FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 01-16-2008, 03:46 PM
Paul Howarth
 
Default Fedora 8 odds and sods

Today I've done a bit of a clean-up of the local policy modules I've had
in use over the last couple of Fedora releases, removing bits that are
no longer needed and consolidating the remaining ones into a single
"localmisc" module. The results of this is:


policy_module(localmisc, 0.1.34)

require {
attribute mailserver_delivery;
type depmod_t;
type httpd_t;
type load_policy_t;
type procmail_t;
type procmail_tmp_t;
type pptp_t;
type restorecon_t;
type sendmail_t;
type setfiles_t;
type soundd_port_t;
type squid_t;
type useradd_t;
type var_t;
};

# ========================================
# Things that probably need to go upstream
# ========================================

# Milter sockets, why did this work before?
#allow sendmail_t initrc_t:unix_stream_socket { read write connectto };
init_stream_connect_script(mailserver_delivery)
init_rw_script_stream_sockets(mailserver_delivery)

# Allow misc command output to be sent to a pipe, needed for rpm scriptlets
# Probably not needed since Fedora 8
#unconfined_rw_pipes(depmod_t)
#unconfined_rw_pipes(load_policy_t)
#unconfined_rw_pipes(setfiles_t)
#unconfined_rw_pipes(useradd_t)

# Allow pptp to manage its own processes
allow pptp_t selfrocess signal;

# Allow sendmail to read procmail tempfiles for forwarding
# (would need a new interface in procmail.if to do this properly)
allow sendmail_t procmail_tmp_t:file { read write getattr ioctl };

# Not sure what this is, needed when network is congested
allow sendmail_t selfrocess signull;

# ==============
# Local oddities
# ==============

# Allow restorecon to restore file contexts via the /var/www -> /srv/www
symlink

allow restorecon_t var_t:lnk_file read;

# Allow httpd to read /var/www -> /srv/www symlink
allow httpd_t var_t:lnk_file { getattr read };

# Allow squid to connect to websites on port 8000 (defined in policy as
soundd_port_t)

allow squid_t soundd_port_t:tcp_socket name_connect;



Not a lot left there, so I thought I'd post them here in their entirety
for discussion and hopefully inclusion (at least in part) in a future
policy update.


Paul.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 02-05-2008, 10:28 PM
Paul Howarth
 
Default Fedora 8 odds and sods

On Thu, 17 Jan 2008 12:51:33 -0500
Daniel J Walsh <dwalsh@redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Paul Howarth wrote:
> > Today I've done a bit of a clean-up of the local policy modules
> > I've had in use over the last couple of Fedora releases, removing
> > bits that are no longer needed and consolidating the remaining ones
> > into a single "localmisc" module. The results of this is:
> >
> > policy_module(localmisc, 0.1.34)
> >
> > require {
> > attribute mailserver_delivery;
> > type depmod_t;
> > type httpd_t;
> > type load_policy_t;
> > type procmail_t;
> > type procmail_tmp_t;
> > type pptp_t;
> > type restorecon_t;
> > type sendmail_t;
> > type setfiles_t;
> > type soundd_port_t;
> > type squid_t;
> > type useradd_t;
> > type var_t;
> > };
> >
> > # ========================================
> > # Things that probably need to go upstream
> > # ========================================
> >
> > # Milter sockets, why did this work before?
> > #allow sendmail_t initrc_t:unix_stream_socket { read write
> > connectto }; init_stream_connect_script(mailserver_delivery)
> > init_rw_script_stream_sockets(mailserver_delivery)
> >
> Already added.
> > # Allow misc command output to be sent to a pipe, needed for rpm
> > scriptlets # Probably not needed since Fedora 8
> > #unconfined_rw_pipes(depmod_t)
> > #unconfined_rw_pipes(load_policy_t)
> > #unconfined_rw_pipes(setfiles_t)
> > #unconfined_rw_pipes(useradd_t)
> >
> > # Allow pptp to manage its own processes
> > allow pptp_t selfrocess signal;
> >
> Added.
> > # Allow sendmail to read procmail tempfiles for forwarding
> > # (would need a new interface in procmail.if to do this properly)
> > allow sendmail_t procmail_tmp_t:file { read write getattr ioctl };
> >
> Added

Policy now has procmail_read_tmp_files(sendmail_t) but this doesn't
allow write access by sendmail. Sendmail needs to write into
procmail_tmp_t when a procmail recipe pipes a message into a filter and
that filter creates a temp file I believe.

I'm getting the AVCs anyway:
type=AVC msg=audit(1202162399.034:320138): avc: denied { write } for
pid=16452 comm="sendmail" path="/tmp/choplist.16383" dev=dm-1 ino=13
scontext=system_u:system_r:sendmail_t:s0
tcontext=system_ubject_rrocmail_tmp_t:s0 tclass=file type=SYSCALL
msg=audit(1202162399.034:320138): arch=40000003 syscall=11 success=yes
exit=0 a0=bf8febff a1=84ffe44 a2=bf8fe3a4 a3=84ffe44 items=0 ppid=16384
pid=16452 auid=0 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=51
sgid=51 fsgid=51 tty=(none) comm="sendmail"
exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0
key=(null) type=AVC msg=audit(1202162401.083:320139): avc: denied
{ write } for pid=16453 comm="sendmail"
path=2F746D702F63686F706C6973742E31363338332028646 56C6574656429
dev=dm-1 ino=13 scontext=system_u:system_r:sendmail_t:s0
tcontext=system_ubject_rrocmail_tmp_t:s0 tclass=file

Paul.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 02-06-2008, 02:24 PM
Daniel J Walsh
 
Default Fedora 8 odds and sods

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Howarth wrote:
> On Thu, 17 Jan 2008 12:51:33 -0500
> Daniel J Walsh <dwalsh@redhat.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Paul Howarth wrote:
>>> Today I've done a bit of a clean-up of the local policy modules
>>> I've had in use over the last couple of Fedora releases, removing
>>> bits that are no longer needed and consolidating the remaining ones
>>> into a single "localmisc" module. The results of this is:
>>>
>>> policy_module(localmisc, 0.1.34)
>>>
>>> require {
>>> attribute mailserver_delivery;
>>> type depmod_t;
>>> type httpd_t;
>>> type load_policy_t;
>>> type procmail_t;
>>> type procmail_tmp_t;
>>> type pptp_t;
>>> type restorecon_t;
>>> type sendmail_t;
>>> type setfiles_t;
>>> type soundd_port_t;
>>> type squid_t;
>>> type useradd_t;
>>> type var_t;
>>> };
>>>
>>> # ========================================
>>> # Things that probably need to go upstream
>>> # ========================================
>>>
>>> # Milter sockets, why did this work before?
>>> #allow sendmail_t initrc_t:unix_stream_socket { read write
>>> connectto }; init_stream_connect_script(mailserver_delivery)
>>> init_rw_script_stream_sockets(mailserver_delivery)
>>>
>> Already added.
>>> # Allow misc command output to be sent to a pipe, needed for rpm
>>> scriptlets # Probably not needed since Fedora 8
>>> #unconfined_rw_pipes(depmod_t)
>>> #unconfined_rw_pipes(load_policy_t)
>>> #unconfined_rw_pipes(setfiles_t)
>>> #unconfined_rw_pipes(useradd_t)
>>>
>>> # Allow pptp to manage its own processes
>>> allow pptp_t selfrocess signal;
>>>
>> Added.
>>> # Allow sendmail to read procmail tempfiles for forwarding
>>> # (would need a new interface in procmail.if to do this properly)
>>> allow sendmail_t procmail_tmp_t:file { read write getattr ioctl };
>>>
>> Added
>
> Policy now has procmail_read_tmp_files(sendmail_t) but this doesn't
> allow write access by sendmail. Sendmail needs to write into
> procmail_tmp_t when a procmail recipe pipes a message into a filter and
> that filter creates a temp file I believe.
>
> I'm getting the AVCs anyway:
> type=AVC msg=audit(1202162399.034:320138): avc: denied { write } for
> pid=16452 comm="sendmail" path="/tmp/choplist.16383" dev=dm-1 ino=13
> scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_ubject_rrocmail_tmp_t:s0 tclass=file type=SYSCALL
> msg=audit(1202162399.034:320138): arch=40000003 syscall=11 success=yes
> exit=0 a0=bf8febff a1=84ffe44 a2=bf8fe3a4 a3=84ffe44 items=0 ppid=16384
> pid=16452 auid=0 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=51
> sgid=51 fsgid=51 tty=(none) comm="sendmail"
> exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0
> key=(null) type=AVC msg=audit(1202162401.083:320139): avc: denied
> { write } for pid=16453 comm="sendmail"
> path=2F746D702F63686F706C6973742E31363338332028646 56C6574656429
> dev=dm-1 ino=13 scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_ubject_rrocmail_tmp_t:s0 tclass=file
>
> Paul.

Fixed in selinux-policy-3.0.8-84.fc8
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkep0TIACgkQrlYvE4MpobObegCg52sdeWuVie 1SjhBFUiolPp8i
dDkAnRXyqFCr8KzE7y6dd7gktCciETgd
=gLYk
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 01:32 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org