selinux syntax för owner
by pi
Sorry all, i should have set a subject ti this to. I appologise for the
first one.
I have a site made in joomla, placed under a users public_html.
Everything works exept for one optional thing within the
php/mysql-section.
Now when i look at the output of:
ls -adZ /home/xyz-user/public_html
i get this:
drwxr-xr-x xyz-user xyz-user root:object_r:user_home_t
/home/xyz-user/public_htmldrwxr-xr-x root root
root:object_r:user_home_t /home/xyz-user/public_html
Is there any command i can give in terminal so set it right, and do i
need to relabel the system after that?
Regards
/pi
18 years, 2 months
Bonehead basic selinux questions
by Jason L Tibbitts III
OK, I've done a lot of reading and I've even done some policy
hacking. But there are some fundamental things about selinux I just
don't understand yet.
So I do a fresh FC4 install, log in, mkdir /local and make and mount a
couple of filesystems under it: /svn and /trac.
I do chcon -R --reference=/var/www /local/svn
and httpd can see stuff under /local/svn without issue.
So I wonder if that change is permanent or if I'll get boned if the
system gets relabeled:
> s restorecon -n -R -v /local
/sbin/restorecon reset /local context root:object_r:root_t->system_u:object_r:default_t
/sbin/restorecon reset /local/trac context system_u:object_r:file_t->system_u:object_r:default_t
/sbin/restorecon reset /local/trac/lost+found context system_u:object_r:file_t->system_u:object_r:default_t
Looks OK; the context on /local/svn isn't going to change. So I go
ahead and drop the '-n' so I'm not surprised later, which had the
effect of surprising me immediately. Now httpd can't look in
/local/svn (because it can't see under /local?):
> s ausearch -i -ui apache
[...blah...]
type=PATH msg=audit(02/03/06 15:22:17.034:320) : item=0 name=/local flags=none inode=65545 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(02/03/06 15:22:17.034:320) : cwd=/
type=AVC_PATH msg=audit(02/03/06 15:22:17.034:320) : path=/local
type=SYSCALL msg=audit(02/03/06 15:22:17.034:320) : arch=i386 syscall=lstat64 success=no exit=-13(Permission denied) a0=8db7f40 a1=bfbeb7bc a2=dc6ff4 a3=bfbeb7bc items=1 pid=8587 auid=tibbs uid=apache gid=apache euid=apache suid=apache fsuid=apache egid=apache sgid=apache fsgid=apache comm=httpd exe=/usr/sbin/httpd
type=AVC msg=audit(02/03/06 15:22:17.034:320) : avc: denied { getattr } for pid=8587 comm=httpd name=local dev=dm-0 ino=65545 scontext=root:system_r:httpd_t tcontext=system_u:object_r:default_t tclass=dir
So changing the context from root:object_r:root_t to
system_u:object_r:default_t locks httpd out?
I have not changed the policy booleans from their default values:
allow_httpd_anon_write inactive
allow_httpd_sys_script_anon_write inactive
httpd_builtin_scripting active
httpd_can_network_connect inactive
httpd_disable_trans inactive
httpd_enable_cgi active
httpd_enable_ftp_server inactive
httpd_enable_homedirs active
httpd_ssi_exec active
httpd_suexec_disable_trans inactive
httpd_tty_comm inactive
httpd_unified active
I don't think it would be proper to chcon /local to the same context
as /local/svn, because I will certainly mount non-httpd-visible things
under /local. So what is the proper way to fix this?
Any enlightenment would be very much appreciated,
- J<
18 years, 2 months
(no subject)
by pi
I have a site made in joomla, placed under a users public_html.
Everything works exept for one optional thing within the
php/mysql-section.
Now when i look at the output of:
ls -adZ /home/xyz-user/public_html
i get this:
drwxr-xr-x xyz-user xyz-user root:object_r:user_home_t
/home/xyz-user/public_htmldrwxr-xr-x root root
root:object_r:user_home_t /home/xyz-user/public_html
Is there any command i can give in terminal so set it right, and do i
need to relabel the system after that?
Regards
/pi
18 years, 2 months
some selinux logs
by Nicolas Mailhot
Hi,
After a long pause (had a kernel FS corruption to track) here is a new
selinux-on-x86_64-rawhide report.
Attached are full audit logs since yesterday (after a system relabel)
libselinux-1.29.6-1
libselinux-devel-1.29.6-1
selinux-policy-2.2.11-1
libselinux-python-1.29.6-1
selinux-policy-targeted-2.2.11-1
libselinux-1.29.6-1
The logs speak for themselves
I had to disable enforcing today to rescue evo, firefox and other nss
users. They did work just after the labelling
Seems system background processes mess the labeling, so initial boot
after relabel is ok but after a while all hell breaks loose.
I suspect prelink
(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=177976)
Regards,
--
Nicolas Mailhot
18 years, 2 months
selinux syntax för owner, disregard the previous ones
by pi
Damn, i´m ashame. everything seems to go wrong today.
I have a site made in joomla, placed under a users public_html.
Everything works exept for one optional thing within the
php/mysql-section.
Now when i look at the output of:
ls -adZ /home/xyz-user/public_html
i get this:
drwxr-xr-x xyz-user xyz-user root:object_r:user_home_t
/home/xyz-user/public_html
It probaably should look like this:
drwxr-xr-x root root root:object_r:user_home_t
/home/xyz-user/public_html
Is there any command i can give in terminal so set it right, and do i
need to relabel the system after that?
Regards
/pi
18 years, 2 months
SELinux Symposium: Second Keynote Speaker announced
by Frank Mayer
For those planning to go the SELinux Symposium, a second keynote speaker has
just been announced. The press release is below. The agenda for the
technical session has also been updated; see the symposium's web site
(www.selinux-symposium.org). Frank
-=-=-=-=-=-=-
Second Keynote Speaker Announced for the
Second Security-Enhanced Linux Symposium and Developer Summit
Event slated for February 27-March 3, 2006 in Baltimore, Maryland, USA
Baltimore, MD - (February, 02 2006) - Dr. Steve Marsh, Director of the
Central Sponsor for Information Assurance unit in the UK Cabinet Office,
will be a keynote speaker for the second annual Security-Enhanced Linux
(SELinux) Symposium scheduled for February 27-March 3, 2006 in Baltimore,
Maryland.
The Central Sponsor for Information Assurance unit was formed in October
2002 to provide assurance to government that the risks to the UK national
information infrastructure are appropriately managed. Prior to this
assignment, Dr. Marsh was Director of Security Policy in the Office of the
e-Envoy, responsible for establishing a common framework for the security of
electronic government systems. This included the ways by which individuals
and business users authenticate themselves when using electronic government
services. He has over 15 years experience in security and IT within the
public sector.
Dr. Marsh will present a keynote address entitled "UK e-Government: Security
Challenges and Solutions for Innovative Service Delivery." In this address,
Dr. Marsh will share some of the security challenges facing e-Government
services in the UK, as well as some of the solutions being explored to
address these challenges. SELinux is being explored as one of a number of
aids to securing UK e-government services. SELinux has the ability to
provide enhanced information assurance for key infrastructure components and
applications. A separate case study to be presented during the symposium
will discuss the planned use of SELinux in an UK e-Government pilot program.
About the SELinux Symposium
The Security-Enhanced Linux (SELinux) Symposium is an annual exchange of
ideas, technology, and research involving SELinux. SELinux is technology
that adds flexible, strong mandatory access control security to Linux. The
Second Symposium is scheduled for February 27-March 3, 2006 in Baltimore,
Maryland and is sponsored by Hewlett-Packard, IBM, Red Hat, Tresys
Technology, and Trusted Computer Solutions. The event brings together
experts from business, government, and academia to share research,
development, and application experiences using SELinux. For information on
registration and sponsorship opportunities, see www.selinux-symposium.org or
info(a)selinux-symposium.org.
18 years, 2 months
NetWorkManagerDispatcher is initrc_t
by Tom London
Running latest Rawhide, targeted/enforcing.
NetworkManagerDispatcher appears to be running in initrc_t. Is that
appropriate? Should it be NetworkManager_t like NetworkManager?
Just checking. There aren't many things still running in initrc_t......
tom
--
Tom London
18 years, 2 months
rawhide selinux-policy-strict whoopsage...
by Valdis.Kletnieks@vt.edu
Ran yum, it tried to install selinux-policy-strict-2.2.5-1 and died a horrid death:
Updating : selinux-policy-strict ####################### [13/24]
libsepol.verify_module_requirements: Module acct's global requirements were not met: type/attribute sysadm_home_dir_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
libsepol.verify_module_requirements: Module alsa's global requirements were not met: type/attribute devlog_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
libsepol.verify_module_requirements: Module amanda's global requirements were not met: type/attribute sysadm_home_dir_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
.... (skipping scads of similar errors..)
libsepol.verify_module_requirements: Module xserver's global requirements were not met: type/attribute logfile
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
libsepol.verify_module_requirements: Module zebra's global requirements were not met: type/attribute direct_init
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
Running strict/permissive. Any suggestions?
18 years, 2 months
/var/run/NetworkManager.pid
by Tom London
Running latest rawhide, targeted/enforcing.
[root@localhost run]# restorecon -v -R -n /var/run
restorecon reset /var/run/NetworkManager.pid context
system_u:object_r:initrc_var_run_t->system_u:object_r:NetworkManager_var_run_t
[root@localhost run]#
Does the following patch to /etc/rc.d/init.d/NetworkManager make sense?
tom
--- NetworkManager 2006-01-31 11:54:20.000000000 -0800
+++ NetworkManager.new 2006-02-02 12:33:19.000000000 -0800
@@ -41,6 +41,7 @@
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$servicename &&
echo `/sbin/pidof $processname` > $pidfile
+ restorecon $pidfile
}
stop()
--
Tom London
18 years, 2 months
extras package that require changes in selinux-policy (initng)
by dragoran
Hello.
I am working on selinux support in initng, which is in review for extras
now [1].
But it seems that initng requires a policy to work (just tested in
targeted mode)
Using the default context (sbin_t) lets all apps that are started from
initng run as kernel_t.
Relabling /sbin/initng to init_exec_t (same as init) fixes this and the
processes run as init_t and udev_t for udev, but some issues still remain.
hald,httpd, etc. also run as init_t which is *wrong* they have to get
into their own domain. How is this handled in sysvinit?
After reading the code I havn't found anything about it.
The patch I wrote can be found here:
http://bugzilla.initng.thinktux.net/show_bug.cgi?id=365
Did I do something wrong? Did I miss something?
After fixing this we will run into an other problem. Every time the
filesystem gots relabled initng will become sbin_t which will break it.
To fix this we need to modify the selinux-policy. What should be done if
a package in extras requires to change a core package?
Should I just fill a bug against it and hope that it will be released as
an update for FC4, and gets into rawhide too?
Was unable to find anything about it in the wiki.
1: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173459
18 years, 2 months