dhclient-script avc error f7
by Tim Fenn
I recently upgraded a machine from FC6 to F7, and I used to use a
/etc/dhclient-exit-hooks script to call some iptables functions after
bringing up my external interface. This used to work on FC6 as long
as I setsebool -P dhcpc_disable_trans 1, but the policy in F7 no
longer contains such a boolean, so dhclient-script is prevented from
getattr/executing iptables. Is there a simple fix to this, or do I
need to write a policy and compile it? If the latter, any pointers on
what the policy file should contain?
Thanks for any help,
tim
16 years, 7 months
userspace checking in passwd command
by KaiGai Kohei
Dan,
Now, I'm tracking the userspace extensions in passwd command
to port them into busybox.
check_selinux_access() is defined as an extension of passwd,
and it enables to confirm passwd:{passwd} permission when
root (uid==0) executes this commans.
However, there is a condition to bypass this checking.
I cannot make sure the meaning of the condition.
See the following implementation of the function.
---------------------------
48 int
49 check_selinux_access(const char *change_user, int change_uid, unsigned int access)
50 {
51 int status = -1;
52 security_context_t user_context;
53 const char *user;
54
55 if (security_getenforce() == 0) {
56 status = 0;
57 } else {
58 if (getprevcon(&user_context) == 0) {
59 context_t c;
60 c = context_new(user_context);
61 user = context_user_get(c);
62 if (change_uid != 0 && strcmp(change_user, user) == 0) {
63 status = 0;
64 } else {
65 struct av_decision avd;
66 int retval;
67 retval = security_compute_av(user_context,
68 user_context,
69 SECCLASS_PASSWD,
70 access,
71 &avd);
72 if ((retval == 0) &&
73 ((access & avd.allowed) == access)) {
74 status = 0;
75 }
76 }
77 context_free(c);
78 freecon(user_context);
79 }
80 }
81 return status;
82 }
---------------------------
In line 62, it compares the target uid and username, then checking
passwd:{passwd} is skipped when UID is non-privileged user and username
matched with user field in its security context.
Could you tell me the reason why such a checking is applied.
If it is not necessary, I think we can use checkPasswdAccess() instead.
Thanks,
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai(a)ak.jp.nec.com>
16 years, 7 months
AVCs on suspend/resume
by Tom London
Running latest Rawhide, targeted/enforcing.
I accidentally did a suspend/resume on my Thinkpad.
I got the following AVCs. Sorry, can't tell from this if this
happened during suspend or resume.
I'm guessing the first AVC (from alsactl) is from
/usr/lib/pm-utils/sleep.d/65alsa. There is this code there:
#!/bin/bash
. /usr/lib/pm-utils/functions
case "$1" in
hibernate|suspend)
alsactl store 0 >/dev/null 2>&1
;;
thaw|resume)
alsactl restore 0 >/dev/null 2>&1
;;
*)
;;
esac
Could there be a leaded file descriptor?
/var/log/pm-suspend.log contains:
===== Tue Oct 2 10:45:35 PDT 2007: running hook:
/usr/lib/pm-utils/sleep.d/60sysfont =====
/usr/lib/pm-utils/sleep.d/60sysfont: line 7: /dev/tty0: Permission denied
60sysfont has:
case "$1" in
resume|thaw)
setsysfont </dev/tty0 ;;
esac
Not sure its related.....
Are these known? Worth redoing in permissive mode?
tom
type=AVC msg=audit(1191347118.765:32): avc: denied { search } for
pid=6632 comm="alsactl" name="root" dev=dm-0 ino=9043969
scontext=system_u:system_r:alsa_t:s0
tcontext=root:object_r:sysadm_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1191347118.765:32): arch=40000003 syscall=33
success=no exit=-13 a0=8588508 a1=4 a2=743678 a3=858091c items=0
ppid=6630 pid=6632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="alsactl" exe="/sbin/alsactl"
subj=system_u:system_r:alsa_t:s0 key=(null)
type=USYS_CONFIG msg=audit(1191347120.527:33): user pid=6688 uid=0
auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing
system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=?
res=success)'
type=AVC msg=audit(1191347120.695:34): avc: denied { setsched } for
pid=6547 comm="pm-suspend" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:kernel_t:s0 tclass=process
type=AVC msg=audit(1191347120.695:34): avc: denied { setsched } for
pid=6547 comm="pm-suspend" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:kernel_t:s0 tclass=process
type=SYSCALL msg=audit(1191347120.695:34): arch=40000003 syscall=4
success=yes exit=3 a0=1 a1=b7fd5000 a2=3 a3=3 items=0 ppid=6544
pid=6547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="pm-suspend" exe="/bin/bash"
subj=system_u:system_r:hald_t:s0 key=(null)
type=USYS_CONFIG msg=audit(1191347135.250:35): user pid=6809 uid=0
auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing
system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=?
res=success)'
type=AVC msg=audit(1191347135.013:36): avc: denied { search } for
pid=6816 comm="alsactl" name="root" dev=dm-0 ino=9043969
scontext=system_u:system_r:alsa_t:s0
tcontext=root:object_r:sysadm_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1191347135.013:36): arch=40000003 syscall=33
success=no exit=-13 a0=956a508 a1=4 a2=743678 a3=956291c items=0
ppid=6814 pid=6816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="alsactl" exe="/sbin/alsactl"
subj=system_u:system_r:alsa_t:s0 key=(null)
type=USER_ACCT msg=audit(1191348061.178:37): user pid=7003 uid=0
auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?,
addr=?, terminal=cron res=success)'
--
Tom London
16 years, 7 months
Intel Network card does not work on SELinux?
by Shintaro Fujiwara
Hi, I'm having trouble on SELinux, I think.
I bought an old note-pc, NEC Lavie M LM500/3.
Manufactured in 2002.
It has an network controller named "82551QM Fast Ethernet Controller".
By that machine,
I cannot connect network on targeted enforcing mode.
eth0 rises up OK, but ping not reacheable.
On disabled, yes.
So, I thought it's a SELinux problem.
No denied messages, so I have no clues.
Not yet done enableaudit everything.
I tried to install Intel driver but failed,
echoed messages something like,
no such file config.h...
Any suggestion?
Thanks in advance!
16 years, 7 months
ftpd is denied access to a dir
by Michael Klinosky
I have Fedora 7, using gnome. I installed pure-ftpd (version 1.0.21-12)
on my personal computer (for my own use), along with the selinux augment.
When I run the server as a xinetd service, and attempt a unix-style log
in (with gftp, on my LAN), I get this from gftp:
Connected to 10.0.0.50:21
220 (text)
220 (text)
USER mpk
331 user mpk OK. Password required.
PASS xxxx
530 user authentication failed
Disconnected from 10.0.0.50.
On 10.0.0.50, this is in the SElinux troubleshooter:
>> ALERT 1
Summary
SELinux is preventing the ftp daemon from writing files outside the
home directory (pure-ftpd).
Detailed Description
SELinux has denied the ftp daemon write access to directories
outside the home directory (pure-ftpd). Someone has logged in via your
ftp daemon and is trying to create or write a file. If you only setup
ftp to allow anonymous ftp, this could signal a intrusion attempt.
Allowing Access
If you do not want SELinux preventing ftp from writing files
anywhere on the system you need to turn on the allow_ftpd_full_access
boolean:
"setsebool -P allow_ftpd_full_access=1"
The following command will allow this access:
setsebool -P allow_ftpd_full_access=1
Additional Information
Source Context user_u:system_r:ftpd_t
Target Context user_u:object_r:var_run_t
Target Objects pure-ftpd [ dir ]
Affected RPM Packages pure-ftpd-1.0.21-12.fc7 [application]
Policy RPM selinux-policy-2.6.4-8.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.allow_ftpd_full_access
Host Name d500.localdomain
Platform Linux d500.localdomain 2.6.21-1.3228.fc7
#1 SMP Tue Jun 12 15:37:31 EDT 2007 i686 i686
Alert Count 6
First Seen Sat 25 Aug 2007 09:54:58 AM EDT
Last Seen Sat 25 Aug 2007 10:30:03 AM EDT
Local ID a8f17786-d787-4b38-86a2-ce3309391690
Line Numbers
Raw Audit Messages
avc: denied { create } for comm="pure-ftpd" egid=0 euid=0
exe="/usr/sbin/pure-
ftpd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="pure-ftpd" pid=28641
scontext=user_u:system_r:ftpd_t:s0 sgid=0 subj=user_u:system_r:ftpd_t:s0
suid=0 tclass=dir tcontext=user_u:object_r:var_run_t:s0 tty=(none) uid=0
**
I issued that command, and it apparently worked (no complaint displayed).
>> ALERT 2
Summary
SELinux is preventing /usr/sbin/pure-ftpd (ftpd_t) "search" to net
(proc_net_t).
Detailed Description
SELinux denied access requested by /usr/sbin/pure-ftpd. It is not
expected that this access is required by /usr/sbin/pure-ftpd and this
access may signal an intrusion attempt. It is also possible that the
specific version or configuration of the application is causing it to
require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could
try to restore the default system file context for net, restorecon -v
net If this does not work, there is currently no automatic way to allow
this access. Instead, you can generate a local policy module to allow
this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can
disable SELinux protection altogether. Disabling SELinux protection is
not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context user_u:system_r:ftpd_t
Target Context system_u:object_r:proc_net_t
Target Objects net [ dir ]
Affected RPM Packages pure-ftpd-1.0.21-12.fc7 [application]
Policy RPM selinux-policy-2.6.4-8.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name d500.localdomain
Platform Linux d500.localdomain 2.6.21-1.3228.fc7
#1 SMP Tue Jun 12 15:37:31 EDT 2007 i686 i686
Alert Count 12
First Seen Thu 30 Aug 2007 09:26:07 PM EDT
Last Seen Thu 06 Sep 2007 09:30:33 PM EDT
Local ID 8958c16e-27eb-4d3f-ad5c-787c1a960769
Line Numbers
Raw Audit Messages
avc: denied { search } for comm="pure-ftpd" dev=proc egid=0 euid=0
exe="/usr/sbin/pure-ftpd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="net"
pid=19097 scontext=user_u:system_r:ftpd_t:s0 sgid=0
subj=user_u:system_r:ftpd_t:s0 suid=0 tclass=dir
tcontext=system_u:object_r:proc_net_t:s0 tty=(none) uid=0
**
I tried to allow access; I saw that there is a directory 'net' in proc:
[root@d500 proc]# restorecon -v net
lstat(net) failed: Permission denied
Now what? Did I do this wrong, or do I need to create a 'local policy
module'?
Btw - if I run pure-ftpd as a standalone, I can login fine (but I don't
want to run it that way).
16 years, 7 months
SELinux is preventing /sbin/ip (ifconfig_t) "write" to pipe (unconfined_t).
by Antonio Olivares
Summary
SELinux is preventing /sbin/ip (ifconfig_t)
"write" to pipe (unconfined_t).
Detailed Description
SELinux denied access requested by /sbin/ip. It is
not expected that this
access is required by /sbin/ip and this access may
signal an intrusion
attempt. It is also possible that the specific
version or configuration of
the application is causing it to require
additional access.
Allowing Access
You can generate a local policy module to allow
this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
Or you can disable
SELinux protection altogether. Disabling SELinux
protection is not
recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context
system_u:system_r:ifconfig_t
Target Context
system_u:system_r:unconfined_t
Target Objects pipe [ fifo_file ]
Affected RPM Packages iproute-2.6.22-2.fc8
[application]
Policy RPM
selinux-policy-3.0.8-14.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall
Host Name localhost.localdomain
Platform Linux
localhost.localdomain
2.6.23-0.214.rc8.git2.fc8 #1 SMP Fri Sep 28
17:38:00 EDT 2007 i686
i686
Alert Count 14
First Seen Wed 26 Sep 2007 06:34:54
PM CDT
Last Seen Wed 03 Oct 2007 06:18:53
PM CDT
Local ID
d0527712-8653-4588-9f61-e20604d839bf
Line Numbers
Raw Audit Messages
avc: denied { write } for comm=ip dev=pipefs egid=0
euid=0 exe=/sbin/ip exit=0
fsgid=0 fsuid=0 gid=0 items=0 path=pipe:[12268]
pid=3166
scontext=system_u:system_r:ifconfig_t:s0 sgid=0
subj=system_u:system_r:ifconfig_t:s0 suid=0
tclass=fifo_file
tcontext=system_u:system_r:unconfined_t:s0 tty=(none)
uid=0
Summary
SELinux is preventing /sbin/consoletype
(consoletype_t) "write" to pipe
(unconfined_t).
Detailed Description
SELinux denied access requested by
/sbin/consoletype. It is not expected
that this access is required by /sbin/consoletype
and this access may signal
an intrusion attempt. It is also possible that the
specific version or
configuration of the application is causing it to
require additional access.
Allowing Access
You can generate a local policy module to allow
this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
Or you can disable
SELinux protection altogether. Disabling SELinux
protection is not
recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context
system_u:system_r:consoletype_t
Target Context
system_u:system_r:unconfined_t
Target Objects pipe [ fifo_file ]
Affected RPM Packages initscripts-8.56-1
[application]
Policy RPM
selinux-policy-3.0.8-14.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall
Host Name localhost.localdomain
Platform Linux
localhost.localdomain
2.6.23-0.214.rc8.git2.fc8 #1 SMP Fri Sep 28
17:38:00 EDT 2007 i686
i686
Alert Count 18
First Seen Wed 26 Sep 2007 06:34:54
PM CDT
Last Seen Wed 03 Oct 2007 06:18:53
PM CDT
Local ID
a29d7946-1930-4194-8c71-7edfbf95f972
Line Numbers
Raw Audit Messages
avc: denied { write } for comm=consoletype dev=pipefs
egid=0 euid=0
exe=/sbin/consoletype exit=0 fsgid=0 fsuid=0 gid=0
items=0 path=pipe:[12164]
pid=3131 scontext=system_u:system_r:consoletype_t:s0
sgid=0
subj=system_u:system_r:consoletype_t:s0 suid=0
tclass=fifo_file
tcontext=system_u:system_r:unconfined_t:s0 tty=(none)
uid=0
____________________________________________________________________________________
Yahoo! oneSearch: Finally, mobile search
that gives answers, not web links.
http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC
16 years, 7 months
Re: Can't enjoy SEPostgresql(Solved ! Now I'm enjoying.)
by Shintaro Fujiwara
Could install SE-PostgreSQL on my note-pc.
I heard from F8 it would be much easier to install.
Thanks, Kohei !
Cheers!
2007/10/3, Shintaro Fujiwara <shintaro.fujiwara(a)gmail.com>:
> Error message was, like this.
>
> module exim's global requirement were not met.
> exim_exec_t
>
> So I semodule -r ed exim and reinstalled.
> No error this time.
>
>
> 2007/10/3, Shintaro Fujiwara <shintaro.fujiwara(a)gmail.com>:
> > Thanks! Kaigai-san.
> >
> > 2007/10/3, KaiGai Kohei <kaigai(a)ak.jp.nec.com>:
> > > Shintaro Fujiwara wrote:
> > > > Hi, I want to be entertained by SEPostgresql.
> > > >
> > > > I succeeded installing my note-pc SEPostgresql.
> > > >
> > > > But I can't find any sepostgresql module by
> > > > semodule -l or cant initialize db.
> > > > There is nothing /etc/init.d/sepostgresql
> > > > What's wrong.
> > >
> > > You don't succeed to install SE-PostgreSQL :)
> >
> > Indeed :(
> >
> > > > During the installing process of SEPostgresql,
> > > > I got errors on dependencies, so I install with
> > > > option --oldpackage, because
> > > > I already updated to 2.6.4-43.
> > >
> > > You HAVE TO install the selinux-policy package with
> > > with object classes/permission related to SE-PostgreSQL.
> >
> > OK, now I understand why.
> >
> > > Unfortunatelly, we have not released the package based on
> > > the latest selinux-policy.
> > > Please apply selinux-policy-2.6.4-42.sepgsql instead.
> >
> > All rihgt. I can pickup 2.6.4-42's and try again tonight JST.
> >
> > > In Fedora 7 system, the default base security policy does not
> > > contain any object classes/permissions definition related to
> > > database management system, so we have to replace it by
> > > the .sepgsql version.
> >
> > Got it, buddy.
> > I understand sepgsql needs new classes/permissions stuff.
> >
> > > > And I got error on semodule, too after installed
> > > > SEPostgresql.
> > > > What's wrong and what should I do?
> > >
> > > What kind of errores are happen?
> >
> > I don't have it anymore, but link package failed or
> > something like that.
> >
> > Anyway, I will try again and give you report on it, thanks.
> >
> >
> > > Thanks,
> > > --
> > > OSS Platform Development Division, NEC
> > > KaiGai Kohei <kaigai(a)ak.jp.nec.com>
> > >
> >
>
16 years, 7 months
Can't enjoy SEPostgresql
by Shintaro Fujiwara
Hi, I want to be entertained by SEPostgresql.
I succeeded installing my note-pc SEPostgresql.
But I can't find any sepostgresql module by
semodule -l or cant initialize db.
There is nothing /etc/init.d/sepostgresql
What's wrong.
During the installing process of SEPostgresql,
I got errors on dependencies, so I install with
option --oldpackage, because
I already updated to 2.6.4-43.
And I got error on semodule, too after installed
SEPostgresql.
What's wrong and what should I do?
16 years, 7 months
How to fix acv denied errors
by Ian Leonard
Hi,
I am new to SELinux so I may have got this wrong but....
I am using a custom FC6 distribution that I built and installed using
Kickstart. After installation I have two errors in the log file:
audit(1191322730.172:5): avc: denied { mounton } for pid=1606
comm="mount" name="log" dev=hda1 ino=1035266
scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:var_log_t:s0 tclass=dir
Oct 2 11:59: kernel: audit(1191322771.771:34): avc: denied { getattr
} for pid=1424 comm="rhgb" name=".X0-lock" dev=hda1 ino=485340
scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:tmp_t:s0
tclass=file
To take the second one, it seems that the .X0-lock needs to be allowed
to run from the rhgb_t context. To fix this I have edited,
/etc/selinux/targeted/src/contexts/files/file_contexts (I am running in
targeted mode). I added the rhgb_t context to the /tmp.*.
Now it seems I have to run 'make load'. However there is no sign of a
makefile anywhere (and this is true of my standard FC6 distro).
Where am I going wrong. TIA.
--
Ian Leonard
Please ignore spelling and punctuation - I did.
16 years, 7 months
logrotate and /var/log/rpmpkgs ....
by Tom London
Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for
pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163
scontext=system_u:system_r:logrotate_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=file
type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195
success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0
ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate"
exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0
key=(null)
Should there be a directory in /var/log for these logs (with the
appropriate label)?
tom
--
Tom London
16 years, 7 months