about restarting services and user domains F14
by Gabriel Ramirez
Hi,
I have a small problem or I didn't find the correct info, in my Fedora
14 x86_64 and i686 machines when I restart a service by:
# service postfix restart
or
$ sudo service postfix restart
always the process runs under unconfined_u
as per ps axZ | grep postfix
unconfined_u:system_r:postfix_master_t:s0 26602 ? Ss 0:00
/usr/libexec/postfix/master
unconfined_u:system_r:postfix_pickup_t:s0 26604 ? S 0:00 pickup -l -t
fifo -u
unconfined_u:system_r:postfix_qmgr_t:s0 26605 ? S 0:00 qmgr -l -t
fifo -u
and not under system_u as after a reboot
system_u:system_r:postfix_master_t:s0 1706 ? Ss 0:11
/usr/libexec/postfix/master
system_u:system_r:postfix_qmgr_t:s0 1717 ? S 0:05 qmgr -l -t
fifo -u
system_u:system_r:postfix_master_t:s0 1822 ? S 0:01 tlsmgr -l -t
unix -u
system_u:system_r:postfix_pickup_t:s0 26061 ? S 0:00 pickup -l -t
fifo -u
what can use to restart a service with the correct user context?
also sometimes I edit a file in /etc and after saving the context change
from system_u to unconfined_u how can prevent that??,
thanks
Gabrielo
13 years, 1 month
unconfined domains and Dan Walsh's article
by Klaus Lichtenwalder
I've been reading Dan's article about undefining the unconfined domain
("10 things you probably did not know about SELinux.. #4"). Curious as
I'm often am, I tried it. And hit bugzilla 627879... Are there any plans
to [continue/start] work on this?
Klaus
--
------------------------------------------------------------------------
Klaus Lichtenwalder, Dipl. Inform., http://lklaus.homelinux.org/Klaus/
PGP Key fingerprint: BF52 72FA 1F5A 1E29 C0F8 498C C4C6 633C 2821 97DA
13 years, 1 month
[ANN] Linux Security Summit 2011 - Announcement and CFP
by James Morris
==========================================================================
ANNOUNCEMENT AND CALL FOR PARTICIPATION
LINUX SECURITY SUMMIT 2011 - SANTA ROSA
==========================================================================
DESCRIPTION
The Linux Security Summit is a technical forum for collaboration
between Linux developers, researchers, and end users. Its primary aim
is to foster community efforts in analyzing and solving Linux security
challenges.
The format of the summit will be:
* Selected brief presentations
* Lightning talks
* Q&A panel sessions
WEB SITE
https://security.wiki.kernel.org/index.php/LinuxSecuritySummit2011
DATES / LOCATION
The Linux Security Summit for 2011 will be held on the 8th of September in
Santa Rosa, CA, USA. It will be co-located with Linux Plumbers Conference
(LPC) [1].
Note that Linux Security Summit attendees and speakers must be registered to attend
LPC. See the LPC site for details on registration, travel, and accommodation:
http://www.linuxplumbersconf.org/2011/
The Linux Security Summit CFP is now open, and will close on 27th of May.
Accepted speakers will be notified by 1st of June.
WHO SHOULD ATTEND
The event is open to all registered LPC attendees.
You do not have to be a "security person" to attend -- we're seeking a
diverse range of attendees, and welcome the participation of general
developers, researchers, operations, and end-users.
There will be several panel sessions in addition to brief, selected
presentations, with a strong focus on discussion.
CALL FOR PARTICIPATION
The program committee currently seeks proposals for:
Presentations:
Brief technical talks in 30 minute slots, including at least 10
minutes of discussion (i.e. the maximum length of the presentation
alone is 20 minutes). Papers are encouraged, and slides should be
minimal.
Presentation abstracts should be approximately 150 words in length.
Panel discussion topics:
If you'd like to see an issue discussed in a Q&A style panel, send it
in. Note that this may result in you volunteering to participate in
a panel.
Topic areas include, but are not limited to:
* System hardening
* Access control
* Cryptography
* Integrity control
* Hardware security
* Networking
* Storage
* Virtualization
* Desktop
* Tools
* Management
* Case studies
* Emerging technologies, threats & techniques
Proposals should be submitted in plain text via email to the program
committee at: lss-pc (_at_) ext.namei.org
MAILING LIST
Everyone planning to attend should join the event mailing list:
https://ext.namei.org/mailman/listinfo/linux-security-summit
Updates and announcements about the event will also be sent to the list.
PROGRAM COMMITTEE
The Linux Security Summit for 2011 is organized by:
* James Morris, Red Hat
* Serge Hallyn, Canonical
* Paul Moore, HP
* Stephen Smalley, NSA
* Joshua Brindle, Tresys
* Tetsuo Handa, NTT Data
* Herbert Xu, Red Hat
* John Johansen, Canonical
* Kees Cook, Canonical
* Casey Schaufler, Smack Project
The program committee may be contacted as a group via email:
lss-pc (_at_) ext.namei.org
REFERENCES
[1] Linux Plumbers Conference http://www.linuxplumbersconf.org/2011/
13 years, 1 month
policy issue with munin
by Alex
Hi,
I'm having trouble with munin on a fedora14 box and basic auth through
apache. Included below is the selinux report I receive when trying to
login. I have another installation where this same setup isn't a
problem, so I'm not sure why it would be a problem here. I've followed
the suggestions provided below to create a local policy, yet the
problem continues.
How can I troubleshoot this? Included below is the report that I received.
SELinux is preventing /usr/sbin/httpd from open access on the file
/etc/munin/htpasswd.users.
***** Plugin catchall (100. confidence) suggests ***************************
If you believe that httpd should be allowed open access on the
htpasswd.users file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:object_r:munin_etc_t:s0
Target Objects /etc/munin/htpasswd.users [ file ]
Source httpd
Source Path /usr/sbin/httpd
Port <Unknown>
Host gary
Source RPM Packages httpd-2.2.17-1.fc14
Target RPM Packages
Policy RPM selinux-policy-3.9.7-37.fc14
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name gary
Platform Linux alex 2.6.35.11-83.fc14.x86_64 #1 SMP Mon Feb
7 07:06:44 UTC 2011 x86_64 x86_64
Alert Count 9
First Seen Sun 03 Apr 2011 12:39:10 PM EDT
Last Seen Sun 03 Apr 2011 12:39:20 PM EDT
Local ID 31e62e21-19a8-44af-9555-5be1e0f704b4
Raw Audit Messages
type=AVC msg=audit(1301848760.437:29563): avc: denied { open } for
pid=1396 comm="httpd" name="htpasswd.users" dev=sda1 ino=3543833
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:munin_etc_t:s0 tclass=file
type=SYSCALL msg=audit(1301848760.437:29563): arch=x86_64 syscall=open
success=no exit=EACCES a0=7f24438bde48 a1=80000 a2=1b6 a3=33 items=0
ppid=1391 pid=1396 auid=4294967295 uid=48 gid=48 euid=48 suid=48
fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd
exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: httpd,httpd_t,munin_etc_t,file,open
audit2allow
#============= httpd_t ==============
allow httpd_t munin_etc_t:file open;
audit2allow -R
#============= httpd_t ==============
allow httpd_t munin_etc_t:file open;
13 years, 1 month
eggdrop policy module
by Luciano Furtado
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Group,
Does eggdrop has a selinux policy module? if so starting on which fedora
version?
I am looking to get the sources for it , build / install it on my Debian
installation which doesn't seem to have a module for it.
Best Regards.
Luciano
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJNjNptAAoJEEJ82UW2Ovvtyd4IAIoQqJPXFlNNtOH3V+EM0zL9
8pujhgoM7x2kEssoOY/taTyOPxn5PDys28ZLB1nuqx9Br1s7bt+ErserSCVBVyo/
zopiZYb93ky2NII9rerN5eE+E49fGhsb0svUPaDkKN95bYM+FIvlP8FrEN/sT3N1
Mh2pJNGtStFZlC7TQi1NXGis6r05z0/IfYx0Rpqr0XBIQ3LnWrijGBBnz3qx097a
YOfRKHpIPqEeXaeX3TzxS+VDCWqH1FObRbK6STO9Q1fge3iNHvyEqNqE7qbB2sHE
SlIqmIqdjzbnMz66vDsOpBrkxXrjCarUhZm8BrYbR8fO6Hc2sXz0huRT2XLmAik=
=cUlU
-----END PGP SIGNATURE-----
13 years, 1 month