documentation plans
by Karsten Wade
Since the release of Fedora 7, we have been watching the statistics for
our new content location, http://docs.fedoraproject.org. In a recent
thread on f-docs-l[1], Google referrer statistics[2] show that SELinux
questions are a sizeable percentage (over 10%) of incoming search terms.
Unfortunately. Why? Because:
* The content they are hitting most is the FC3 SELinux FAQ
* The top search keyphrase is "disable selinux", with "selinux disable"
as number four (all of which take you to the FC3 FAQ)
* Users cannot find anything useful that we'd want them to have
The proposal[3] of the Fedora Docs team is this:
1. We gather all content that we have[4] that is not Fedora-specific and
push that up to grow and be maintained on selinuxproject.org
2. A Fedora Docs writer, Paulo Santos, will help watch that content on
selinuxproject.org. This becomes a new location for us to collaborate
on distro-neutral community docs.
3. Paulo works up Fedora-specific content, from what exists in Fedora
and added to by all of you, and that becomes new "SELinux for Fedora"
content that Fedora Docs plans to maintain. Your help is much needed.
4. In all the locations where you find SELinux content
in .*fedoraproject.org, we repopulate or redirect to a single Fedora
SELinux content page. From that page we link to the upstream canonical
docs on selinuxproject.org and provide the Fedora variant on that
content.
Barring someone stepping up and putting a partial or full-time resource
on this writing, a job I no longer do at Red Hat, this is going to be
the best way to generate and maintain SELinux open content. By using
open collaboration tools (Wiki, Plone), it will be *much* easier for
someone such as Dan Walsh to do a brain dump and have it be polished,
formalized, and published.
Thoughts?
- Karsten
[1] http://www.redhat.com/archives/fedora-docs-list/2007-June/msg00084.html
[2] Use your browser's keyword search to find SELinux/selinux stuff:
http://fedoraproject.org/awstats/docs/awstats.docs.fedoraproject.org.html
[3] http://www.redhat.com/archives/fedora-docs-list/2007-June/msg00077.html
[4] This page has a short list of locations we are going to pull content
from: http://fedoraproject.org/wiki/Docs/Drafts/SELinux
--
Karsten Wade, 108 Editor ^ Fedora Documentation Project
Sr. Developer Relations Mgr. | fedoraproject.org/wiki/DocsProject
quaid.108.redhat.com | gpg key: AD0E0C41
////////////////////////////////// \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
16 years, 10 months
inability to import keys/ set firewall properties
by charles f. zeitler
when trying to import keys,
rpm is unable to get a lock.
using system-config-securitylevel,
attempted changes do not "stick",
opened ports don't show up in
the "other ports" window,
if firewall is disabled, it is
re-enabled.
is selinux keeping me from
doing sysadmin things?
charles zeitler
: Do What Thou Wilt :
: Shall Be :
: The Whole of The Law :
16 years, 10 months
problem trying to transition to sysadm_r
by charles f. zeitler
when i enter:
newrole -r sysadm_r
at the cli,
i get:
Couldn't get default type.
can someone give me a hint/tip/clue?
thanx
charles zeitler
: Do What Thou Wilt :
: Shall Be :
: The Whole of The Law :
16 years, 10 months
useradd failure under ldap with tls
by Chaos Golubitsky
When i manage user data via LDAP (using pam_ldap), useradd/usermod/etc
fail when run from scripts. In particular, e.g.
# yum install httpd
fails because the "useradd apache" commands hangs.
Audit2allow suggests:
allow useradd_t urandom_device_t:chr_file { getattr read };
If i modify my LDAP configuration so that connections are not encrypted
using TLS, the useradd succeeds.
I think that, when LDAP is in use, anyone who needs to query the passwd
or group map [1] should be able to read /dev/urandom so they can initiate
TLS LDAP connections. But i don't know enough about the layout of the
SELinux policy to speculate on whether the problem is that:
(a) The PAM/LDAP client policy is ignorant of TLS
(b) The useradd/etc policy is ignorant of LDAP
(c) Something else
Any suggestions would be appreciated. I have "solved" this for my own
purposes the hackish way (i.e. by doing what audit2allow recommends, as
a standalone module), but i'd like to be able to recommend a real patch.
Thanks.
Chaos
[1] The useradd/usermod/etc commands need to query passwd maps in order
to fail with an error if a central user conflicts with the user being
created.
16 years, 10 months
Re: documentation plans
by John Dennis
On 6/19/07, John Dennis <jdennis(a)redhat.com> wrote:
> I take it that selinuxproject.org is new. Who is hosting
> this?
> On Tue, 2007-06-19 at 04:12 +0200, Paulo Santos wrote:
> I'm not aware of selinuxproject.org under Fedora Project
> infrastructure.
Silly me, this is James Morris's domain, I just didn't recognize it with
the different content.
--
John Dennis <jdennis(a)redhat.com>
16 years, 10 months
Re: mknod problem still present denied avc's
by Antonio Olivares
----- Original Message ----
From: Daniel J Walsh <dwalsh(a)redhat.com>
To: Antonio Olivares <olivares14031(a)yahoo.com>
Cc: fedora-selinux-list(a)redhat.com
Sent: Thursday, June 14, 2007 9:02:35 AM
Subject: Re: mknod problem still present denied avc's
Antonio Olivares wrote:
> dmesg returns
>
> audit(1181681041.681:4): avc: denied { add_name } for pid=739 comm="mknod" name="slamr0" scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=dir
>
> After I did this again
>
> [olivares@localhost ~]$ su -
> Password:
> [root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod
> ******************** IMPORTANT ***********************
> To make this policy package active, execute:
>
> semodule -i myinsmod.pp
>
> [root@localhost ~]# semodule -i myinsmod.pp
> [root@localhost ~]#
>
> Selinux troubleshooter returned this:
>
> avc: denied { write } for comm="mknod" dev=tmpfs egid=0 euid=0 exe="/bin/mknod" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="/" pid=2766 scontext=user_u:system_r:insmod_t:s0 sgid=0 subj=user_u:system_r:insmod_t:s0 suid=0 tclass=dir tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0
>
>
Yes you allowed add_name to the directory now it is complaing about the
write. It is best to put the machine in permissive mode, Run the app to
completion, then generate the policy and
retest in enforcing mode.
setenforce 0
run test
grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod
semodule -i myinsmod.pp
setenforce 1
run test
> Policy RPM: selinux-policy-2.6.4-8.fc7
>
> Affected RPM Packages: coreutils-6.9-2.fc7 [application]Policy RPM: selinux-policy-2.6.4-12.fc7
>
>
> How can I effectively fix this?
>
> This is my /etc/modprobe.conf
>
> [root@localhost Download]# cat /etc/modprobe.conf
> alias eth0 8139too
> alias scsi_hostadapter sata_via
> alias scsi_hostadapter1 pata_via
> alias snd-card-0 snd-via82xx
> options snd-card-0 index=0
> options snd-via82xx index=0
> install slamr modprobe --ignore-install ungrab-winmodem ; modprobe --ignore-install slamr; test -e /dev/slamr0 || (/bin/mknod -m 660 /dev/slamr0 c 242 0 2>/dev/null && chgrp dialout /dev/slamr0)
> [root@localhost Download]#
>
> Thanks,
>
> Antonio
>
>
>
>
> ____________________________________________________________________________________
> Yahoo! oneSearch: Finally, mobile search
> that gives answers, not web links.
> http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
Did as you instructed. Set Selinux to permissive mode, recreated the dev/slamr0 using mknod and upon rebooting with selinux enabled it works!!
[root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i myinsmod.pp
[root@localhost ~]# semodule -i myinsmod.pp
[root@localhost ~]# setenforce 1
but the message still appears
audit(1181873499.608:3): avc: denied { create } for pid=751 comm="mknod" name="slamr0" scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file
I have checked with the troubleshooter and it recommends me to do
restorecon -v /dev/slamr0
[root@localhost ~]# restorecon -v /dev/slamr0
[root@localhost ~]# ls /dev/slamr0 -l
crw-rw---- 1 root root 242, 0 2007-06-14 21:11 /dev/slamr0
[root@localhost ~]#
Here is the summary from setroubleshoot browser.
Summary
SELinux is preventing sh (insmod_t) "getattr" access to device /dev/slamr0.
Detailed Description
SELinux has denied the sh (insmod_t) "getattr" access to device /dev/slamr0.
/dev/slamr0 is mislabeled, this device has the default label of the /dev
directory, which should not happen. All Character and/or Block Devices
should have a label. You can attempt to change the label of the file using
restorecon -v /dev/slamr0. If this device remains labeled device_t, then
this is a bug in SELinux policy. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
package. If you look at the other similar devices labels, ls -lZ
/dev/SIMILAR, and find a type that would work for /dev/slamr0, you can use
chcon -t SIMILAR_TYPE /dev/slamr0, If this fixes the problem, you can make
this permanent by executing semanage fcontext -a -t SIMILAR_TYPE /dev/slamr0
If the restorecon changes the context, this indicates that the application
that created the device, created it without using SELinux APIs. If you can
figure out which application created the device, please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
Allowing Access
Attempt restorecon -v /dev/slamr0 or chcon -t SIMILAR_TYPE /dev/slamr0
Additional Information
Source Context system_u:system_r:insmod_t
Target Context system_u:object_r:device_t
Target Objects /dev/slamr0 [ chr_file ]
Affected RPM Packages
Policy RPM selinux-policy-2.6.4-12.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name plugins.device
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.21-1.3226.fc7 #1
SMP Sat Jun 9 22:23:35 EDT 2007 i686 athlon
Alert Count 1
First Seen Thu 14 Jun 2007 06:26:18 PM CDT
Last Seen Thu 14 Jun 2007 06:26:18 PM CDT
Local ID 04c18a63-7a70-462e-8937-018923ab95bf
Line Numbers
Raw Audit Messages
avc: denied { getattr } for comm="sh" dev=tmpfs egid=0 euid=0 exe="/bin/bash"
exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="slamr0" path="/dev/slamr0" pid=2265
scontext=system_u:system_r:insmod_t:s0 sgid=0 subj=system_u:system_r:insmod_t:s0
suid=0 tclass=chr_file tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0
Thanks for helping,
Antonio
____________________________________________________________________________________
Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out.
http://answers.yahoo.com/dir/?link=list&sid=396545469
16 years, 10 months
new (updated) FC7 system getting auditing errors
by Phil Edwards
Hi. I've just installed FC7, updated its packages, but made few other
changes so far; no changes at all to selinux (I wouldn't know how, and
there is no full-time sysadmin).
The messages log is filling up with stuff like this:
dbus: Can't send to audit system: USER_AVC avc: received policyload
notice (seqno=2) : exe="/bin/dbus-daemon" (sauid=539, hostname=?,
addr=?, terminal=?)
nscd: Can't send to audit system: USER_AVC avc: received policyload
notice (seqno=2) : exe="?" (sauid=28, hostname=?, addr=?, terminal=?)
dbus and nscd are the nosiest culprits.
Googling for what look like the key phrases gets me tons of hits from
2005, but nothing recent and nothing pertaining to FC7 (but having
never used an FC release before, I could be wrong).
Could somebody please tell me how to turn this noise off?
16 years, 10 months
Hierarchy for sensitivity levels
by Forrest Taylor
I am teaching class this week and I had an interesting question from a
student. We were discussing sensitivities and categories, and a student
wondered about the hierarchical nature of sensitivities and categories.
Assuming that s0 is unclassified, s1 is classified, s2 is secret and s3
is top secret, and s0<s1<s2<s3. If I have access to s3, I assume that
you also have access to s2, s1, s0. Is there a way to throw categories
in here so that users who have access to s3 do not necessarily have
access to all of s2 and lower?
Thanks,
Forrest
16 years, 10 months
SELinux is preventing ifup-eth (udev_t) "getattr" to /etc/dhclient-eth1.conf (dhcp_etc_t).
by Matthew Saltzman
I occasionally have to remove and re-insert my ipw2200 driver module.
Every time I do, the following is generated:
SELinux denied access requested by ifup-eth. It is not expected that
this access is required by ifup-eth and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional
access.
Source Context: system_u:system_r:udev_t:SystemLow-SystemHigh
Target Context: system_u:object_r:dhcp_etc_t
Target Objects: /etc/dhclient-eth1.conf [ file ]
Affected RPM Packages:
Policy RPM: selinux-policy-2.6.4-13.fc7
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Enforcing
Plugin Name: plugins.catchall_file
Host Name: xxxxxxxxxxxxxxxxxx
Platform: Linux xxxxxxxxxxxxxxx 2.6.20-1.2952.fc6 #1 SMP Wed May 16
18:59:18 EDT 2007 i686 i686
Alert Count: 23
First Seen: Sun 10 Jun 2007 03:15:44 AM EDT
Last Seen: Wed 13 Jun 2007 09:30:46 PM EDT
Local ID: 244d5474-af72-4c98-8d63-2e3a43c9457a
Line Numbers:
Raw Audit Messages :
avc: denied { getattr } for comm="ifup-eth" dev=dm-0 egid=0 euid=0
exe="/bin/bash" exit=-13 fsgid=0 fsuid=0 gid=0 items=0
name="dhclient-eth1.conf" path="/etc/dhclient-eth1.conf" pid=11020
scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 sgid=0
subj=system_u:system_r:udev_t:s0-s0:c0.c1023 suid=0 tclass=file
tcontext=system_u:object_r:dhcp_etc_t:s0 tty=(none) uid=0
Thanks.
16 years, 10 months
"Could not change policy booleans"
by Nils Caspar
Hi
I'd like to change some policy booleans. For example
httpd_can_network_connect.
So I tried this (as root):
> /usr/sbin/setsebool -P httpd_can_network_connect=1
But than I get "Could not change policy booleans".
This works:
> /usr/sbin/setsebool httpd_can_network_connect=1
I could put this into a boot script ;)
In /var/log/messages, I get the following entry:
> Jun 3 00:02:56 localhost dbus: Can't send to audit system: USER_AVC
avc: received policyload notice (seqno=3) : exe="/bin/dbus-daemon"
(sauid=500, hostname=?, addr=?, terminal=?)
Have you any ideas?
Cu
Nils
16 years, 10 months