Proprietary telnet daemon fails login when SELinux is enabled
by Dave Stoner
I apologise in advance for asking questions which I feel I should have
been able to answer from sources on the internet. If you could possibly
give me some pointers on where to look it would be so much appreciated.
My system is centos 6.2 -
Linux MyHostName 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22
GMT 2011 x86_64 x86_64 x86_64 GNU/Linux
SELinux mode is set 'enforced'.
I have a proprietary telnet daemon which upon a telnet to port 52000, is
started OK when SELinux is disabled. But when it is enabled the same
telnet results in /var/log/audit/audit.log showing:
type=USER_LOGIN msg=audit(1343048458.345:69): user pid=2536 uid=0
auid=799 ses=7 subj=system_u:system_r:inetd_t:s0-s0:c0.c1023
msg='op=login id=799 exe="/bin/login" hostname=0.0.0.0 addr=0.0.0.0
termi
nal=pts/2 res=success'
A normal telnet gives a message similar to above, my telnet adds the
following:
type=AVC msg=audit(1343048458.353:70): avc: denied { entrypoint } for
pid=2543 comm="login" path="/bin/bash" dev=sda2 ino=135083
scontext=unconfined_u:system_r:qmail_tcp_env_t:s0-s0:c0.c1023 tconte
xt=system_u:object_r:shell_exec_t:s0 tclass=file
I believe I can create a policy to overcome this using audit2allow, i.e.
it comes up with:
module mypola 1.0;
require {
type qmail_tcp_env_t;
type shell_exec_t;
class file entrypoint;
}
#============= qmail_tcp_env_t ==============
allow qmail_tcp_env_t shell_exec_t:file entrypoint;
But it seems to me what I ought to be doing is somehow to get my daemon
to run with a domain of 'remote_logon_t' as is used by the standard
telnet daemon, as here:
type=USER_LOGIN msg=audit(1343058924.928:212): user pid=3759 uid=0
auid=799 ses=29 subj=system_u:system_r:remote_login_t:s0-s0:c0.c1023
msg='op=login id=799 exe="/bin/login" hostname=localhost addr=::
1 terminal=pts/2 res=success'
This is unfamiliar territory and any hints or pointers would really be
appreciated.
Dave.
Dave Stoner
Principal Systems Architect
Northgate Reality
Direct: +44 (0)1442 272071 - VPN: 872 2071
www.northgate-is.com/reality <http://www.northgate-is.com/reality>
-----------------------------------------------------------------------------------------
This email is sent on behalf of Northgate Information Solutions Limited and its associated companies ("Northgate") and is strictly confidential and intended solely for the addressee(s).
If you are not the intended recipient of this email you must: (i) not disclose, copy or distribute its contents to any other person nor use its contents in any way or you may be acting unlawfully; (ii) contact Northgate immediately on +44 (0)1442 232424 quoting the name of the sender and the addressee then delete it from your system.
Northgate has taken reasonable precautions to ensure that no viruses are contained in this email, but does not accept any responsibility once this email has been transmitted. You should scan attachments (if any) for viruses.
Northgate Information Solutions Limited. Registered in England no. 06442582 - Northgate Information Solutions UK Limited. Registered in England no. 968498 - NorthgateArinso UK Limited .Registered in England no. 1587537 - Moorepay Limited. Registered in England no. 891686 - First Business Support Limited. Registered in England no. 3056267 - Registered Office: Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead, Hertfordshire HP2 4NW
Northgate Managed Services Limited (NI). Registered in Northern Ireland no. NI032979 - LearnServe Limited (NI). Registered in Northern Ireland no. NI043825
Registered Office: Hillview House, 61 Church Road, Newtownabbey, Co. Antrim, BT36 7LQ
-----------------------------------------------------------------------------------------
11 years, 10 months
relabel after policy update
by Vadym Chepkov
Hi,
Once n a while I find mislabeled files on the file system. Since I never touched them, I assume it is due to the policy change.
What is the best practice, shall I relabel the system every time selinux-policy-targeted is updated?
For example:
# restorecon -vR /usr/
restorecon reset /usr/libexec/sesh context system_u:object_r:bin_t:s0->system_u:object_r:shell_exec_t:s0
# restorecon -vR /var
restorecon reset /var/lib/rsyslog context system_u:object_r:var_lib_t:s0->system_u:object_r:syslogd_var_lib_t:s0
Regards,
Vadym
11 years, 10 months
freshclam F17
by Frank Murphy
freshclam email from cron daemon
Sub: Cron <root@foo> /usr/share/clamav/freshclam-sleep
Failed to get D-Bus connection: An SELinux policy prevents this sender
from sending this message to this recipient, 0 matched rules;
type="method_call", sender="(null)" (inactive)
interface="org.freedesktop.DBus" member="Hello" error name="(unset)"
requested_reply="0" destination="org.freedesktop.DBus" (bus)
~$ sudo freshclam
works without error.
all clamav booleans are on
Uncertain if I need the following exim booleans on:
exim_manage_user_files
exim_read_user_files
selinux-policy-targeted-3.10.0-140.fc17.noarch
--
Regards,
Frank
"Jack of all, fubars"
11 years, 10 months
Fwd: Proprietary telnet daemon fails login when SELinux is enabled
by Maurizio D'Antonio
Hi, Dave
If I understand your problem you need add this port 52000 in the
ports.local file for inherit the correct selinux context.
The command is:
root@localhost # semanage port -a -t telnetd_port_t -p tcp 52000
and probably you need enable the appropriate boolean because you have
a denied { entrypoint } for qmail_t domain.
Try
>>> Maurizio D'Antonio
___________________________________________
H A R D E N I X™ - (Secure by Default)
Mobile: +39 331 4440754
FAX: +39 08621960432
Web: www.kernelz.org | www.bylinux.org
> 2012/7/26 Dave Stoner <dave.stoner(a)northgate-is.com>:
> I apologise in advance for asking questions which I feel I should have been
> able to answer from sources on the internet. If you could possibly give me
> some pointers on where to look it would be so much appreciated.
>
>
>
> My system is centos 6.2 –
>
> Linux MyHostName 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22
>
> GMT 2011 x86_64 x86_64 x86_64 GNU/Linux
>
>
>
> SELinux mode is set ‘enforced’.
>
>
>
> I have a proprietary telnet daemon which upon a telnet to port 52000, is
> started OK when SELinux is disabled. But when it is enabled the same telnet
> results in /var/log/audit/audit.log showing:
>
>
>
> type=USER_LOGIN msg=audit(1343048458.345:69): user pid=2536 uid=0 auid=799
> ses=7 subj=system_u:system_r:inetd_t:s0-s0:c0.c1023 msg='op=login id=799
> exe="/bin/login" hostname=0.0.0.0 addr=0.0.0.0 termi
>
> nal=pts/2 res=success'
>
>
>
> A normal telnet gives a message similar to above, my telnet adds the
> following:
>
>
>
> type=AVC msg=audit(1343048458.353:70): avc: denied { entrypoint } for
> pid=2543 comm="login" path="/bin/bash" dev=sda2 ino=135083
> scontext=unconfined_u:system_r:qmail_tcp_env_t:s0-s0:c0.c1023 tconte
>
> xt=system_u:object_r:shell_exec_t:s0 tclass=file
>
>
>
> I believe I can create a policy to overcome this using audit2allow, i.e. it
> comes up with:
>
>
>
> module mypola 1.0;
>
>
>
> require {
>
> type qmail_tcp_env_t;
>
> type shell_exec_t;
>
> class file entrypoint;
>
> }
>
>
>
> #============= qmail_tcp_env_t ==============
>
> allow qmail_tcp_env_t shell_exec_t:file entrypoint;
>
>
>
> But it seems to me what I ought to be doing is somehow to get my daemon to
> run with a domain of ‘remote_logon_t’ as is used by the standard telnet
> daemon, as here:
>
>
>
> type=USER_LOGIN msg=audit(1343058924.928:212): user pid=3759 uid=0 auid=799
> ses=29 subj=system_u:system_r:remote_login_t:s0-s0:c0.c1023 msg='op=login
> id=799 exe="/bin/login" hostname=localhost addr=::
>
> 1 terminal=pts/2 res=success'
>
>
>
> This is unfamiliar territory and any hints or pointers would really be
> appreciated.
>
>
>
> Dave.
>
>
>
>
>
> Dave Stoner
>
> Principal Systems Architect
> Northgate Reality
>
> Direct: +44 (0)1442 272071 - VPN: 872 2071
>
> www.northgate-is.com/reality
>
>
>
>
> ________________________________
>
> This email is sent on behalf of Northgate Information Solutions Limited and
> its associated companies ("Northgate") and is strictly confidential and
> intended solely for the addressee(s).
>
> If you are not the intended recipient of this email you must: (i) not
> disclose, copy or distribute its contents to any other person nor use its
> contents in any way or you may be acting unlawfully; (ii) contact Northgate
> immediately on +44 (0)1442 232424 quoting the name of the sender and the
> addressee then delete it from your system.
>
> Northgate has taken reasonable precautions to ensure that no viruses are
> contained in this email, but does not accept any responsibility once this
> email has been transmitted. You should scan attachments (if any) for
> viruses.
>
> Northgate Information Solutions Limited. Registered in England no. 06442582
> - Northgate Information Solutions UK Limited. Registered in England no.
> 968498 - NorthgateArinso UK Limited. Registered in England no. 1587537 -
> Moorepay Limited. Registered in England no. 891686 - First Business
> Support Limited. Registered in England no. 3056267 - Registered Office:
> Peoplebuilding 2, Peoplebuilding Estate, Maylands Avenue, Hemel Hempstead,
> Hertfordshire HP2 4NW
>
> Northgate Managed Services Limited (NI). Registered in Northern Ireland
> no. NI032979 - LearnServe Limited (NI). Registered in Northern Ireland
> no. NI043825 Registered Office: Hillview House, 61 Church Road,
> Newtownabbey, Co. Antrim, BT36 7LQ
>
> ________________________________
>
>
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
11 years, 10 months
dovecot denials
by Vadym Chepkov
Hi,
man dovecot_selinux doesn't show any booleans and yet I get the following AVC, which in my opinion should be allowed:
----
time->Mon Jul 23 00:10:03 2012
type=SYSCALL msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1343002203.689:153237): avc: denied { write } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676 scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
----
time->Mon Jul 23 00:10:03 2012
type=SYSCALL msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1343002203.689:153238): avc: denied { open } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343002203.689:153238): avc: denied { read write } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
----
selinux-policy-targeted-3.7.19-155.el6_3.noarch
Have I missed something?
Thanks,
Vadym
11 years, 10 months
Re: ./autorelabel
by mark
Daniel J Walsh wrote:
> On 07/19/2012 11:18 AM, m.roth(a)5-cent.us wrote:
>> Daniel J Walsh wrote:
>>> On 07/19/2012 11:03 AM, m.roth(a)5-cent.us wrote:
>>>>
>>>> I updated a CentOS system yesterday from 6.2 to 6.3. I saw it update
>>>> selinux-policy-targeted (I think it was) and several hours later, it
>>>> still hadn't gotten to the next package; looking, it appeared to be
>>>> running a restorecon. I killed it, and redid the update.
>>>>
>>>> For other reasons, it didn't reboot. I brought it up under the most
>>>> recent previous kernel, it did an fsck on a 2T drive... then it's been
>>>> running autorelabel for at least an hour and a half, and I have no
>>>> idea how much longer it will be. It's longer than fsck.
>>>>
>>>> This is a backup server, which uses hardlinks to save space.
>>>>
>>>> You may not consider this a bug, but it certainly makes selinux close
>>>> to unusable in anything resembling a working environment.
>>>>
>>> If you have a volume with a huge number of files on it, you could mount
>>> it with a context option and this will prevent restorecon from entering
>>> the volume for relabel. Otherwise an autorelabel will attempt to read
>>> the context on ever file on the computer and "fix" it.
<snip>
>> But still, the fact that it takes that long is what I'm griping about.
>> If I'm doing an fsck -c, to check for bad blocks, I can understand why it
>> takes forever on 2T and 3T drives; but for this, where there are some
>> significantly smaller number of files than blocks, I still see that as a
>> problem.
>
> Right when SELinux policy is updated it attempts to find the least
> possible changes of labeling between the old labeling and the new labeling
> (fixfiles -C filecontext.pre restore) In some cases this could get as
high as
> restorecon -R -v /usr or restorecon -R -v /var which seems to be what
you saw.
As a datapoint, it's now been relabelling for at least three or three and
a half hours. As I noted above, I believe that there are significantly
fewer files on this f/s than there are physical blocks that an fsck -c
would check. Therefore, I suggest to you that you folks need to revisit
your code, and look at speed optimizations.
mark
11 years, 10 months
./autorelabel
by mark
Folks,
I updated a CentOS system yesterday from 6.2 to 6.3. I saw it update
selinux-policy-targeted (I think it was) and several hours later, it
still hadn't gotten to the next package; looking, it appeared to be
running a restorecon. I killed it, and redid the update.
For other reasons, it didn't reboot. I brought it up under the most
recent previous kernel, it did an fsck on a 2T drive... then it's been
running autorelabel for at least an hour and a half, and I have no idea
how much longer it will be. It's longer than fsck.
This is a backup server, which uses hardlinks to save space.
You may not consider this a bug, but it certainly makes selinux close
to unusable in anything resembling a working environment.
mark
11 years, 10 months
Out of Memory & Relabeling
by Jorge Fábregas
Hi,
I've been running a minimally configured CentOS VM (with 256MB of
memory). This morning I upgraded to 6.3 and prior to rebooting I
created /.autorelabel which caused the following errors:
http://imagebin.org/220184
This looks similar to:
https://bugzilla.redhat.com/show_bug.cgi?id=633807
...albeit for Fedora 16. I'm not sure if I should open a bugzilla as
I'm running a VM in a non-supported configuration (512MB is the minimum
suggested). I remember I even couldn't perform the installation with
256MB (Anaconda didn't allowed it so I had to increase it to 512MB).
After installation I lowered the memory back to 256MB.
Are the F16 changes to handle this ever coming to RHEL6 or will it be
for RHEL7?
Thanks,
Jorge
11 years, 10 months
FC17 and setroubleshoot
by mark
I have a couple of systems I've just upgraded from FC15 to FC17. I
installed setroubleshoot and setroubleshoot-server.
FC17 is obviously too new for an old fart like me - I can't find any
normal way to start setroubleshootd. Nothing in /etc/init.d....
mark
11 years, 11 months
Rawhide SELinux issues
by Paul Howarth
I have a Rawhide VM on which I'm seeing some strange issues.
Firstly, I'm getting some AVCs that I don't understand and can't get rid
of using audit2allow:
type=AVC msg=audit(1341327661.200:69): avc: denied { 0x10 } for
pid=537 comm="sssd_nss" capability=36
scontext=system_u:system_r:sssd_t:s0
tcontext=system_u:system_r:sssd_t:s0 tclass=capability2
(audit2allow doesn't output anything for this)
Secondly, I'm seeing denials for kernel_dgram_send for a wide variety of
domains:
kernel_dgram_send(NetworkManager_t)
kernel_dgram_send(audisp_t)
kernel_dgram_send(auditd_t)
kernel_dgram_send(avahi_t)
kernel_dgram_send(chronyd_t)
kernel_dgram_send(dhcpc_t)
kernel_dgram_send(dnsmasq_t)
kernel_dgram_send(ftpd_t)
kernel_dgram_send(modemmanager_t)
kernel_dgram_send(nfsd_t)
kernel_dgram_send(rpcd_t)
kernel_dgram_send(sendmail_t)
kernel_dgram_send(setroubleshootd_t)
kernel_dgram_send(smf_spf_milter_t)
kernel_dgram_send(sshd_t)
kernel_dgram_send(sssd_t)
kernel_dgram_send(system_dbusd_t)
kernel_dgram_send(systemd_tmpfiles_t)
Is this something that needs adding to a basic domain template? Or
should I not be getting these?
Paul.
11 years, 11 months