On 08/23/2010 12:20 PM, Arthur Dent wrote:
> On Mon, 2010-08-23 at 10:56 +0200, Dominick Grift wrote:
>> On 08/23/2010 10:47 AM, Arthur Dent wrote:
>>> On Mon, 2010-08-23 at 10:42 +0200, Dominick Grift wrote:
>>>> On 08/23/2010 10:40 AM, Arthur Dent wrote:
>>>>> On Mon, 2010-08-23 at 10:29 +0200, Dominick Grift wrote:
>>>>>> On 08/23/2010 10:09 AM, Arthur Dent wrote:
>>>>>>> On Sun, 2010-08-22 at 22:44 +0100, Arthur Dent wrote:
>>>>>>>> On Sun, 2010-08-22 at 23:07 +0200, Dominick Grift wrote:
>>>>>>>>> On 08/22/2010 08:24 PM, Arthur Dent wrote:
>>>>>>>> ----
>>>>>>> time->Mon Aug 23 08:57:07 2010
>>>>>>> type=SYSCALL msg=audit(1282550227.058:42734): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf800420 a2=3 a3=1 items=0 ppid=23912 pid=23920 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan" exe="/usr/local/bin/clamdscan" subj=system_u:system_r:procmail_t:s0 key=(null)
>>>>>>> type=AVC msg=audit(1282550227.058:42734): avc: denied { search } for pid=23920 comm="clamdscan" name="clamd" dev=sda6 ino=269280 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
>>>>>>
>>>>>> This is still an issue:
>>>>>>
>>>>>> some process running in the procmail_t domain is running
>>>>>> /usr/bin/clamdscan (ls -alZ /usr/bin/clamdscan to verify its context),
>>>>>> but it is not domain transitioning to the clamscan_t domain.
>>>>>
>>>>> # which clamdscan
>>>>> /usr/local/bin/clamdscan
>>>>>
>>>>> # ls -laZ /usr/local/bin/clamdscan
>>>>> -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/local/bin/clamdscan
>>>>>
>>>>> Now, in actual fact, procmail does not call clamdscan directly (it can't
>>>>> deal with emails), it calls a program called clamassassin which in turn
>>>>> calls clamdscan.
>>>>>
>>>>> # ls -laZ /usr/local/bin/clamassassin
>>>>> -r-xr-xr-x. root root system_u:object_r:bin_t:s0 /usr/local/bin/clamassassin
>>>>>
>>>>
>>>> Why are these files located there and not /usr/bin where they are
>>>> expected to be? The files are mislabelled.
>>>
>>> In both cases I compiled from source and accepted the defaults
>>> in ./configure.
>>>
>>> I guess I could try to recompile them in /usr/bin if it is a problem -
>>> but I'm no expert...
>>
>> The problem there is; who knows what other locations owned by these apps
>> differ from the expected locations.
>>
>> Why are you not using redhat supplied packages?
>
> Well I started compiling clam from source about 3 or 4 years ago. I got
> frustrated with the fact that (at that time - I don't know if it's
> better now) it would take sometimes 3-4 weeks after a new release of
> clam before the redhat package became available. In the meantime I would
> have to put up with daily warnings in syslog.
>
> Also, I am often unable to upgrade to the latest Fedora package until it
> is already at end of life (viz - I have only just upgraded to F13 from
> F11) and the clam packages would often not be available at all...
>>
>> As for clamdscan; for now you could try the following to see if it would
>> work if this file is labelled correctly:
>>
>> chcon -t clamscan_exec_t /usr/local/bin/clamdscan
>>
>> See if that makes things work for you
>
> Well I am still getting permission denied...
>
> Latest messages:
>
> ----
> time->Mon Aug 23 11:09:06 2010
> type=SYSCALL msg=audit(1282558146.211:43246): arch=40000003 syscall=11
> success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
> ppid=24933 pid=24934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
> exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
> type=AVC msg=audit(1282558146.211:43246): avc: denied { noatsecure }
> for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> type=AVC msg=audit(1282558146.211:43246): avc: denied { siginh } for
> pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> type=AVC msg=audit(1282558146.211:43246): avc: denied { rlimitinh }
> for pid=24934 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> ----
> time->Mon Aug 23 11:12:05 2010
> type=SYSCALL msg=audit(1282558325.997:43259): arch=40000003 syscall=11
> success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
> ppid=24953 pid=24954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
> exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
> type=AVC msg=audit(1282558325.997:43259): avc: denied { noatsecure }
> for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> type=AVC msg=audit(1282558325.997:43259): avc: denied { siginh } for
> pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> type=AVC msg=audit(1282558325.997:43259): avc: denied { rlimitinh }
> for pid=24954 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
> tcontext=system_u:system_r:procmail_t:s0 tclass=process
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.163:43260): arch=40000003 syscall=11
> success=yes exit=0 a0=9d75660 a1=9d75538 a2=9d715b8 a3=9d75538 items=0
> ppid=24956 pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
> egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
> exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
> key=(null)
> type=AVC msg=audit(1282558326.163:43260): avc: denied { noatsecure }
> for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.163:43260): avc: denied { siginh } for
> pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.163:43260): avc: denied { rlimitinh }
> for pid=24960 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.163:43260): avc: denied { read } for
> pid=24960 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
> dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
> tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.179:43261): arch=40000003 syscall=102
> success=no exit=-13 a0=3 a1=bfcfd440 a2=3 a3=0 items=0 ppid=24956
> pid=24960 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
> sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
> exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
> key=(null)
> type=AVC msg=audit(1282558326.179:43261): avc: denied { connectto }
> for pid=24960 comm="clamdscan" path="/var/run/clamd/clamd.sock"
> scontext=system_u:system_r:clamscan_t:s0
> tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.209:43262): arch=40000003 syscall=11
> success=yes exit=0 a0=9d75ab0 a1=9d75380 a2=9d715b8 a3=9d75380 items=0
> ppid=24956 pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
> egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
> exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
> key=(null)
> type=AVC msg=audit(1282558326.209:43262): avc: denied { noatsecure }
> for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.209:43262): avc: denied { siginh } for
> pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.209:43262): avc: denied { rlimitinh }
> for pid=24964 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:clamscan_t:s0 tclass=process
> type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
> pid=24964 comm="clamdscan" path="/var/spool/mqueue/dfo7NAC5wD024952"
> dev=sda6 ino=14772 scontext=system_u:system_r:clamscan_t:s0
> tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
> type=AVC msg=audit(1282558326.209:43262): avc: denied { write } for
> pid=24964 comm="clamdscan" path="/tmp/clamassassinlog.9knHcazJ44"
> dev=sda6 ino=86007 scontext=system_u:system_r:clamscan_t:s0
> tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
> type=AVC msg=audit(1282558326.209:43262): avc: denied { read } for
> pid=24964 comm="clamdscan" path="/tmp/clamassassinmsg.fyU9qe9Rn4"
> dev=sda6 ino=67816 scontext=system_u:system_r:clamscan_t:s0
> tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
this is due to clamassassin not having its own policy currently. You
could probably allow this with audit2allow but only after the problem
described below is fixed.
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.213:43263): arch=40000003 syscall=102
> success=no exit=-13 a0=3 a1=bf9e8a30 a2=3 a3=1 items=0 ppid=24956
> pid=24964 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12
> sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
> exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
> key=(null)
> type=AVC msg=audit(1282558326.213:43263): avc: denied { connectto }
> for pid=24964 comm="clamdscan" path="/var/run/clamd/clamd.sock"
> scontext=system_u:system_r:clamscan_t:s0
> tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
Looks like clamd again/or still runs in the init script domain.
Therefore clamdscan cannot connect to it
ps -auxZ | grep initrc_t
We need to make sure that clamd runs in its own domain.
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.267:43264): arch=40000003 syscall=11
> success=yes exit=0 a0=9e31dd0 a1=9e334c8 a2=9e33620 a3=9e334c8 items=0
> ppid=24967 pid=24968 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
> egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="spamc"
> exe="/usr/bin/spamc" subj=system_u:system_r:spamc_t:s0 key=(null)
> type=AVC msg=audit(1282558326.267:43264): avc: denied { noatsecure }
> for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:spamc_t:s0 tclass=process
> type=AVC msg=audit(1282558326.267:43264): avc: denied { siginh } for
> pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:spamc_t:s0 tclass=process
> type=AVC msg=audit(1282558326.267:43264): avc: denied { rlimitinh }
> for pid=24968 comm="spamc" scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:system_r:spamc_t:s0 tclass=process
> ----
> time->Mon Aug 23 11:12:06 2010
> type=SYSCALL msg=audit(1282558326.309:43265): arch=40000003 syscall=5
> success=no exit=-13 a0=606a29 a1=80000 a2=1b6 a3=6069c5 items=0
> ppid=20953 pid=20954 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=(none) ses=772 comm="spamd" exe="/usr/bin/perl"
> subj=unconfined_u:system_r:spamd_t:s0 key=(null)
> type=AVC msg=audit(1282558326.309:43265): avc: denied { read } for
> pid=20954 comm="spamd" name="shadow" dev=sda6 ino=85497
> scontext=unconfined_u:system_r:spamd_t:s0
> tcontext=system_u:object_r:shadow_t:s0 tclass=file
> ----
> time->Mon Aug 23 11:12:09 2010
> type=SYSCALL msg=audit(1282558329.941:43268): arch=40000003 syscall=300
> success=no exit=-13 a0=9 a1=243c883 a2=bf8d6de0 a3=0 items=0 ppid=1
> pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
> exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
> type=AVC msg=audit(1282558329.941:43268): avc: denied { getattr } for
> pid=1228 comm="rpc.mountd" path="/proc/kcore" dev=proc ino=4026531989
> scontext=system_u:system_r:nfsd_t:s0
> tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file
> ----
> time->Mon Aug 23 11:12:09 2010
> type=SYSCALL msg=audit(1282558329.947:43269): arch=40000003 syscall=5
> success=no exit=-13 a0=243b978 a1=8000 a2=0 a3=243b938 items=0 ppid=1
> pid=1228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) ses=4294967295 comm="rpc.mountd"
> exe="/usr/sbin/rpc.mountd" subj=system_u:system_r:nfsd_t:s0 key=(null)
> type=AVC msg=audit(1282558329.947:43269): avc: denied { read } for
> pid=1228 comm="rpc.mountd" name="sda8" dev=devtmpfs ino=5613
> scontext=system_u:system_r:nfsd_t:s0
> tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
> ----
>
>
>
>>>>
>>>>>>
>>>>>> Policy defines that if a process running in the procmail_t domain runs a
>>>>>> file labelled clamscan_exec_t, that procmail_t will domain transition to
>>>>>> clamscan_t domain.
>>>>>>
>>>>>> This did not happen on your config.
>>>>>>
>>>>>> Either your clamdscan executable file is mislabelled or you are missing
>>>>>> a domain transition rule.
>>>>>>
>>>>>> Where is your "clamdscan" executable file located, and what is it labelled?
>>>>>
>>>>> see above.
>>>>>
>>>>>> What does the following return:
>>>>>>
>>>>>> sesearch -SC --allow -s procmail_t -t clamscan_t -c process
>>>>>> sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
>>>>>
>>>>> # sesearch -SC --allow -s procmail_t -t clamscan_t -c process
>>>>> Found 1 semantic av rules:
>>>>> allow procmail_t clamscan_t : process transition ;
>>>>>
>>>>> # sesearch -SC --allow -s procmail_t -t clamscan_exec_t -f file
>>>>> sesearch: invalid option -- 'f'
>>>>> Usage: sesearch [OPTIONS] RULE_TYPE [RULE_TYPE ...] [EXPESSION]
>>>>> [POLICY ...]
>>>>>
>>>>> Try sesearch --help for more help.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> selinux mailing list
>>>>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>
>>>>
>>>> --
>>>> selinux mailing list
>>>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>
>>>>
>>>> --
>>>> selinux mailing list
>>>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> --
>> selinux mailing list
>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> --
>> selinux mailing list
>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
Attachment:
signature.asc
Description: OpenPGP digital signature
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
