Re: FC3 and selinux

From: Daniel J Walsh (dwalsh_at_redhat.com)
Date: 03/09/05

  • Next message: Rick Bilonick: "Re: FC3 Security" 
    Date: Wed, 09 Mar 2005 07:51:51 -0500
To: For users of Fedora Core releases <fedora-list@redhat.com>

    Hans Müller wrote:

    >Hello, after update from FC2 to FC3 and enabled SELinux with:
    >
    >1. Edit /etc/selinux/config and change the type of policy to SELINUXTYPE=policyname.
    >2. To ensure that you can return from a reboot, set the mode to SELINUX=permissive. This way SELinux
    >will be running under the correct policy, but will let you login if there is a problem such as
    >incorrect file context labeling.
    >3.
    >Tell the init scripts to relabel the system on reboot with the command touch /.autorelabel.
    >4.
    >Reboot the system. A clean restart under the new policy allows all system processes to be started in
    >the proper context, and reveals any problems in the policy change.
    >5. Confirm your changes took effect with the command sestatus -v. With the new system running in
    >permissive mode, check /var/log/messages for avc: denied messages. These may indicate a problem that
    >needs to be solved for the system to run without trouble under the new policy.
    >
    >and at step 5 I have entry with the avc: denied messages.
    >This have i found:
    >Mar 9 13:19:00 homer kernel: audit(1110370740.023:0): avc: denied { unlink } for pid=5797
    >exe=/usr/sbin/httpd name=ssl_mutex.5797 dev=hda1 ino=1063633 scontext=root:system_r:httpd_t
    >tcontext=root:object_r:httpd_log_t tclass=file
    >
    >
    Is there a way to get these files creates somewhere else? We might need
    to change policy, but allowing httpd the ability to unlink log files
    is not an option. Since this would allow a cracker to cleanup his tracks.

    >Mar 9 13:19:00 homer httpd: Starten von httpd succeeded
    >Mar 9 13:19:01 homer kernel: audit(1110370741.003:0): avc: denied { getattr } for pid=5798
    >exe=/usr/sbin/httpd path=/etc/php.ini dev=hda1 ino=246465 scontext=root:system_r:httpd_t
    >tcontext=system_u:object_r:etc_t tclass=lnk_file
    >
    >
    >
    Why is /etc/php.ini a link file?

    >what must I do to correct this??
    >
    > 

    -- 
Learn, Network and Experience Open Source.
Red Hat Summit, New Orleans 2005
http://www.redhat.com/promo/summit/
-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Rick Bilonick: "Re: FC3 Security"

    Relevant Pages

    • Re: CTRL ALT DEL function disabled locally
      ... Keep in mind that if you setup the OU with a Group Policy, that security ... the problem computer for a remote command prompt if that would help. ... Upon reboot I was immediately locked out without the ...
      (microsoft.public.win2000.security)
    • Re: Using gpupdate /force doesnt update settings, only reboot does
      ... it will take a reboot to apply. ... I've tried 2 things to verify if the policy apply: ... Darren Mar-Elia wrote: ... What are the settings that you're trying to apply? ...
      (microsoft.public.windows.group_policy)
    • Re: Security hierarchy
      ... >would only apply to local machine accounts if domain policy is overridden.. ... that password complexity should not be enforced although it ... Local setting show ... >> I reboot the DC. ...
      (microsoft.public.win2000.security)
    • Re: Deleting Cached Roaming Profiles GPO Setting
      ... > Did you reboot the server after making the change to the HKLM hive? ... They are picking it up correctly, both GPO Modelling and RSoP indicate it's ... They are in the OU which the policy applies to, they are not a member of any ...
      (microsoft.public.windows.server.active_directory)
    • Re: ATTN: Susan Bradley
      ... workstation, I've run GPUPDATE/FORCE, and I've rebooted the server, but the ... There are two other places where Windows firewall is mentioned: Group Policy ... > Did you reboot the workstation? ...
      (microsoft.public.windows.server.sbs)