* RHEL4 Selinux mailinglist @ 2010-03-01 15:34 Ulrich Althaus 2010-03-01 16:08 ` Daniel J Walsh 0 siblings, 1 reply; 6+ messages in thread From: Ulrich Althaus @ 2010-03-01 15:34 UTC (permalink / raw) To: selinux Hi, if I have problems with telnet in RHEL4, which mailing list should I write to? Regards Ulrich -- ------------------------------------------------------------------------------------------------- Ulrich Althaus TriaGnoSys GmbH Argelsrieder Feld 22 D-82234 Wessling-Oberpfaffenhofen Germany Tel: +49 8153 88678-218 Fax:+49 8153 88678-1 email: Ulrich.Althaus@triagnosys.com www: http://www.triagnosys.com ------------------------------------ TriaGnoSys GmbH, Registergericht: München HRB 141647, Vat. :DE 813396184 Geschäftsführer: Matthias Holzbock, Dr. Axel Jahn, Dr. Markus Werner This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by replying to this e-mail and delete the material from any computer. Thank you for your cooperation. ------------------------------------------------------------------------------------------------- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL4 Selinux mailinglist 2010-03-01 15:34 RHEL4 Selinux mailinglist Ulrich Althaus @ 2010-03-01 16:08 ` Daniel J Walsh 2010-03-01 16:30 ` Ulrich Althaus 0 siblings, 1 reply; 6+ messages in thread From: Daniel J Walsh @ 2010-03-01 16:08 UTC (permalink / raw) To: Ulrich Althaus; +Cc: selinux On 03/01/2010 10:34 AM, Ulrich Althaus wrote: > Hi, > > if I have problems with telnet in RHEL4, which mailing list should I > write to? > > Regards > Ulrich > Depends on what the problem is. The official response probably would be open a bugzilla. Or talk to your support person. What is the problem you are seeing? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL4 Selinux mailinglist 2010-03-01 16:08 ` Daniel J Walsh @ 2010-03-01 16:30 ` Ulrich Althaus 2010-03-01 16:50 ` Daniel J Walsh 2010-03-01 20:06 ` Stephen Smalley 0 siblings, 2 replies; 6+ messages in thread From: Ulrich Althaus @ 2010-03-01 16:30 UTC (permalink / raw) To: Daniel J Walsh; +Cc: selinux Am 01.03.2010 17:08, schrieb Daniel J Walsh: > On 03/01/2010 10:34 AM, Ulrich Althaus wrote: >> Hi, >> >> if I have problems with telnet in RHEL4, which mailing list should I >> write to? >> >> Regards >> Ulrich >> > Depends on what the problem is. The official response probably would be > open a bugzilla. Or talk to your support person. > > What is the problem you are seeing? > I have a RHEL4 Server on which I cannot execute telnet when being in enforcing mode, while in permissive mode it works without any problems. Plus I don't get any avc denies. -- ------------------------------------------------------------------------------------------------- Ulrich Althaus TriaGnoSys GmbH Argelsrieder Feld 22 D-82234 Wessling-Oberpfaffenhofen Germany Tel: +49 8153 88678-218 Fax:+49 8153 88678-1 email: Ulrich.Althaus@triagnosys.com www: http://www.triagnosys.com ------------------------------------ TriaGnoSys GmbH, Registergericht: München HRB 141647, Vat. :DE 813396184 Geschäftsführer: Matthias Holzbock, Dr. Axel Jahn, Dr. Markus Werner This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by replying to this e-mail and delete the material from any computer. Thank you for your cooperation. ------------------------------------------------------------------------------------------------- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL4 Selinux mailinglist 2010-03-01 16:30 ` Ulrich Althaus @ 2010-03-01 16:50 ` Daniel J Walsh 2010-03-01 20:06 ` Stephen Smalley 1 sibling, 0 replies; 6+ messages in thread From: Daniel J Walsh @ 2010-03-01 16:50 UTC (permalink / raw) To: Ulrich Althaus; +Cc: selinux On 03/01/2010 11:30 AM, Ulrich Althaus wrote: > > Am 01.03.2010 17:08, schrieb Daniel J Walsh: > >> On 03/01/2010 10:34 AM, Ulrich Althaus wrote: >> >>> Hi, >>> >>> if I have problems with telnet in RHEL4, which mailing list should I >>> write to? >>> >>> Regards >>> Ulrich >>> >>> >> Depends on what the problem is. The official response probably would be >> open a bugzilla. Or talk to your support person. >> >> What is the problem you are seeing? >> >> > I have a RHEL4 Server on which I cannot execute telnet when being in > enforcing mode, while in permissive mode it works without any problems. > Plus I don't get any avc denies. > > > > id -Z -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL4 Selinux mailinglist 2010-03-01 16:30 ` Ulrich Althaus 2010-03-01 16:50 ` Daniel J Walsh @ 2010-03-01 20:06 ` Stephen Smalley 2010-03-02 16:53 ` Ulrich Althaus 1 sibling, 1 reply; 6+ messages in thread From: Stephen Smalley @ 2010-03-01 20:06 UTC (permalink / raw) To: Ulrich Althaus; +Cc: Daniel J Walsh, selinux On Mon, 2010-03-01 at 17:30 +0100, Ulrich Althaus wrote: > > Am 01.03.2010 17:08, schrieb Daniel J Walsh: > > On 03/01/2010 10:34 AM, Ulrich Althaus wrote: > >> Hi, > >> > >> if I have problems with telnet in RHEL4, which mailing list should I > >> write to? > >> > >> Regards > >> Ulrich > >> > > Depends on what the problem is. The official response probably would be > > open a bugzilla. Or talk to your support person. > > > > What is the problem you are seeing? > > > > I have a RHEL4 Server on which I cannot execute telnet when being in > enforcing mode, while in permissive mode it works without any problems. > Plus I don't get any avc denies. avc denials may be suppressed by dontaudit rules in the policy (used to silence denials that may occur normally due to harmless application probing). Have you tried rebuilding your policy without dontaudit rules? On RHEL4, that would look like: # requires selinux-policy-targeted-sources to be installed cd /etc/selinux/targeted/src/policy make enableaudit load Then retry the operation and check again for avc messages in /var/log/messages or dmesg output. There may be numerous unrelated avc messages that were previously silenced by dontaudit rules, so you need to look for ones that appear to be relevant to the operation in question. When finished, restore your dontaudit rules via: cd /etc/selinux/targeted/src/policy make clean load sestatus and pstree -Z output can often be helpful too when diagnosing problems. References: Fedora Core 3 SELinux FAQ (RHEL 4 SELinux was very similar to Fedora Core 3), http://docs.fedoraproject.org/selinux-faq-fc3/ RHEL 4 SELinux Guide, http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/ -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: RHEL4 Selinux mailinglist 2010-03-01 20:06 ` Stephen Smalley @ 2010-03-02 16:53 ` Ulrich Althaus 0 siblings, 0 replies; 6+ messages in thread From: Ulrich Althaus @ 2010-03-02 16:53 UTC (permalink / raw) To: Stephen Smalley; +Cc: Daniel J Walsh, selinux Am 01.03.2010 21:06, schrieb Stephen Smalley: > On Mon, 2010-03-01 at 17:30 +0100, Ulrich Althaus wrote: >> >> Am 01.03.2010 17:08, schrieb Daniel J Walsh: >>> On 03/01/2010 10:34 AM, Ulrich Althaus wrote: >>>> Hi, >>>> >>>> if I have problems with telnet in RHEL4, which mailing list should I >>>> write to? >>>> >>>> Regards >>>> Ulrich >>>> >>> Depends on what the problem is. The official response probably would be >>> open a bugzilla. Or talk to your support person. >>> >>> What is the problem you are seeing? >>> >> >> I have a RHEL4 Server on which I cannot execute telnet when being in >> enforcing mode, while in permissive mode it works without any problems. >> Plus I don't get any avc denies. > > avc denials may be suppressed by dontaudit rules in the policy (used to > silence denials that may occur normally due to harmless application > probing). Have you tried rebuilding your policy without dontaudit > rules? > > On RHEL4, that would look like: > # requires selinux-policy-targeted-sources to be installed > cd /etc/selinux/targeted/src/policy > make enableaudit load > > Then retry the operation and check again for avc messages > in /var/log/messages or dmesg output. There may be numerous unrelated > avc messages that were previously silenced by dontaudit rules, so you > need to look for ones that appear to be relevant to the operation in > question. > > When finished, restore your dontaudit rules via: > cd /etc/selinux/targeted/src/policy > make clean load > > sestatus and pstree -Z output can often be helpful too when diagnosing > problems. > > References: > Fedora Core 3 SELinux FAQ (RHEL 4 SELinux was very similar to Fedora Core 3), http://docs.fedoraproject.org/selinux-faq-fc3/ > RHEL 4 SELinux Guide, http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/ > I solved the problem by looking at dontaudits. In my case the telnet was started from an expect script, which could not open a pty. So all I had to do was add the following rule: allow agscm_t devpts_t:chr_file { read write }; But it took me some hours to understand what expect is doing. :) Thanks for your quick answers. Regards, Ulrich -- ------------------------------------------------------------------------------------------------- Ulrich Althaus TriaGnoSys GmbH Argelsrieder Feld 22 D-82234 Wessling-Oberpfaffenhofen Germany Tel: +49 8153 88678-218 Fax:+49 8153 88678-1 email: Ulrich.Althaus@triagnosys.com www: http://www.triagnosys.com ------------------------------------ TriaGnoSys GmbH, Registergericht: München HRB 141647, Vat. :DE 813396184 Geschäftsführer: Matthias Holzbock, Dr. Axel Jahn, Dr. Markus Werner This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by replying to this e-mail and delete the material from any computer. Thank you for your cooperation. ------------------------------------------------------------------------------------------------- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-03-02 16:53 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2010-03-01 15:34 RHEL4 Selinux mailinglist Ulrich Althaus 2010-03-01 16:08 ` Daniel J Walsh 2010-03-01 16:30 ` Ulrich Althaus 2010-03-01 16:50 ` Daniel J Walsh 2010-03-01 20:06 ` Stephen Smalley 2010-03-02 16:53 ` Ulrich Althaus
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.