suspend, ntpd and hald....
by Tom London
Running latest rawhide, targeted/enforcing.
Testing the 'you don't need shutdown, suspend is just fine' item in
the System menu, I get this when I resume:
----
type=PATH msg=audit(02/19/2006 08:52:46.096:18) : item=1
flags=follow,open inode=1045689 dev=fd:00 mode=file,755 ouid=root
ogid=root rdev=00:00
type=PATH msg=audit(02/19/2006 08:52:46.096:18) : item=0
name=/usr/sbin/ntpdate flags=follow,open inode=5802372 dev=fd:00
mode=file,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(02/19/2006 08:52:46.096:18) : cwd=/
type=AVC_PATH msg=audit(02/19/2006 08:52:46.096:18) : path=/dev/null
type=SYSCALL msg=audit(02/19/2006 08:52:46.096:18) : arch=i386
syscall=execve success=yes exit=0 a0=9582458 a1=9583320 a2=95841b0
a3=9583838 items=2 pid=3169 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=ntpdate exe=/usr/sbin/ntpdate
type=AVC msg=audit(02/19/2006 08:52:46.096:18) : avc: denied { use }
for pid=3169 comm=ntpdate name=null dev=tmpfs ino=1151
scontext=system_u:system_r:ntpd_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=fd
----
type=PATH msg=audit(02/19/2006 08:53:01.082:19) : item=1
flags=follow,open inode=1045689 dev=fd:00 mode=file,755 ouid=root
ogid=root rdev=00:00
type=PATH msg=audit(02/19/2006 08:53:01.082:19) : item=0
name=/usr/sbin/ntpd flags=follow,open inode=5791501 dev=fd:00
mode=file,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(02/19/2006 08:53:01.082:19) : cwd=/
type=AVC_PATH msg=audit(02/19/2006 08:53:01.082:19) : path=/dev/null
type=AVC_PATH msg=audit(02/19/2006 08:53:01.082:19) : path=/dev/null
type=AVC_PATH msg=audit(02/19/2006 08:53:01.082:19) : path=/dev/null
type=SYSCALL msg=audit(02/19/2006 08:53:01.082:19) : arch=i386
syscall=execve success=yes exit=0 a0=8a74750 a1=8a74a60 a2=8a74c88
a3=8a746b0 items=2 pid=3172 auid=unknown(4294967295) uid=root gid=root
euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=ntpd exe=/usr/sbin/ntpd
type=AVC msg=audit(02/19/2006 08:53:01.082:19) : avc: denied { use }
for pid=3172 comm=ntpd name=null dev=tmpfs ino=1151
scontext=system_u:system_r:ntpd_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=fd
type=AVC msg=audit(02/19/2006 08:53:01.082:19) : avc: denied { use }
for pid=3172 comm=ntpd name=null dev=tmpfs ino=1151
scontext=system_u:system_r:ntpd_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=fd
type=AVC msg=audit(02/19/2006 08:53:01.082:19) : avc: denied { use }
for pid=3172 comm=ntpd name=null dev=tmpfs ino=1151
scontext=system_u:system_r:ntpd_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=fd
Not quite sure I understand this.... a file descriptor leak?
tom
--
Tom London
18 years, 2 months
/sbin/restorecon and hard links
by Erik Sjölund
[root@e /]# cat /etc/redhat-release
Fedora Core release 4 (Stentz)
[root@e /]# adduser erik
[root@e /]# su - erik
[erik@e ~]$ ln /etc/passwd .
[erik@e ~]$ exit
[root@e /]# ls -lZ /etc/passwd
-rw-r--r-- root root system_u:object_r:etc_t /etc/passwd
[root@e /]# restorecon -R /home
[root@e /]# ls -lZ /etc/passwd
-rw-r--r-- root root user_u:object_r:user_home_t /etc/passwd
Should it be like that?
/sbin/restorecon -R /home
might lead to strange security contexts for files belonging to root.
cheers,
Erik
18 years, 2 months
[PATCH] fix and enhance openssh-selinux patch
by Jan Kiszka
[resent as my previous post from an unsubscribed address didn't mad it]
Hi,
hope I'm on the right list for submitting patches:
The attached one is an add-on to the openssh-selinux patch revision
1.17. It fixes the compilation without selinux support (gcc4 complained
about redefinitions of the selinux stubs) and extends the --with-selinux
configure switch by the libselinux installation path (useful for
cross-compiling).
Jan
diff -u openssh-4.2p1/configure.ac openssh-4.2p1/configure.ac
--- openssh-4.2p1/configure.ac 2005-10-18 15:50:12.000000000 -0400
+++ openssh-4.2p1/configure.ac 2005-10-18 15:50:12.000000000 -0400
@@ -2671,8 +2671,16 @@
SELINUX_MSG="no"
LIBSELINUX=""
AC_ARG_WITH(selinux,
- [ --with-selinux Enable SELinux support],
+ [ --with-selinux[[=LIBSELINUX-PATH]] Enable SELinux support],
[ if test "x$withval" != "xno" ; then
+ if test "x$withval" != "xyes"; then
+ CPPFLAGS="$CPPFLAGS -I${withval}/include"
+ if test -n "${need_dash_r}"; then
+ LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
+ else
+ LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+ fi
+ fi
AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
SELINUX_MSG="yes"
AC_CHECK_HEADERS(selinux.h)
diff -u openssh-4.2p1/selinux.h openssh-4.2p1/selinux.h
--- openssh-4.2p1/selinux.h 2005-10-18 15:50:12.000000000 -0400
+++ openssh-4.2p1/selinux.h 2005-10-18 15:50:12.000000000 -0400
@@ -5,6 +5,6 @@
extern void setup_selinux_exec_context(const char *name);
#else
-inline void setup_selinux_pty(const char *name, const char *tty) {}
-inline void setup_selinux_exec_context(const char *name) {}
+static inline void setup_selinux_pty(const char *name, const char *tty) {}
+static inline void setup_selinux_exec_context(const char *name) {}
#endif /* WITH_SELINUX */
#endif /* __SELINUX_H_ */
18 years, 2 months
More FC5 AVCs
by Nicolas Mailhot
Hi,
I've attached a new AVC report at :
https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=124742
to
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172088
This is generated on a clean up-to-date rawhide system. This late in the
game you'd expect everything to be mostly fixed (it did look like this a
few days ago) but unfortunately it isn't. A lot of long-known problems
rear their ugly heads again. It's almost as if the selinux policies
where OK but the system labelling was degenerating over time.
The log was generated after 5 min of uptime max. I expect I haven't hit
yet the rest of the problems (and I won't - I need some of the blocked
apps so it's setenforce 0 from now on)
Regards,
--
Nicolas Mailhot
18 years, 2 months
dispatch.fcgi aka fastcgi
by Craig White
trying to work with ruby on rails and apache w/ fastcgi and implementing
fastcgi has left me with a real problem with all sorts of things...I'm
thinking that it just might be best to give fastcgi a get out of jail
free card (how do I do that?)
This was only a click or two...there's no telling how many I can get by
trying to use the thing (which of course seems pointless since it is
denying me access to things like my css files so it looks like hell
too...
Feb 14 01:37:19 srv2 kernel: audit(1139906239.590:47): avc: denied
{ search } for pid=28974 comm="dispatch.fcgi" name="ruby-db" dev=dm-1
ino=1212642 scontext=root:system_r:htt
pd_sys_script_t tcontext=user_u:object_r:user_home_t tclass=dir
Feb 14 01:37:19 srv2 kernel: audit(1139906239.591:48): avc: denied
{ read } for pid=28974 comm="dispatch.fcgi" name="environment.rb"
dev=dm-1 ino=1212686 scontext=root:system_
r:httpd_sys_script_t tcontext=user_u:object_r:user_home_t tclass=file
Feb 14 01:37:19 srv2 kernel: audit(1139906239.591:49): avc: denied
{ getattr } for pid=28974 comm="dispatch.fcgi" name="environment.rb"
dev=dm-1 ino=1212686 scontext=root:syst
em_r:httpd_sys_script_t tcontext=user_u:object_r:user_home_t tclass=file
Feb 14 01:37:21 srv2 kernel: audit(1139906241.708:50): avc: denied
{ getattr } for pid=28974 comm="dispatch.fcgi" name="models" dev=dm-1
ino=1212648 scontext=root:system_r:htt
pd_sys_script_t tcontext=user_u:object_r:user_home_t tclass=dir
Feb 14 01:37:21 srv2 kernel: audit(1139906241.709:51): avc: denied
{ read } for pid=28974 comm="dispatch.fcgi" name="models" dev=dm-1
ino=1212648 scontext=root:system_r:httpd_
sys_script_t tcontext=user_u:object_r:user_home_t tclass=dir
Feb 14 01:37:21 srv2 kernel: audit(1139906241.727:52): avc: denied
{ append } for pid=28974 comm="dispatch.fcgi" name="production.log"
dev=dm-1 ino=1212718 scontext=root:syste
m_r:httpd_sys_script_t tcontext=user_u:object_r:user_home_t tclass=file
Feb 14 01:37:21 srv2 kernel: audit(1139906241.781:53): avc: denied
{ getattr } for pid=28974 comm="dispatch.fcgi" name="fastcgi.crash.log"
dev=dm-1 ino=1215942 scontext=root:s
ystem_r:httpd_sys_script_t tcontext=root:object_r:user_home_t
tclass=file
Feb 14 01:37:21 srv2 kernel: audit(1139906241.781:54): avc: denied
{ append } for pid=28974 comm="dispatch.fcgi" name="fastcgi.crash.log"
dev=dm-1 ino=1215942 scontext=root:sy
stem_r:httpd_sys_script_t tcontext=root:object_r:user_home_t tclass=file
Feb 14 01:37:21 srv2 kernel: audit(1139906241.784:55): avc: denied
{ getattr } for pid=28974 comm="dispatch.fcgi"
name="258e9c185bb365445884d61bf2121a01" scontext=root:system_
r:httpd_sys_script_t tcontext=root:system_r:httpd_t
tclass=unix_stream_socket
Feb 14 01:37:21 srv2 kernel: audit(1139906241.784:56): avc: denied
{ accept } for pid=28974 comm="dispatch.fcgi"
name="258e9c185bb365445884d61bf2121a01" scontext=root:system_r
:httpd_sys_script_t tcontext=root:system_r:httpd_t
tclass=unix_stream_socket
Feb 14 01:37:22 srv2 kernel: audit(1139906242.315:57): avc: denied
{ shutdown } for pid=28974 comm="dispatch.fcgi"
name="258e9c185bb365445884d61bf2121a01" scontext=root:system
_r:httpd_sys_script_t tcontext=root:system_r:httpd_t
tclass=unix_stream_socket
18 years, 2 months
risk of losing httpd_user_script_exec_t labels?
by Erik Sjölund
If I inactivate httpd_unified and start using httpd_user_script_exec_t
and httpd_user_script_rw_t in /home/erik/public_html, will those
labels get lost (i.e reverted to httpd_user_content_t ) if I run
"/sbin/fixfiles relabel"?
What I'm more concerned of is if a
"yum update selinux-policy-targeted"
could force a relabeling and therefore loss of httpd_user_script_rw_t labels?
A quick test shows that /sbin/restorecon converts httpd_user_script_rw_t to
httpd_user_content_t.
Though, I haven't tried "sbin/fixfiles relabel" yet.
[erik@www ~]$ cd ~/public_html
[erik@www public_html]$ chcon user_u:object_r:httpd_user_script_exec_t
script.cgi
[erik@www public_html]$ ls -lZ script.cgi
-rwxr-xr-x erik others user_u:object_r:httpd_user_script_exec_t script.cgi
[erik@www public_html]$ /sbin/restorecon script.cgi
[erik@www public_html]$ ls -lZ script.cgi
-rwxr-xr-x erik others system_u:object_r:httpd_user_content_t script.cgi
[erik@www public_html]$ /usr/sbin/getsebool -a | grep unifi
httpd_unified --> inactive
cheers,
Erik Sjölund
18 years, 2 months
Need help with moving the data directory of Postgresql
by Markus Lindholm
Hi
I have a FC4 box (all updates applied) on which I have a Postgresql server
(standard fedora rpms) and I'm running targeted selinux policy.
The problem is that I cannot move the data directory away from
/var/lib/pgsql/data with out turning selinux off.
Is there any HOWTOs out there that would be helpful?
I've tried using chcon so that the permission would be identical between the
new and the old
[root@zeus ~]# ls -ldZ /var/lib/pgsql/data/
drwx------ postgres postgres system_u:object_r:postgresql_db_t
/var/lib/pgsql/data/
[root@zeus ~]# ls -lZd /mnt/raid/db/pgsql/data/
drwx------ postgres postgres system_u:object_r:postgresql_db_t
/mnt/raid/db/pgsql/data/
But I still get permission denied when I try to start postgresql !! If I
mark the "Disable SELinux protection for Postgresql daemon" in the SELinux
GUI, then it starts up fine.
But what would be the correct way to handle this?
/markus
18 years, 2 months
todays avc messages
by Jason Dravet
Here are some avc messages from todays rawhide. I have tried a relabel and
I still get these and more avcs in my audit.log. Hal does not work because
of the last entry.
Thanks,
Jason
time->Tue Feb 14 08:05:00 2006
type=PATH msg=audit(1139925900.906:54): item=1 flags=101 inode=393231
dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1139925900.906:54): item=0 name="/sbin/auditctl"
flags=101 inode=655430 dev=fd:00 mode=0100750 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1139925900.906:54): cwd="/"
type=AVC_PATH msg=audit(1139925900.906:54): path="/ptmx"
type=SYSCALL msg=audit(1139925900.906:54): arch=40000003 syscall=11
success=yes exit=0 a0=90d5f80 a1=90d5f18 a2=90dacd8 a3=90d5d88 items=2
pid=1683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="auditctl" exe="/sbin/auditctl"
type=AVC msg=audit(1139925900.906:54): avc: denied { use } for pid=1683
comm="auditctl" name="ptmx" dev=tmpfs ino=641
scontext=system_u:system_r:auditctl_t:s0
tcontext=system_u:system_r:kernel_t:s0 tclass=fd
----
time->Tue Feb 14 08:05:01 2006
type=PATH msg=audit(1139925901.154:56): item=1 flags=101 inode=393231
dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1139925901.154:56): item=0 name="/sbin/syslogd"
flags=101 inode=655490 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1139925901.154:56): cwd="/"
type=AVC_PATH msg=audit(1139925901.154:56): path="/ptmx"
type=SYSCALL msg=audit(1139925901.154:56): arch=40000003 syscall=11
success=yes exit=0 a0=9e89ad0 a1=9e8a0c0 a2=9e89fc8 a3=9e89a40 items=2
pid=1692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="syslogd" exe="/sbin/syslogd"
type=AVC msg=audit(1139925901.154:56): avc: denied { use } for pid=1692
comm="syslogd" name="ptmx" dev=tmpfs ino=641
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:kernel_t:s0 tclass=fd
----
time->Tue Feb 14 08:05:01 2006
type=PATH msg=audit(1139925901.366:57): item=1 flags=101 inode=393231
dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1139925901.366:57): item=0 name="/sbin/klogd" flags=101
inode=655480 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1139925901.366:57): cwd="/"
type=AVC_PATH msg=audit(1139925901.366:57): path="/ptmx"
type=SYSCALL msg=audit(1139925901.366:57): arch=40000003 syscall=11
success=yes exit=0 a0=904bb10 a1=904c060 a2=904bf70 a3=904b9c8 items=2
pid=1695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="klogd" exe="/sbin/klogd"
type=AVC msg=audit(1139925901.366:57): avc: denied { use } for pid=1695
comm="klogd" name="ptmx" dev=tmpfs ino=641
scontext=system_u:system_r:klogd_t:s0 tcontext=system_u:system_r:kernel_t:s0
tclass=fd
----
time->Tue Feb 14 09:18:05 2006
type=SYSCALL msg=audit(1139930285.404:256): arch=40000003 syscall=206
success=no exit=-1 a0=1 a1=9ec2338 a2=351ff4 a3=1 items=0 pid=3426 auid=0
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="hald"
exe="/usr/sbin/hald"
type=AVC msg=audit(1139930285.404:256): avc: denied { setgid } for
pid=3426 comm="hald" capability=6 scontext=root:system_r:hald_t:s0
tcontext=root:system_r:hald_t:s0 tclass=capability
18 years, 2 months
postfix AVCs
by fedora@synersoft.be
Hello All,
Using targeted policies 1.27.1-2.18 with postfix-2.2.2-2 on FC4.
I receive lots of AVCs related to postfix (here is one regarding postdrop, but
I have also 'sendmail.postfix', 'cleanup' and 'spamc' related AVCs) :
type=AVC msg=audit(1139803214.270:14817): avc: denied { getattr } for
pid=14521 comm="postdrop" name="pickup" dev=hda2 ino=6193158
scontext=root:system_r:postfix_pipe_t
tcontext=system_u:object_r:postfix_public_t tclass=fifo_file
type=SYSCALL msg=audit(1139803214.270:14817): arch=c000003e syscall=4
success=yes exit=0 a0=62cf28 a1=7fffffb60270 a2=7fffffb60270 a3=2aaaaaaab000
items=1 pid=14521 auid=500 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=90
sgid=90 fsgid=90 comm="postdrop" exe="/usr/sbin/postdrop"
type=AVC_PATH msg=audit(1139803214.270:14817):
path="/var/spool/postfix/public/pickup"
type=CWD msg=audit(1139803214.270:14817): cwd="/var/spool/postfix"
type=PATH msg=audit(1139803214.270:14817): item=0 name="public/pickup" flags=1
inode=6193158 dev=03:02 mode=010622 ouid=89 ogid=89 rdev=00:00
type=AVC msg=audit(1139803214.270:14818): avc: denied { write } for
pid=14521 comm="postdrop" name="pickup" dev=hda2 ino=6193158
scontext=root:system_r:postfix_pipe_t
tcontext=system_u:object_r:postfix_public_t tclass=fifo_file
type=SYSCALL msg=audit(1139803214.270:14818): arch=c000003e syscall=2
success=yes exit=4 a0=62cf28 a1=801 a2=0 a3=2aaaaaaab000 items=1 pid=14521
auid=500 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=90 sgid=90 fsgid=90
comm="postdrop" exe="/usr/sbin/postdrop"
type=CWD msg=audit(1139803214.270:14818): cwd="/var/spool/postfix"
type=PATH msg=audit(1139803214.270:14818): item=0 name="public/pickup"
flags=101 inode=6193158 dev=03:02 mode=010622 ouid=89 ogid=89 rdev=00:00
Any explanation ?
If a known bug, could someone post a working postfix.fc/postfix.te set ?
TIA
======================
PS:sorry for the double posting. the first was erroneously 'in-reply-to'
another message. it would be a pity that someone miss my interesting message
because of threads filtering ;-)
18 years, 2 months
postfix AVCs
by fedora@synersoft.be
Hello All,
Using targeted policies 1.27.1-2.18 with postfix-2.2.2-2 on FC4.
I receive lots of AVCs related to postfix (here is one regarding postdrop, but
I have also 'sendmail.postfix', 'cleanup' and 'spamc' related AVCs) :
type=AVC msg=audit(1139803214.270:14817): avc: denied { getattr } for
pid=14521 comm="postdrop" name="pickup" dev=hda2 ino=6193158
scontext=root:system_r:postfix_pipe_t
tcontext=system_u:object_r:postfix_public_t tclass=fifo_file
type=SYSCALL msg=audit(1139803214.270:14817): arch=c000003e syscall=4
success=yes exit=0 a0=62cf28 a1=7fffffb60270 a2=7fffffb60270 a3=2aaaaaaab000
items=1 pid=14521 auid=500 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=90
sgid=90 fsgid=90 comm="postdrop" exe="/usr/sbin/postdrop"
type=AVC_PATH msg=audit(1139803214.270:14817):
path="/var/spool/postfix/public/pickup"
type=CWD msg=audit(1139803214.270:14817): cwd="/var/spool/postfix"
type=PATH msg=audit(1139803214.270:14817): item=0 name="public/pickup" flags=1
inode=6193158 dev=03:02 mode=010622 ouid=89 ogid=89 rdev=00:00
type=AVC msg=audit(1139803214.270:14818): avc: denied { write } for
pid=14521 comm="postdrop" name="pickup" dev=hda2 ino=6193158
scontext=root:system_r:postfix_pipe_t
tcontext=system_u:object_r:postfix_public_t tclass=fifo_file
type=SYSCALL msg=audit(1139803214.270:14818): arch=c000003e syscall=2
success=yes exit=4 a0=62cf28 a1=801 a2=0 a3=2aaaaaaab000 items=1 pid=14521
auid=500 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=90 sgid=90 fsgid=90
comm="postdrop" exe="/usr/sbin/postdrop"
type=CWD msg=audit(1139803214.270:14818): cwd="/var/spool/postfix"
type=PATH msg=audit(1139803214.270:14818): item=0 name="public/pickup"
flags=101 inode=6193158 dev=03:02 mode=010622 ouid=89 ogid=89 rdev=00:00
Any explanation ?
If a known bug, could someone post a working postfix.fc/postfix.te set ?
TIA
18 years, 2 months