Re: SELinux Policy in OpenSUSE 11.2

[Dominick Grift <domg472@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3744 bytes --]

On 02/16/2010 07:04 PM, Alan Rouse wrote:
> Dominick, thanks for the reply.   These AVC messages occur during normal bootup (not from a command line), so it is the boot process which is starting these in the wrong context.  
> 
> OpenSuSE 11.2 is still using System V init startup, but Fedora 12 is using upstart.  Perhaps that explains why the recent refpolicy is not starting OpenSuse processes in the right context.  Is the current refpolicy known to work in System V init -based systems?

Oh right sorry, now i see it is system_r not sysadm_r. Looks like init
is not in the right domain i guess. I am not sure what the reason for
this is but my guess is that its (or some of its) executable(s) is
mislabelled, although that still does not explain how it got to sysadm_t.

I am interested to hear what others say about this issue.

> 
> -----Original Message-----
> From: Dominick Grift [mailto:domg472@gmail.com] 
> Sent: Tuesday, February 16, 2010 10:22 AM
> To: Alan Rouse
> Cc: 'selinux@tycho.nsa.gov'
> Subject: Re: SELinux Policy in OpenSUSE 11.2
> 
> On 02/16/2010 03:55 PM, Alan Rouse wrote:
> le
>> type=AVC msg=audit(1265904613.689:203): avc:  denied  { execstack } 
>> for  pid=2382 comm="cupsd" scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:system_r:sysadm_t tclass=process type=AVC 
>> msg=audit(1265904613.690:204): avc:  denied  { execmem } for  pid=2382 
>> comm="cupsd" scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:system_r:sysadm_t tclass=process type=AVC 
>> msg=audit(1265904614.260:205): avc:  denied  { read write } for  
>> pid=2448 comm="smartd" name="sda" dev=tmpfs ino=1749 
>> scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file 
>> type=AVC msg=audit(1265904614.260:206): avc:  denied  { open } for  
>> pid=2448 comm="smartd" name="sda" dev=tmpfs ino=1749 
>> scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file 
>> type=AVC msg=audit(1265904614.261:207): avc:  denied  { ioctl } for  
>> pid=2448 comm="smartd" path="/dev/sda" dev=tmpfs ino=1749 
>> scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file 
>> type=AVC msg=audit(1265904615.964:209): avc:  denied  { read } for  
>> pid=2337 comm="auditd" scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:system_r:sysadm_t tclass=netlink_audit_socket 
>> type=AVC msg=audit(1265904616.063:212): avc:  denied  { read } for  
>> pid=308 comm="udevd" scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:system_r:sysadm_t 
>> tclass=netlink_kobject_uevent_socket
>> type=AVC msg=audit(1265904616.063:213): avc:  denied  { write } for  
>> pid=308 comm="udevd" scontext=system_u:system_r:sysadm_t 
>> tcontext=system_u:system_r:sysadm_t 
>> tclass=netlink_kobject_uevent_socket
> 
> With regard to the AVC denials above it seems that these services (cupsd, smartd, auditd and udevd) run in the wrong domain. When you restart services manually, you should use "run_init".
> 
> run_init /etc/rc.d/init.d/cupsd start
> 
> Besides that some if this might still not work. For example execstack and execmem permissions for cupsd, but start by executing these daemons in the proper domains first.
> 
> As for dbus i have not noticed any dbus specific AVC denials. It may be the dbus denials are directed to /var/log/messages, /var/log/audit/audit.log or dmesg.
> 
>>
>>
>>
> 
> 
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]