MySQL-5.1.31 / mysql-server-community
by Per Sjoholm
I installed
MySQL-server-5.1.31-0.glibc23.i386.rpm
MySQL-client-5.1.31-0.glibc23.i386.rpm
MySQL-shared-compat-5.1.31-0.glibc23.i386.rpm
MySQL-devel-5.1.31-0.glibc23.i386.rpm
on Fedora 9
There are some selinux issues, does anyone have a working policy ?
15 years, 2 months
samba nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t)
by Per Sjoholm
On CentOS 5.2
The server is answering on different netbios names.
SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t)
in smb.conf the include files is in 2 halves. One for global config and one for shares/aliases
I have include = /etc/samba/smb.%L.alias to get differnt shares/alias depending netbios name
the alias contains
[name]
...
[name2]
...
I link asen20 to ASEN20 to allow netbios name
# ls -Z /etc/samba/smb*
-r--r--r-- root root root:object_r:samba_etc_t /etc/samba/smb.asen20.alias
lrwxrwxrwx root root root:object_r:samba_etc_t /etc/samba/smb.ASEN20.alias -> smb.asen20.alias
/var/log/message
Feb 22 11:18:29 dox nmbd[4689]: become_domain_master_browser_bcast: querying subnet 192.168.1.6 for domain master
browser on workgroup OASEN
Feb 22 11:18:31 dox setroubleshoot: SELinux is preventing the samba daemon from serving r/o local files to remote
clients. For complete SELinux messages. run sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76
Feb 22 11:18:31 dox last message repeated 2 times
Feb 22 11:18:31 dox setroubleshoot: SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t). For
complete SELinux messages. run sealert -l 350c8d95-e127-4a23-b2a1-455771106aeb
setting setsebool -P samba_export_all_ro=1 as advised in sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76
does not help
# sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76
Summary:
SELinux is preventing the samba daemon from serving r/o local files to remote
clients.
Detailed Description:
SELinux has preventing the samba daemon (smbd) from reading files on the local
system. If you have not exported these file systems, this could signals an
intrusion.
Allowing Access:
If you want to export file systems using samba you need to turn on the
samba_export_all_ro boolean: "setsebool -P samba_export_all_ro=1".
The following command will allow this access:
setsebool -P samba_export_all_ro=1
Additional Information:
Source Context root:system_r:smbd_t
Target Context root:object_r:samba_etc_t
Target Objects smb.ASEN20.alias [ lnk_file ]
Source smbd
Source Path /usr/sbin/smbd
Port <Unknown>
Host dox.oasen.dyndns.org
Source RPM Packages samba-3.0.28-1.el5_2.1
Target RPM Packages
Policy RPM selinux-policy-2.4.6-137.1.el5
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name samba_export_all_ro
Host Name dox.oasen.dyndns.org
Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1
SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64
Alert Count 6
First Seen Sun Feb 22 11:01:48 2009
Last Seen Sun Feb 22 11:18:29 2009
Local ID 55450fa9-b52d-4224-ad52-58b0b9fc4b76
Line Numbers
Raw Audit Messages
host=dox.oasen.dyndns.org type=AVC msg=audit(1235297909.562:32001): avc: denied { read } for pid=4685 comm="smbd"
name="smb.ASEN20.alias" dev=sdc3 ino=2247782 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:samba_etc_t:s0
tclass=lnk_file
host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235297909.562:32001): arch=c000003e syscall=4 success=no exit=-13
a0=7fffa6dcac10 a1=7fffa6dcab60 a2=7fffa6dcab60 a3=2b560ee731f0 items=0 ppid=4684 pid=4685 auid=0 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5386 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0
key=(null)
# sealert -l 350c8d95-e127-4a23-b2a1-455771106aeb
Summary:
SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t).
Detailed Description:
SELinux denied access requested by nmbd. It is not expected that this access is
required by nmbd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for smb.ASEN20.alias,
restorecon -v 'smb.ASEN20.alias'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context root:system_r:nmbd_t
Target Context root:object_r:samba_etc_t
Target Objects smb.ASEN20.alias [ lnk_file ]
Source nmbd
Source Path /usr/sbin/nmbd
Port <Unknown>
Host dox.oasen.dyndns.org
Source RPM Packages samba-3.0.28-1.el5_2.1
Target RPM Packages
Policy RPM selinux-policy-2.4.6-137.1.el5
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name dox.oasen.dyndns.org
Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1
SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64
Alert Count 6
First Seen Sun Feb 22 11:01:48 2009
Last Seen Sun Feb 22 11:18:29 2009
Local ID 350c8d95-e127-4a23-b2a1-455771106aeb
Line Numbers
Raw Audit Messages
host=dox.oasen.dyndns.org type=AVC msg=audit(1235297909.628:32004): avc: denied { read } for pid=4688 comm="nmbd"
name="smb.ASEN20.alias" dev=sdc3 ino=2247782 scontext=root:system_r:nmbd_t:s0 tcontext=root:object_r:samba_etc_t:s0
tclass=lnk_file
host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235297909.628:32004): arch=c000003e syscall=4 success=no exit=-13
a0=7fffca8af300 a1=7fffca8af250 a2=7fffca8af250 a3=0 items=0 ppid=4687 pid=4688 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts6 ses=5386 comm="nmbd" exe="/usr/sbin/nmbd" subj=root:system_r:nmbd_t:s0 key=(null)
15 years, 2 months
VMware Server blocked but no AVCs
by Arthur Dent
Hello all,
I use VMware Server on my F9 box for running other OSs in a virtualised
environment.
I used to use the VMware-server-1.0.* range, but recently upgraded to
VMware-server-2.0.0. This version has a strange web interface rather
than operating as an individual application as before. The interface
loads and presents a log-on screen.
It fails here with any attempt to log in to the server met with the
error:
"The server is not responding. Please check that the server is running
and accepting connections."
The strange thing is:
There are *NO* AVCs
It does NOT work in permissive mode
It DOES work when selinux is *disabled*
It also causes the system to hang when shutting down the PC.
Does anyone know of a workaround or fix, or do I need to revert to v.
1.0.7 ?
Thanks in advance
Mark
15 years, 2 months
Policy for Embedded Machine
by Spann, John W.
All,
I am working with a 2.6.27.14 kernel on an embedded PowerPC 440 board.
Aside from the operating system and some drivers and libraries, there
will be a few custom applications written which I will need to write
policy for.
I am looking for the best policy writing approach for the environment.
Seems like I could take the latest policy distributed with Fedora and
start ripping out stuff or start with nothing and build up. Not having
written much policy yet, I am seeking advice on the best approach.
I also have read about SELinux Policy Editor (SEEdit) and wonder if this
might be a good approach for a new policy writer.
Thoughts...
SpannMan
15 years, 2 months
Rawhide Cant' update crontab using gnome-schedule.
by Frank Murphy
Gnome-Schedule opens, but cannot update any tasks.
~/audit/.log
doesn't show any specific denials.
Hpappens as pure root, (sudo, su) user
sudo gnome-schedule
Access denied by SELinux, must be privileged to use -u
15 years, 2 months
Getting a LOT of "hotplug_t" errors.
by Dan Thurman
It seems, that these are appearing whenever I am downloading files
from an F9/10 NTFS samba shared file to a remote machine. Is there
anything I can do?
====================================================================
Count Description
====================================================================
636 SELinux is preventing pidof (hotplug_t) "sys_nice" hotplug_t.
=================
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1235083401.426:52788): avc:
denied { sys_nice } for pid=30760 comm="pidof" capability=23
scontext=system_u:system_r:hotplug_t:s0
tcontext=system_u:system_r:hotplug_t:s0 tclass=capability
node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.426:52788):
arch=40000003 syscall=3 success=yes exit=203 a0=4 a1=b800e000 a2=400
a3=8177628 items=0 ppid=30725 pid=30760 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="pidof" exe="/sbin/killall5" subj=system_u:system_r:hotplug_t:s0
key=(null)
====================================================================
Count Description
====================================================================
636 SELinux is preventing pidof (hotplug_t) "sys_ptrace" hotplug_t.
=================
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1235083401.426:52789): avc:
denied { sys_ptrace } for pid=30760 comm="pidof" capability=19
scontext=system_u:system_r:hotplug_t:s0
tcontext=system_u:system_r:hotplug_t:s0 tclass=capability
node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.426:52789):
arch=40000003 syscall=85 success=no exit=-13 a0=bfc0dcb8 a1=81777b8
a2=1000 a3=bfc0dbbe items=0 ppid=30725 pid=30760 auid=4294967295 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="pidof" exe="/sbin/killall5"
subj=system_u:system_r:hotplug_t:s0 key=(null)
====================================================================
Count Description
====================================================================
212 SELinux is preventing ifdown-ipv6 (hotplug_t) "read" to net
(proc_net_t).
=================
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1235083401.406:52783): avc:
denied { read } for pid=30748 comm="ifdown-ipv6" name="net" dev=proc
ino=4026531869 scontext=system_u:system_r:hotplug_t:s0
tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file
node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.406:52783):
arch=40000003 syscall=195 success=no exit=-13 a0=865d3b0 a1=bfa834d0
a2=67fff4 a3=865d3b0 items=0 ppid=30725 pid=30748 auid=4294967295 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="ifdown-ipv6" exe="/bin/bash"
subj=system_u:system_r:hotplug_t:s0 key=(null)
Thanks,
Dan
15 years, 2 months
network-scripts problem
by Antonio Olivares
Dear fellow testers,
I encountered network functions/network-scripts problem :(
[root@localhost ~]# dhclient eth0
Missing /etc/sysconfig/network-scripts/network-functions, exiting.
Missing /etc/sysconfig/network-scripts/network-functions, exiting.
Missing /etc/sysconfig/network-scripts/network-functions, exiting.
^C
[root@localhost ~]# restorecon -v 'network-scripts'
restorecon: stat error on network-scripts: No such file or directory
[root@localhost ~]# restorecon -v network-scripts
restorecon: stat error on network-scripts: No such file or directory
[root@localhost ~]# dhclient eth0
Missing /etc/sysconfig/network-scripts/network-functions, exiting.
^C
You have new mail in /var/spool/mail/root
[root@localhost ~]# service network status
Configured devices:
lo eth0 eth1
Currently active devices:
lo eth1 eth0
[root@localhost ~]# service network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: net.ipv4.ip_forward = 0
[ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0:
Determining IP information for eth0...Missing /etc/sysconfig/network-scripts/network-functions, exiting.
^C
Got also greeted by selinux alert:
Summary:
SELinux is preventing dhclient-script (dhcpc_t) "search" to network-scripts
(net_conf_t).
Detailed Description:
SELinux denied access requested by dhclient-script. It is not expected that this
access is required by dhclient-script and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for network-scripts,
restorecon -v 'network-scripts'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:dhcpc_t:SystemLow-SystemHigh
Target Context system_u:object_r:net_conf_t
Target Objects network-scripts [ dir ]
Source dhclient-script
Source Path /bin/bash
Port <Unknown>
Host localhost
Source RPM Packages bash-4.0-0.4.rc1.fc11
Target RPM Packages
Policy RPM selinux-policy-3.6.6-1.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name localhost
Platform Linux localhost 2.6.29-0.124.rc5.fc11.i586 #1 SMP
Mon Feb 16 21:15:37 EST 2009 i686 athlon
Alert Count 3
First Seen Tue 17 Feb 2009 09:32:55 AM CST
Last Seen Tue 17 Feb 2009 09:33:55 AM CST
Local ID 878e2548-4687-45f0-8115-d40144370614
Line Numbers
Raw Audit Messages
node=localhost type=AVC msg=audit(1234884835.408:131): avc: denied { search } for pid=11969 comm="dhclient-script" name="network-scripts" dev=dm-0 ino=28344324 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir
node=localhost type=SYSCALL msg=audit(1234884835.408:131): arch=40000003 syscall=195 success=no exit=-13 a0=8463100 a1=bfb25c2c a2=b45ff4 a3=8463102 items=0 ppid=11968 pid=11969 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient-script" exe="/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)
I applied it, but did not work :(
restorecon -v 'network-scripts'
Regards,
Antonio
15 years, 2 months
SELinux doesn't understand sendmail<->spamassassin interactions
by G.Wolfe Woodbury
Similar to the mailman problem, SELinux doesn't understand the
interactions between sendmail and spamassassin. In this case, however,
the spamassassin stuff quits working completely.
This installation of spamassassin uses the "spamc" daemon, and mails are
passed to that daemon from user's .procmailrc files. (This allows the
user to opt-in/opt-out of spam detection on their own by altering their
own .procmailrc file.)
SELinux complains a lot because every message passwd from the user
delivery chain gets a denial because "sendmail" (actually procmail) has
no permissions to write the spamassassin spamc socket:
type=AVC msg=audit(1234094494.975:3163): avc: denied { read write }
for pid=612 comm="spamc" path="socket:[2166561]" dev=sockfs ino=2166561
scontext=system_u:system_r:spamc_t:s0
context=system_u:system_r:sendmail_t:s0
tclass=unix_stream_socket
I don't fully understand some of the concepts used in SELinux, and am
running F10+updates in "permissive" mode so that things work but I get
notified of "abnormal" events.
Additionally, other aspects of the sendmail/spamassassin interaction
attract SELinux complaints. (getattr of spamc socket, etc) but I geet
thousands of complaints about the read/write of the spamc socket.
(about 8 active e-mail accounts, several of which are spam traps.)
Thanks for your attention and patience.
--
G.Wolfe Woodbury
15 years, 2 months
Suitable type for DNSSEC private keys
by Göran Uddeborg
I'm upgrading my DNS system to DNSSEC, and now I have public and
private key files in /var/named. They of course got the type
named_zone_t which is the default in that directory.
For the public keys, that is appropriate. The DNS server needs to
read them, and they do contain zone data.
But it should not be able to read the private keys, and it can not
because of MAC. It seemed prudent to me to also give them another
type, just in case.
But what type would be appropriate? Just something generic like
etc_t? Or does it exist some more specific type that would be more
appropriate. I wasn't planning to add any extra policy modules or
types just for this, only to add a fcontext pattern for these files.
Does anybody have any good suggestions?
15 years, 2 months
Rawhide: SELinux is preventing dhclient-script (dhcpc_t) "getattr"
by Frank Murphy
Summary:
SELinux is preventing dhclient-script (dhcpc_t) "getattr" to
/etc/sysconfig/network-scripts (net_conf_t).
Detailed Description:
SELinux denied access requested by dhclient-script. It is not expected that this
access is required by dhclient-script and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for /etc/sysconfig/network-scripts,
restorecon -v '/etc/sysconfig/network-scripts'
If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
Target Context system_u:object_r:net_conf_t:s0
Target Objects /etc/sysconfig/network-scripts [ dir ]
Source dhclient-script
Source Path /bin/bash
Port <Unknown>
Host torrent01.frankly3d.local
Source RPM Packages bash-4.0-0.4.rc1.fc11
Target RPM Packages initscripts-8.89-1
Policy RPM selinux-policy-3.6.6-1.fc11
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name torrent01.frankly3d.local
Platform Linux torrent01.frankly3d.local
2.6.29-0.124.rc5.fc11.i586 #1 SMP Mon Feb 16
21:15:37 EST 2009 i686 i686
Alert Count 22
First Seen Wed 18 Feb 2009 18:27:50 GMT
Last Seen Wed 18 Feb 2009 18:28:10 GMT
Local ID b0b1e5b5-49b2-4163-8d84-e7f08502aacb
Line Numbers
Raw Audit Messages
node=torrent01.frankly3d.local type=AVC msg=audit(1234981690.326:167):
avc: denied { getattr } for pid=31049 comm="dhclient-script"
path="/etc/sysconfig/network-scripts" dev=dm-3 ino=54
scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
tcontext=system_u:object_r:net_conf_t:s0 tclass=dir
node=torrent01.frankly3d.local type=SYSCALL
msg=audit(1234981690.326:167): arch=40000003 syscall=195 success=no
exit=-13 a0=80e653b a1=bfcb8e2c a2=6dfff4 a3=8a147e8 items=0
ppid=31032 pid=31049 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 ses=1 comm="dhclient-script" exe="/bin/bash"
subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)
------------------
I have run an audit2allow against this. But figured I should post anyway.
--
aMSN: Frankly3D
15 years, 2 months