On Mon, 2010-08-23 at 13:20 +0200, Dominick Grift wrote:
> On 08/23/2010 01:12 PM, Arthur Dent wrote:
> > On Mon, 2010-08-23 at 13:01 +0200, Dominick Grift wrote:
> >> On 08/23/2010 12:57 PM, Arthur Dent wrote:
> >>> On Mon, 2010-08-23 at 12:31 +0200, Dominick Grift wrote:
> >>>> On 08/23/2010 12:20 PM, Arthur Dent wrote:
> >>>>> On Mon, 2010-08-23 at 10:56 +0200, Dominick Grift wrote:
> >>>>>> On 08/23/2010 10:47 AM, Arthur Dent wrote:
> >>>>>>> On Mon, 2010-08-23 at 10:42 +0200, Dominick Grift wrote:
> >>>>>>>> On 08/23/2010 10:40 AM, Arthur Dent wrote:
> >>>>>>>>> On Mon, 2010-08-23 at 10:29 +0200, Dominick Grift wrote:
> >>>>>>>>>> On 08/23/2010 10:09 AM, Arthur Dent wrote:
> >>>>>>>>>>> On Sun, 2010-08-22 at 22:44 +0100, Arthur Dent wrote:
> >>>>>>>>>>>> On Sun, 2010-08-22 at 23:07 +0200, Dominick Grift wrote:
> >>>>>>>>>>>>> On 08/22/2010 08:24 PM, Arthur Dent wrote:
>
> Well now clamd runs in the proper domain but it is denied to read
> generic files in /usr/share.
>
> Basically likely another side effect of using a custom package.
>
> Here is how to allow it:
>
> mkdir ~/myclamd; cd ~/myclamd;
> echo "policy_module(myclamd, 1.0.0)" > myclamd.te;
> echo "gen_require(\`" >> myclamd.te;
> echo "type clamd_t;" >> myclamd.te;
> echo "')" >> myclamd.te;
> echo "files_read_usr_files(clamd_t)" >> myclamd.te;
>
> make -f /usr/share/selinux/devel/Makefile myclamd.pp
> sudo semodule -i myclamd.pp
>
> But expect more issues after this
Well that certainly seemed to work - at least to the extent that clamd
restarted OK this time - and now messages are being checked with it and
I am no longer getter permission denied messages. So progress!
There are still some avcs:
----
time->Mon Aug 23 19:36:08 2010
type=SYSCALL msg=audit(1282588568.794:44819): arch=40000003 syscall=11
success=yes exit=0 a0=15559d0 a1=bf9c9f7c a2=303840 a3=41904 items=0
ppid=27824 pid=27825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1282588568.794:44819): avc: denied { noatsecure }
for pid=27825 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282588568.794:44819): avc: denied { siginh } for
pid=27825 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
type=AVC msg=audit(1282588568.794:44819): avc: denied { rlimitinh }
for pid=27825 comm="procmail" scontext=system_u:system_r:sendmail_t:s0
tcontext=system_u:system_r:procmail_t:s0 tclass=process
----
time->Mon Aug 23 19:36:09 2010
type=SYSCALL msg=audit(1282588569.206:44820): arch=40000003 syscall=11
success=yes exit=0 a0=9dfd660 a1=9dfd538 a2=9df95b8 a3=9dfd538 items=0
ppid=27827 pid=27831 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282588569.206:44820): avc: denied { noatsecure }
for pid=27831 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.206:44820): avc: denied { siginh } for
pid=27831 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.206:44820): avc: denied { rlimitinh }
for pid=27831 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.206:44820): avc: denied { read } for
pid=27831 comm="clamdscan" path="/var/spool/mqueue/dfo7NIa8Pw027823"
dev=sda6 ino=29025 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
----
time->Mon Aug 23 19:36:09 2010
type=SYSCALL msg=audit(1282588569.311:44821): arch=40000003 syscall=11
success=yes exit=0 a0=9dfcb40 a1=9dfcae8 a2=9df95b8 a3=9dfcae8 items=0
ppid=27827 pid=27835 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="clamdscan"
exe="/usr/local/bin/clamdscan" subj=system_u:system_r:clamscan_t:s0
key=(null)
type=AVC msg=audit(1282588569.311:44821): avc: denied { noatsecure }
for pid=27835 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.311:44821): avc: denied { siginh } for
pid=27835 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.311:44821): avc: denied { rlimitinh }
for pid=27835 comm="clamdscan" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:clamscan_t:s0 tclass=process
type=AVC msg=audit(1282588569.311:44821): avc: denied { read } for
pid=27835 comm="clamdscan" path="/var/spool/mqueue/dfo7NIa8Pw027823"
dev=sda6 ino=29025 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
type=AVC msg=audit(1282588569.311:44821): avc: denied { write } for
pid=27835 comm="clamdscan" path="/tmp/clamassassinlog.oeoLKk3sph"
dev=sda6 ino=86007 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
type=AVC msg=audit(1282588569.311:44821): avc: denied { read } for
pid=27835 comm="clamdscan" path="/tmp/clamassassinmsg.hx0zrEnf40"
dev=sda6 ino=85937 scontext=system_u:system_r:clamscan_t:s0
tcontext=system_u:object_r:procmail_tmp_t:s0 tclass=file
----
time->Mon Aug 23 19:36:09 2010
type=SYSCALL msg=audit(1282588569.400:44822): arch=40000003 syscall=11
success=yes exit=0 a0=8281dd0 a1=8281020 a2=8283650 a3=8281020 items=0
ppid=27839 pid=27840 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0
egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="spamc"
exe="/usr/bin/spamc" subj=system_u:system_r:spamc_t:s0 key=(null)
type=AVC msg=audit(1282588569.400:44822): avc: denied { noatsecure }
for pid=27840 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282588569.400:44822): avc: denied { siginh } for
pid=27840 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
type=AVC msg=audit(1282588569.400:44822): avc: denied { rlimitinh }
for pid=27840 comm="spamc" scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:system_r:spamc_t:s0 tclass=process
----
time->Mon Aug 23 19:36:09 2010
type=SYSCALL msg=audit(1282588569.460:44823): arch=40000003 syscall=5
success=no exit=-13 a0=606a29 a1=80000 a2=1b6 a3=6069c5 items=0
ppid=20953 pid=20954 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=772 comm="spamd" exe="/usr/bin/perl"
subj=unconfined_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1282588569.460:44823): avc: denied { read } for
pid=20954 comm="spamd" name="shadow" dev=sda6 ino=85497
scontext=unconfined_u:system_r:spamd_t:s0
tcontext=system_u:object_r:shadow_t:s0 tclass=file
Not sure if they're serious or not...
Thanks again for all your help so far. Much appreciated.
Mark
Attachment:
signature.asc
Description: This is a digitally signed message part
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
