yum-cron fails trying to mail a temporary file
by Vadym Chepkov
I got an interesting denial which took me a bit to figure out.
type=AVC msg=audit(1232788787.310:1787): avc: denied { read } for pid=9836 comm="mail" path="/var/run/yum-cron.EHQJws" dev=dm-3 ino=77843 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_run_t:s0 tclass=file
It comes from yum-cron package. What happens is a script starts from cron and creates a temporary file which inherits directory security context. Later it mails it using redirection syntax:
"mail $MAILTO < $YUMTMP"
mailx transitions to system_mail_t and is denied to read such a temporary file.
I don't think this is a unique script that has similar logic and I suspect some other directory needs to be used, but I didn't find any suitable in sources/sendmail.fc and before I create new type/directory I would like to know maybe there is more proper way to handle cases like this?
Thank you.
Sincerely yours,
Vadym Chepkov
15 years, 3 months
Does mcs work on rawhide correctly?
by KaiGai Kohei
I found a strange behavior with selinux-policy-3.6.3-8.fc11.noarch.
[root@masu ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
[root@masu ~]# touch aaa
[root@masu ~]# ls -Z aaa
-rw-r--r-- root root unconfined_u:object_r:admin_home_t:s0 aaa
[root@masu ~]# id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c31
[root@masu ~]# chcon -l s0:c0 aaa
chcon: failed to change context of `aaa' to `unconfined_u:object_r:admin_home_t:s0:c0': Operation not permitted
Why "s0-s0:c0.c31" cannot change the context from "s0" to "s0:c0"?
I could reproduce the matter after "semodule -B".
Is there anyone who can reproduce the matter?
--
KaiGai Kohei <kaigai(a)kaigai.gr.jp>
15 years, 3 months
SELinux in netbooted images
by Paulo Santos
Hi all,
I googled a bit about this, but didn't found anything so i decided to send
this email to get some information/help.
I have several servers running on a netbooted image, which on its base, does
not contain any selinux related packages.
Currently I'm installing on the beginning of the boot process the following
package:
Installing:
selinux-policy-targeted noarch 2.4.6-137.1.el5 updates 911
k
Installing for dependencies:
audit-libs-python x86_64 1.6.5-9.el5 base 75 k
diffutils x86_64 2.8.1-15.2.3.el5 base 211
k
libselinux-python x86_64 1.33.4-5.el5 base 59 k
libsemanage x86_64 1.9.1-3.el5 base 138 k
policycoreutils x86_64 1.33.12-14.el5 base 631 k
selinux-policy noarch 2.4.6-137.1.el5 updates 381 k
In the end i still end up with SELinux disabled.
My question is the following.
How do i enable SELinux already in runtime, after the boot process finished?
(or do i need to modify the base image, to contain the selinux packages)
I apologize if this information can be found somewhere else, and if this is
not the correct place to ask the question.
Thanks,
Paulo
15 years, 3 months
denied avc's on rawhide: part 2
by Antonio Olivares
Dear list,
I get the following avc's on rawhide. I had 7 days without internet connection, updated and now I get the following ones. Setroubleshoot does not kick in :(
output done by dmesg:
type=1400 audit(1232555999.381:4): avc: denied { write } for pid=1590 comm="ip6tables-resto" path="/0" dev=devpts ino=3 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file
type=1400 audit(1232556094.962:5): avc: denied { create } for pid=2654 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir
type=1400 audit(1232556101.971:6): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.972:7): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.972:8): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.973:9): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.974:10): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.975:11): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.975:12): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.976:13): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.977:14): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556101.977:15): avc: denied { search } for pid=2694 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
__ratelimit: 234 callbacks suppressed
type=1400 audit(1232556109.359:94): avc: denied { search } for pid=2724 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
type=1400 audit(1232556109.359:95): avc: denied { search } for pid=2724 comm="hal-acl-tool" name="PolicyKit-public" dev=dm-0 ino=3407878 scontext=system_u:system_r:hald_acl_t:s0 tcontext=system_u:object_r:polkit_var_lib_t:s0 tclass=dir
fuse init (API version 7.11)
Regards,
Antonio
15 years, 3 months
plymouthd avcs in MLS
by Joe Nall
type=AVC msg=audit(1231458433.619:3): avc: denied { execute } for
pid=1 comm="init" name="plymouth" dev=rootfs ino=73
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:root_t:s0 tclass=file
type=AVC msg=audit(1231458433.621:4): avc: denied { read } for
pid=723 comm="init" name="plymouth" dev=rootfs ino=73
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:root_t:s0 tclass=file
type=AVC msg=audit(1231458433.621:4): avc: denied
{ execute_no_trans } for pid=723 comm="init" path="/bin/plymouth"
dev=rootfs ino=73 scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:root_t:s0 tclass=file
type=AVC msg=audit(1231458433.623:5): avc: denied { getattr } for
pid=723 comm="plymouth" path="/etc/ld.so.cache" dev=rootfs ino=122
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:root_t:s0 tclass=file
type=AVC msg=audit(1231458433.625:6): avc: denied { search } for
pid=695 comm="plymouthd" name="lib" dev=dm-0 ino=555970
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
type=AVC msg=audit(1231458433.625:6): avc: denied { read } for
pid=695 comm="plymouthd" name="boot-duration" dev=dm-0 ino=564304
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:var_lib_t:s0 tclass=file
type=AVC msg=audit(1231458433.632:7): avc: denied { getattr } for
pid=695 comm="plymouthd" path="/var/lib/plymouth/boot-duration"
dev=dm-0 ino=564304 scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:var_lib_t:s0 tclass=file
type=AVC msg=audit(1231458434.550:20): avc: denied { read } for
pid=695 comm="plymouthd" path="/ptmx" dev=tmpfs ino=354
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:ptmx_t:s0 tclass=chr_file
type=AVC msg=audit(1231458434.550:21): avc: denied { write } for
pid=695 comm="plymouthd" path="/tty1" dev=tmpfs ino=357
scontext=system_u:system_r:kernel_t:s15:c0.c1023
tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file
with the last avc repeated ~3000 times a second forever in enforcing.
Should plymouthd have a dedicated type or should tty1 be SystemHigh?
joe
15 years, 3 months
Fedora 10 Selinux Denies Firefox Ability to Upload Picture
by Ole Ersoy
Hi,
I tried uploading a picture to facebook, and it appears that selinux was denying firefox the ability to read the image. The image has the following context:
rw-rw-r-- ole ole unconfined_u:object_r:user_home_t:s0 dsc06702.jpg
I looked in /var/log/messages and /var/log/audit/audit.log for a denial message, but did not see one (Silent denial?). The image uploaded fine after running:
setenforce 0
though, so I assume it's SELinux. Thought I'd mention this in case it's something that can make a secure Fedora experience simpler for the average desktop user.
Cheers,
- Ole
15 years, 3 months
Samba Sharing
by Frank Murphy
sorry typo should read:
chcon -R -t samba_share_t /myfiles ( a folder immediately under /
owned by me and accessible to @samba users)
The run
semanage fcontext -a -t samba_share_t ’/myfiles(/.*)?’
to hold the context after a full relabel?
Basically the users need r\w to /myfiles (their own sub folders of)
Frank
15 years, 3 months
Samba Sharing
by Frank Murphy
Having had a look at:
http://danwalsh.livejournal.com/14195.html
and smb.conf
I won't to share a dir+ subs on my samba\ssh server.
So I would
chcon -R -t samba_share_t /myfiles ( a folder immediately under root,
owned by me and accessible to @samba users)
The run
semanage fcontext -a -t samba_share_t ’/myfiles(/.*)?’
to hold the context after a full relabel?
Basically the users need r\w to /myfiles (their own sub folders of)
Frank
15 years, 3 months
libgpod HAL callout and SELinux denials
by Todd Zullinger
Hi,
I help maintain libgpod upstream and in Fedora. We install a hal
callout¹ to handle newer iPods, which make some very useful and
required information accessible only via a SCSI query of the iPod.
The callout is meant to make the needed query and store the
information retrieved (which is is an XML file) on the iPod where it
can subsequently be read by a normal user.
To do this, the callout mounts the iPod to a temporary location,
queries the device, saves the XML, and unmounts. This causes a number
of denials which I will attach. I'd like to get some help in
determining what things need fixed in the callout code and what things
need policy changes. If I need to, I can package a policy module in
libgpod, though having it in the main selinux policy would be
preferable I think.
The libgpod callout code is in:
https://gtkpod.svn.sourceforge.net/svnroot/gtkpod/libgpod/trunk/tools/
Most of the interesting code is in hal-callout.c, but the other files
are probably worth a look as well.
FWIW, the callout currently uses /tmp/ipodXXXXXX (via mkdtemp) as the
temporary mount point. I did try moving that to /media to see if that
worked any better, but AFAICT, it caused the same denials. Moving the
temp mount out of /tmp is not a problem (and is probably a good idea
anyway).
Any help will be much appreciated.
¹ http://people.freedesktop.org/~david/hal-spec/hal-spec.html#device-proper...
--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
We can't be so fixated on our desire to preserve the rights of
ordinary Americans.
-- William Jefferson Clinton (USA TODAY, 11 March 1993, page 2A)
15 years, 3 months
running rsync as root to preserve contexts
by Murray McAllister
Hi,
I am not sure how rsync works, but should it have to be run as the root
user to preserve contexts?
$ pwd
/home/murray
$ mkdir other
$ ls -dZ other/
drwxrwxr-x murray murray unconfined_u:object_r:user_home_t:s0 other/
$ touch file && chcon -t samba_share_t file
$ ls -Z file
-rw-rw-r-- murray murray unconfined_u:object_r:samba_share_t:s0 file
$ rsync -aXHv file other/
sending incremental file list
file
sent 122 bytes received 31 bytes 102.00 bytes/sec
total size is 0 speedup is 0.00
$ ls -Z other/
-rw-rw-r-- murray murray unconfined_u:object_r:user_home_t:s0 file
# samba_share_t type was not preserved.
$ sudo rsync -aXHv file other/
sending incremental file list
sent 128 bytes received 17 bytes 290.00 bytes/sec
# running as sudo sends more bytes (previously 122).
total size is 0 speedup is 0.00
$ ls -Z other/
-rw-rw-r-- murray murray unconfined_u:object_r:samba_share_t:s0 file
# samba_share_t type was preserved.
I am using:
rsync-3.0.4-0.fc10.i386
openssh-askpass-5.1p1-3.fc10.i386
openssh-5.1p1-3.fc10.i386
openssh-clients-5.1p1-3.fc10.i386
libssh2-0.18-7.fc9.i386
openssh-server-5.1p1-3.fc10.i386
selinux-policy-3.5.13-38.fc10.noarch
selinux-policy-targeted-3.5.13-38.fc10.noarch
Cheers.
15 years, 3 months