clamd_use_jit on
by Frank Murphy
Boot up screen,
said I needed to run
setsebool -P clamd_use_jit on
for clamd.clamav
but as root in Terminal
$ setsebool -P clamd_use_jit on
libsepol.expand_filename_trans: Conflicting filename trans rules xvc9
kernel_t device_t : chr_file otype1:tty_device_t otype2:tty_device_t
libsepol.expand_module: Error during expand
libsemanage.semanage_expand_sandbox: Expand module failed
Could not change policy booleans
selinux-policy-targeted-3.10.0-55.fc16.noarch
--
Regards,
Frank Murphy
UTF_8 Encoded
Friend of fedoraproject.org
12 years, 5 months
incorrect type transition rules in fedora policy
by KaiGai Kohei
Hi, I noticed the selinux-policy of Fedora is not updated to the
latest upstream refpolicy in type_transition rules.
The attached file is a diff set of services/postgresql.te between the
upstream and selinux-policy-3.10.0-55.
It drops the following type_transition rules:
type_transition postgresql_t sepgsql_database_type:db_schema sepgsql_schema_t;
type_transition postgresql_t sepgsql_schema_type:db_table sepgsql_sysobj_t;
type_transition postgresql_t sepgsql_schema_type:db_sequence sepgsql_seq_t;
type_transition postgresql_t sepgsql_schema_type:db_view sepgsql_view_t;
type_transition postgresql_t sepgsql_schema_type:db_procedure
sepgsql_proc_exec_t;
And, it defines the rules incorrectly.
-type_transition sepgsql_admin_type sepgsql_schema_type:db_sequence
sepgsql_seq_t;
+type_transition sepgsql_admin_type sepgsql_schema_type:db_schema sepgsql_seq_t;
-type_transition sepgsql_admin_type sepgsql_schema_type:db_view sepgsql_view_t;
+type_transition sepgsql_admin_type sepgsql_view_type:db_view sepgsql_view_t;
Please fix them. Thanks,
--
KaiGai Kohei <kaigai(a)kaigai.gr.jp>
12 years, 5 months
customizable_types
by Artur Szymczak
Hi,
could some give me an real-world example, when I would like to use
customizable_types?
Regards
--
Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer
RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2
GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D
http://CodzienneChodzenieZBogiem.blogspot.com/
12 years, 6 months
selinux doesn't prevent php fopen to remote 80/tcp
by Marko Uskoković
Hello,
If I understand documentation correctly, SELinux should prevent php
scripts (running via mod_php) from opening remote urls with fopen
function
by default, that is when httpd_can_network_connect --> off
Here are the links that confirm that behavior in the past:
http://www.php.net/manual/en/function.fopen.php#56551
https://bugzilla.redhat.com/show_bug.cgi?id=164700
I've installed and updated Fedora 15 with no selinux modifications:
[root@localhost ~]# cat /etc/redhat-release
Fedora release 15 (Lovelock)
[root@localhost ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 26
Policy from config file: targeted
I've made three tests:
[root@localhost ~]# cat /var/www/html/marko1.php
<?php
$file = fopen ("http://www.example.com", "r");
if (!$file) {
echo "<p>Unable to open remote file.\n";
exit;
}
while (!feof ($file)) {
$line = fgets ($file, 1024);
echo ($line);
}
fclose($file);
?>
[root@localhost ~]# cat /var/www/html/marko2.php
<?php
$file = fopen ("http://10.11.12.13:31254/", "r");
if (!$file) {
echo "<p>Unable to open remote file.\n";
exit;
}
while (!feof ($file)) {
$line = fgets ($file, 1024);
echo ($line);
}
fclose($file);
?>
[root@localhost ~]# cat /var/www/html/marko3.php
<?php
exec ('wget http://www.example.com -O /tmp/example.html');
exec ('wget http://10.11.12.13:31254 -O /tmp/mail.html');
?>
IP 10.11.12.13 is a remote machine, with apache listening on tcp port 31254
and i can reach it with wget running under unconfined root account.
My httpd booleans are:
[root@localhost ~]# getsebool -a|grep http
allow_httpd_anon_write --> off
allow_httpd_mod_auth_ntlm_winbind --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_read_user_content --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_tmp_exec --> off
httpd_tty_comm --> on
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
named_bind_http_port --> off
and semanage -o - gives:
boolean -D
boolean -1 httpd_builtin_scripting
login -D
login -a -s unconfined_u -r 's0-s0:c0.c1023' __default__
login -a -s unconfined_u -r 's0-s0:c0.c1023' root
login -a -s system_u -r 's0-s0:c0.c1023' system_u
user -D
port -D
interface -D
node -D
fcontext -D
The problem is that opening marko1.php in browser gives me the html
found on http://www.example.com
and opening marko3.php produces the /tmp/example.html file on server
with the html found on http://www.example.com
The requests for http://10.11.12.13:31254/ both php's and wget-s, are
not successful and are logged logged like:
type=AVC msg=audit(1320370308.125:103): avc: denied { name_connect }
for pid=1842 comm="wget" dest=31254
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1320370308.980:104): avc: denied { name_connect }
for pid=1656 comm="httpd" dest=31254
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
mod_proxy is commented and not enabled (which is default in F15, AFAIK).
Am I missing something or has the documentation missed this little fact? ;)
--
Marko Uskokovic
Mainstream d.o.o.
www.mainstream.rs
12 years, 6 months
Object Classes and kernel
by Artur Szymczak
Hi,
how can kernel distinguishes objects in system and object in policy? I
mean. How kernel know, that this allow rule is correct to /etc/passwd
and not correct for /etc itself (as dir):
allow httpd_t etc_t : file { ioctl read getattr lock open } ;
Ok, it is written in policy, that it is a file, but it is only a object
class. Is it defined somewher, that object class 'file' is file, and
object class 'dir' is directory?
How can I create new object class named foo, which will be usedd for
named_pipe?
Regards
--
Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer
RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2
GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D
http://CodzienneChodzenieZBogiem.blogspot.com/
12 years, 6 months
Spamassassin / GPG Problem
by Arthur Dent
Hello all,
I use Spamassassin on my server. It regularly downloads updated signatures
and checks the download using GPG. Since I upgraded to
selinux-policy-targeted-3.9.16-44.fc15.noarch this week I have been
getting errors reported by Spamassassin:
========8<==============================================================
error: GPG validation failed!
The update downloaded successfully, but the GPG signature verification
failed.
channel: GPG validation failed, channel failed
02-Nov-2011 06:05:06: SpamAssassin: Update available, but download or
extract failed
========8<==============================================================
I also get the an SELinux AVC (full details below).
What is the best way to deal with this?
Thanks in advance...
Mark
========8<==============================================================
SELinux is preventing /usr/bin/gpg from read access on the file
.spamassassin12765zsyG6Ftmp.
***** Plugin catchall (100. confidence) suggests
***************************
If you believe that gpg should be allowed read access on the
.spamassassin12765zsyG6Ftmp file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gpg /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:gpg_t:s0-s0:c0.c1023
Target Context system_u:object_r:spamd_tmp_t:s0
Target Objects .spamassassin12765zsyG6Ftmp [ file ]
Source gpg
Source Path /usr/bin/gpg
Port <Unknown>
Host mydomain.org.uk
Source RPM Packages gnupg-1.4.11-3.fc15
Target RPM Packages
Policy RPM selinux-policy-3.9.16-44.fc15
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name troodos.org.uk
Platform Linux mydomain.org.uk
2.6.40.6-0.fc15.i686.PAE #1
SMP Tue Oct 4 00:44:38 UTC 2011 i686 i686
Alert Count 2
First Seen Mon Oct 31 05:22:55 2011
Last Seen Wed Nov 2 06:05:06 2011
Local ID bb4e6159-04a3-4e8c-b5f5-f41c0ff80d56
Raw Audit Messages
type=AVC msg=audit(1320213906.154:7990): avc: denied { read } for
pid=12766
comm="gpg" name=".spamassassin12765zsyG6Ftmp" dev=sda5 ino=1058383
scontext=system_u:system_r:gpg_t:s0-s0:c0.c1023
tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1320213906.154:7990): arch=i386 syscall=open
success=no
exit=EACCES a0=bfe78f49 a1=8000 a2=0 a3=bfe78f49 items=0 ppid=12765
pid=12766 auid=0
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=1070 comm=gpg
exe=/usr/bin/gpg subj=system_u:system_r:gpg_t:s0-s0:c0.c1023 key=(null)
Hash: gpg,gpg_t,spamd_tmp_t,file,read
audit2allow
#============= gpg_t ==============
allow gpg_t spamd_tmp_t:file read;
audit2allow -R
#============= gpg_t ==============
allow gpg_t spamd_tmp_t:file read;
12 years, 6 months
Lexmark - I'm impressed
by Artur Szymczak
Hi,
I just finished installation of my new printer at home: Lexmark Prospect
Pro209 on F16rc4 (fresh install on my wife's netbook). I used drivers
from lexmark (for Fedora 64bit) and... I saw this during installation:
[quote]
(...)
=============================
Execute: /usr/bin/checkmodule -M -m -o
/tmp/selfgz746922398/pkg/files/dbuspolicy.mod
/tmp/selfgz746922398/pkg/files/dbuspolicy.te
/usr/bin/checkmodule: loading policy configuration from
/tmp/selfgz746922398/pkg/files/dbuspolicy.te
/usr/bin/checkmodule: policy configuration loaded
/usr/bin/checkmodule: writing binary representation (version 13) to
/tmp/selfgz746922398/pkg/files/dbuspolicy.mod
=============================
=============================
Execute: /usr/bin/semodule_package -o
/tmp/selfgz746922398/pkg/files/dbuspolicy.pp -m
/tmp/selfgz746922398/pkg/files/dbuspolicy.mod
=============================
=============================
Execute: /usr/sbin/semodule -i /tmp/selfgz746922398/pkg/files/dbuspolicy.pp
=============================
(...)
=============================
Execute: /usr/bin/checkmodule -M -m -o
/tmp/selfgz746922398/pkg/files/lxhcp.mod
/tmp/selfgz746922398/pkg/files/lxhcp.te
/usr/bin/checkmodule: loading policy configuration from
/tmp/selfgz746922398/pkg/files/lxhcp.te
/usr/bin/checkmodule: policy configuration loaded
/usr/bin/checkmodule: writing binary representation (version 13) to
/tmp/selfgz746922398/pkg/files/lxhcp.mod
=============================
=============================
Execute: /usr/bin/semodule_package -o
/tmp/selfgz746922398/pkg/files/lxhcp.pp -m
/tmp/selfgz746922398/pkg/files/lxhcp.mod
=============================
=============================
Execute: /usr/sbin/semodule -i /tmp/selfgz746922398/pkg/files/lxhcp.pp
=============================
(...)
[/quote]
So i looked on this tw policy files:
[code]
$ cat dbuspolicy.te
module printfilter 1.0;
require {
type unconfined_t;
type cupsd_t;
class unix_stream_socket connectto;
};
#============= cupsd_t ==============
allow cupsd_t unconfined_t:unix_stream_socket connectto;
$ cat lxhcp.te
module lxhcp 1.0;
require {
type howl_port_t;
type cupsd_t;
class udp_socket name_bind;
}
#============= cupsd_t ==============
allow cupsd_t howl_port_t:udp_socket name_bind;
[/code]
It seems, that not everybody (vendors for software/hardware) are
disabling SELinux. I checked printing in Enforcing mode and all works fine.
Regards
--
Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer
RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2
GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D
http://CodzienneChodzenieZBogiem.blogspot.com/
12 years, 6 months
SELinux on Android
by Mr Dash Four
Has this been done/implemented?
I've come across quite a few attempts - all in the not-so-recent past,
but don't like any of them. The most "promising" effort I could find was
by Yuichi Nakamura (ynakam(a)hitachisoft.jp), Hitachi Software Engineering
Co., Ltd dating about 5 years ago! This effort is described at
http://elinux.org/images/a/a3/ELC2008_nakamura.pdf.
Are there any better SELinux attempts/implementations done since then?
12 years, 6 months
fixfiles, setfiles and restorecon
by Artur Szymczak
Hi,
I'm wondering which command and when should I use. Yes, I read man, but
it doesn't help. IMHO they do the same things.
--
Artur Szymczak | RHCE: 100-001-734 | CAcert Assurer
RHCA, RHCSS, RHCX, CLE11, CNI, UCP-1, UCI, Linux+, LPIC-2
GPG: C03A 385E 5C10 82C5 6564 C1E9 3D6A 616E B15D 122D
http://CodzienneChodzenieZBogiem.blogspot.com/
12 years, 6 months