Re: [gentoo-hardened] newrole -r selinux problem

[lunaslide]

It appears that several of your cron related files are not labeled. 
Furthermore, the temp files cron is creating are not being labeled when 
they are generated.  Check to see that you have 
sec-policy/selinux-vixie-cron installed and try doing 'make relabel'.

stanke wrote:
> Hello
>
> Thanks for help, I solved my problem with user_r and sysadm_r it's
> working ok now, but I have still problem with my cron,
> Everything (probably)  usefull I can find in logs is.
>
> Could please someone help me or show me the right way i should go.
>
> Thank you
>
> Sep 25 05:23:01 gentoo64 cron[24435]: (root) ENTRYPOINT FAILED
> (crontabs/root)
>
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8048): avc:  denied  {
> search } for  pid=21140 comm="crontab" name="/" dev=dm-3 ino=2
> ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=dir
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8049): avc:  denied  {
> write } for  pid=21140 comm="crontab" name="/" dev=dm-3 ino=2
> ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=dir
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8050): avc:  denied  {
> add_name } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=dir
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8051): avc:  denied  {
> create } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=tester:object_r:unlabeled_t tclass=file
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8052): avc:  denied  {
> associate } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> ipaddr=16.14.42.166 scontext=tester:object_r:unlabeled_t
> tcontext=system_u:object_r:unlabeled_t tclass=filesystem
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8053): avc:  denied  {
> setattr } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> dev=dm-3 ino=58 ipaddr=16.14.42.166
> scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=file
> Sep 25 05:21:53 gentoo64 audit(1159154513.832:8054): avc:  denied  {
> getattr } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> dev=dm-3 ino=58 ipaddr=16.14.42.166
> scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=file
> Sep 25 05:21:53 gentoo64 audit(1159154513.844:8055): avc:  denied  {
> write } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG" dev=dm-3
> ino=58 ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=file
> Sep 25 05:22:02 gentoo64 audit(1159154522.949:8056): avc:  denied  {
> read } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG" dev=dm-3
> ino=58 ipaddr=16.14.42.166 scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=file
> Sep 25 05:22:02 gentoo64 audit(1159154522.949:8057): avc:  denied  {
> remove_name } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> dev=dm-3 ino=58 ipaddr=16.14.42.166
> scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=dir
> Sep 25 05:22:02 gentoo64 audit(1159154522.949:8058): avc:  denied  {
> unlink } for  pid=21140 comm="crontab" name="crontab.XXXX9WNbfG"
> dev=dm-3 ino=58 ipaddr=16.14.42.166
> scontext=tester:sysadm_r:sysadm_crontab_t
> tcontext=system_u:object_r:unlabeled_t tclass=file
>
>
>
>
> Antoine Martin  wrote / napísal(a):
>>>>> The policy does not allow a role transition from user_r to sysadm_r.
>>>>> So thats why su can't work.
>>>>>
>>>>>
>>>> The solution in this case is to make sure that when you login as root
>>>> you get into sysadm_u:sysadm_r:sysadm_t or another context which does
>>>> allow the transition to sysadm. Setting the default for ssh is fairly
>>>> well documented.
>>>>
>>> Thanks for help could you please send me some link for manuals, i google
>>> it (probably wrong) but i didn't found nothing usefull.
>>>
>> /etc/security/default_contexts
>> is what you're looking for.
>>
>> Antoine
>>
>>
>


-- 
lunaslide           *          GPG key->lunapark.org/~luna/key.asc
  *     *        *               *         *         *         *
...you shall now pay me in full for the grief you have caused me
on account of my comrades whom you have killed in battle.      *
            *            - Achilles, The Iliad     *
*     *              *              *                *          *
          *                    *            *              *
-- 
gentoo-hardened@g.o mailing list