Getting a RuntimeError: Invalid argument from _seinfo
by Frank Licea
I'm on a fresh installation of Fedora 14 and I'm encountering an error when
I use the `sandbox` policy script. I'm would like to know if there are any
others who are getting the same issue that I am.
Using the sandbox policy with any command (for example):
`sandbox ls`
`sandbox`
Always returns the following error message:
Traceback (most recent call last):
File "/usr/bin/sandbox", line 443, in <module>
rc = sandbox.main()
File "/usr/bin/sandbox", line 428, in main
self.__parse_options()
File "/usr/bin/sandbox", line 251, in __parse_options
types = "\t" + "\n\t".join(setools.seinfo(setools.ATTRIBUTE,
"sandbox_type")[0]['types'])
File "/usr/lib/python2.7/site-packages/setools/__init__.py", line 49, in
seinfo
dict_list = _seinfo.seinfo(setype, name)
RuntimeError: Invalid argument
Anyone else getting this or just me?
13 years, 4 months
F13: nautilus & mmap
by Dan Thurman
Not sure what this means, but it sound omimous...
Using the latest updates.
==================================================
Summary:
Your system may be seriously compromised! /usr/bin/nautilus (deleted)
attempted
to mmap low kernel memory.
Detailed Description:
SELinux has denied the nautilus the ability to mmap low area of the kernel
address space. The ability to mmap a low area of the address space, as
configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps
protect against exploiting null deref bugs in the kernel. All
applications that
need this access should have already had policy written for them. If a
compromised application tries modify the kernel this AVC would be generated.
This is a serious issue. Your system may very well be compromised.
Allowing Access:
Contact your security administrator and report this issue.
Additional Information:
Source Context
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Context
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
023
Target Objects None [ memprotect ]
Source nautilus
Source Path /usr/bin/nautilus (deleted)
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.7.19-74.fc13
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name mmap_zero
Host Name (removed)
Platform Linux <host>.<domain>.com
2.6.34.7-61.fc13.i686 #1 SMP
Tue Oct 19 04:42:47 UTC 2010 i686 i686
Alert Count 1186
First Seen Thu 09 Dec 2010 12:08:59 PM PST
Last Seen Thu 09 Dec 2010 12:13:09 PM PST
Local ID aba9eed1-e6cf-48cb-80c4-88ccf2d90f43
Line Numbers
Raw Audit Messages
node=<host>.<domain>.com type=AVC msg=audit(1291925589.462:92406): avc:
denied { mmap_zero } for pid=26679 comm="nautilus"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=memprotect
node=<host>.<domain>.com type=SYSCALL msg=audit(1291925589.462:92406):
arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=a000 a2=3 a3=22
items=0 ppid=2663 pid=26679 auid=500 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="nautilus"
exe=2F7573722F62696E2F6E617574696C7573202864656C6574656429
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
13 years, 4 months
Nero for Linux & rpm initial labels
by Jorge Fábregas
Hi,
I installed the latest "Nero for Linux" (version 4) and noticed that rpm
labeled all files in /usr/lib/nero/lib* as textrel_shlib_t.. However, there's
no reference to this path in file_contexts and when I do a restorecon of these
files they get labeled as "lib_t" (as I would expect since there's no regex in
files_context for these).
I thought that what made rpm SELinux-aware was that it somehow consulted the
file_contexts (or a library called by rpm) but this is not the case in the
above example. Is it that rpm has some hardcoded rules to label some files in
/usr/lib/ as textrel_shlib_t regardless of what's in the file_contexts?
BTW, I had to add some regular expressions to the local file_contexts in order
to label some Nero libs as textrel_shlib_t for the ones located in
/usr/lib/nero/plug-ins/lib* as I got many AVCs when using the program.
There's one regex in file_contexts for Nero:
/usr/lib(64)?/nero/plug-ins/libMP3\.so(\.[^/]*)* --
system_u:object_r:textrel_shlib_t:s0
...but there are other libs in that directory (besides the MP3 one) that need
textrel_shlib_t. I ddin't file a bug report as I'm on Fedora 12 (it reached
its end of life). I'll check again if this happens when I install Fedora 14.
Thanks,
Jorge
13 years, 5 months
No AVC when sshd is mislabeled
by Jorge Fábregas
Hi,
On my Fedora 12 system I changed - on purpose - the label for the sshd binary.
I gave it httpd_exec_t and tried to start it with the service command to see
what happens. I got:
Starting sshd: Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key
..which is expected as "httpd_t" doesn't have access to these files.
My question is: Why don't I get any AVC errors for this? I was expecting
something like "httpd_t is ttrying to read files labeled as sshd_key_t..."
There's nothing in /var/log/audit/audit.log (I'm using auditd).
Are there any "dontaudit" rules for these types of access that causes SELinux
not to log these?
Regards,
Jorge
13 years, 5 months
selinux policy for encrypted files
by Roberto Sassu
Hi all
i want to write a policy for encrypted files.
In order to do this i created some new types which have the
name of the correspondent type used for non encrypted files,
with the prefix 'encrypted_'.
Then i need to define the policy for applications that need to
use these new types which is very similar to this defined
for original types, except that i want to take rules only
for the 'dir' and 'file' class.
What this the best way to define the policy? Do i have
to duplicate all required interfaces/templates or can i reuse
the existent code, for instance by adding a new parameter?
I will show an example of what i'm trying to define.
New type: encrypted_etc_t;
Example interface:
interface(`files_list_etc',`
gen_require(`
type etc_t;
')
allow $1 etc_t:dir list_dir_perms;
')
Added interface:
interface(`files_list_encrypted_etc',`
gen_require(`
type encrypted_etc_t;
')
allow $1 encrypted_etc_t:dir list_dir_perms;
')
13 years, 5 months
The concept of unconfined_t
by Jorge Fábregas
Hi,
I'm wondering about unconfined_t...
Is it that, for unconfined_t, there are a bunch of "allow rules" for every
type of object and every available type? Is there anything unconfined_t can't
do?
Thanks,
Jorge
13 years, 5 months
Re: avc: smartcard token login
by Dominick Grift
Reference:
http://lists.fedoraproject.org/pipermail/selinux/2010-December/013294.html
This may be more appropriate if other login programs need this as well.
Signed-off-by: Dominick Grift <domg472(a)gmail.com>
---
:100644 100644 6521109... ceadd00... M policy/modules/system/authlogin.if
policy/modules/system/authlogin.if | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 6521109..ceadd00 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -189,6 +189,12 @@ interface(`auth_login_pgm_domain',`
')
optional_policy(`
+ openct_stream_connect($1)
+ openct_signull($1)
+ openct_read_pid_files($1)
+ ')
+
+ optional_policy(`
corecmd_exec_bin($1)
storage_getattr_fixed_disk_dev($1)
mount_domtrans($1)
--
1.7.3.2
13 years, 5 months
avc: smartcard token login
by Mr Dash Four
When I try to log in (via a terminal) using smartcard token managed by
openct I get the following AVC:
type=AVC msg=audit(1291494642.695:5): avc: denied { search } for
pid=1651 comm="login" name="openct" dev=dm-0 ino=9737
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:object_r:openct_var_run_t:s0 tclass=dir
type=SYSCALL msg=audit(1291494642.695:5): arch=40000003 syscall=5
success=no exit=-13 a0=bfee6f9c a1=0 a2=3ad326 a3=0 items=0 ppid=1
pid=1651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login"
subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
When I put SELinux in permissive mode I found out that openct, via
/bin/login, is trying to access its status file (/var/run/openct/status):
type=AVC msg=audit(1291510211.246:10): avc: denied { search } for
pid=1656 comm="login" name="openct" dev=dm-0 ino=4248
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:object_r:openct_var_run_t:s0 tclass=dir
type=AVC msg=audit(1291510211.246:10): avc: denied { read } for
pid=1656 comm="login" name="status" dev=dm-0 ino=57346
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file
type=AVC msg=audit(1291510211.246:10): avc: denied { open } for
pid=1656 comm="login" name="status" dev=dm-0 ino=57346
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1291510211.246:10): arch=40000003 syscall=5
success=yes exit=5 a0=bfaf597c a1=0 a2=ab1326 a3=0 items=0 ppid=1
pid=1656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login"
subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1291510211.277:11): avc: denied { getattr } for
pid=1656 comm="login" path="/var/run/openct/status" dev=dm-0 ino=57346
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:object_r:openct_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1291510211.277:11): arch=40000003 syscall=197
success=yes exit=0 a0=5 a1=bfaf587c a2=3a5ff4 a3=3 items=0 ppid=1
pid=1656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=tty1 ses=4294967295 comm="login" exe="/bin/login"
subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
The Linux policy I am using is the latest for FC13. My /etc/pam.d/login
file is:
#%PAM-1.0
auth sufficient pam_pkcs11.so
#auth [success=done authinfo_unavail=ignore ignore=ignore
default=die] pam_pkcs11.so
auth [user_unknown=ignore success=ok ignore=ignore default=bad]
pam_securetty.so
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed
in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
-session optional pam_ck_connector.so
pam_pkcs11.so is used by openct to perform the actual login and
appropriate mapping. Any ideas - should I report this as a bug?
13 years, 5 months