How to add a new application in targeted
by James Z. Li
I wrote some policy files for sendmail, say
/etc/selinux/targeted/src/policy/file_contexts/program/sendmail.fc
/etc/selinux/targeted/src/policy/domain/program/sendmail.te
I compiled them using 'make load' but it looks like selinux does not
check against my policy files.
I was wondering if there is a checklist where I could add 'sendmail'
to let selinux
know sendmail is now one of the targeted applications. Or should I put my
sendmail.fc and sendmail.te in local.fc and local.te respectively?
Thanks,
James
18 years, 11 months
php+mysql under httpd in fc3
by Stanislav Malyshev
I run FC3 with targeted policies (default install). I have a problem
running connecting to mysql server from php under apache - the problem is
that httpd/php is denied write access to mysql.sock, something like this:
fc3 kernel: audit(1116843116.146:0): avc: denied { write } for pid=7281
exe=/usr/sbin/httpd name=mysql.sock dev=dm-0 ino=375162
scontext=root:system_r:httpd_t tcontext=user_u:object_r:var_lib_t
tclass=sock_file
Now, I have seen various modifications to policy sources that would allow
it to work, but what I am asking is if it possible to do it without
rebuilding policy from sources. The reason for this is that we need to
make our ptoduce to install mysql & certain modules using it on user
servers, and we can not count on policy sources being installed there.
Also, the security of mysqld itself does not matter in this particular
case and it is OK for us to run it unrestricted (it's separate server for
this application only without network connection). The only problem is to
allow restricted httpd to connect to that particular Unix socket.
I see that default system sources (apache.te) seem to include various
types that seem to allow this, but I have no success in using them. If I
try to use mysqld_var_run_t chcon gives me "Invalid argument", same with
mysqld_db_t. Also, I see that httpd_php_t has can_unix_connect() rule,
while httpd_t does not, however I did not find any documentation on what
these types are, what's teh difference and how one can use httpd_php_t. I
see httpd is running now under httpd_t according to ps -eZ.
I tries also to set mysql.sock into tmp_t, then write error disappears,
and this one appears instead:
fc3 kernel: audit(1116844521.972:0): avc: denied { connectto } for
pid=7275 exe=/usr/sbin/httpd path=/var/lib/mysql/mysql.sock
scontext=root:system_r:httpd_t tcontext=user_u:system_r:unconfined_t
tclass=unix_stream_socket
I am rather new to all SELinux concepts, so if anyone can give me some
explanations about this or point me to some docs that describe these
things it will be appreciated.
TIA,
--
Stanislav Malyshev, Zend Products Engineer
stas(a)zend.com http://www.zend.com/ +972-3-6139665 ext.115
18 years, 11 months
domains/misc/kernel.te
by Tom London
domains/misc/kernel.te has the following lines:
# Use capabilities.
allow kernel_t self:capability *;
allow kernel_t sysfs_t:dir search;
allow kernel_t { usbfs_t usbdevfs_t sysfs_t }:dir search;
# Run init in the init_t domain.
Search for sysfs_t is in twice.
Also, I'm getting avc's for kernel_t for getattr/read for sysfs_t:
May 22 10:04:32 fedora kernel: SELinux: initialized (dev usbfs, type
usbfs), uses genfs_contexts
May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied
{ getattr } for path="/sys/class/input/mouse1" dev=sysfs ino=1850
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t
tclass=dir
May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied
{ getattr } for path="/sys/class/input/mouse1/dev" dev=sysfs ino=2090
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t
tclass=file
May 22 10:04:32 fedora kernel: audit(1116756222.766:0): avc: denied
{ read } for name=dev dev=sysfs ino=2090
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysfs_t
tclass=file
Would it be right to replace
allow kernel_t sysfs_t:dir search;
allow kernel_t { usbfs_t usbdevfs_t sysfs_t }:dir search;
with
r_dir_file(kernel_t, sysfs_t)
allow kernel_t { usbfs_t usbdevfs_t }:dir search;
tom
--
Tom London
18 years, 11 months
allow_write_xhm ?
by Tom London
Running strict/enforcing, latest rawhide.
During boot, I get an error complaining about boolean 'allow_write_xhm'.
/etc/selinux/strict/booleans has
allow_write_xhm=1
as last line.
Should this be:
allow_write_xshm=1
Is this something I did locally, or .... ?
tom
--
Tom London
18 years, 11 months
rhgb and /usr
by Tom London
Running strict/enforcing, today's rawhide.
Booting, get these avc from rhgb:
May 21 13:06:45 fedora smartd[2314]: Device: /dev/hda, opened
May 21 13:06:45 fedora kernel: SELinux: initialized (dev ramfs, type
ramfs), uses genfs_contexts
May 21 13:06:45 fedora kernel: audit(1116680781.182:0): avc: denied
{ read } for name=index.theme dev=hda2 ino=4523023
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680781.513:0): avc: denied
{ getattr } for path="/usr/share/themes/Clearlooks/gtk-2.0/gtkrc"
dev=hda2 ino=4592143 scontext=system_u:system_r:rhgb_t
tcontext=system_u:object_r:usr_t tclass=file
May 21 13:06:45 fedora kernel: audit(1116680781.687:0): avc: denied
{ read } for name=large-computer.png dev=hda2 ino=4126600
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680781.869:0): avc: denied
{ getattr } for path="/usr/share/vte/termcap/xterm" dev=hda2
ino=4459308 scontext=system_u:system_r:rhgb_t
tcontext=system_u:object_r:usr_t tclass=file
May 21 13:06:45 fedora kernel: audit(1116680784.842:0): avc: denied
{ read } for name=index.theme dev=hda2 ino=4523023
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680784.842:0): avc: denied
{ read } for name=index.theme dev=hda2 ino=4523023
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680784.962:0): avc: denied
{ read } for name=index.theme dev=hda2 ino=4523023
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680784.964:0): avc: denied
{ read } for name=system-logo.png dev=hda2 ino=4112422
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
May 21 13:06:45 fedora kernel: audit(1116680784.973:0): avc: denied
{ read } for name=throbber-anim.png dev=hda2 ino=4114138
scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:usr_t
tclass=file
What's right here, dontaudit or allow? (System appears to boot just fine.)
tom
--
Tom London
18 years, 11 months
Auditd & Strict Policy 1.19
by George J. Jahchan
On a Bastilled FC3 latest kernel and with the strict SE Linux policy (1.19), if
not in permissive mode, the auditd daemon refuses to start with the following
error messages in /var/log/messages:
... Unable to set audit pid, exiting.
... Error sending failure mode request (Operation not permitted).
Once the daemon starts in permissive mode, it is not a problem to revert SE
Linux back to enforcing mode, the daemon stays up (and performs as expected).
Have started Fedora with audit=1 kernel option and enabled the noisy events in
SE Linux (make enableaudit & make load in the strict policy source directory),
auditd-related denials have all been explicitly allowed in our custom.te policy
under domains/misc. Auditd daemon still fails to start in enforcing mode, and no
selinux denials are generated when we try to start it.
Using the above method, we have been able to get the system to boot in enforcing
mode and run all the programs & daemons we needed to run (with no selinux
denials, except attempts to access shadow_t which is protected by an assertion
in the strict policy), except for auditd.
Any hints on how to resolve this issue?
18 years, 11 months
cupsd & targeted....
by Tom London
Running targeted/enforcing, latest rawhide.
I get the following avc from cupsd on startup and during use of an HP
USB printer:
May 19 06:22:51 localhost kernel: audit(1116508971.985:0): avc:
denied { read } for name=printconf.pickle dev=dm-0 ino=2158741
scontext=system_u:system_r:cupsd_config_t
tcontext=system_u:object_r:var_t tclass=file
May 19 06:23:48 localhost kernel: audit(1116509028.008:0): avc:
denied { write } for name=printconf.pickle dev=dm-0 ino=2158741
scontext=system_u:system_r:cupsd_config_t
tcontext=system_u:object_r:var_t tclass=file
May 19 07:06:39 localhost kernel: audit(1116511599.151:0): avc:
denied { read } for name=printconf.pickle dev=dm-0 ino=2158741
scontext=system_u:system_r:cupsd_config_t
tcontext=system_u:object_r:var_t tclass=file
May 19 07:06:48 localhost kernel: audit(1116511608.606:0): avc:
denied { signal } for scontext=system_u:system_r:hald_t
tcontext=system_u:system_r:cupsd_config_t tclass=process
May 19 07:06:52 localhost kernel: audit(1116511612.418:0): avc:
denied { write } for name=printconf.pickle dev=dm-0 ino=2158741
scontext=system_u:system_r:cupsd_config_t
tcontext=system_u:object_r:var_t tclass=file
Some read/write avcs are for /var/foomatic/printconf.pickle. Is there
an appropriate type for this (other than var_t)?
Should hald.te have:
ifdev(`cups.te', `
allow hald_t cupsd_config_t:process signal;
')
Other?
tom
--
Tom London
18 years, 11 months
vsftpd with selinux on FC3
by James Z. Li
Hi there,
I am configuring Selinux to protect vsftpd on my FC3 box. I follow the
procedure of
Chapter 8 Cutermizing and Writing Policy in Red Hat Enterprise Linux
SELinux Guide.
Step1: i created a file called
/etc/selinux/targeted/src/policy/domains/program/vsftpd.te
the cotents are
#################################
#
# Rules for the vsftpd_t domain.
#
daemon_domain(vsftpd)
the security context of this file was root:object_r:policy_src_t
I changed it by using
chcon -u system_u vsftpd.te
Step2: create /etc/selinux/targeted/src/policy/file_contexts/program/vsftpd.fc
contents are
/usr/sbin/vsftpd -- system_u:object_r:vsftpd_exec_t
/var/run/vsftpd.pid -- system_u:object_r:vsftpd_var_run_t
/etc/vsftpd/vsftpd.conf -- system_u:object_r:vsftpd_conf_t
chcon -u system_u vsftpd.fc
At this moment, the security context of /etc/vsftpd and vsftpd.conf are:
# ls -dZ /etc/vsftpd
drwxr-xr-x root root system_u:object_r:etc_t /etc/vsftpd
ls -Z /etc/vsftpd/vsftpd.conf
-rw------- root root system_u:object_r:etc_t
/etc/vsftpd/vsftpd.conf
Step3: #make load
Error message:
...
Validating file_contexts ...
/usr/sbin/setfiles -q -c /etc/selinux/targeted/policy/policy.18
/etc/selinux/tar geted/contexts/files/file_contexts
/usr/sbin/setfiles: invalid context system_u:object_r:vsftpd_conf_t
on line num ber 785
make: *** [install] Error 1
Could anyone help me on this? Thanks a lot!
Btw, should I set the security context of /etc/vsftpd/vsftpd.conf to
vsftpd_conf_t
or vsftpd_etc_t? I am confused about some existing context, such as
#ls -dZ /etc/httpd/
drwxr-xr-x root root system_u:object_r:httpd_config_t /etc/httpd/
#ls -Z /etc/httpd/conf/httpd.conf
-rw-r--r-- root root system_u:object_r:httpd_config_t
/etc/httpd/conf/httpd.conf
BUT,
# ls -dZ /etc/snmp/
drwxr-xr-x root root system_u:object_r:etc_t /etc/snmp/
# ls -Z /etc/snmp/snmpd.conf
-rw-r--r-- root root system_u:object_r:snmpd_etc_t
/etc/snmp/snmpd.conf
Thanks,
James
18 years, 11 months
need advice
by pi
I have a few users on /home/ on hda and a few on /home2/ wich resides
on hdb.
i have httpd serving webpages without problem from (hda)
/home/~/public_html but when adding users to home2/~/public_html on
hdb, webpages doesnt work. Can this be caused by selnux? I ran the
selinux-commands without succes, and i have done what´s expected from
http://fedora.redhat.com/docs/selinux-faq-fc3/index.html#id2825658
When i first installed FC3, hdb was already formatted and made no
changes on it. the install went right down on hda.
Is it possible to make it work by merging the 2 partition together
perhaps?
/pi
18 years, 11 months
Problems running postgresql
by Richard E Miles
I have been trying to start up the postgresql postmaster server to a database
which have all failed. The following are a list of avc: denied messages from
/var/log/messages:
May 13 13:20:32 localhost kernel: audit(1116015632.155:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir
May 13 13:20:32 localhost last message repeated 7 times
May 13 13:20:32 localhost kernel: audit(1116015632.156:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir
May 13 13:20:32 localhost last message repeated 3 times
May 13 13:20:32 localhost kernel: audit(1116015632.157:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir
May 13 13:20:32 localhost last message repeated 32 times
May 13 13:20:32 localhost kernel: audit(1116015632.158:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir
May 13 13:20:32 localhost last message repeated 34 times
May 13 13:20:32 localhost kernel: audit(1116015632.159:0): avc: denied { write } for pid=16659 exe=/usr/bin/postgres name=pgdb dev=hda2 ino=6471728 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:usr_t tclass=dir
Why am I getting write denials? I am running FC3 with targetted policy.
--
Richard E Miles
Federal Way WA. USA
registered linux user 46097
18 years, 11 months