Re: Can't login in F7 strict

[Daniel J Walsh <dwalsh@redhat.com>]

Shintaro Fujiwara wrote:
> There really aren't any denied messages concerning it ...
> There really are no problem if I attach my log allright, but no use...
> But I copied .te files I made from both logs (audit.log and messages).
> Are there any clue in here ?
> Or,
> Should I install enableaudit.pp and listen to all the log or not ?
>
>
> ##########here's module i made from audit.log##############
> module localaudit 1.0;
>
> require {
>        type default_t;
>        type system_cron_spool_t;
>        type local_login_t;
>        type system_dbusd_var_run_t;
>        type sysadm_su_t;
>        type crond_t;
>        class capability { setuid setgid };
>        class dir { read search };
> }
>
> #============= crond_t ==============
> allow crond_t system_cron_spool_t:dir read;
>
> #============= local_login_t ==============
> allow local_login_t default_t:dir search;
default_t is caused by a mislabeled /root.  restorecon -R -v /root
> allow local_login_t system_dbusd_var_run_t:dir search;
>
> #============= sysadm_su_t ==============
> allow sysadm_su_t default_t:dir search;
> allow sysadm_su_t self:capability { setuid setgid };
>
Latest policy should have this.
>
> ##########here's module i made from /var/log/messages##############
> module localmessages 1.0;
>
> require {
>        type default_t;
>        type sysctl_net_unix_t;
>        type init_t;
>        type initrc_t;
>        type file_t;
>        type restorecon_t;
>        type sysctl_vm_t;
>        type kernel_t;
>        type lvm_control_t;
>        type loadkeys_t;
>        type proc_kcore_t;
>        type sysctl_irq_t;
>        type sysctl_net_t;
>        type sysctl_hotplug_t;
>        type mount_t;
>        type nscd_var_run_t;
>        type setfiles_t;
>        type proc_xen_t;
>        type proc_kmsg_t;
>        type proc_mdstat_t;
>        type sysctl_modprobe_t;
>        type sysctl_dev_t;
>        type fsadm_t;
>        type udev_t;
>        type lvm_t;
>        type sysctl_kernel_t;
>        type proc_net_t;
>        type local_login_t;
>        type sshd_t;
>        class capability { audit_write audit_control };
>        class chr_file write;
>        class lnk_file getattr;
>        class dir { getattr read search };
>        class file { read lock getattr unlink };
>        class netlink_audit_socket { create ioctl setattr getattr
> append write nlmsg_relay nlmsg_read create read bind connect setopt
> getopt shutdown };
> }
>
> #============= initrc_t ==============
> allow initrc_t lvm_control_t:chr_file write;
>
What program caused this?  Should probably be labeled lvm_exec_t
> #============= loadkeys_t ==============
> allow loadkeys_t nscd_var_run_t:dir search;
>
> #============= udev_t ==============
> allow udev_t default_t:dir search;
> #============= fsadm_t ==============
> allow fsadm_t file_t:file { read getattr };
These should not exist file_t means you have unlabled files on your system
>
> #============= init_t ==============
> allow init_t file_t:file { read lock getattr };
>
> #============= initrc_t ==============
> allow initrc_t file_t:file read;
>
> #============= lvm_t ==============
> allow lvm_t file_t:file { read getattr };
>
> #============= mount_t ==============
> allow mount_t file_t:file unlink;
>
> #============= restorecon_t ==============
> allow restorecon_t file_t:file read;
>
> #============= setfiles_t ==============
> allow setfiles_t file_t:file read;
> allow setfiles_t init_t:dir { read getattr search };
> allow setfiles_t init_t:file getattr;
> allow setfiles_t init_t:lnk_file getattr;
> allow setfiles_t initrc_t:dir { read getattr search };
> allow setfiles_t initrc_t:file getattr;
> allow setfiles_t initrc_t:lnk_file getattr;
> allow setfiles_t kernel_t:dir { read getattr search };
> allow setfiles_t kernel_t:file getattr;
> allow setfiles_t kernel_t:lnk_file getattr;
> allow setfiles_t proc_kcore_t:file getattr;
> allow setfiles_t proc_kmsg_t:file getattr;
> allow setfiles_t proc_mdstat_t:file getattr;
> allow setfiles_t proc_net_t:dir { read getattr search };
> allow setfiles_t proc_net_t:file getattr;
> allow setfiles_t proc_xen_t:dir { read getattr search };
> allow setfiles_t proc_xen_t:file getattr;
Should all be dontaudit, this is caused by running restorecon or 
setfiles on /proc
> ###############edited by me################################
> #allow setfiles_t self:capability audit_write;
> #allow setfiles_t self:netlink_audit_socket { write nlmsg_relay create 
> read };
> ###########################################################
> allow setfiles_t sysctl_dev_t:dir { read getattr search };
> allow setfiles_t sysctl_dev_t:file getattr;
> allow setfiles_t sysctl_hotplug_t:file getattr;
> allow setfiles_t sysctl_irq_t:dir { read getattr search };
> allow setfiles_t sysctl_irq_t:file getattr;
> allow setfiles_t sysctl_kernel_t:dir { read getattr search };
> allow setfiles_t sysctl_kernel_t:file getattr;
> allow setfiles_t sysctl_modprobe_t:file getattr;
> allow setfiles_t sysctl_net_t:dir { read getattr search };
> allow setfiles_t sysctl_net_t:file getattr;
> allow setfiles_t sysctl_net_unix_t:dir { read getattr search };
> allow setfiles_t sysctl_net_unix_t:file getattr;
> allow setfiles_t sysctl_vm_t:dir { read getattr search };
> allow setfiles_t sysctl_vm_t:file getattr;
> allow setfiles_t udev_t:dir { read getattr search };
> allow setfiles_t udev_t:file getattr;
> allow setfiles_t udev_t:lnk_file getattr;
>
> #============= udev_t ==============
> allow udev_t file_t:file { read getattr };
>
> ###############added by me################################
>
> #============= local_login_t ==============
> logging_send_audit_msg(local_login_t)
> logging_set_loginuid(local_login_t)
Latest policy should have these
>
> #============= sshd_t ==============
> logging_send_audit_msg(sshd_t)
> logging_set_loginuid(sshd_t)
>
>
> 2007/6/12, Daniel J Walsh <dwalsh@redhat.com>:
>> Shintaro Fujiwara wrote:
>> > With the latest policy, I could install and could login my machine.
>> >
>> > Thanks !
>> >
>> > But another problem...
>> >
>> > Keymap(jp106) fails...
>> >
>> > Is this the only problem for not English speaking people and how
>> > should we fix it ?
>> > I can use my jp106 keybord as US keybord but invconvinient...
>> >
>> > Is there still bug in policy or not ?
>> >
>> Most likely a bug in policy,  Please report it and attach your audit.log
>>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.