context mount options in FC5
by Paul Howarth
The "context" and "fscontext" mount options no longer seem to be
supported by mount in FC5:
# mount -r -o
loop,fscontext=system_u:object_r:public_content_t /srv/softlib/fedora/bordeaux/FC-5-i386-DVD.iso /srv/softlib/fedora/bordeaux/dvd
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
The same command fails in the same way with "fscontext" changed to
"context", but works if neither of those options is present. This leaves
me with the mounted DVD image having a context of iso9660_t, which is
reasonable but not what I want for serving out a local yum repository.
So how can I get ISO images mounted with public_content_t in FC5?
Or am I going to have to create a policy module to allow httpd, ftpd,
samba etc. to read iso9660_t?
Paul.
18 years, 1 month
strict module linking
by Richard Hally
From yum update today (3/25/06). Just in case someone missed it.
"
Updating : selinux-policy-strict ####################### [20/47]
libsepol.scope_copy_callback: vpnc: Duplicate declaration in module:
type/attribute vpnc_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
"
[root@LinuxNew2 ~]# rpm -q selinux-policy-strict
selinux-policy-strict-2.2.26-1
18 years, 1 month
FC5 hpiod AVC's
by Bob Kashani
This is on a fresh install of FC5 with all the latest updates as of
March 24th.
libsepol-1.12.1-1.fc5
selinux-policy-2.2.25-2.fc5
selinux-policy-targeted-2.2.25-2.fc5
libsetrans-0.1.20-1.fc5
libselinux-python-1.30-1.fc5
libsemanage-1.6-1.fc5
libselinux-1.30-1.fc5
hplip-0.9.9-5.1
hpijs-0.9.9-5.1
[medieval@chaucer ~]$ audit2allow -d
allow hplip_t usb_device_t:chr_file { read write };
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:2): avc: denied
{ read write } for pid=1733 comm="hpiod" name="001" \dev=tmpfs ino=4260
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:3): avc: denied
{ read } for pid=1733 comm="hpiod" name="001" dev=tm\pfs ino=4260
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:4): avc: denied
{ read write } for pid=1733 comm="hpiod" name="001" \dev=tmpfs ino=4208
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:5): avc: denied
{ read } for pid=1733 comm="hpiod" name="001" dev=tm\pfs ino=4208
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:6): avc: denied
{ read write } for pid=1733 comm="hpiod" name="001" \dev=tmpfs ino=4158
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:7): avc: denied
{ read } for pid=1733 comm="hpiod" name="001" dev=tm\pfs ino=4158
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:8): avc: denied
{ read write } for pid=1733 comm="hpiod" name="001" \dev=tmpfs ino=4108
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.812:9): avc: denied
{ read } for pid=1733 comm="hpiod" name="001" dev=tm\pfs ino=4108
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: ppdev: user-space parallel port driver
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:10): avc: denied
{ read write } for pid=1745 comm="hpiod" name="001"\ dev=tmpfs ino=4260
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:11): avc: denied
{ read } for pid=1745 comm="hpiod" name="001" dev=t\mpfs ino=4260
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:12): avc: denied
{ read write } for pid=1745 comm="hpiod" name="001"\ dev=tmpfs ino=4208
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:13): avc: denied
{ read } for pid=1745 comm="hpiod" name="001" dev=t\mpfs ino=4208
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:14): avc: denied
{ read write } for pid=1745 comm="hpiod" name="001"\ dev=tmpfs ino=4158
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:15): avc: denied
{ read } for pid=1745 comm="hpiod" name="001" dev=t\mpfs ino=4158
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:16): avc: denied
{ read write } for pid=1745 comm="hpiod" name="001"\ dev=tmpfs ino=4108
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Mar 24 11:41:49 chaucer kernel: audit(1143229305.992:17): avc: denied
{ read } for pid=1745 comm="hpiod" name="001" dev=t\mpfs ino=4108
scontext=system_u:system_r:hplip_t:s0
tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
Bob
--
Bob Kashani
http://www.gnome.org/~bobk/
18 years, 2 months
logwatch does not show disk usage of partitions mounted in /mnt
by Dawid Gajownik
Hi!
In mails from logwatch there is something like this:
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
df: `/mnt/FreeDOS': Access denied
I found this avc message:
Mar 21 17:14:05 X kernel: audit(1142957645.904:32): avc: denied {
search } for pid=2588 comm="df" name="mnt" dev=hda5 ino=809601
scontext=system_u:system_r:logwatch_t:s0
tcontext=system_u:object_r:mnt_t:s0 tclass=dir
OS: FC5
selinux-policy-targeted: 2.2.23-15
How can I fix it?
Regards,
Dawid
--
^_*
18 years, 2 months
postinstall error from selinux-policy-targeted
by Richard Hally
todays rawhide update produced the following error:
Updating : selinux-policy-targeted ##################### [ 57/119]
/var/tmp/rpm-tmp.10515: line 10: /usr/sbin/fixfiles: No such file or
directory
It looks like the postinstall script has the wrong path for fixfiles.
selinux-policy-targeted-2.2.24-1.
18 years, 2 months
FC5 dbus-deamon name_connect denied
by Tim Fenn
After upgrading from FC4 to FC5, everything seems to be working well,
except for the dbus-daemon. It hogs CPU and continuously spits out
the following, unless messagebus is stopped:
audit(1143051102.334:1219773): avc: denied { name_connect } for
pid=24150 comm="dbus-daemon" dest=111
scontext=user_u:system_r:system_dbusd_t:s0
tcontext=system_u:object_r:portmap_port_t:s0 tclass=tcp_socket
audit(1143051102.334:1219773): arch=40000003 syscall=102 success=no
exit=-13 a0=3 a1=bfa7fbec a2=da4ff4 a3=0 items=0 pid=24150 auid=1567
uid=81 gid=81 euid=81 suid=81 fsuid=81 egid=81 sgid=81 fsgid=81
comm="dbus-daemon" exe="/bin/dbus-daemon"
audit(1143051102.334:1219773): saddr=0200006F7F00000168C56709C0916700
audit(1143051102.334:1219773): nargs=3 a0=c a1=bfa7fcfc a2=10
I'm sure I missed something simple (as usual). Any hints?
If it helps, I'm using:
selinux-policy-2.2.23-15
selinux-policy-targeted-2.2.23-15
Thanks for any pointers,
Tim
18 years, 2 months
Re: error in 'make load'
by Martin Ebourne
Stephen Smalley wrote:
> On Mon, 2006-02-20 at 07:44 -0700, gf wrote:
> > Hi,
> > I am trying to update the httpd policy in selinux to allow access to
port 8443.
> > I thought that I could add the line
> > portcon tcp 8443 system_u:object_r:http_port_t
> > to the file
> > /etc/selinux/targeted/src/policy/net_contents
> > and recompile.
> >
> > My first step was to download the sources:
> > selinux-policy-targeted-sources-1.17.30-2.110.rpm
> > and install.
> >
> > To check whether or not everthing was working, I tried the following
> > without altering any files:
> >
> > [$ /etc/selinux/targeted/src/policy]:make load
> > mkdir -p /etc/selinux/targeted/policy
> > /usr/bin/checkpolicy -o /etc/selinux/targeted/policy/policy.18
policy.conf
> > /usr/bin/checkpolicy: loading policy configuration from policy.conf
> > tmp/program_used_flags.te:2:ERROR 'syntax error' at token
> > '/etc/selinux/targeted/src/policy/domains/program' on line 1164:
> > /etc/selinux/targeted/src/policy/domains/program
> > #line 1 "tmp/program_used_flags.te"
> > /usr/bin/checkpolicy: error(s) encountered while parsing
configuration
> > make: *** [/etc/selinux/targeted/policy/policy.18] Error 1
>
> Sounds like a bug in the policy Makefile in the generation of the
> policy.conf file, as that string
> ('/etc/selinux/targeted/src/policy/domains/program') shouldn't appear
in
> it. Provide more context please, e.g. the lines around line 1164 of
the
> policy.conf file.
I've just come across this error myself. I've got two updated FC4
machines here both doing the same thing.
Turns out it's a 'cd' in the Makefile that is echoing the new directory
and getting caught up in the destination file. The odd thing is that my
shell setup has never had cd echoing the destination (it would annoy me
- if I've just cd'd, I know where to!), so this must be something from
Fedora.
Anyhow, the attached patch fixes it for me. Any chance this can make it
upstream?
[Stephen, thanks for the clue that let me to find this!]
Cheers,
Martin.
18 years, 2 months
turing off selinux makes gnome 60% faster?
by dragoran
according to this review:
http://distrocenter.linux.com/distrocenter/06/03/08/2321254.shtml?tid=107
"FC5 runs on a 2.6.15 kernel and uses a branded version of GNOME 2.14 as
its default desktop. Although GNOME 2.14 is roughly twice as fast as
earlier versions when installed in other distributions, little of this
acceleration is visible in FC5. A large part of this relative slowness
is due to the default enabling of SELinux -- turn it off, and GNOME is
as much as 60% faster."
turing off selinux makes gnome 60% faster...
can this be true?
how does selinux affects gnome perfomance?
18 years, 2 months