Re: /usr/share - self inflicted issue
by Paul Howarth
Craig White wrote:
> On Thu, 2006-01-26 at 14:38 +0000, Paul Howarth wrote:
>
>>Craig White wrote:
>>
>>>My main desktop, I was trying to upgrade from FC-3 to FC-4.
>>>
>>>I was a little short of space in /usr partition so I moved /usr/share
>>>to /home/share and symlinked it back.
>>>
>>>This seemed all and good but that does cause a cups issue.
>>>
>>>the only clues I ever get are...
>>>
>>>E [26/Jan/2006:07:02:22 -0700] LoadBanners: Unable to open banner
>>>directory "/usr/share/cups/banners": Permission denied
>>>
>>>/var/log/cups/error_log
>>>E [26/Jan/2006:07:02:22 -0700] LoadPPDs: Unable to open PPD directory
>>>"/usr/share/cups/model": Permission denied
>>>
>>>but those directories **seem to be ok**
>>>
>>># ls -Zld /usr/share/cups/model /usr/share/cups/banners/
>>>drwxr-xr-x 2 system_u:object_r:cupsd_etc_t root root 4096 Jan 16
>>>18:29 /usr/share/cups/banners/
>>>drwxr-xr-x 2 system_u:object_r:cupsd_etc_t root root 4096 Jan 16
>>>18:29 /usr/share/cups/model
>>>
>>>on my CentOS-4 system...they are different
>>># ls -Zld /usr/share/cups/model /usr/share/cups/banners/
>>>drwxr-xr-x 2 system_u:object_r:usr_t root root 4096 Dec 27
>>>07:12 /usr/share/cups/banners/
>>>drwxr-xr-x 2 system_u:object_r:usr_t root root 4096 Dec 27
>>>07:12 /usr/share/cups/model
>>
>>Everything under /usr/share/cups is system_u:object_r:cupsd_etc_t on my
>>FC4 boxes. What are the actual AVCs you're getting?
>>
>># ausearch -m avc,selinux_err
>
> ----
> for the purposes of brevity, I will only paste in the first
> record...there are probably as many returned as there are files in
> the /usr/share/cups tree like this...
>
> time->Mon Jan 16 16:33:00 2006
> type=PATH msg=audit(1137454380.947:5): item=0
> name="/usr/share/printconf/util" flags=1 inode=2 dev=03:02 mode=040755
> ouid=0 ogid=0 rdev=00:00
> type=CWD msg=audit(1137454380.947:5): cwd="/"
> type=SYSCALL msg=audit(1137454380.947:5): arch=40000003 syscall=195
> success=no exit=-13 a0=bfa5a5b6 a1=bfa5a9b8 a2=b1eff4 a3=b7ec890c
> items=1 pid=1974 aui
> d=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> comm="printconf-backe" exe="/usr/bin/python"
> type=AVC msg=audit(1137454380.947:5): avc: denied { read } for
> pid=1974 comm="printconf-backe" name="share" dev=hda2 ino=12
> scontext=system_u:system_r:
> cupsd_config_t tcontext=system_u:object_r:usr_t tclass=lnk_file
It seems to be having problems with your symlink. Could you try doing a
bind mount instead:
# mount --bind /home/share /usr/share
Paul.
18 years, 3 months
3rd party shared objects won't work without disabling SELinux
by Lonni J Friedman
Hello,
I'm working on an application that requires 3rd party (outside of what
ships with FC) shared libraries. With FC4, I'm not having any
problems. Up until just a few days ago, everything was working in
FC5-test2 as well.
However it seems that some update suddenly broke things in such a way
that unless I completely disable SELinux, I cannot load/access the
shared objects that I installed. When I attempt to do so, I get the
following error:
cannot enable executable stack as shared object requires: Permission denied
Can someone point out what SELinux foo I might be missing here?
thanks,
Lonni
18 years, 3 months
Fedora C-4
by Doug
On Jan. 22, 2006 I wrote: After upgrading from Fedora core3 to core4 my
Nero-linux would not open. I installed the selinux policy targeted
update and the Nero-linux problem was fixed but a new problem arose, now
my HP Device Manager will not open. I have reinstalled HPLIP, checked
everything I can find documented that might cause this and have resorted
to living with the problem. If anyone has a suggestion I would be
grateful for the help. dougdavidson(a)direcway.com
I have discovered through trial and error (not knowledge YET) my problem
can be fixed, by doing the following. Select in order; System Settings,
Security Level, Selinux, Modify Selinux Policy, Other, place a check in
(box)HPLIP_Disable_Trans.
Close and re-boot. Now HP Device Manager works and so does the Scanner.
Does anyone know what the consequence of this action might be, if
any? dougdavidson(a)direcway.com
18 years, 3 months
invalid context root:sysadm_r:initrc_t?
by dragoran
hello I found this errors in dmesg on a FC4 system using
selinux-policy-targeted-1.27.1-2.16:
audit(1137825680.353:2): security_compute_sid: invalid context
root:sysadm_r:initrc_t for scontext=root:sysadm_r:unconfined_t
tcontext=system_u:object_r:initrc_exec_t tclass=process
audit(1137825680.617:3): security_compute_sid: invalid context
root:sysadm_r:initrc_t for scontext=root:sysadm_r:unconfined_t
tcontext=system_u:object_r:initrc_exec_t tclass=process
what are this errors? what does invalid context means?
18 years, 3 months
new avcs
by Jason Dravet
After todays rawhide updates avahi and hal no longer start. Here are the
messages in the audit.log. I am running selinux-policy-targeted-2.2.2-1 in
enforcing mode. The other software is avahi-0.6.4-4 and hal-0.5.6-2.
Thanks,
Jason
----
time->Tue Jan 24 07:19:01 2006
type=PATH msg=audit(1138108741.041:9): item=0 name="/etc/blkid.tab"
flags=401 inode=2098656 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1138108741.041:9): cwd="/"
type=SYSCALL msg=audit(1138108741.041:9): arch=40000003 syscall=33
success=no exit=-13 a0=9676f08 a1=2 a2=98a164 a3=805cdc0 items=1 pid=1966
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="mount" exe="/bin/mount"
type=AVC msg=audit(1138108741.041:9): avc: denied { write } for pid=1966
comm="mount" name="blkid.tab" dev=dm-0 ino=2098656
scontext=system_u:system_r:mount_t:s0 tcontext=root:object_r:etc_t:s0
tclass=file
----
time->Tue Jan 24 07:19:05 2006
type=PATH msg=audit(1138108745.294:10): item=0 flags=1 inode=1212726
dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00
type=SOCKETCALL msg=audit(1138108745.294:10): nargs=3 a0=c a1=bf9e107a a2=21
type=SOCKADDR msg=audit(1138108745.294:10):
saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574
type=AVC_PATH msg=audit(1138108745.294:10):
path="/var/run/dbus/system_bus_socket"
type=SYSCALL msg=audit(1138108745.294:10): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bf9e1040 a2=f555d4 a3=1f items=1 pid=2096
auid=4294967295 uid=70 gid=70 euid=70 suid=70 fsuid=70 egid=70 sgid=70
fsgid=70 comm="avahi-daemon" exe="/usr/sbin/avahi-daemon"
type=AVC msg=audit(1138108745.294:10): avc: denied { connectto } for
pid=2096 comm="avahi-daemon" name="system_bus_socket"
scontext=system_u:system_r:avahi_t:s0 tcontext=system_u:system_r:initrc_t:s0
tclass=unix_stream_socket
----
time->Tue Jan 24 07:19:11 2006
type=PATH msg=audit(1138108751.178:11): item=0 flags=1 inode=1212726
dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00
type=SOCKETCALL msg=audit(1138108751.178:11): nargs=3 a0=3 a1=bfd631ca a2=21
type=SOCKADDR msg=audit(1138108751.178:11):
saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574
type=AVC_PATH msg=audit(1138108751.178:11):
path="/var/run/dbus/system_bus_socket"
type=SYSCALL msg=audit(1138108751.178:11): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bfd63190 a2=9d85d4 a3=1f items=1 pid=2127
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option"
type=AVC msg=audit(1138108751.178:11): avc: denied { connectto } for
pid=2127 comm="hald-add-selinu" name="system_bus_socket"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0
tclass=unix_stream_socket
----
time->Tue Jan 24 07:19:11 2006
type=PATH msg=audit(1138108751.310:12): item=0 flags=1 inode=1212726
dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00
type=SOCKETCALL msg=audit(1138108751.310:12): nargs=3 a0=3 a1=bf93bcba a2=21
type=SOCKADDR msg=audit(1138108751.310:12):
saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574
type=AVC_PATH msg=audit(1138108751.310:12):
path="/var/run/dbus/system_bus_socket"
type=SYSCALL msg=audit(1138108751.310:12): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bf93bc80 a2=65f5d4 a3=1f items=1 pid=2129
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option"
type=AVC msg=audit(1138108751.310:12): avc: denied { connectto } for
pid=2129 comm="hald-add-selinu" name="system_bus_socket"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0
tclass=unix_stream_socket
----
time->Tue Jan 24 07:19:11 2006
type=PATH msg=audit(1138108751.894:13): item=0 flags=1 inode=1212726
dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00
type=SOCKETCALL msg=audit(1138108751.894:13): nargs=3 a0=3 a1=bfa2b4fa a2=21
type=SOCKADDR msg=audit(1138108751.894:13):
saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574
type=AVC_PATH msg=audit(1138108751.894:13):
path="/var/run/dbus/system_bus_socket"
type=SYSCALL msg=audit(1138108751.894:13): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bfa2b4c0 a2=1805d4 a3=1f items=1 pid=2136
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="hald-add-selinu" exe="/usr/libexec/hald-add-selinux-mount-option"
type=AVC msg=audit(1138108751.894:13): avc: denied { connectto } for
pid=2136 comm="hald-add-selinu" name="system_bus_socket"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0
tclass=unix_stream_socket
----
time->Tue Jan 24 07:19:12 2006
type=PATH msg=audit(1138108752.022:14): item=0 flags=1 inode=1212726
dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00
type=SOCKETCALL msg=audit(1138108752.022:14): nargs=3 a0=d a1=bfaf0aba a2=21
type=SOCKADDR msg=audit(1138108752.022:14):
saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574
type=AVC_PATH msg=audit(1138108752.022:14):
path="/var/run/dbus/system_bus_socket"
type=SYSCALL msg=audit(1138108752.022:14): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bfaf0a80 a2=2e65d4 a3=1f items=1 pid=2107
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
comm="hald" exe="/usr/sbin/hald"
type=AVC msg=audit(1138108752.022:14): avc: denied { connectto } for
pid=2107 comm="hald" name="system_bus_socket"
scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:initrc_t:s0
tclass=unix_stream_socket
18 years, 3 months
Opening keynote annouce for SELinux Symposium
by Frank Mayer
For those of you planning to attend the SELinux Symposium, we just annouced
the opening keynote speaker. I've attached the press release below. Frank
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Opening Keynote Speaker Announced for the
Second Security-Enhanced Linux Symposium and Developer Summit
Baltimore, MD - (January 23, 2006) - Steve Walker, President of Steve Walker
& Associates and Managing Partner of Walker Ventures, will be the opening
keynote speaker for the second annual Security-Enhanced Linux (SELinux)
Symposium scheduled for February 27-March 3, 2006 in Baltimore, Maryland.
Mr. Walker has the unique experience of having participated in the evolution
of computer security over the past 35 years from its early research within
the U.S. Department of Defense (DoD) through its explosion into today's
world-wide products and services business. He is a 22-year veteran of the
DoD at the National Security Agency, the Advanced Research Projects Agency
and the Office of the Secretary of Defense. Mr. Walker was one of the elite
members of a team responsible for the development of the ARPAnet, the
legendary breakthrough messaging system that allowed the birth of the
Internet as we know it today. He is also nationally recognized for his
pioneering work on the DoD Computer Security Initiative and establishment of
the National Computer Security Center within the U.S.
In addition, Mr. Walker was the President and Chief Executive Officer of
Trusted Information Systems, Inc. (TIS), which he founded in 1983. Before
its purchase by Network Associates, TIS had become a publicly traded
company, employed more than 350 people, and had offices throughout the
world. Having its foundation in network security advanced research and
development, TIS was responsible for creating revolutionary technologies
including the world's most secure firewall, Gauntlet, and the first fully
exportable encryption, RecoverKey. Currently, Mr. Walker serves as President
of Steve Walker & Associates and Managing Partner of Walker Ventures, a
venture capital fund investing in early-stage technology companies.
Mr. Walker will present a keynote address entitled "The Road to Practical
Mandatory Security in Mainstream Operating Systems - an historical
perspective." In this address, Mr. Walker will share his insights on the
technological, political, and business challenges that have been overcome
the past 30+ years on the road to the practical mandatory access control
features SELinux brings to the mainstream.
About the SELinux Symposium
The Security-Enhanced Linux (SELinux) Symposium is an annual exchange of
ideas, technology, and research involving SELinux. SELinux is technology
that adds flexible, strong mandatory access control security to Linux. The
Second Symposium is scheduled for February 27-March 3, 2006 in Baltimore,
Maryland and is sponsored by Hewlett-Packard, IBM, Red Hat, Tresys
Technology, and Trusted Computer Solutions. The event brings together
experts from business, government, and academia to share research,
development, and application experiences using SELinux. For information on
registration and sponsorship opportunities, see www.selinux-symposium.org or
info(a)selinux-symposium.org.
18 years, 3 months
Latest rawhide: boot issue with avahi/hald/... ?
by Tom London
Running latest rawhide, targeted/permissive: (only --excude=totem\*)
Get the following from audit.log:
allow NetworkManager_t initrc_t:unix_stream_socket { acquire_svc connectto };
allow avahi_t initrc_t:unix_stream_socket connectto;
allow cupsd_config_t initrc_t:unix_stream_socket { acquire_svc
connectto send_msg };
allow dhcpc_t initrc_t:unix_stream_socket { acquire_svc connectto };
allow hald_t initrc_t:unix_stream_socket { acquire_svc connectto };
Seems to be problems accessing /var/run/dbus/system_bus_socket: avc's
imply file is initrc_t, but ls -lZ yields:
srwxrwxrwx root root system_u:object_r:system_dbusd_var_run_t
system_bus_socket
'messagebus' service did move earlier in startup sequence over the
weekend, but didn't seem to affect this.
Here are a few complete entries from audit.log
type=PATH msg=audit(01/23/2006 06:58:02.423:10) : item=0 flags=follow
inode=2142247 dev=fd:00 mode=socket,777 ouid=root ogid=root rdev=00:00
type=SOCKETCALL msg=audit(01/23/2006 06:58:02.423:10) : nargs=3 a0=c
a1=bf80d3aa a2=21
type=SOCKADDR msg=audit(01/23/2006 06:58:02.423:10) : saddr=local
/var/run/dbus/system_bus_socket
type=AVC_PATH msg=audit(01/23/2006 06:58:02.423:10) :
path=/var/run/dbus/system_bus_socket
type=SYSCALL msg=audit(01/23/2006 06:58:02.423:10) : arch=i386
syscall=socketcall(connect) success=yes exit=0 a0=3 a1=bf80d370
a2=4d55d4 a3=1f items=1 pid=2646 auid=unknown(4294967295) uid=avahi
gid=avahi euid=avahi suid=avahi fsuid=avahi egid=avahi sgid=avahi
fsgid=avahi comm=avahi-daemon exe=/usr/sbin/avahi-daemon
type=AVC msg=audit(01/23/2006 06:58:02.423:10) : avc: denied {
connectto } for pid=2646 comm=avahi-daemon name=system_bus_socket
scontext=system_u:system_r:avahi_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
type=PATH msg=audit(01/23/2006 06:58:02.879:15) : item=0 flags=follow
inode=2142247 dev=fd:00 mode=socket,777 ouid=root ogid=root rdev=00:00
type=SOCKETCALL msg=audit(01/23/2006 06:58:02.879:15) : nargs=3 a0=3
a1=bfbe580a a2=21
type=SOCKADDR msg=audit(01/23/2006 06:58:02.879:15) : saddr=local
/var/run/dbus/system_bus_socket
type=AVC_PATH msg=audit(01/23/2006 06:58:02.879:15) :
path=/var/run/dbus/system_bus_socket
type=SYSCALL msg=audit(01/23/2006 06:58:02.879:15) : arch=i386
syscall=socketcall(connect) success=yes exit=0 a0=3 a1=bfbe57d0
a2=2835d4 a3=1f items=1 pid=2658 auid=unknown(4294967295) uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=cups-config-dae exe=/usr/bin/cups-config-daemon
type=AVC msg=audit(01/23/2006 06:58:02.879:15) : avc: denied {
connectto } for pid=2658 comm=cups-config-dae name=system_bus_socket
scontext=system_u:system_r:cupsd_config_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket
----
tom
--
Tom London
18 years, 3 months
Re: Re: su, context(selinux?) 2nd prompt
by Rex Dieter
Maciej Żenczykowski wrote:
>>> Weird, I'm not seeing this...
>>
>> Are using an selinux-enabled CentOS 4.2 (or RHEL4U2) box?
>
> Yes, an up2date Centos 4.2 box with selinux at the default targeted value.
>
> However:
> $ su -
> Password:
> # selinuxenabled; echo $?
> 0
> # getenforce
> Enforcing
Interesting. All our boxes that show this behavior were installed
originally CentOS 4.1, and upgraded to 4.2. Further, my personal box is
only using selinux in permissive mode (too much breakage), but I still see
the second prompt.
-- Rex
18 years, 3 months
AVC funny msgs!
by Sebastián A. La Spina
This is an important avc? Im currently running my SE on permisive mode, im
not very sure to run it on enforcing . :(
audit(1138026282.862:2): avc: denied { compute_user } for pid=2166
comm="crond" scontext=system_u:system_r:crond_t
tcontext=system_u:object_r:security_t tclass=security
audit(1138026302.050:4): avc: denied { compute_user } for pid=2533
comm="gdm-binary" scontext=system_u:system_r:unconfined_t
tcontext=system_u:object_r:security_t tclass=security
audit(1138026456.531:6): avc: denied { compute_relabel } for pid=2702
comm="sshd" scontext=system_u:system_r:unconfined_t
tcontext=system_u:object_r:security_t tclass=security
Sorry for my litle English...
Good luck for all of yours!
Sebastián
18 years, 3 months
MCS article
by James Morris
If anyone wants to play with MCS, have a look at this article I just
posted:
"Getting Started with Multi-Category Security (MCS)"
http://james-morris.livejournal.com/8228.html
Feedback, suggestions etc. welcome.
- James
--
James Morris
<jmorris(a)namei.org>
18 years, 3 months