SELinux is preventing access to files with the label, file_t.
by Antonio Olivares
Dear all,
I have done this before :
"touch /.autorelabel; reboot"
several days pass and I see this file_t again and I
have to do "in quote" this again . What is file_t
anyway?
I do not know of any in my system.
Thanks,
Antonio
Summary:
SELinux is preventing access to files with the label,
file_t.
Detailed Description:
SELinux permission checks on files labeled file_t are
being denied. file_t is
the context the SELinux kernel gives to files that do
not have a label. This
indicates a serious labeling problem. No files on an
SELinux box should ever be
labeled file_t. If you have just added a new disk
drive to the system you can
relabel it using the restorecon command. Otherwise you
should relabel the entire
files system.
Allowing Access:
You can execute the following command as root to
relabel your computer system:
"touch /.autorelabel; reboot"
Additional Information:
Source Context
system_u:system_r:tmpreaper_t
Target Context system_u:object_r:file_t
Target Objects
./virtual-olivares.1dNZIJ [ dir ]
Source tmpwatch
Source Path /usr/sbin/tmpwatch
Port <Unknown>
Host localhost
Source RPM Packages tmpwatch-2.9.13-2
Target RPM Packages
Policy RPM
selinux-policy-3.3.1-9.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name file
Host Name localhost
Platform Linux localhost
2.6.25-0.80.rc3.git2.fc9 #1 SMP
Fri Feb 29 18:17:34 EST
2008 i686 athlon
Alert Count 1
First Seen Mon 03 Mar 2008 10:01:18
AM CST
Last Seen Mon 03 Mar 2008 10:01:18
AM CST
Local ID
08676827-232c-4027-aa44-9431e45d6d53
Line Numbers
Raw Audit Messages
host=localhost type=AVC msg=audit(1204560078.2:50):
avc: denied { rmdir } for pid=32386 comm="tmpwatch"
name="virtual-olivares.1dNZIJ" dev=dm-0 ino=31391789
scontext=system_u:system_r:tmpreaper_t:s0
tcontext=system_u:object_r:file_t:s0 tclass=dir
host=localhost type=SYSCALL
msg=audit(1204560078.2:50): arch=40000003 syscall=40
success=no exit=-13 a0=960ec33 a1=28 a2=960f1a0
a3=960ec33 items=0 ppid=32384 pid=32386
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="tmpwatch" exe="/usr/sbin/tmpwatch"
subj=system_u:system_r:tmpreaper_t:s0 key=(null)
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
16 years, 2 months
mock context needs updating
by Paul Howarth
Since mock 0.9.x (I think), mock has dropped the SUID helper and become
a consolehelper-based application. So /usr/bin/mock, which used to be a
regular file labelled as unconfined_notrans_exec_t, is now a symlink to
/usr/sbin/mock. As a result of this, mock now does domain transitions
and that results in some AVCs.
I think that labelling /usr/sbin/mock as unconfined_notrans_exec_t
should fix it.
I believe this currently affects Fedora 8 and Rawhide but not (yet)
Fedora 7.
Paul.
16 years, 2 months
logrotate_t wants ptrace to the masses.... ;)
by Tom London
Running current Rawhide, logrotate must have kicked in and generated
lots of AVCs when in enforcing mode.
All of them are for ptrace:
#============= logrotate_t ==============
allow logrotate_t NetworkManager_t:process ptrace;
allow logrotate_t apmd_t:process ptrace;
allow logrotate_t audisp_t:process ptrace;
allow logrotate_t auditd_t:process ptrace;
allow logrotate_t consolekit_t:process ptrace;
allow logrotate_t crond_t:process ptrace;
allow logrotate_t cupsd_t:process ptrace;
allow logrotate_t dhcpc_t:process ptrace;
allow logrotate_t entropyd_t:process ptrace;
allow logrotate_t fsdaemon_t:process ptrace;
allow logrotate_t getty_t:process ptrace;
allow logrotate_t hald_t:process ptrace;
allow logrotate_t init_t:process ptrace;
allow logrotate_t initrc_t:process ptrace;
allow logrotate_t klogd_t:process ptrace;
allow logrotate_t mount_t:process ptrace;
allow logrotate_t restorecond_t:process ptrace;
allow logrotate_t self:capability sys_ptrace;
allow logrotate_t self:process ptrace;
allow logrotate_t setrans_t:process ptrace;
allow logrotate_t setroubleshootd_t:process ptrace;
allow logrotate_t sshd_t:process ptrace;
allow logrotate_t syslogd_t:process ptrace;
allow logrotate_t system_crond_t:process ptrace;
allow logrotate_t udev_t:process ptrace;
allow logrotate_t unconfined_t:process ptrace;
allow logrotate_t xdm_t:process ptrace;
allow logrotate_t xdm_xserver_t:process ptrace;
Complete audit.log attached.
tom
--
Tom London
16 years, 2 months
selinux interfering with dynamic dns
by Edward Kuns
I have dhcp + named set up to cooperate, but selinux (understandably)
denies named write access to the files it needs to modify for dynamic
dns updates. I have created the following policy. Is there a better
way of doing this? Best would be if there was a way to allow write
access *only* to those handful of files in /var/named/chroot/var/named
that are truly dynamic, perhaps by labeling. Would it be possible or
reasonable to add named_dynamic_zone_t or some equivalent? Is there a
better way to solve this problem or am I missing some already-available
mechanism?
Thanks
Eddie
module mybind 1.0;
require {
type named_t;
type named_zone_t;
class file write;
}
#============= named_t ==============
allow named_t named_zone_t:file write;
--
Edward Kuns <ekuns(a)kilroy.chi.il.us>
16 years, 2 months
SELinux interfering with clamav?
by Edward Kuns
A couple times a day (23 times in 10 days), I get the following AVC:
Summary
SELinux is preventing /usr/sbin/clamav-milter (clamd_t) "search" to
<Unknown> (bin_t).
Detailed Description
SELinux denied access requested by /usr/sbin/clamav-milter. It is
not
expected that this access is required by /usr/sbin/clamav-milter and
this
access may signal an intrusion attempt. It is also possible that the
specific version or configuration of the application is causing it
to
require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could
try to
restore the default system file context for <Unknown>, restorecon -v
<Unknown> If this does not work, there is currently no automatic way
to
allow this access. Instead, you can generate a local policy module
to allow
this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
Or you can disable SELinux protection altogether. Disabling SELinux
protection is not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this
package.
Additional Information
Source Context system_u:system_r:clamd_t:s0
Target Context system_u:object_r:bin_t:s0
Target Objects None [ dir ]
Affected RPM Packages clamav-milter-0.92.1-1.fc8 [application]
Policy RPM selinux-policy-3.0.8-84.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name kilroy.chi.il.us
Platform Linux kilroy.chi.il.us 2.6.23.15-137.fc8
#1 SMP
Sun Feb 10 17:48:34 EST 2008 i686 i686
Alert Count 23
First Seen Wed 20 Feb 2008 12:25:16 PM CST
Last Seen Thu 28 Feb 2008 09:11:28 PM CST
Local ID 7eb02331-c2e4-4c65-a413-d283fbb7ca6f
Line Numbers
Raw Audit Messages
avc: denied { search } for comm=clamav-milter dev=dm-0 egid=486 euid=492
exe=/usr/sbin/clamav-milter exit=-13 fsgid=486 fsuid=492 gid=486 items=0
name=bin pid=13663 scontext=system_u:system_r:clamd_t:s0 sgid=486
subj=system_u:system_r:clamd_t:s0 suid=492 tclass=dir
tcontext=system_u:object_r:bin_t:s0 tty=(none) uid=492
I assume that we want to allow clamav to scan anything on the system,
yes? If I follow the advice from an earlier Email and try the
following:
grep clamav /var/log/audit/audit.log | audit2allow -M clamav
I get a file that contains:
module clamav 1.0;
require {
type bin_t;
type clamd_t;
class dir search;
}
#============= clamd_t ==============
allow clamd_t bin_t:dir search;
Is this something that should be part of standard policy? Hmm, I try to
install the above policy and get a complaint:
# semodule -i clamav.pp
libsepol.print_missing_requirements: clamav's global requirements were
not met: type/attribute clamd_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule: Failed!
Any thoughts?
Thanks
Eddie
--
Edward Kuns <ekuns(a)kilroy.chi.il.us>
16 years, 2 months
segatex-5.30 released
by Shintaro Fujiwara
I released segatex-5.30.
Incorporated aureport.
almost all the options you can enjoy.
http://sourceforge.net/projects/segatex/
#######################################
About segatex
segatex is a program even if not knowing much about SELinux commands, can
easily set SELinux commands by GUI. Written in C++. Requires Qt ( qt-devel
package ).
#######################################
--
http://intrajp.no-ip.com/ Home Page
16 years, 2 months
SELinux PHP setup, how ?
by Kuang-Chun Cheng
Hi,
I'm new to RH5.x/SELinux.
I have a simple PHP script which will call passthru() or exec() to
invoke "/bin/ls" or other external
commands to do some taskes. The SELinux (targeted policy) deny the
action by default.
Following the message in sealert which ask me to relabel /bin/ls
to allow httpd to invoke /bin/ls from my PHP (ls.php) ... well, it's OK ... but
I'm wondering if I can only limit invoking "/bin/ls" from ONLY my "ls.php".
So, other PHP still can't call exec() to invoke "/bin/ls".
Is this possible in targeted policy ?
Thanks
KC
16 years, 2 months