
read write } for pid=2720 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.284:0): avc: denied {
read write } for pid=2727 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.314:0): avc: denied {
read write } for pid=2734 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.344:0): avc: denied {
read write } for pid=2741 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.705:0): avc: denied {
read write } for pid=2824 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.707:0): avc: denied {
read write } for pid=2825 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
Jul 19 18:58:54 fedora kernel: audit(1090288734.710:0): avc: denied {
read write } for pid=2826 exe=/sbin/udev name=.udev.tdb dev=hda2
ino=2698913 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:device_t tclass=file
19 years, 9 months
hpoj?
by Tom London
I'm getting some messages from hpoj that
I don't remember getting before, shown below.
After starting in permissive mode,
checking on '/var/run/ptal-mlcd and ptal-printd' shows
files (fifos) with context 'system_u:object_r:var_run_t'.
I was expecting them to be 'system_u:object_r:ptal_var_run_t'.
Have I missed configuring this properly?
thanks,
tom
Audit2allow on permissive avc's yield:
allow ptal_t etc_runtime_t:file { getattr };
allow ptal_t etc_t:file { read };
allow ptal_t staff_home_dir_t:dir { search };
allow ptal_t usbdevfs_t:dir { getattr read };
allow ptal_t var_run_t:fifo_file { create read setattr };
allow ptal_t var_run_t:sock_file { create setattr };
(enforcing);
Jul 19 09:58:07 fedora kernel: audit(1090256287.964:0): avc: denied {
create } for pid=5638 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t
tclass=sock_file
Jul 19 09:58:07 fedora ptal-mlcd: FATAL ERROR at ExMgr.cpp:1250,
dev=<mlc:usb:PSC_900_Series>, pid=5638, e=13, t=1090256287
bind(/var/run/ptal-mlcd/usb:PSC_900_Series) failed! Ensure
/var/run/ptal-mlcd/ exists.
Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied {
search } for pid=5639 exe=/usr/sbin/ptal-printd name=root dev=hda2
ino=1196033 scontext=system_u:system_r:ptal_t
tcontext=root:object_r:staff_home_dir_t tclass=dir
Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied {
read } for pid=5639 exe=/usr/sbin/ptal-printd
name=mlc:usb:PSC_900_Series dev=hda2 ino=738368
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_t
tclass=file
Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied {
getattr } for pid=5639 exe=/usr/sbin/ptal-printd
path=/etc/ptal/ptal-printd-like dev=hda2 ino=737289
scontext=system_u:system_r:ptal_t
tcontext=system_u:object_r:etc_runtime_t tclass=file
Jul 19 09:58:07 fedora ptal-printd: ptal-printd(mlc:usb:PSC_900_Series):
Unable to read file permissions from "/etc/ptal/ptal-printd-like"!
Jul 19 09:58:09 fedora ptal-photod: ptal-photod(mlc:usb:PSC_900_Series)
successfully initialized, listening on port 5703.
(permissive):
Jul 19 09:59:41 fedora ptal-mlcd: SYSLOG at ExMgr.cpp:652,
dev=<mlc:usb:PSC_900_Series>, pid=5694, e=2, t=1090256381
ptal-mlcd successfully
initialized.
Jul 19 09:59:41 fedora ptal-printd: ptal-printd(mlc:usb:PSC_900_Series)
successfully initialized using /var/run/ptal-printd/mlc_usb_PSC_900_Series*.
Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied {
create } for pid=5693 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t
tclass=sock_file
Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied {
setattr } for pid=5693 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series
dev=hda2 ino=4493726 scontext=system_u:system_r:ptal_t
tcontext=system_u:object_r:var_run_t tclass=sock_file
Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied {
read } for pid=5693 exe=/usr/sbin/ptal-mlcd dev=usbdevfs ino=1417
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:usbdevfs_t
tclass=dir
Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied {
getattr } for pid=5693 exe=/usr/sbin/ptal-mlcd path=/proc/bus/usb
dev=usbdevfs ino=1417 scontext=system_u:system_r:ptal_t
tcontext=system_u:object_r:usbdevfs_t tclass=dir
Jul 19 09:59:41 fedora kernel: audit(1090256381.308:0): avc: denied {
search } for pid=5695 exe=/usr/sbin/ptal-printd name=root dev=hda2
ino=1196033 scontext=system_u:system_r:ptal_t
tcontext=root:object_r:staff_home_dir_t tclass=dir
Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied {
read } for pid=5695 exe=/usr/sbin/ptal-printd
name=mlc:usb:PSC_900_Series dev=hda2 ino=738368
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_t
tclass=file
Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied {
getattr } for pid=5695 exe=/usr/sbin/ptal-printd
path=/etc/ptal/ptal-printd-like dev=hda2 ino=737289
scontext=system_u:system_r:ptal_t
tcontext=system_u:object_r:etc_runtime_t tclass=file
Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied {
create } for pid=5695 exe=/usr/sbin/ptal-printd
name=mlc_usb_PSC_900_Series scontext=system_u:system_r:ptal_t
tcontext=system_u:object_r:var_run_t tclass=fifo_file
Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied {
setattr } for pid=5695 exe=/usr/sbin/ptal-printd
name=mlc_usb_PSC_900_Series dev=hda2 ino=4493727
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t
tclass=fifo_file
Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied {
read } for pid=5695 exe=/usr/sbin/ptal-printd
name=mlc_usb_PSC_900_Series dev=hda2 ino=4493727
scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t
tclass=fifo_file
Jul 19 09:59:43 fedora ptal-photod: ptal-photod(mlc:usb:PSC_900_Series)
successfully initialized, listening on port 5703.
19 years, 9 months