selinux March 2015

selinux@lists.fedoraproject.org

9 participants
8 discussions

Strange requirement: confine unconfined
by W. Michael Petullo 14 Apr '15

14 Apr '15

I have a requirement which seems to be most easily satisfied by confining unconfined users. Please let me explain: Imagine some file "foo" that must remain secret. Now imagine a dynamic system which must allow arbitrary (possibly untrustworthy, possibly as-root, possibly user-installed) programs to run. Nothing matters except keeping "foo" secret. Is it possible to construct an SELinux policy which would satisfy such a requirement? For example, it would be helpful to allow users to run their programs unconfined (to allow user-installed, policyless, etc. programs) yet still enforce the policy as it pertains to "foo". Of course, it further seems that SELinux would also have to ensure certain other restrictions apply to unconfined users, such as running semodule or insmod. Alternatively, would it be possible to construct a not-quite-unconfined user by granting all syscalls on all objects *except* those labeled "foo_t" (and semodule, etc.)? I have worked with custom policies before both for software I have written and for standard software, but this seems a bit different. It may be that I have my model wrong, so I would appreciate any guidance whether along the implementation lines I suggested or not (but holding to the original requirements). It is also possible that I have overlooked some existing literature. Thank you! -- Mike :wq

2 1

New Article on Future Docker Security.
by Daniel J Walsh 03 Apr '15

03 Apr '15

http://opensource.com/business/15/3/docker-security-future

2 2

RE: How do I create a directory in C that will follow selinux file context rules?
by Jayson Hurst 27 Mar '15

27 Mar '15

I resolved the problem with Dans help by adding a transition from unconfined to vasd_t Sent from my Windows Phone ________________________________ From: Miroslav Grepl<mailto:mgrepl@redhat.com> Sent: ‎3/‎27/‎2015 2:24 AM To: Jayson Hurst<mailto:swazup@hotmail.com>; selinux(a)lists.fedoraproject.org<mailto:selinux@lists.fedoraproject.org> Subject: Re: How do I create a directory in C that will follow selinux file context rules? On 03/26/2015 08:37 PM, Jayson Hurst wrote: > What I don't understand is why the filetrans doesn't work in the first > place? > > In my policy I define: > > filetrans_pattern(vasd_t, vasd_var_t, vasd_var_auth_t, dir ) > > But when my binary that runs under the vasd_t domain as an unconfined > user creates a directory in /var/opt/quest/vas/ called vasd it gets > created as a vasd_var_t. > > The parent directory of /var/opt/quest/vas is labeled as vasd_var_t. > Shouldn't the above filetrans_pattern label all new directories under > /var/opt/quest/vas as vasd_var_auth_t when they are being created under > the vasd_t domain? It should work. Are you sure you create it under vasd_t? Also you need to have manage_dirs_pattern(vasd_t, vasd_var_auth_t, vasd_var_auth_t) > >> Date: Thu, 26 Mar 2015 18:24:01 +0100 >> From: mgrepl(a)redhat.com >> To: swazup(a)hotmail.com; selinux(a)lists.fedoraproject.org >> Subject: Re: How do I create a directory in C that will follow selinux > file context rules? >> >> On 03/26/2015 04:17 PM, Jayson Hurst wrote: >> > RHEL 6.5 >> > >> > I have tried this using a filestran pattern but it doesn't seem to work. >> > >> >> Date: Wed, 25 Mar 2015 09:32:32 +0100 >> >> From: mgrepl(a)redhat.com >> >> To: swazup(a)hotmail.com; selinux(a)lists.fedoraproject.org >> >> Subject: Re: How do I create a directory in C that will follow selinux >> > file context rules? >> >> >> >> On 03/24/2015 10:45 PM, Jayson Hurst wrote: >> >> > I need to create a directory in a C binary. >> >> > >> >> > I am currently doing something similar to this: >> >> > >> >> > >> >> > >> >> > status = mkdir("/home/cnd/mod1", S_IRWXU | S_IRWXG | S_IROTH | > S_IXOTH); >> >> > >> >> > >> >> > >> >> > But when the directory is created it ends up with the wrong SELinux >> > context. It inherits it's parent's context and >> >> > >> >> > not the one defined in file context. >> >> >> >> What is your OS? >> >> >> >> > >> >> > >> >> > >> >> > Is there a C call that can be used that understands how to correctly >> > create and label SElinux directories? >> >> > >> >> > >> >> > >> >> > -- >> >> > selinux mailing list >> >> > selinux(a)lists.fedoraproject.org >> >> > https://admin.fedoraproject.org/mailman/listinfo/selinux >> >> > >> >> >> >> >> >> -- >> >> Miroslav Grepl >> >> Software Engineering, SELinux Solutions >> >> Red Hat, Inc. >> >> Ok, basically you can add a transition rule for "/home/cnd/mod1" >> >> >> userdom_user_home_dir_filetrans(unconfined_t, ABC_t, dir) >> >> It will create a dir in /home/cnd with ABC_t labeling for unconfined_t >> or for a domain defined by you. >> >> Where you are not able to use a file transition, you can use restorecond >> on RHEL6. It uses inotify to watch files listed in >> >> /etc/selinux/restorecond.conf >> /etc/selinux/restorecond_user.conf >> >> when they are created and it sets a context defined in the policy. >> >> -- >> Miroslav Grepl >> Software Engineering, SELinux Solutions >> Red Hat, Inc. -- Miroslav Grepl Software Engineering, SELinux Solutions Red Hat, Inc.

1 0

Fedora 21, unable to add new file context
by Mark Montague 27 Mar '15

27 Mar '15

Fedora 21 with selinux-policy-targeted-3.13.1-105.3 I've installed a local policy for PHP-FPM based off of https://github.com/prometheanfire/selinux-modules which defines several new types (to avoid conflicting with httpd_t type aliases in Fedora). I can't include everything in the .fc file for the local policy because I need to change the file contexts defined in other modules, so I set local contexts using semanage. This was working fine in Fedora 20, but here is what happens in Fedora 21: [root@ice ~]# semanage fcontext -a -t phpfcgi_exec_t /usr/sbin/php-fpm # this works fine [root@ice ~]# semanage fcontext -a -t phpfcgi_var_run_t "/var/run/php-fpm(/.*)?" # fails libsemanage.dbase_llist_query: could not query record value (No such file or directory). OSError: No such file or directory [root@ice ~]# semanage fcontext -a -t phpfcgi_var_run_t "/var/run/php-fpm" # but this works [root@ice ~]# Does anyone have any idea why the first and third commands above work, but the second one no longer works under Fedora 21? The error message isn't very helpful. I've searched the web and looked at the libsemanage source code, but neither was helpful. I've also run strace on the commands that succeed and compared the output to running strace on the command that failed, but I don't see any system calls that shed light on the problem (including nothing just prior to the write() calls for the error message that returns ENOENT). Here is some additional information. Note that I can add file context patterns very similar to the one that is failing above without any problems, such as "fcontext -a -f a -t selinux_config_t '/var/lib/config(/.*)?'" [root@ice ~]# ls -ldZ /var/run/php-fpm drwxr-xr-x. root root system_u:object_r:httpd_var_run_t:s0 /var/run/php-fpm [root@ice ~]# semanage export boolean -D login -D interface -D user -D port -D node -D fcontext -D module -D boolean -m -0 abrt_upload_watch_anon_write boolean -m -0 auditadm_exec_content boolean -m -0 boinc_execmem boolean -m -0 cron_userdomain_transition boolean -m -1 daemons_dump_core boolean -m -0 dbadm_exec_content boolean -m -1 deny_execmem boolean -m -1 deny_ptrace boolean -m -0 entropyd_use_audio boolean -m -0 gluster_export_all_rw boolean -m -0 gssd_read_tmp boolean -m -0 guest_exec_content boolean -m -0 httpd_builtin_scripting boolean -m -1 httpd_can_network_connect boolean -m -0 kerberos_enabled boolean -m -0 logadm_exec_content boolean -m -0 logging_syslogd_use_tty boolean -m -0 nfs_export_all_ro boolean -m -0 nfs_export_all_rw boolean -m -0 openvpn_can_network_connect boolean -m -0 openvpn_enable_homedirs boolean -m -1 polyinstantiation_enabled boolean -m -0 postfix_local_write_mail_spool boolean -m -0 postgresql_selinux_unconfined_dbadm boolean -m -0 postgresql_selinux_users_ddl boolean -m -0 privoxy_connect_any boolean -m -0 secadm_exec_content boolean -m -0 selinuxuser_direct_dri_enabled boolean -m -0 selinuxuser_execmod boolean -m -0 selinuxuser_execstack boolean -m -0 spamd_enable_home_dirs boolean -m -0 squid_connect_any boolean -m -0 telepathy_tcp_connect_generic_network_ports boolean -m -0 unconfined_chrome_sandbox_transition boolean -m -0 unconfined_login boolean -m -0 unconfined_mozilla_plugin_transition boolean -m -0 virt_use_usb boolean -m -0 xend_run_blktap boolean -m -0 xend_run_qemu boolean -m -0 xguest_connect_network boolean -m -0 xguest_exec_content boolean -m -0 xguest_mount_media boolean -m -0 xguest_use_bluetooth login -a -s guest_u -r 's0' __default__ login -a -s staff_u -r 's0' markmont login -a -s unconfined_u -r 's0-s0:c0.c1023' root login -a -s system_u -r 's0-s0:c0.c1023' system_u user -a -L s0 -r s0-s0:c0.c1023 -R 'staff_r unconfined_r system_r' staff_u fcontext -a -f a -t iptables_exec_t '/etc/systemd/ipset' fcontext -a -f a -t initrc_exec_t '/etc/systemd/selinux-lockdown' fcontext -a -f a -t tmp_t '/tmp/tmp-inst' fcontext -a -f a -t selinux_config_t '/var/lib/config(/.*)?' fcontext -a -f a -t tmp_t '/var/tmp/tmp-inst' module -d permissivedomains module -d unconfined module -d unlabelednet [root@ice ~]# -- Mark Montague mark(a)catseye.org

4 10

Ubuntu Selinux
by ezinne mbah 26 Mar '15

26 Mar '15

Hi All, Please can someone assist me on this, I enabled Selinux on Ubuntu 14.04 server and it's disabling ssh remote login for all users including root. >From the ssh terminal I get the following error: ssh root(a)192.168.x.x Last login: Wed Mar 25 12:39:02 2015 from 192.168.x.x /bin/bash: Permission denied Connection to 192.168.211.135 closed. tail /var/log/auth.log ubuntu sshd[1640]: Accepted password for root from 192.168.x.x port 51082 ssh2 ubuntu sshd[1642]: Accepted password for root from 192.168.x.x port 51089 ssh2 ubunt sshd[1640]: Received disconnect from 192.168.x.x: disconnected by user audit2allow --all sshd_t This avc is a constraint violation. you would need to modify the attribute of either the source or target types to allow this access. possible cause is the source user (system_u) and target user (unconfined_u) are different. possible cause is the source role (system_r) and target role (unconfined_r) are different. possible cause is the source level (s0) and target level (s0-s0:c0.c255) are different. allow sshd_t unconfined_trocess transition. Please how can I make this changes to take effect. Thanks in advance.

1 0

Tuning Docker with the newest security enhancements
by Daniel J Walsh 09 Mar '15

09 Mar '15

How to customize SELinux settings in Docker. http://opensource.com/business/15/3/docker-security-tuning

1 0

Idiomatic solution for tiny systemd "services"?
by Robin Lee Powell 05 Mar '15

05 Mar '15

Hey all. I have a tiny web service that I'm running with a ruby script in ~/.rvm/ , and I'd like to run it out of systemd (just to keep it running always), but init_t can't read or execute user_home_t. Nor can init_t run runcon. Basically, I can't figure out any way to transition from systemd's init_t to my user's type (staff_t). So what's the idiomatic way to handle that sort of thing? -- http://intelligence.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

3 7

boolean secure_mode under Rhel7
by Tim.Einmahl＠kba.de 02 Mar '15

02 Mar '15

Hi, can anyone please tell me the exact meaning of the booleans secure_mode (secure_mode_insmod secure_mode_policyload) under RHEL7? "semanage boolean -l" is not very helpful and I can't find a documentation regarding the booleans which is bit disappointing as booleans play an important role in SELinux. Thanks in advance Regards Tim

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2015