selinux patch breaks sudo NOEXEC capability
by Gene Czarcinski
This problem has been reported as
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178429 against
fc5test1/development although it exists in FC4 also (the sudo NOEXEC
capability was not available in FC3).
In sudo 1.6.8p8 and later (maybe a bit earlier too) adds a NOEXEC option. The
NOEXEC option is an important security feature since it suppresses a user's
ability to "shell out" of a program such as vi to get general root access.
When NOEXEC is working, you can use "sudo vi xxx" to edit file xxx but you
cannot shell out (e.g., ":!bash") from vi.
If the selinux patch to the sudo package is applied, then you get the message:
/usr/sbin/sesh: Error execing /bin/vi: Permission denied
and you cannot run vi (or anything) under sudo (when "Defaults noexec" is
specified in the /etc/sudoers file).
A very quick look at the code says that this will not be easy to fix since
sudo implements NOEXEC by dummying out the "exec" functions for the program
run by sudo. With the selinux patch applied, sudo invokes /usr/sbin/sesh
before invoking your program and sesh is using the dummied-out exec function.
Gene
18 years, 3 months
amrestore problem, still
by Stephen Walton
Hi,
Running FC4 pretty much out of the box. If you look at
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168136, you'll see
a bug I filed some time ago about conflicts with SELinux and amrecover.
The last comment there says "Fixed in selinux-policy-*-1.27.1-2.1" which
is true for that specific bug, but one still can't use amrecover because
of some problem with the index server amindexd. I've attached the audit
log below. The on disk copy of amindexd has context
system_u:object_r:amanda_inetd_exec_t.
Do I need to file another bug report on bugzilla?
type=AVC msg=audit(1137440126.806:65011): avc: denied { read write }
for pid=30860 comm="amindexd" name="[39498626]" dev=sockfs ino=39498626
scontext=system_u:system_r:amanda_t tcontext=system_u:system_r:inetd_t
tclass=tcp_socket
type=SYSCALL msg=audit(1137440126.806:65011): arch=40000003 syscall=11
success=yes exit=0 a0=8a39640 a1=8a39ab8 a2=8a3ee88 a3=bfe6b964 items=2
pid=30860 auid=4294967295 uid=33 gid=6 euid=33 suid=33 fsuid=33 egid=6
sgid=6 fsgid=6 comm="amindexd" exe="/usr/lib/amanda/amindexd"
type=AVC_PATH msg=audit(1137440126.806:65011): path="socket:[39498626]"
type=CWD msg=audit(1137440126.806:65011): cwd="/"
type=PATH msg=audit(1137440126.806:65011): item=0
name="/usr/lib/amanda/amindexd" flags=101 inode=776533 dev=fd:03
mode=0100755 ouid=33 ogid=6 rdev=00:00
type=PATH msg=audit(1137440126.806:65011): item=1 flags=101 inode=89458
dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1137440126.862:65012): avc: denied { getattr } for
pid=30860 comm="amindexd" laddr=127.0.0.1 lport=10082 faddr=127.0.0.1
fport=521 scontext=system_u:system_r:amanda_t
tcontext=system_u:system_r:inetd_t tclass=tcp_socket
type=SYSCALL msg=audit(1137440126.862:65012): arch=40000003 syscall=102
success=yes exit=0 a0=7 a1=bf9f4110 a2=aea498 a3=0 items=0 pid=30860
auid=4294967295 uid=33 gid=6 euid=33 suid=33 fsuid=33 egid=6 sgid=6
fsgid=6 comm="amindexd" exe="/usr/lib/amanda/amindexd"
type=SOCKETCALL msg=audit(1137440126.862:65012): nargs=3 a0=0
a1=bf9f4254 a2=bf9f4268
18 years, 3 months
Stopping SELinux
by Timothy Murphy
Sorry to be a bore,
but how does one stop selinux running?
Is it sufficient to set "SELINUX=disabled"
in /etc/selinux/config ?
[I'm afraid since I started running selinux
I've been having problems with my WiFi network -
quite likely nothing to do with SELinux,
but all the same I'd like to make sure it is not running
during diagnostics.
I have made the setting above,
but still seem to get messages about selinux in /var/log/messages .
Is there any process I should kill ?]
--
Timothy Murphy
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
18 years, 3 months
SELinux Symposium WiPs, BoFs, and Case Studies Reminder
by Joshua Brindle
This is a reminder to submit WiPs, BoFs, and Case Studies for the 2006
SELinux symposium. If you have interesting information about SELinux
that is not already part of the agenda, please consider submitting
something.
The deadline for case studies and WiPs is February 1. The deadline for
BoFs is February 15. There is limited space for all three. Accepted
presenters will be notified by email and the final schedule will be
placed on the website and posted at the conference.
SELinux Case Studies
Case studies are an opportunity to present lessons-learned and success
stories about deployed, SELinux-based enterprise solutions and/or
SELinux-based products. There is time for 2-3 case studies with
presentations of 20-30 minutes with no formal paper required. Interested
parties can submit case studies to chair(a)selinux-symposium.org. Please
include a title, no more than one-page description of the case study,
participating organizations, and contact information for the presenters.
Work-in-Progress Reports (WiPs)
WiPs are an opportunity to present emerging projects and technologies to
the community in short presentations. The presentations usually cover
works-in-progress, new results, status updates, or timely topics. There
is time for 6-8 WiPs with presentations of 10 - 15 minutes with no
formal paper required. Speakers should submit the title of the
presentation, a one paragraph abstract, and a brief speaker bio to
chair(a)selinux-symposium.org.
Birds-of-a-Feather Sessions (BoFs)
BoFs are an opportunity to have an informal gathering of community
members interested in a particular topic. BoFs often include a brief
presentation or demonstration followed by discussion. There is time for
4 BoFs of 45 minutes each. BoFs will be scheduled during the Symposium
reception. Interested parties can submit suggestions for BoFs to
chair(a)selinux-symposium.org. Please include a title, brief description
of the topic, and contact information for the organizer.
18 years, 3 months
[ANN] SELinux Policy Editor 1.3.1
by Yuichi Nakamura
Hi.
SELinux Policy Editor 1.3.1 has been released.
About SELinux Policy Editor, visit http://seedit.sourceforge.net/
(1) Notice
This release includes Simplified Policy only.
GUI is not included, it will be re-developped.
It is development version, may be unstable.
And tested only in Fedora Core4.
(2) Changes
* audit2spdl utility
It works like audit2allow, generates simplified policy from log.
You do not have to remember detail of simplified policy syntax.
* Detailed permission for files support
For users who want more security, new permission a(Append),t(seTattr),
c(Create), e(Erace),o(Overwrite) can be used.
* Documentation
Documentation about what permissions are integrated, unsupported by simplified policy is prepared.
Verifying security of Simplified Policy has become easier.
See http://seedit.sourceforge.net/doc/permission_integrate/
* Generation of above document using XML/Python
(3) How to use
First get seedit-converter-1.3.1-1.i386.rpm and seedit-policy-1.3.1-FC4.noarch.rpm from
http://sourceforge.net/project/showfiles.php?group_id=135756
How to install is the same as 1.2,
see http://seedit.sourceforge.net/doc/install/INSTALL.html
For detail, see manual at http://seedit.sourceforge.net/doc_devel/simplified_policy_manual/
(4) Plan
- XML support to be handled easily by UI tools
- New GUI
- Review security of simplified policy, prepare document
If you have question, comment, suggestion and others,
please feel free to send me e-mail(ynakam(a)gwu.edu).
-----
Yuichi Nakamura
Japan SELinux Users Group(JSELUG)
SELinux Policy Editor: http://seedit.sourceforge.net/
18 years, 3 months
rawhide avcs...(hostname, restorecon)
by Tom London
Avcs from today's rawhide (selinux-policy-targeted-2.1.10-1) (enforcing):
>From /var/log/messages:
Jan 14 09:27:16 localhost kernel: SELinux: initialized (dev sysfs,
type sysfs), uses genfs_contexts
Jan 14 09:27:16 localhost kernel: audit(1137230757.160:2): avc:
denied { read write } for pid=400 comm="hostname" name="console"
dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0
tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
Jan 14 09:27:16 localhost kernel: audit(1137230757.160:3): avc:
denied { read write } for pid=400 comm="hostname" name="console"
dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0
tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
Jan 14 09:27:16 localhost kernel: audit(1137230757.160:4): avc:
denied { read write } for pid=400 comm="hostname" name="console"
dev=tmpfs ino=560 scontext=system_u:system_r:hostname_t:s0
tcontext=system_u:object_r:tmpfs_t:s0 tclass=chr_file
Jan 14 09:27:16 localhost kernel: SELinux: initialized (dev usbfs,
type usbfs), uses genfs_contexts
Jan 14 09:27:16 localhost kernel: audit(1137230758.780:5): avc:
denied { write } for pid=413 comm="restorecon" name="[987]"
dev=pipefs ino=987 scontext=system_u:system_r:restorecon_t:s0
tcontext=system_u:system_r:restorecon_t:s0 tclass=fifo_file
Jan 14 09:27:16 localhost kernel: audit(1137230758.780:6): avc:
denied { read } for pid=412 comm="restorecon" name="[987]"
dev=pipefs ino=987 scontext=system_u:system_r:restorecon_t:s0
tcontext=system_u:system_r:restorecon_t:s0 tclass=fifo_file
Jan 14 09:27:16 localhost kernel: hw_random hardware driver 1.0.0 loaded
--
Tom London
18 years, 3 months
Denied { search } mingetty and can't log in
by Emeric Maschino
Hi,
I've just installed a clean Fedora Core development IA-64 (Itanium
systems) on the second HDD of my hp workstation zx6000. During the
installation of selinux-policy-targeted 2.1.7-3, the following messages
are recorded in the logs. I don't know if they're relevant to my problem
with mingetty however (see below):
libsemanage.dbase_policydb_list: out of memory
libsemanage.semanage_exec_prog: Child process /usr/sbin/genhomedircon
did not exit cleanly.
libsemanage.semanage_install_sandbox: genhomedircon returned error code
-1.
semodule: Failed!
Forcing reinstall or trying to install a different policy (e.g. selinux-
policy-mls) gives the same result.
At reboot, I can't log in to my system because of something going wrong
with mingetty. The following line is repeated a huge number of times:
avc: denied { search } for pid=553 comm="mingetty" name="/" dev=tmpfs
ino=977 scontext=system_u:system_r:getty_t:s0
tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
Relabeling the whole file system with touch /.autorelabel or fixfiles
relabel didn't help.
Sure, I can log in in permissive mode. I can't see the message regarding
mingetty, but I'm getting a few other denials. If it can help
understanding what's going wrong, here they are:
avc: denied { execmod } for pid=380 comm="rc.sysinit" name="bash"
dev=dm-0 ino=3371812 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
avc: denied { execmod } for pid=389 comm="awk" name="gawk" dev=dm-0
ino=3371818 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
avc: denied { execmod } for pid=409 comm="start_udev" name="bash"
dev=dm-0 ino=3371812 scontext=system_u:system_r:udev_t:s0-s0:c0.c255
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
avc: denied { execmod } for pid=412 comm="awk" name="gawk" dev=dm-0
ino=3371818 scontext=system_u:system_r:udev_t:s0-s0:c0.c255
tcontext=system_u:object_r:bin_t:s0 tclass=file
avc: denied { execmod } for pid=559 comm="sh" name="bash" dev=dm-0
ino=3371812 scontext=system_u:system_r:insmod_t:s0-s0:c0.c255
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
avc: denied { execmod } for pid=1519 comm="S10network" name="bash"
dev=dm-0 ino=3371812 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
avc: denied { execmod } for pid=1607 comm="awk" name="gawk" dev=dm-0
ino=3371818 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
avc: denied { execmod } for pid=1728 comm="dhclient-script"
name="bash" dev=dm-0 ino=3371812 scontext=system_u:system_r:dhcpc_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
avc: denied { execmod } for pid=1741 comm="awk" name="gawk" dev=dm-0
ino=3371818 scontext=system_u:system_r:dhcpc_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
I'm running kernel 2.6.15-1.1826.2.5_FC5 with the following SELinux
components: checkpolicy 1.28-4, libselinux 1.29.4-1, libsepol 1.11.7-1,
libsetrans 0.1.15-1, selinux-policy 2.1.7-3 and selinux-policy-targeted
2.1.7-3 (hope I don't forget one).
If I can try something to help correct these problems on the IA-64
architecture, just let me know.
Thanks,
Émeric
18 years, 3 months
Selinux Audit in FC 4
by symphony
Hi, i'm beginner in Selinux and FC4.
I read in the FAQ of the site of the fedora that needs to qualify the
audit in kernel, somebody I can say me as to make this?
Exists some tools that it tests the eficiencia of the SELinux in the FC4?
Thanks
18 years, 3 months
logwatch avcs
by Tom London
Running latest rawhide (selinux-policy-targeted-2.1.9-2), targeted/enforcing.
Should sbin_t:lnk_file included in corecmd_read_sbin_file(), ....?
type=PATH msg=audit(01/13/2006 07:39:38.361:43) : item=0 name=/selinux
flags=follow inode=327 dev=00:0d mode=dir,755 ouid=root ogid=root
rdev=00:00
type=CWD msg=audit(01/13/2006 07:39:38.361:43) : cwd=/
type=AVC_PATH msg=audit(01/13/2006 07:39:38.361:43) : path=/selinux
type=SYSCALL msg=audit(01/13/2006 07:39:38.361:43) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=8afdf68
a1=8aa20c8 a2=ae8ff4 a3=8afdf68 items=1 pid=3926
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=perl exe=/usr/bin/perl
type=AVC msg=audit(01/13/2006 07:39:38.361:43) : avc: denied {
getattr } for pid=3926 comm=perl name=/ dev=selinuxfs ino=327
scontext=system_u:system_r:logwatch_t:s0
tcontext=system_u:object_r:security_t:s0 tclass=dir
----
type=PATH msg=audit(01/13/2006 07:39:40.729:44) : item=0
name=/usr/sbin/ntpd flags=follow inode=135413 dev=fd:00 mode=file,755
ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/13/2006 07:39:40.729:44) : cwd=/
type=AVC_PATH msg=audit(01/13/2006 07:39:40.729:44) : path=/usr/sbin/ntpd
type=SYSCALL msg=audit(01/13/2006 07:39:40.729:44) : arch=i386
syscall=stat64 success=no exit=-13(Permission denied) a0=9c7bf68
a1=9c200c8 a2=ae8ff4 a3=9c7bf68 items=1 pid=4198
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=perl exe=/usr/bin/perl
type=AVC msg=audit(01/13/2006 07:39:40.729:44) : avc: denied {
getattr } for pid=4198 comm=perl name=ntpd dev=dm-0 ino=135413
scontext=system_u:system_r:logwatch_t:s0
tcontext=system_u:object_r:ntpd_exec_t:s0 tclass=file
----
type=PATH msg=audit(01/13/2006 07:39:41.081:45) : item=0
name=/usr/sbin/sendmail flags=follow,open inode=130890 dev=fd:00
mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(01/13/2006 07:39:41.081:45) : cwd=/
type=SYSCALL msg=audit(01/13/2006 07:39:41.081:45) : arch=i386
syscall=execve success=no exit=-13(Permission denied) a0=8057d63
a1=87d3604 a2=bfa400c8 a3=87d3604 items=1 pid=4213
auid=unknown(4294967295) uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root comm=mail exe=/bin/mail
type=AVC msg=audit(01/13/2006 07:39:41.081:45) : avc: denied { read
} for pid=4213 comm=mail name=sendmail dev=dm-0 ino=138949
scontext=system_u:system_r:logwatch_t:s0
tcontext=system_u:object_r:sbin_t:s0 tclass=lnk_file
--
Tom London
18 years, 3 months
Adjusting FC4 targetted policy to fix avc errors on bugzilla cgi scripts?
by Graham King
Please can you help with my first, naive, attempt to fix an selinux
problem?
Following a recent yum update of a Fedora Core 4 machine, bugzilla no
longer works.
audit.log contained:
avc: denied { execute_no_trans } for pid=811 comm="httpd"
name="index.cgi" dev=dm-3 ino=227397 scontext=root:system_r:httpd_t
tcontext=root:object_r:httpd_sys_content_t tclass=file
sestatus outputs:
...
httpd_enable_cgi active
...
But ls -Z /var/www/html/bugzilla-2.18.3/index.cgi showed that file to be
of type httpd_sys_content_t, so I inferred that it needed to be changed
to httpd_sys_script_exec_t.
In order for the change to persist across relabelling events, I first
tried to alter the policy by adding the following line
to /etc/linux/targetted/src/policy/file_contexts/file_contexts:
/var/www/html/bugzilla-[^/]*/[^/]*\.cgi --
system_u:object_r:httpd_sys_script_exec_t
and then ran:
cd /etc/linux/targetted/src/policy
make reload
make relabel
( first with setenforce 1, then with setenforce 0 )
The ls -Z output was unchanged, so I then ran:
chcon -t httpd_sys_script_exec_t /var/www/html/bugzilla-2.18.3/index.cgi
audit.log is however still showing the same error (adjusted for the new
tcontext type).
What am I doing wrong?
kind regards
-- Graham King
18 years, 3 months