All of lore.kernel.org
 help / color / mirror / Atom feed
* (no subject)
@ 2003-12-05  1:18 Nick
  2003-12-05  2:07 ` ssh policy Russell Coker
  2003-12-05 18:07 ` SLAT: SE Linux policy file analysis John D. Ramsdell
  0 siblings, 2 replies; 5+ messages in thread
From: Nick @ 2003-12-05  1:18 UTC (permalink / raw)
  To: SE Linux

I rebooted the system and logged into the console

newrole -r sysadm_r

dmesg | grep ssh

avc:  denied  { signal } for  pid=1002 exe=/usr/sbin/sshd
scontext=system_u:system_r:sshd_t tcontext=system_u:system_r:sshd_t
tclass=process

I dont think I get this one at all, unless the process which is starting
sshd is what is not able to send a signal or is it sshd can't send a
signal out?

now I walk over to a terminal and ssh in.

newrole -r sysadm_r

dmesg | grep ssh

avc:  denied  { signal } for  pid=1002 exe=/usr/sbin/sshd
scontext=system_u:system_r:sshd_t tcontext=system_u:system_r:sshd_t
tclass=process

avc:  denied  { getattr } for  pid=1055 exe=/usr/sbin/sshd name=xauth
dev=03:02 ino=2261013 scontext=system_u:system_r:sshd_t
tcontext=system_u:object_r:bin_t tclass=file

avc:  denied  { name_bind } for  pid=1055 exe=/usr/sbin/sshd port=6010
scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:port_t
tclass=tcp_socket

The first one is the message that is still there from the startup. I'm
not sure I understand the next two though.

The daemon wants getattr access to xauth (Why) and it wants to bind to
6010. (Why)

More importantly the question is if these are normal why aren't the
covered by the policy already in place? I certainly didn't go out of my
way to change the behavior of SSH.

A google search of "SSH" and 6010 indicates that this is normal behavior
when the daemon is started with port forwarding turned on. So the
question again is since this is "Normal" for Redhat, what is up with the
policy??

Nix

-- 
Never give a cow a typewriter - Click, Clack, Moo

Nick (Nix) Gray
Senior Systems Engineer
Bruzenak Inc.
(512) 331-7998

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2003-12-06  6:22 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-12-05  1:18 Nick
2003-12-05  2:07 ` ssh policy Russell Coker
     [not found]   ` <1070651210.27071.290.camel@hawaii.efficax.net>
2003-12-06  6:22     ` Russell Coker
2003-12-05 18:07 ` SLAT: SE Linux policy file analysis John D. Ramsdell
2003-12-05 18:21   ` Security contexts in strace John D. Ramsdell

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.