selinux September 2018

selinux@lists.fedoraproject.org

5 participants
4 discussions

Initial context for init
by Philip Seeley 01 Aug '19

01 Aug '19

Hi all, Quick question is: In the targeted policy should init run SystemHigh as it does in the mls policy? The background: We're setting up a targeted system where we confine all users and remove the unconfined policy module, but we also enable polyinstantiation of /tmp and /var/tmp. If we ssh in as a staff_u user phil and elevate to root/sysadm_r then we have a context of: staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 And therefore /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp Which is really: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_phil The real /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp Now if we use run_init to update an RPM that contains a post install script, rpm can't create the temporary script file: # run_init bash -c 'rpm -i --force /root/libselinux-2.0.94-7.el6.x86_64.rpm' Authenticating phil. Password: error: error creating temporary file /var/tmp/rpm-tmp.atkHTf: Permission denied error: Couldn't create temporary file for %post (libselinux-2.0.94-7.el6.x86_64): Permission denied Note: you need to use run_init as the rpm might restart a service, e.g. the sssd rpm. We've traced this to the /etc/selinux/targeted/contexts/initrc_context file which contains: system_u:system_r:initrc_t:s0 So we transition to initrc_t and then to rpm_t without any categories, but because the polyinstantiated /var/tmp directory has c0.c1023 we get denied. Normally in targeted init runs unconfined, but we've removed this. type=AVC msg=audit(1467342325.016:716): avc: denied { read } for pid=2779 comm="rpm" name="system_u:object_r:tmp_t:s0-s0:c0.c1023_phil" dev=dm-0 ino=1966082 scontext=system_u:system_r:rpm_t:s0 tcontext=system_u:object_r:tmp_t:s0-s0:c0.c1023 tclass=dir It works if we change initrc_context to: system_u:system_r:initrc_t:s0-s0:c0.c1023 We don't see the issue under mls because the default initrc_context is: system_u:system_r:initrc_t:s0-s15:c0.c1023 We've traces this back through the selinux-policy src RPM and to the upstream refpolicy and see that config/appconfig-mcs/initrc_context is: system_u:system_r:initrc_t:s0 whereas config/appconfig-mls/initrc_context is: system_u:system_r:initrc_t:s0-mls_systemhigh So under mls init's context is SystemHigh, but under mcs/targeted it doesn't have any categories. So the long question is should config/appconfig-mcs/initrc_context really be: system_u:system_r:initrc_t:mcs_systemhigh as it seems odd that the more secure mls policy would run init at SystemHigh but targeted doesn't. Thanks Phil Seeley

3 3

Container SELinux Customization
by Lukas Vrabec 23 Sep '18

23 Sep '18

Hi All, Back in April, I announced that we work on POC how we could automatically create SELinux security policies for different kind of containers. The original concept is described here: https://github.com/fedora-selinux/container-selinux-customization Long story short, using pre-defined policy blocks, system administrators would be able to simply create customized SELinux policies for containers. The goal is to create a standalone tool which would be able to do it. And we a have a prototype now. It's called "udica" and you can find it here: https://github.com/containers/udica In this repo you can find sources and examples how to create SELinux policy for your containers. I also created copr repository for Fedora 29 and Rawhide: https://copr.fedorainfracloud.org/coprs/lvrabec/udica/ Feedback is welcome. Any issues please report in github issues tracking system. Thanks, Lukas. -- Lukas Vrabec Software Engineer, Security Technologies Red Hat, Inc.

1 0

New user role (guest_u + exec permission on specific accounts - network access)
by Lakshmipathi.G 22 Sep '18

22 Sep '18

Hi. We have lot of guest_u users don't want to use 'guest_exec_content', which will enable access to all users. SELinux User Capabilities lists guest_u has "X-windows=no, su/sudo=no , home/tmp execute perm=no , networking=no" Is it possible to add new role like 'eguest_u' "X-windows=no, su/sudo=no , home/tmp execute perm=yes , networking=no" Alternate method will be, Removing network support from "user_u". Thanks for any pointers. ---- Cheers, Lakshmipathi.G http://www.giis.co.in http://www.webminal.org http://www.btrfs.in

1 0

USB drive mounting via remote access
by Robert Moskowitz 20 Sep '18

20 Sep '18

I maintain some servers via VNC (over my internal network, firewall rules prevent remote connections). In the past, I would VNC in as root and I had all the control I needed. I am trying to get away from root over VNC. I discovered that a user account cannot mount a USB drive, no permissions. This is true for a USB stick, USB connected HD, and a USB connected CD burner (K3b does not even see the drive). I am assuming this is an SELinux feature. I want the user I have set up for VNC access (that is also in the Wheel group) to be able to perform this function. I don't want to have to command line sudo mount, nor can I figure out what k3b would need. I have been googling this problem for a few days, but either my search foo is weak (nothing new there), or there is really no information out there on this. So if this IS an SELinux feature, can someone help me with what I would need as a policy rule? Oh, right now I am doing this for Fedora 29-armfhp beta. I will also be doing it for Centos7-armfhp. thanks

3 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2018