Selinux Alerts
by Anthony Davis
Hi guys,
Im getting selinux alerts logged to audit.log, is there anyway to
parse the alerts via the command line to get human readable alerts?
I have read that you can install setroubleshoot, but installs a huge
list of dependencies for use with the gui, but i dont have a gui
installed.
Any ideas?
Tony
14 years, 3 months
Selinux alerts
by Jouni Viikari
I wonder why I started to get tons of this kind of *warnings*:
SELinux is preventing /usr/lib/nagios/plugins/check_http "create"
access.
Detailed Description
[check_imap has a permissive type (nagios_system_plugin_t). This access
was not denied.]
SELinux denied access requested by check_http. It is not expected that
this access is required by check_http and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional
access.
If I remember correctly this started when I did
#restorecon /usr/lib/nagios/plugins
BR,
Jouni
#rpm -qi selinux-policy
Name : selinux-policy
Version : 3.6.32
Release : 66.fc12
...
14 years, 3 months
A really simple question
by Usman S. Ansari
I have written a driver for Linux kernel, in this driver I am using sk_security field for driver's internal data structure. This means that if SELinux is enabled, it will have conflict with my driver. For this reason, I run my driver with SELinux disabled.
I want to know if it is possible to, only enable security on files and not on network objects ?
>From what I have read about SELinux, it looks like this it possible, I just need conformation. And if this is possible, will SELinux need to use sk_security filed or not.
If this is wrong list, please let me know appropriate place.
Thanks.
14 years, 4 months
Home directories within /var
by Robert Nichols
On my system I have home directories in /var/home and bind mounted
to /home:
/var/home on /home type none (rw,bind)
Is there any way to prevent restorecon on /var from descending into
/var/home and destroying the normal home directory file contexts?
Reproducing all of file_contexts.homedirs in local policy is of course
unmaintainable.
--
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.
14 years, 4 months
selinux and smagent
by mark
I never did solve this, and I'm looking at it again. Selinux still gripes
(it's in permissive mode, or this would be more of a problem).
httpd_unified is on, which is what the *wrong* error message from selinux
tells me will fix this.
Given the info below, *should* I chcon (or semanage)
/var/log/httpd/smagent.log to the same type as the httpd error.log? Will
that make selinux happy?
mark, not happy with selinux
host=biblio type=AVC msg=audit(1262787360.769:5531): avc: denied { write
} for pid=1654 comm="LLAWP" path="/var/log/httpd/smagent.log" dev=sda3
ino=46107941 scontext=user_u:system_r:httpd_t:s0
tcontext=user_u:object_r:httpd_log_t:s0 tclass=file
ll -Z /var/log/httpd/smagent.log
-rw-r--r-- apache root user_u:object_r:httpd_log_t
/var/log/httpd/smagent.log
ll -Z /usr/local/opt/<blah>/webagent/bin/LLAWP
-rwxrwxr-x root root system_u:object_r:bin_t
/usr/local/opt/<blah>/webagent/bin/LLAWP
ll -Z /var/log/httpd/error_log
-rw-r--r-- root root system_u:object_r:httpd_log_t
/var/log/httpd/error_log
ll -Z /usr/sbin/httpd
-rwxr-xr-x root root system_u:object_r:httpd_exec_t /usr/sbin/httpd
14 years, 4 months
Move httpd root, selinux help
by Anthony Davis
Hi,
Wishing everyone a happy new year!
Can anyone point me in the right direction with a problem im having
with selinux and httpd please?
I have created a virtual host and have created the directory structure:
/vhosts/domain.tld/htdocs # Document root
/vhosts/domain.tld/logs # Log root
/vhosts/domain.tld/private # Private root
I have set the contexts and they display as:
[root@server htdocs]# ls -laZ /vhosts/domain.tld/htdocs
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 ..
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html
[root@server htdocs]# ls -laZ /vhosts/domain.tld/logs
drwxr-xr-x. root root unconfined_u:object_r:httpd_log_t:s0 .
drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 ..
so to me this looks like it has the right contexts.
when i try to start apache i get the following error:
[root@server htdocs]# /sbin/service httpd start
Starting httpd: Warning: DocumentRoot [/vhosts/domain.tld/htdocs] does
not exist
httpd: Could not reliably determine the server's fully qualified
domain name, using ::1 for ServerName
[FAILED]
now i know the directory exists, which confuses me. below are the error logs:
[root@server htdocs]# tail /var/log/httpd/error_log
(13)Permission denied: httpd: could not open error log file
/wb01/specialistdevelopment.com/www.specialistdevelopment.com/logs/error.log.
Unable to open logs
Can anyone help as i am really stuck.
Thankyou in advance!
Tony
14 years, 4 months
generating rules in permissive mode?
by sai ganesh
hi,
i have a query
if i want to start a completely custom made service .i have defined all the
transitions and types.now i need only the allow rules.
what is the difference between (going to permissive mode and checking the
logs to generate the entire set of policy's allow rules ) and ( generating
the allow rules one by one after updating the policy again and again in the
enforcing mode ).i find it easier to generate the entire set of allow rules
switching to permissive mode.is there any chance that i may miss a rule if i
switch to permissive mode and generate the rules from the logs or say i give
extra permissions ?
which is the preffered method?.
--
s.saiganesh
“The Linux philosophy is 'Laugh in the face of danger'. Oops. Wrong One. 'Do
it yourself'. Yes, that's it
14 years, 4 months
CentOS 5.4 + xinetd + sshd + SELinux issues
by Grzegorz Nosek
Hi all,
I have a problem trying to run sshd via xinetd on a CentOS 5.4 system
(I want to slap a tcpwrappers-style wrapper before sshd, so I need it
that way).
In permissive mode I can log in/out with the following failures reported
by audit2allow:
allow amanda_t consoletype_exec_t:file { execute execute_no_trans };
allow amanda_t devpts_t:chr_file { write ioctl };
allow amanda_t hostname_exec_t:file { execute execute_no_trans };
allow amanda_t shell_exec_t:file entrypoint;
I don't even have amanda installed, so the context is clearly bogus.
After a chat on #fedora-selinux it seems that sshd cannot find its
default context, so falls back to the first available one, which happens
to be something:something:amanda_t (the list is read from /selinux/user).
This operation is performed by sshd itself (as verified by strace).
I don't need Fort Knox type security but I'd like to use SELinux to
tighten down other parts of the system, so I'd really like to use the
enforcing mode.
Any hints? A good TFM to R will hopefully do.
Best regards,
Grzegorz Nosek
14 years, 4 months
Bug in bind.if - bind_admin
by Dominick Grift
Whoops sorry but similar bug apears in bind_admin:
bind_initrc_exec_t is non-existent; use named_initrc_exec_t instead.
init_labeled_script_domtrans($1, bind_initrc_exec_t)
bind, named... i know its confusing
thanks
14 years, 4 months
bug in bind.if - bind_initrc_domtrans
by Dominick Grift
I just stumbled on a bug:
Bad:
########################################
## <summary>
## Execute bind server in the bind domain.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
#
interface(`bind_initrc_domtrans',`
gen_require(`
type bind_initrc_exec_t;
')
init_labeled_script_domtrans($1, bind_initrc_exec_t)
Good:
########################################
## <summary>
## Execute bind server in the bind domain.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
#
interface(`bind_initrc_domtrans',`
gen_require(`
type bind_initrc_exec_t;
')
init_labeled_script_domtrans($1, named_initrc_exec_t)
')
Thanks
14 years, 4 months