2013-06-17

[Technology] SELinux and audit.log not updating

Disclaimer: I am neither a FUSE nor an SELinux expert 
So, I have a FUSE filesystem for the home directory of one of the users on my computer, and launching chromium-browser and some other programs who had data directories in the FUSE filesystem failed to launch.

Learning about SELinux

It appears that generally only the mounting user can see the mounted filesystem, so I wondered whether that was part of the problem, but testing chromium-browser on a test /tmp/ directory with permissions 700 still worked.  I then tried the regular thing, and checked if it was SELinux.  It's always SELinux.  Indeed, briefly setting setenforce 0 allowed chromium-browser to launch.  Obviously that's not a real solution; it's like taking the battery out of a beeping smoke alarm.

Recently on Google+ I perused a thread on SELinux linked to stopdisablingselinux.com, which leads to a 52 minute RedHat video on how to properly use it.  While I feel that 52 minutes is a bit long to convince the average user, I'd like to better understand SELinux, so I watched it. 

I recommend watching it if you're curious about how to work with SELinux because it was pretty clear and crisp.  Types, labels, policies and useful commands.

auditd, audit.log not updating?


Now, I'll confess that I've known there's been something amiss with my configuration, in that, for a while (since upgrading to Fedora 16!), I have not seen any sealerts.  I've confirmed that SELinux was operating and haven't had the time to diagnose the problem further.  At first I thought that sealerts were no longer being displayed by intent, but then a Fedora 18 Live USB key started displaying some.   With my new knowledge, I solved two problems in one day.

To find out what was going on with fuse and chromium-browser, I manually checked /var/log/audit/audit.log to discover that it had not been updated since November 2011!   I checked to see whether auditd was running using systemctl and ps, and it was not.  It probably hasn't started since that upgrade.  Probably systemd-migration related.  Referring to the Fedora 18 security manual, the solution to this was simple, /sbin/chkconfig --levels 2345 auditd on, so it will usually start, and systemctl start auditd.service, so it would start right now. 

Using FUSE file systems as home directories

Then, I tested chromium-browser again, sometimes starting with its user-data-dir in the FUSE filesystem, other times in /tmp/, and the problem I was encountering was this:
type=ANOM_ABEND msg=audit(1371441397.452:21): auid=504 uid=504 gid=504 ses=2 subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1044 pid=21858 comm="chromium-browse" reason="memory violation" sig=11

Sadly, setroubleshootd couldn't offer any solutions to this, so I googled ANOM_ABEND and "memory violation" and fuse, and discovered the boolean use_fusefs_home_dirs.  There weren't many search results, but this was enough.  Using setsebool use_fusefs_home_dirs 1 allowed chromium-browser and others to run normally.  Hooray!

Concluding Thoughts

Upgrading and migrating settings and customisation
 
So, two thoughts: Fedora and Linux distributions in general often have problems when upgrading.  Fedora used to (still does?) advise that you install through Anaconda, and I think I was supposed to install a clean system.  I don't think that's very user friendly, having to burn ISOs, and feel like it should happen in place managed by software (not during a user session, of course).  Eventually preupgrade came along, and eventually it become acceptable.  Still, though, upgrades often end up with subtly broken configuration.  gnome-documents was supposed to be notable in one upgrade, but I had to manually install it, because the upgrade didn't add it as a new package for the new release.  Worse than system configuration breaking (like auditd's autostarting at boot) might be user configuration for apps changing and rarely is any migration offered.  I have config files that are many years old that are no longer used and just sit there, or contain now invalid configuration.   There are stale gconf keys.  One solution is to start fresh and copy over data, but then it's a pain re-onfiguring all my favourite apps, and I might not know what customisations I've lost.  One solution is to reduce the amount of customisation that is allowed, so you don't have to support complex migrations later, and I feel like that's the current trend.  I think I'd like a standardised settings and migration standard.  I suppose GSettings and dconf helps deal with a class of settings within GNOME applications, but of course many tools are not GNOME, and even many GNOME applications store data in ~/.config/.  Ah well.  At least awareness and familiarity with my system (a luxury) helps me avoid anything catastrophic, though not so much, as I haven't had time to fix my SELinux logging for over a year.

User feedback from security applications

SELinux is getting better, with sealert and setroubleshoot, but it and the firewall have some issues in offering feedback to users.  Even with auditd and the other tools, SELinux wasn't able to indicate to me that use_fusefs_home_dirs set to 0 was preventing my browser from running.  It's the type of feedback that would be nice to save me an hour of my day.  I've seen many neat features appear in applications, using mDNS networking and Avahi, that "mysteriously" don't work, and in reality it's because the firewall silently blocks it.  Promoting features in applications that can't work out-of-the-box and where the user can't readily know why it isn't working is sad.   Perhaps developers are afraid of the syndrome where you present security information to a user and then they blindly click "allow" to everything, no matter how dangerous or malicious.  Is that better or worse than googling and reading in a dozen forums the solution of "disable the firewall" or "disable SELinux" for people who can't be bothered (time is precious) to understand and crisply fix their problem.

Labels

#General #Microblog friends life #Technology gnome music google iaido guelph fedora vegan bugs food school linux technology #GNOME #School jodo gxml #Budo blogger #Photos work nature web happy vala art Flesherton firefox android anime internet open source stress travel home kendo kosmokaryote writing birthday dad science animals computers environment future security canada cookies development photos programming german reading sick sleep snow video winter GUADEC cell phones css fun language learning me people phone picasaweb ta time christmas evolution love movies vegetarianism Toronto gsoc identity society speech vancouver vlogbrothers #Vegan adventure ai birds dreams git google+ gseta happiness libgdata new zealand night responsibility skedge stars tea wind mobile Nintendo baking cake consumerism fedora 17 memories netflix nlp photography quote tablet uoguelph Josh Ritter books bug communication design facebook family humanity javascript magic meaning memory money organisation pidgin rain recipes speechdispatcher sushi tv weather Spain TAing animalia cat chocolate cold cycling death encryption film flight genderguesser halloween health knowledge languages liv mail new years nightmares politics productivity psychology swords the legend of zelda ubuntu video games web development xml xorg youtube Thanksgiving The Frames acer bc blogging busy conversation cooking duolingo emacs emusic fedora 18 galaxy nexus gay rights gitorious gmail japan libxml2 martial arts materialism nerdfighteria privacy rhythmbox software sound space university upgrade valentines wahoo walking Con-G Europe John Green Scott Pilgrim age animal welfare apple autumn bash brain brave breath of fire II calm camera canada day change clothing comments confidence conservation creativity culture dance dataloss djaqua e-mail errors feminism gdom germany goals google reader gtk humour intelligence japanese laundry law light math morning nostalgia ottawa peterborough pets philosophy pie quality research sei do kai shopping spring style summer value village vday vonage water web design website x11 New York alone anime north anxiety argument blog budo buffy business cats computer science concert data loss diy duplicity eating economy education energy english exercise failure fedora 19 file systems flowers freedom french games gdata greyhound growth habits heat history house html ice cream im information joy koryu laptop living lost microsoft moon moving mozilla muffins mystery news nz pain photo php physics pirates pizza play poverty preupgrade progress purple python reality reflection religion rss self serialisation sharing skating social sun synergy tachi uchi testing themes thesis thinking thoughts transit turtles veggie challenge velociraptors violin weekend weird yum zellers #Life API Air Canada Empathy Hank Green Hugo Jane Austen Lord of the Rings Nexus One OCUS Sudbury Trick or Eat arboretum audible autonomous automobiles backup beauty bike blogs browsers camping cancer canoeing celebration charity chrome colour community content copyright corporations crafts decay decor depression depth disaster drawing emotion epic equality experience faery fest farmer's market fedora 12 fedora 16 fedora 20 fedora 22 fedup feelings fireworks friend gender ghetto ghosts glib gnome blog gnome shell google talk green hair hobocore hungry icarus interest introspection java jobs last exile luks macbook mail-notification mario meat in vitro mind mom mood moon festival motivation mtp ninjas oh the humanity pagans pants papers past performance perl phones picnics pitivi plastic pride pumpkin pumpkin pie quiet thrill rae spoon receipts rogers rpm seminar sewing simple simplicity sleep deprivation smells soy milk speech dispatcher sports stories story telling strange streamlines swimming telephone temperature texting thrift stores time management time travel tragedy truth understanding united states urban ecosystems usb veganism voice volunteering webschwerver wild wireless working world yojimbo zoology Avatar: The Last Airbender Blassreiter CIS*2750 CIS*6890 Czech Republic Diablo Dresden Codak Dunedin Dutch Blitz Electric Networked Vehicle Elliott Brood Ender's Game France Fringe GNOME 3 HTC Hayao Miyazaki Mario Kart Montréal Network Manager Newfoundland Ontario Ouran Host Club Richard SVC Samsung Samurai Champloo Santa Claus Studio Ghibli TCAF US academics adb aeroport algonquin amusing animal agriculture apartment automation awkward bad movies banana bats battery beard belladonna beta bicycle book branding breakfast brno bus buses buy nothing day cabin calgary candy cards cars catastrophe celebrate celtic chat cheap cheese childhood china chinese calendar cities clarity clean cleaning clock comics compassion compiler computer conspiracy theorists consumption context convention cookie cool cornerstone cosplay cottage country court creation cthulhu cupcakes curiosity cute dancing dark themes dbus definition democracy despair dinosaurs discomfort dns dodgeball dragon dress dust dystopia earth earth day efficiency eggs elections email enhanced history ethics evil exhausted expectations exploring ext3 ext4 fail fair trade fall fashion favourite feedly ferry focus formal free friendship fruit fudge full moon furniture gaelic game boards garden gardening gee generosity genetics gimp gir gobject good google hangouts google wave government grading gratitude green roofs groups gsec guerilla gardening haircut hakama help homosexuality honesty howl hp human rights humanitarianism humility hypocrisy ice images imaqua instant messaging integration internet explorer jabber jazz jelly bean jokes kernel keyboard knife labs last exile: fam the silver wing laurena lazy letters library libxml livejournal lizzie bennet loneliness loss lovely lyrics maps maturity meditation melancholy metadata microbes microfinancing microwaves moon cake morality mother music concert muso jikiden eishin ryu myth namespaces nasa nerdfighter neural networks nintendo 3ds normal normality notes obsolescence oceans open open souce open standards panasonic paper parties patches peanut butter perception personal perspectives philanthropy plants pleasant politeness potluck preparation problems ptp pulseaudio quidditch racism recreate redundancy relationships relax repairs resizing richard's room roomba roses rsync running sad sadness salsa samurai sanity scary schwarting seasons self-esteem self-navigating car selinux semiformal senility sensitivity sentimental sheep ships silicon motion sleeping in sms social justice software engineering solitude solutions songs soup speed ssh star wars strangers stupid success sunset surreality survival skills suspense sustainability sweet sympathy symphony tardigrades tasks teaching technical communication and research methods test tests thought thrift tim tams time and space tired tools tracker tradition tranquillity transience trees trust tumblr twitter update usability utopia via vihart vlog waffles warmth waste waterloo wave web comic webkit wii wiki winter is coming wizard wonder woods words xmpp yoga youth zoo #Wishlist 1. is anyone reading this? 1602 1984 2. you win a prize! 2014 24fps 3. gimme a call to collect 404 All My Children Andy Griffith Argentina Armstrong House Avatar: The Legend of Korra BarTab Beach House Boston Boston Summit Businesses C CIS*6050 Cambridge Christopher Plummer Claymore Creatures Darker than Black David Attenborough Dear Wendy Docking Station Dollhouse Earthbound England Excalibur February Fergus Final Fantasy IX GError GSA Go Grimes Hunger Games I believe in a thing called love I'm a wizard IRC Ikea Ireland JRR Tolkien King Arthur MIT Mac OS X Madrid March Massachusetts Matlock McGuinty Melodies of Life Merlin Michael Cera Mother Mother Mr. Tumnus Narnia Neil Gaiman New York Philharmonic Nick and Norah's Infinite Playlist Nintendorks Norns North Korea NotesFromNewYork Olympic OpenShot Orphen Orson Scott Card Oscars PEAP Pete Peterson Planet Fedora Porco Rosso Questionable Content R ROM Rent S SIM Wireless Sauble Beach Selenium Shakespeare Snakes and Lattes Star Trek Steve Grand Stranger Things ThanksLiving The Darkness The Devil is a Part-Timer The Fifth Estate The Guild The Hobbit The Stand Tianjin Tim Hortons Tolkien UK UX VPN Will Grayson Will Grayson Wolves in the Wall WordPerfect Xiki abrt absolutism abuse academia accessibility active activism activity addiction adreama adrift adulthood advertisement advertising air airport express airship ajax al gore alarm clock aldiko alice in wonderland alien alistair summerlee amateur amazon ambience ambition amy winfrey anaconda and imperfection angle angry birds anhosting animation anon anonymity ant apache apology appearances appreciation aqualab arcade architecture arduino arrogance ask assassins assignments association analysis astrid asus eee top asynchronous ati attitude attribution aural abuse authentication authenticity automake automarker avatars awesome b43 backtrack3 backyard bounty bad bagel bandwidth banjo banks barbarians barefoot baseball bathroom beaches beautiful bed bees beetles being belief bellaqua benedict cumberbatch berlin bertrand russell bill gates biofabrication biology biometrics bit rot bitcoin black and white blame blockbuster bloomberg blue board games bohemian bold bon thé place bonds border boredom botany boxing day boy brain scoop brickworks broadcom broccoli browsing bubbles bubbly buildings bunnies burn bus stops butterflies buttons c# c++ cafe calendaring calligraphy camel camera obscura cameras canopy capitalism captivity careless caring cast causality cbc cedar row cello censorship certainty cgi chalk challenger changing locks chaos theory charm cherry blossoms chickadee chickens chivalry choir chopsticks chores christchurch christianity chudan church cijf cinnamon classes clif clorox clorox green works cloud cloud atlas clubs cname coca cola codeine codeviz coincidence coins color comfort commons communism competence competition competitive coughing completeness compliments conference configuration conflicted confusion consciousness consent conservatives conservativism console construction contagion contest contributing convenience corpses cough suppressants coughing coupons courageous crashes crates crayons crazy creative commons criminals crisps criticism crosscanada crowd crtc cry crying cryptic cryptozoology csh cuddles cult currency current tv curse customer service customisation cvs daily grind data data mining databases dating david bowie dconf debate debug symbols debugging delicious design patterns desktop desktop summit destiny detachment dftba diet difficult digimon digital receipts disabilities disappointment discordianism dispute dissection kit distraction diyode dnf doctor who doctors documentation dokuwiki doubt doughnut dpkg drab drano drano prevention dream dreaming drinking drm drowning dryers dtwydt ducks dvds dying dynamic typing ease easter easy ebony jewelwing ebooks ecards economics editors eeetop el paso elder neglect electronic receipts elements elitism ellen page embarrassment emily graslie emptiness empty enchant end of enterprising environmental science symposium eog epiphany eplugin equipment essentialism ether euphoria evoaqua experiment experimenting expertise extensions extortion facades faith falafel familiarity fan fancy fantasy fascism faun favicon fears fedora 11 feed me feedback festival fibonacci fiction fiddler crab field guide field identification figment figures of speech file formats finances fire fish fitness fixing flac flash light flesherton fling flexibility flour flow flying fonts footprints forceps forgottotagit fork fortunate fortune found fragaria frameworks fraud fred penner free time freezing french fries fresh friday friend's wedding frog fspot funding funerals funny fury fuse gargoyles gdb geek geeks gf3 gi gifts gio gjs glass globalnewtgames glory gloves glue gluten gm gmo gnome keyring gnome software go ninja go go transit goat gods goodbye goodfella's google books google wallet gp2x gqe grad graffiti grammar graphing graphviz grass green beaver grey county groceries growing up gtest gtg guts gypsies habit hal halls hard hard drive hard drives hardship hardware harry potter hdtv heart heart break heaven 17 hemlock grove hewlett packard hijinx hiking hoaxes hobbies holidays homelessness homework honey badgers honour horatio hornblower horror hostels hosting hot house of cards hp lovecraft hugs humblebundle humbleness hunting hyperlinking hyrule i am a carpet ibm thinkpad x41 icalendar ice cream sandwich ice rain icthyology ignorant ill image image editing imagination impermanence inadequacy inaturalist inconvenience independence india individuals industry infinity ingrid michaelson inhumanity injuries ink innovation insects instagram installation intel intellectual property interactivity interlocutor internet tv invertabrates io irish irony isolation it it is indigo james bond jedi jikiden joke journalism journey judgement julian assange julie thiel justice kata kayak keys ki-ai killme kim taylor kinder kindness kirby kitchen kiva knights knots kodak koodo kung fu labels landau sacamoto late laundromat led legend lending lenovo lessons letstrace letter writing liberalism liberals libnotify libreoffice librpm lifehacker lilo limericks limits linksys liquid lists live wallpapers livecd liveusb loans local local food local install login london losher lots of hugs mac mini machine learning machine vision madness mae magic school bus magical maintainership majesty malaria malls mantis shrimp marine life marketing marking massages matrices maturation may seminar meat media medicine mel's diner memory leaks mental health meow mercy metacity metaphor methodology mezzo forte micropayments mild mild weather military milk mindhacks minimalism misanthropy miscellany misery misfortune missed the boat missing mlp modelling moisture mold molly parker monitors monologue more cats mosquitoes moss mother's day mounting mouse moxies muffin muffinfilms mundane murder museum mushishi mushroom soup mushrooms musicals mutual funds my slumbering heart mysql nameservers nanowrimo national treasure natural language processing naturalism nausicaa navigating necessity neighbours nervous netgear network new new users newspaper hat next year ninja turtles nodelist nointernet noise noisy nominate non-root norse noses not really dying notebooks notification-daemon novels november fair nuclear war numbers numix obama obligation obliviousness obscure ocz ogg oggenc olap olive omote open formats open music openness openoffice optimisation optimism orcas orchestra oreo oreos org-mode origami oscar otr overheat owen sound package management packagekit packing paint shedding pan pancakes panda parallelism paranoia passport patents patience pattern recognition pdo peace peaceful pen pence pender penguins penmanship perfection pet rocks physical piano pickman's model picnik pidgin plugins pikmin pintsize pipelight pirate festival pizza hut plagiarism planning plans playground playlists plumbing plushies podcast poem poetry points pokemon pomplamoose positions posse post posters postmodernism potatoes potlucks power ppc practise prejudice premier pressure pretty pride and prejudice priorities private processes professionalism projects promise protest proud purchases qt quarantine rad radeon railroad randall munroe raop rats reagan recursion recycling redhat reductionism refactoring refrigerators regret relativism release renew renfrew repetition report resolutions resolve resumes reuse reuters reviews revolution rhino rhps ricola risk road trips roar robots rockwood rot rover rtm ruby day ryu safety sanctuary sand satisfaction savages scary movies scheduling schneier scholarships scooters scp screenshots script seals search secret world of arrietty secrets seitei self-interest self-respect self-sufficiency self-worth semesters senescence sessions setbuilder settlers of catan sftp shame sheepo pistachio sheila patek shell shells sherlock holmes shipping shogun shotwell shoulder bag sigh sim city simafort simpsons sincerity singing sjr skill skunks sky slackware slashdot sliver small smiling snails snowboarding soccer social dance social media socis soft solemn someonesmotherwantstoadoptme song sony sophistication sorbet sorrow sparklers speed river spell spellchecking spelling spies spilt milk splendid splendor splinter spoilers sql squaresville sr ssd sshd stanley park starry night starving steampunk storage strawberries strength structured information struggle stuff stylus suburi sucks sugar super mario super mario land 3d superiority superstition surprise surreal sushi surrender swings systemd systems tabs tachi uchi no kurai tail coats tameshigiri tarot taxes tears technocracy teddy bears tedtalk term termcap terror the duke the fault in our stars the hulk the human league the irregular at magic high school the onion theatre theory thingsidon'twanttodo tim berners-lee tim mcgraw timber timbre timeliness tin tin toaster todo toilets tolerance tonight toomuch touch screen touchpack tour tourniquet toys trac trailer translation travel buddy treestyle view trex triumf triumph trivia trouble tweak twist tx2500 tx2617 typing ugly logos umbrellas un dinaru underwold unemployment universe unlimited blade works updates upgrades uploading urban agriculture urban ecology urchins user experience vagrancy vagrant vague but exciting valadoc validation values vampires vanilla ice variety vegetables velvet burger verb version control vi vinegar violence voip vpnc vulnerable waf wandering wanting war warm weapons web hosting webcomic webcomics webfonts werewolves whales what a wonderful town whatsbetter whic are also lazer powered white spot wifi wii u wikisource will williams wings wisdom wishes wizardry wolf wonderland wordplay world cup world water day writing voice xenophobia xephyr xinput xkcd xpath yahoo yay yyz z-index

Blog Archive

About Me

My photo

I am aeronautical, vanship-style.  I am olympic and mythical.  I rest on my laurels.