type class key

type class key

[Stefan Schulze Frielinghaus]

Every time I log into my system via ssh an audit is generated:

audit(1194529539.754:7803673): avc:  denied  { link } for  pid=9526
comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:dovecot_t:s0 tclass=key

and after logout the following:

audit(1194529580.969:7803674): avc:  denied  { search } for  pid=9526
comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:dovecot_t:s0 tclass=key

Quite frankly I even do not know what a type class "key" is. Can someone
explain to me what a type class "key" is? And maybe any suggestions why
ssh tries to access dovecot's key (which is an imap server).

cheers,
Stefan

PS: I'm running CentOS 5 with the latest updates and strict policy.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: type class key

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefan Schulze Frielinghaus wrote:
> Every time I log into my system via ssh an audit is generated:
> 
> audit(1194529539.754:7803673): avc:  denied  { link } for  pid=9526
> comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:dovecot_t:s0 tclass=key
> 
> and after logout the following:
> 
> audit(1194529580.969:7803674): avc:  denied  { search } for  pid=9526
> comm="sshd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:dovecot_t:s0 tclass=key
> 
> Quite frankly I even do not know what a type class "key" is. Can someone
> explain to me what a type class "key" is? And maybe any suggestions why
> ssh tries to access dovecot's key (which is an imap server).
> 
> cheers,
> Stefan
> 
> PS: I'm running CentOS 5 with the latest updates and strict policy.
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
key is the SELinux mapping of the kernel keyring.  No app currently uses
the kernel keyring, to the best of my knowledge.  And the pam
configurations up to now are setup incorrectly.

When any confined app runs it gets handed a keyring and does a search
access on the app that created the key ring.

The avc's you are reporting above are very strange.  They look like
dovecot created a keyring, probably though pam_keyinit.  And now sshd is
trying to access it.  I think you are running in permissive mode and
your context is messed up.

When you login are you getting user_t or staff_t?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHM20yrlYvE4MpobMRAoY/AJ43FAim2WQEt1yrpHMsWMjKnpJoWQCfSemn
ihtmBI+3TyCb09sQIX+ssnU=
=/Ad8
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: type class key

[Stefan Schulze Frielinghaus]

On Thu, 2007-11-08 at 15:10 -0500, Daniel J Walsh wrote:
[...]
> The avc's you are reporting above are very strange.  They look like
> dovecot created a keyring, probably though pam_keyinit.  And now sshd is
> trying to access it.  I think you are running in permissive mode and
> your context is messed up.
> 
> When you login are you getting user_t or staff_t?

Yeah your right. There is a different. The AVCs are only generated when
I log in as a staff_t. I created a test user logged in as user_t and no
AVCs where generated.

Hope you have more ideas because I run out of them ;-)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: type class key

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefan Schulze Frielinghaus wrote:
> On Thu, 2007-11-08 at 15:10 -0500, Daniel J Walsh wrote:
> [...]
>> The avc's you are reporting above are very strange.  They look like
>> dovecot created a keyring, probably though pam_keyinit.  And now sshd is
>> trying to access it.  I think you are running in permissive mode and
>> your context is messed up.
>>
>> When you login are you getting user_t or staff_t?
> 
> Yeah your right. There is a different. The AVCs are only generated when
> I log in as a staff_t. I created a test user logged in as user_t and no
> AVCs where generated.
> 
> Hope you have more ideas because I run out of them ;-)
> 
Well for now I would just ignore or dontaudit them.  Since I believe
nothing used keyrings and the way it is setup in pam is all wrong right
now.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHNJPSrlYvE4MpobMRAtwOAJ4lVduXNjmMGp+BD+/sO1b2H66GIgCg46rN
7b1lN9q9nynOZwCa6+4LUJI=
=mlVE
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.