selinux July 2018

selinux@lists.fedoraproject.org

6 participants
5 discussions

Initial context for init
by Philip Seeley 01 Aug '19

01 Aug '19

Hi all, Quick question is: In the targeted policy should init run SystemHigh as it does in the mls policy? The background: We're setting up a targeted system where we confine all users and remove the unconfined policy module, but we also enable polyinstantiation of /tmp and /var/tmp. If we ssh in as a staff_u user phil and elevate to root/sysadm_r then we have a context of: staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 And therefore /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp Which is really: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_phil The real /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp Now if we use run_init to update an RPM that contains a post install script, rpm can't create the temporary script file: # run_init bash -c 'rpm -i --force /root/libselinux-2.0.94-7.el6.x86_64.rpm' Authenticating phil. Password: error: error creating temporary file /var/tmp/rpm-tmp.atkHTf: Permission denied error: Couldn't create temporary file for %post (libselinux-2.0.94-7.el6.x86_64): Permission denied Note: you need to use run_init as the rpm might restart a service, e.g. the sssd rpm. We've traced this to the /etc/selinux/targeted/contexts/initrc_context file which contains: system_u:system_r:initrc_t:s0 So we transition to initrc_t and then to rpm_t without any categories, but because the polyinstantiated /var/tmp directory has c0.c1023 we get denied. Normally in targeted init runs unconfined, but we've removed this. type=AVC msg=audit(1467342325.016:716): avc: denied { read } for pid=2779 comm="rpm" name="system_u:object_r:tmp_t:s0-s0:c0.c1023_phil" dev=dm-0 ino=1966082 scontext=system_u:system_r:rpm_t:s0 tcontext=system_u:object_r:tmp_t:s0-s0:c0.c1023 tclass=dir It works if we change initrc_context to: system_u:system_r:initrc_t:s0-s0:c0.c1023 We don't see the issue under mls because the default initrc_context is: system_u:system_r:initrc_t:s0-s15:c0.c1023 We've traces this back through the selinux-policy src RPM and to the upstream refpolicy and see that config/appconfig-mcs/initrc_context is: system_u:system_r:initrc_t:s0 whereas config/appconfig-mls/initrc_context is: system_u:system_r:initrc_t:s0-mls_systemhigh So under mls init's context is SystemHigh, but under mcs/targeted it doesn't have any categories. So the long question is should config/appconfig-mcs/initrc_context really be: system_u:system_r:initrc_t:mcs_systemhigh as it seems odd that the more secure mls policy would run init at SystemHigh but targeted doesn't. Thanks Phil Seeley

3 3

ejabberd pull requests
by Randy Barlow 14 Jul '18

14 Jul '18

Greetings! In November I pulled the ejabberd SELinux policy into Fedora 27+ so I could manage it more closely with ejabberd updates. At the time I sent pull requests to the Fedora SELinux policy to remove it from there, but the pull requests haven't been reviewed or merged. Could someone take a look? https://github.com/fedora-selinux/selinux-policy-contrib/pull/38 https://github.com/fedora-selinux/selinux-policy-contrib/pull/39 At this point, I suppose we'll also want to make this change on the Fedora 28 branch. You can see the policy in the ejabberd sources now: https://src.fedoraproject.org/rpms/ejabberd/tree/master

4 5

Re: Trying again: why am I getting denials in a directory that has been labeled..
by mark 11 Jul '18

11 Jul '18

Date: Sat, 30 Jun 2018 11:22:43 +0200 From: Lukas Vrabec <lvrabec(a)redhat.com> > > On 06/29/2018 10:15 PM, mark wrote: > >> As Lukas suggested, I tried to relabel the file. It didn't work, and >> the reason is this: we have the web under our own root directory, not >> under /var/www. We had done an semanage fcontext -e /var/www <ourpath>. >> When I tried to relabel, it suggested I try to relabel using the > /var/www path, which won't work. >> >> Is there any way around this? >> /<ourpath>/htdocs/<website>/cgi-bin/data/<the probelematic file> > > Could you attach complete outputs from semanage/ls (-Z)/ matchpathcon > commands? I would like to reproduce it to help you find issue. Sorry I couldn't get back to this sooner. semanage fcontext --modify -t httpd_sys_rw_content_t /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat ValueError: File spec /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat conflicts with equivalency rule '/<actual>/<path>/htdocs /var/www/html'; Try adding '/var/www/html/<website>/cgi-bin/Counter/data/image.dat' instead ll -Z: -rw-rw-r--. apache imagej unconfined_u:object_r:httpd_sys_script_exec_t:s0 /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat matchpathcon: /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat system_u:object_r:httpd_sys_script_exec_t:s0 Amd pf course there's no <website> under /var/www/html/ mark

2 2

shellinabox
by lejeczek 10 Jul '18

10 Jul '18

hi guys, cannot get it to work - shellinabox - not being programmer nor selinux sorcerer. shellinabox via apache, when I ausearch it all I get is: #============= unconfined_service_t ============== #!!!! The file '/usr/bin/bash' is mislabeled on your system. #!!!! Fix with $ restorecon -R -v /usr/bin/bash allow unconfined_service_t unconfined_t:process transition; I have shellinabox in Apache's: <Location /cmd> AuthType Basic AuthName "some more" AuthBasicProvider PAM AuthPAMService rstudio Require valid-user #Require all granted ProxyPass http://localhost:4200/ </Location> using: LoadModule authnz_pam_module modules/mod_authnz_pam.so So all seems to work there between apache & shellinabox. Last bit when you login to shell you get denied. Would there be a reasonable selinux module for it or is shellinabox just too poor design? many thanks, L.

3 4

Zoneminder Policy Fixes
by Tristan Santore 03 Jul '18

03 Jul '18

Dear Lukas and Petr, I have made fixes to the Zoneminder Policy module. Zoneminder will not start with the current one. Also I took them liberty to add two bools, one for email sending, because Zoneminder can send emails with images, when an alarm event was detected on a camera, and another boolean for ftp access, as Zoneminder can upload alarm events to a ftp, for safe keeping, in case somebody burgles your house and steals your CCTV gear. It can also use sftp, but not sure I would really like to add a port for that. But if you would like to add that option, I would leave that up to you. If you could be so kind, to look over the additions, I suspect, there might be a few things in there, one might want to avoid, or require labelling. Or ways to make it more secure. Policy additions below(Will require merging into existing policy): module zoneminder2018 1.3; require { type sysfs_t; type zoneminder_script_t; type zoneminder_var_lib_t; type zoneminder_t; type v4l_device_t; type init_var_run_t; type cert_t; type httpd_t; type syslogd_t; type zoneminder_tmpfs_t; type smtp_port_t; type tmpfs_t; type ftp_port_t; type ephemeral_port_t; class file { create getattr lock map open read unlink write }; class chr_file map; class lnk_file read; class dir { create read rmdir search write add_name }; class unix_dgram_socket sendto; class sock_file { create unlink }; class process { noatsecure rlimitinh siginh }; class tcp_socket name_connect; } bool zoneminder_can_sendmail false; bool zoneminder_can_ftp false; #============= httpd_t ============== #allow httpd_t zoneminder_script_t:process { noatsecure rlimitinh siginh }; #Flagged, but not required. allow httpd_t zoneminder_tmpfs_t:file map; allow httpd_t zoneminder_tmpfs_t:file { getattr open read write }; allow httpd_t zoneminder_var_lib_t:sock_file { create unlink }; #============= syslogd_t ============== allow syslogd_t init_var_run_t:lnk_file read; #============= zoneminder_script_t ============== allow zoneminder_script_t cert_t:dir search; allow zoneminder_script_t cert_t:file { getattr open read }; allow zoneminder_script_t httpd_t:unix_dgram_socket sendto; allow zoneminder_script_t init_var_run_t:dir search; allow zoneminder_script_t sysfs_t:dir read; allow zoneminder_script_t sysfs_t:file { getattr open read }; allow zoneminder_script_t zoneminder_tmpfs_t:file map; allow zoneminder_script_t zoneminder_var_lib_t:dir { create rmdir }; allow zoneminder_script_t zoneminder_var_lib_t:file { create getattr lock open read unlink write }; allow zoneminder_script_t tmpfs_t:dir { add_name write }; #============= zoneminder_t ============== if (zoneminder_can_sendmail) { allow zoneminder_t smtp_port_t:tcp_socket name_connect; } #add ftp and sftp here #sftp needs some extra work I guess. if (zoneminder_can_ftp) { allow zoneminder_t ftp_port_t:tcp_socket name_connect; allow zoneminder_t ephemeral_port_t:tcp_socket name_connect; } allow zoneminder_t v4l_device_t:chr_file map; allow zoneminder_t zoneminder_tmpfs_t:file map; -- Tristan Santore BSc MBCS TS4523-RIPE Network and Infrastructure Operations InterNexusConnect Mobile +44-78-55069812 Tristan.Santore(a)internexusconnect.net Former Thawte Notary (Please note: Thawte has closed its WoT programme down, and I am therefore no longer able to accredit trust) For Fedora related issues, please email me at: TSantore(a)fedoraproject.org

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2018