92312 2005-05-11 15:57 0000 Bind does not run chrooted on selinux (+fix) 2005-05-26 03:13:24 0000 1 1 1 Unclassified Gentoo Linux Hardened unspecified All All RESOLVED FIXED P2 normal --- 1 daniel@dthaler.de kaiowas@gentoo.org daniel@dthaler.de 2005-05-11 15:57:53 0000 The selinux policy for bind does not define any labels for the chroot dir and bind also wants cap_dac_read_search when chrooting. I'm attaching my modified named.fc and named.te files Note that I've hardcoded my chroot dir (/var/chroot/dns) in named.fc daniel@dthaler.de 2005-05-11 15:58:37 0000 Created an attachment (id=58703) modified named.fc daniel@dthaler.de 2005-05-11 15:59:04 0000 Created an attachment (id=58704) modified named.te kaiowas@gentoo.org 2005-05-26 03:13:24 0000 ok, I haven't found any pointers in fhs for proper chroot tree placement, so /var/chroot/dns is as good as any other location ;) fix will be available shortly in selinux-bind-20050526 thanks for the bug report 58703 2005-05-11 15:58 0000 modified named.fc named.fc text/plain IyBuYW1lZAppZmRlZihgZGlzdHJvX3JlZGhhdCcsIGAKL3Zhci9uYW1lZCgvLiopPwkJc3lzdGVt X3U6b2JqZWN0X3I6bmFtZWRfem9uZV90Ci92YXIvbmFtZWQvc2xhdmVzKC8uKik/CQlzeXN0ZW1f dTpvYmplY3RfcjpuYW1lZF9jYWNoZV90Ci92YXIvbmFtZWQvZGF0YSgvLiopPwkJc3lzdGVtX3U6 b2JqZWN0X3I6bmFtZWRfY2FjaGVfdAovZXRjL25hbWVkXC5jb25mCS0tCXN5c3RlbV91Om9iamVj dF9yOm5hbWVkX2NvbmZfdAonKSBkbmwgZW5kIGRpc3Ryb19yZWRoYXQKCmlmZGVmKGBkaXN0cm9f ZGViaWFuJywgYAovZXRjL2JpbmQoLy4qKT8JCQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF96b25l X3QKL2V0Yy9iaW5kL25hbWVkXC5jb25mCS0tCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2NvbmZf dAovZXRjL2JpbmQvcm5kY1wua2V5CS0tCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2NvbmZfdAov dmFyL2NhY2hlL2JpbmQoLy4qKT8JCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2NhY2hlX3QKJykg ZG5sIGRpc3Ryb19kZWJpYW4KCi9ldGMvcm5kYy4qCQktLQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1l ZF9jb25mX3QKL2V0Yy9ybmRjLmtleSAgCQktLSAJc3lzdGVtX3U6b2JqZWN0X3I6ZG5zc2VjX3QK L3Vzci9zYmluL25hbWVkICAgICAgCS0tCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2V4ZWNfdAov dXNyL3NiaW4vcj9uZGMJCS0tCXN5c3RlbV91Om9iamVjdF9yOm5kY19leGVjX3QKL3Zhci9ydW4v bmRjCQktcwlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF92YXJfcnVuX3QKL3Zhci9ydW4vYmluZCgv LiopPwkJc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfdmFyX3J1bl90Ci92YXIvcnVuL25hbWVkKC8u Kik/CQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF92YXJfcnVuX3QKL3Vzci9zYmluL2x3cmVzZAkt LQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF9leGVjX3QKL3Zhci9sb2cvbmFtZWQuKiAJLS0gIHN5 c3RlbV91Om9iamVjdF9yOm5hbWVkX2xvZ190CgppZmRlZihgZGlzdHJvX3JlZGhhdCcsIGAKL3Zh ci9uYW1lZC9uYW1lZFwuY2EJLS0Jc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfY29uZl90Ci92YXIv bmFtZWQvY2hyb290KC8uKik/CQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF9jb25mX3QKL3Zhci9u YW1lZC9jaHJvb3QvZGV2L251bGwgICAtYwlzeXN0ZW1fdTpvYmplY3RfcjpudWxsX2RldmljZV90 Ci92YXIvbmFtZWQvY2hyb290L2Rldi9yYW5kb20gLWMJc3lzdGVtX3U6b2JqZWN0X3I6cmFuZG9t X2RldmljZV90Ci92YXIvbmFtZWQvY2hyb290L2Rldi96ZXJvIC1jCXN5c3RlbV91Om9iamVjdF9y Onplcm9fZGV2aWNlX3QKL3Zhci9uYW1lZC9jaHJvb3QvZXRjKC8uKik/IAlzeXN0ZW1fdTpvYmpl Y3RfcjpuYW1lZF9jb25mX3QKL3Zhci9uYW1lZC9jaHJvb3QvZXRjL3JuZGMua2V5ICAtLSBzeXN0 ZW1fdTpvYmplY3RfcjpkbnNzZWNfdAovdmFyL25hbWVkL2Nocm9vdC92YXIvcnVuL25hbWVkLiog c3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfdmFyX3J1bl90Ci92YXIvbmFtZWQvY2hyb290L3Zhci90 bXAoLy4qKT8gc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfY2FjaGVfdAovdmFyL25hbWVkL2Nocm9v dC92YXIvbmFtZWQoLy4qKT8Jc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfem9uZV90Ci92YXIvbmFt ZWQvY2hyb290L3Zhci9uYW1lZC9zbGF2ZXMoLy4qKT8gc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRf Y2FjaGVfdAovdmFyL25hbWVkL2Nocm9vdC92YXIvbmFtZWQvZGF0YSgvLiopPyBzeXN0ZW1fdTpv YmplY3RfcjpuYW1lZF9jYWNoZV90Ci92YXIvbmFtZWQvY2hyb290L3Zhci9uYW1lZC9uYW1lZFwu Y2EJLS0Jc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfY29uZl90CicpIGRubCBkaXN0cm9fcmVkaGF0 CgppZmRlZihgZGlzdHJvX2dlbnRvbycsIGAKL2V0Yy9iaW5kKC8uKik/ICAgICAgICAgICAgIHN5 c3RlbV91Om9iamVjdF9yOm5hbWVkX3pvbmVfdAovZXRjL2JpbmQvbmFtZWRcLmNvbmYgICAtLSAg c3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfY29uZl90Ci9ldGMvYmluZC9ybmRjXC5rZXkgICAgIC0t ICBzeXN0ZW1fdTpvYmplY3RfcjpkbnNzZWNfdAovdmFyL2JpbmQoLy4qKT8gICAgICAgICAgICAg c3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfY2FjaGVfdAovdmFyL2JpbmQvcHJpKC8uKik/ICAgICAg ICAgc3lzdGVtX3U6b2JqZWN0X3I6bmFtZWRfem9uZV90CiNjaHJvb3RlZCBvcGVyYXRpb24gKGFz c3VtaW5nIC92YXIvY2hyb290L2RucyBpcyB0aGUgYmFzZSBkaXIpCi92YXIvY2hyb290L2Rucygv LiopPwkJCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2NvbmZfdAovdmFyL2Nocm9vdC9kbnMvdmFy L2JpbmQoLy4qKT8JCXN5c3RlbV91Om9iamVjdF9yOm5hbWVkX2NhY2hlX3QKL3Zhci9jaHJvb3Qv ZG5zL3Zhci9iaW5kL3ByaSgvLiopPwlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF96b25lX3QKL3Zh ci9jaHJvb3QvZG5zL2V0Yy9iaW5kKC8uKik/CQlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF96b25l X3QKL3Zhci9jaHJvb3QvZG5zL2V0Yy9iaW5kL25hbWVkXC5jb25mCXN5c3RlbV91Om9iamVjdF9y Om5hbWVkX2NvbmZfdAovdmFyL2Nocm9vdC9kbnMvZXRjL2JpbmQvcm5kY1wua2V5CXN5c3RlbV91 Om9iamVjdF9yOmRuc3NlY190Ci92YXIvY2hyb290L2Rucy9kZXYvemVybwktYwlzeXN0ZW1fdTpv YmplY3Rfcjp6ZXJvX2RldmljZV90Ci92YXIvY2hyb290L2Rucy9kZXYvcmFuZG9tCS1jCXN5c3Rl bV91Om9iamVjdF9yOnJhbmRvbV9kZXZpY2VfdAovdmFyL2Nocm9vdC9kbnMvdmFyL3J1bi9uYW1l ZCgvLiopPwlzeXN0ZW1fdTpvYmplY3RfcjpuYW1lZF92YXJfcnVuX3QKJykgZG5sIGRpc3Ryb19n ZW50b28K 58704 2005-05-11 15:59 0000 modified named.te named.te text/plain I0RFU0MgQklORCAtIE5hbWUgc2VydmVyCiMKIyBBdXRob3JzOiAgWXVpY2hpIE5ha2FtdXJhIDx5 bmFrYW1Ab3JpLmhpdGFjaGktc2suY28uanA+LAojICAgICAgICAgICBSdXNzZWxsIENva2VyCiMg WC1EZWJpYW4tUGFja2FnZXM6IGJpbmQgYmluZDkKIyAKIwoKIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjCiMKIyBSdWxlcyBmb3IgdGhlIG5hbWVkX3QgZG9tYWluLgojCnR5cGUgcm5k Y19wb3J0X3QsIHBvcnRfdHlwZSwgcmVzZXJ2ZWRfcG9ydF90eXBlOwoKZGFlbW9uX2RvbWFpbihu YW1lZCwgYCwgbnNjZF9jbGllbnRfZG9tYWluJykKdG1wX2RvbWFpbihuYW1lZCkKCiMgRm9yIC92 YXIvcnVuL25kYyB1c2VkIGluIEJJTkQgOApmaWxlX3R5cGVfYXV0b190cmFucyhuYW1lZF90LCB2 YXJfcnVuX3QsIG5hbWVkX3Zhcl9ydW5fdCwgc29ja19maWxlKQoKIyBuZGNfdCBpcyB0aGUgZG9t YWluIGZvciB0aGUgbmRjIHByb2dyYW0KdHlwZSBuZGNfdCwgZG9tYWluLCBwcml2bG9nLCBuc2Nk X2NsaWVudF9kb21haW47CnJvbGUgc3lzYWRtX3IgdHlwZXMgbmRjX3Q7CnJvbGUgc3lzdGVtX3Ig dHlwZXMgbmRjX3Q7CgppZmRlZihgdGFyZ2V0ZWRfcG9saWN5JywgYApkb250YXVkaXQgbmRjX3Qg cm9vdF90OmZpbGUgeyBnZXRhdHRyIHJlYWQgfTsKZG9udGF1ZGl0IG5kY190IHVubGFiZWxlZF90 OmZpbGUgeyBnZXRhdHRyIHJlYWQgfTsJCicpCgpjYW5fZXhlYyhuYW1lZF90LCBuYW1lZF9leGVj X3QpCmFsbG93IG5hbWVkX3Qgc2Jpbl90OmRpciBzZWFyY2g7CgphbGxvdyBuYW1lZF90IHNlbGY6 cHJvY2VzcyB7IHNldHNjaGVkIHNldGNhcCBzZXRybGltaXQgfTsKCiMgQSB0eXBlIGZvciBjb25m aWd1cmF0aW9uIGZpbGVzIG9mIG5hbWVkLgp0eXBlIG5hbWVkX2NvbmZfdCwgZmlsZV90eXBlLCBz eXNhZG1maWxlOwoKIyBmb3IgcHJpbWFyeSB6b25lIGZpbGVzCnR5cGUgbmFtZWRfem9uZV90LCBm aWxlX3R5cGUsIHN5c2FkbWZpbGU7CgojIGZvciBzZWNvbmRhcnkgem9uZSBmaWxlcwp0eXBlIG5h bWVkX2NhY2hlX3QsIGZpbGVfdHlwZSwgc3lzYWRtZmlsZTsKCiMgZm9yIEROU1NFQyBrZXkgZmls ZXMKdHlwZSBkbnNzZWNfdCwgZmlsZV90eXBlLCBzeXNhZG1maWxlOwphbGxvdyB7IG5kY190IG5h bWVkX3QgfSBkbnNzZWNfdDpmaWxlIHsgZ2V0YXR0ciByZWFkIH07CgojIFVzZSBjYXBhYmlsaXRp ZXMuIFN1cnBsdXMgY2FwYWJpbGl0aWVzIG1heSBiZSBhbGxvd2VkLgphbGxvdyBuYW1lZF90IHNl bGY6Y2FwYWJpbGl0eSB7IGNob3duIGRhY19vdmVycmlkZSBkYWNfcmVhZF9zZWFyY2ggZm93bmVy IHNldGdpZCBzZXR1aWQgbmV0X2JpbmRfc2VydmljZSBzeXNfY2hyb290IHN5c19uaWNlIHN5c19y ZXNvdXJjZSB9OwoKYWxsb3cgbmFtZWRfdCBldGNfdDpmaWxlIHsgZ2V0YXR0ciByZWFkIH07CmFs bG93IG5hbWVkX3QgZXRjX3J1bnRpbWVfdDp7IGZpbGUgbG5rX2ZpbGUgfSB7IGdldGF0dHIgcmVh ZCB9OwoKI05hbWVkIGNhbiB1c2UgbmV0d29yawpjYW5fbmV0d29yayhuYW1lZF90KQpjYW5feXBi aW5kKG5hbWVkX3QpCiMgYWxsb3cgVURQIHRyYW5zZmVyIHRvL2Zyb20gYW55IHByb2dyYW0KY2Fu X3VkcF9zZW5kKGRvbWFpbiwgbmFtZWRfdCkKY2FuX3VkcF9zZW5kKG5hbWVkX3QsIGRvbWFpbikK Y2FuX3RjcF9jb25uZWN0KGRvbWFpbiwgbmFtZWRfdCkKbG9nX2RvbWFpbihuYW1lZCkKCiMgQmlu ZCB0byB0aGUgbmFtZWQgcG9ydC4KYWxsb3cgbmFtZWRfdCBkbnNfcG9ydF90OnVkcF9zb2NrZXQg bmFtZV9iaW5kOwphbGxvdyBuYW1lZF90IHsgZG5zX3BvcnRfdCBybmRjX3BvcnRfdCB9OnRjcF9z b2NrZXQgbmFtZV9iaW5kOwoKCiNyZWFkIGNvbmZpZ3VyYXRpb24gZmlsZXMKcl9kaXJfZmlsZShu YW1lZF90LCBuYW1lZF9jb25mX3QpCgojcmVhZCB6b25lIGZpbGVzCnJfZGlyX2ZpbGUobmFtZWRf dCwgbmFtZWRfem9uZV90KQojIGVuYWJsZSBkb21haW4gYXV0byB1cGRhdGVzLgojY3JlYXRlX2Rp cl9maWxlKG5hbWVkX3QsIG5hbWVkX3pvbmVfdCkKCiN3cml0ZSBjYWNoZSBmb3Igc2Vjb25kYXJ5 IHpvbmVzCnJ3X2Rpcl9jcmVhdGVfZmlsZShuYW1lZF90LCBuYW1lZF9jYWNoZV90KQoKYWxsb3cg bmFtZWRfdCBzZWxmOnVuaXhfc3RyZWFtX3NvY2tldCBjcmVhdGVfc3RyZWFtX3NvY2tldF9wZXJt czsKYWxsb3cgbmFtZWRfdCBzZWxmOnVuaXhfZGdyYW1fc29ja2V0IGNyZWF0ZV9zb2NrZXRfcGVy bXM7CmFsbG93IG5hbWVkX3Qgc2VsZjpuZXRsaW5rX3JvdXRlX3NvY2tldCByX25ldGxpbmtfc29j a2V0X3Blcm1zOwoKIyBSZWFkIHN5c2N0bCBrZXJuZWwgdmFyaWFibGVzLgpyZWFkX3N5c2N0bChu YW1lZF90KQoKIyBSZWFkIC9wcm9jL2NwdWluZm8gYW5kIC9wcm9jL25ldApyX2Rpcl9maWxlKG5h bWVkX3QsIHByb2NfdCkKcl9kaXJfZmlsZShuYW1lZF90LCBwcm9jX25ldF90KQoKIyBSZWFkIC9k ZXYvcmFuZG9tLgphbGxvdyBuYW1lZF90IGRldmljZV90OmRpciByX2Rpcl9wZXJtczsKYWxsb3cg bmFtZWRfdCByYW5kb21fZGV2aWNlX3Q6Y2hyX2ZpbGUgcl9maWxlX3Blcm1zOwoKIyBVc2UgYSBw aXBlIGNyZWF0ZWQgYnkgc2VsZi4KYWxsb3cgbmFtZWRfdCBzZWxmOmZpZm9fZmlsZSByd19maWxl X3Blcm1zOwoKIyBTZXQgb3duIGNhcGFiaWxpdGllcy4KI0EgdHlwZSBmb3IgL3Vzci9zYmluL25k Ywp0eXBlIG5kY19leGVjX3QsIGZpbGVfdHlwZSwgZXhlY190eXBlOwpkb21haW5fYXV0b190cmFu cyh7IHN5c2FkbV90IGluaXRyY190IH0sIG5kY19leGVjX3QsIG5kY190KQp1c2VzX3NobGliKG5k Y190KQpjYW5fbmV0d29ya19jbGllbnRfdGNwKG5kY190KQpjYW5feXBiaW5kKG5kY190KQpjYW5f cmVzb2x2ZShuZGNfdCkKcmVhZF9sb2NhbGUobmRjX3QpCmNhbl90Y3BfY29ubmVjdChuZGNfdCwg bmFtZWRfdCkKCiMgZm9yIC9ldGMvcm5kYy5rZXkKaWZkZWYoYGRpc3Ryb19yZWRoYXQnLCBgCmFs bG93IHsgbmRjX3QgaW5pdHJjX3QgfSBuYW1lZF9jb25mX3Q6ZGlyIHNlYXJjaDsKIyBBbGxvdyBp bml0IHNjcmlwdCB0byBjcCBsb2NhbHRpbWUgdG8gbmFtZWRfY29uZl90CmFsbG93IGluaXRyY190 IG5hbWVkX2NvbmZfdDpmaWxlIHsgc2V0YXR0ciB3cml0ZSB9OwonKQphbGxvdyB7IG5kY190IGlu aXRyY190IH0gbmFtZWRfY29uZl90OmZpbGUgeyBnZXRhdHRyIHJlYWQgfTsKCmFsbG93IG5kY190 IGV0Y190OmRpciByX2Rpcl9wZXJtczsKYWxsb3cgbmRjX3QgZXRjX3Q6ZmlsZSByX2ZpbGVfcGVy bXM7CmFsbG93IG5kY190IHNlbGY6dW5peF9zdHJlYW1fc29ja2V0IGNyZWF0ZV9zdHJlYW1fc29j a2V0X3Blcm1zOwphbGxvdyBuZGNfdCBzZWxmOnVuaXhfc3RyZWFtX3NvY2tldCBjb25uZWN0Owph bGxvdyBuZGNfdCBzZWxmOmNhcGFiaWxpdHkgeyBkYWNfb3ZlcnJpZGUgbmV0X2FkbWluIH07CmFs bG93IG5kY190IHZhcl90OmRpciBzZWFyY2g7CmFsbG93IG5kY190IHZhcl9ydW5fdDpkaXIgc2Vh cmNoOwphbGxvdyBuZGNfdCBuYW1lZF92YXJfcnVuX3Q6c29ja19maWxlIHJ3X2ZpbGVfcGVybXM7 CmFsbG93IG5kY190IG5hbWVkX3Q6dW5peF9zdHJlYW1fc29ja2V0IGNvbm5lY3R0bzsKYWxsb3cg bmRjX3QgeyBwcml2ZmQgaW5pdF90IH06ZmQgdXNlOwojIHNlZW1zIHRvIG5lZWQgcmVhZCBhcyB3 ZWxsIGZvciBzb21lIHJlYXNvbgphbGxvdyBuZGNfdCB7IGFkbWluX3R0eV90eXBlIGluaXRyY19k ZXZwdHNfdCB9OmNocl9maWxlIHsgZ2V0YXR0ciByZWFkIHdyaXRlIH07CmFsbG93IG5kY190IGZz X3Q6ZmlsZXN5c3RlbSBnZXRhdHRyOwoKIyBSZWFkIHN5c2N0bCBrZXJuZWwgdmFyaWFibGVzLgpy ZWFkX3N5c2N0bChuZGNfdCkKCmFsbG93IG5kY190IHNlbGY6cHJvY2VzcyB7IGZvcmsgc2lnbmFs X3Blcm1zIH07CmFsbG93IG5kY190IHNlbGY6Zmlmb19maWxlIHsgcmVhZCB3cml0ZSBnZXRhdHRy IGlvY3RsIH07CmFsbG93IG5kY190IG5hbWVkX3pvbmVfdDpkaXIgc2VhcmNoOwoKIyBmb3IgY2ht b2QgaW4gc3RhcnQgc2NyaXB0CmRvbnRhdWRpdCBpbml0cmNfdCBuYW1lZF92YXJfcnVuX3Q6ZGly IHNldGF0dHI7CgojIGZvciBuZGNfdCB0byBiZSB1c2VkIGZvciByZXN0YXJ0IHNoZWxsIHNjcmlw dHMKaWZkZWYoYG5kY19zaGVsbF9zY3JpcHQnLCBgCnN5c3RlbV9jcm9uZF9lbnRyeShuZGNfZXhl Y190LCBuZGNfdCkKYWxsb3cgbmRjX3QgZGV2dHR5X3Q6Y2hyX2ZpbGUgeyByZWFkIHdyaXRlIGlv Y3RsIH07CmFsbG93IG5kY190IGV0Y19ydW50aW1lX3Q6ZmlsZSB7IGdldGF0dHIgcmVhZCB9Owph bGxvdyBuZGNfdCBwcm9jX3Q6ZGlyIHNlYXJjaDsKYWxsb3cgbmRjX3QgcHJvY190OmZpbGUgeyBn ZXRhdHRyIHJlYWQgfTsKY2FuX2V4ZWMobmRjX3QsIHsgYmluX3Qgc2Jpbl90IHNoZWxsX2V4ZWNf dCB9KQphbGxvdyBuZGNfdCBuYW1lZF92YXJfcnVuX3Q6ZmlsZSBnZXRhdHRyOwphbGxvdyBuZGNf dCBuYW1lZF96b25lX3Q6ZGlyIHsgcmVhZCBnZXRhdHRyIH07CmFsbG93IG5kY190IG5hbWVkX3pv bmVfdDpmaWxlIGdldGF0dHI7CmRvbnRhdWRpdCBuZGNfdCBzeXNhZG1faG9tZV90OmRpciB7IGdl dGF0dHIgc2VhcmNoIHJlYWQgfTsKJykKYWxsb3cgbmRjX3Qgc2VsZjpuZXRsaW5rX3JvdXRlX3Nv Y2tldCByX25ldGxpbmtfc29ja2V0X3Blcm1zOwpkb250YXVkaXQgbmRjX3Qgc3lzYWRtX3R0eV9k ZXZpY2VfdDpjaHJfZmlsZSB7IGlvY3RsIH07Cg==