selinux March 2019

selinux@lists.fedoraproject.org

4 participants
3 discussions

Initial context for init
by Philip Seeley 02 Aug '19

02 Aug '19

Hi all, Quick question is: In the targeted policy should init run SystemHigh as it does in the mls policy? The background: We're setting up a targeted system where we confine all users and remove the unconfined policy module, but we also enable polyinstantiation of /tmp and /var/tmp. If we ssh in as a staff_u user phil and elevate to root/sysadm_r then we have a context of: staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 And therefore /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp Which is really: drwxrwxrwt. root root system_u:object_r:tmp_t:s0-s0:c0.c1023 /var/tmp-inst/system_u:object_r:tmp_t:s0-s0:c0.c1023_phil The real /var/tmp is: drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp Now if we use run_init to update an RPM that contains a post install script, rpm can't create the temporary script file: # run_init bash -c 'rpm -i --force /root/libselinux-2.0.94-7.el6.x86_64.rpm' Authenticating phil. Password: error: error creating temporary file /var/tmp/rpm-tmp.atkHTf: Permission denied error: Couldn't create temporary file for %post (libselinux-2.0.94-7.el6.x86_64): Permission denied Note: you need to use run_init as the rpm might restart a service, e.g. the sssd rpm. We've traced this to the /etc/selinux/targeted/contexts/initrc_context file which contains: system_u:system_r:initrc_t:s0 So we transition to initrc_t and then to rpm_t without any categories, but because the polyinstantiated /var/tmp directory has c0.c1023 we get denied. Normally in targeted init runs unconfined, but we've removed this. type=AVC msg=audit(1467342325.016:716): avc: denied { read } for pid=2779 comm="rpm" name="system_u:object_r:tmp_t:s0-s0:c0.c1023_phil" dev=dm-0 ino=1966082 scontext=system_u:system_r:rpm_t:s0 tcontext=system_u:object_r:tmp_t:s0-s0:c0.c1023 tclass=dir It works if we change initrc_context to: system_u:system_r:initrc_t:s0-s0:c0.c1023 We don't see the issue under mls because the default initrc_context is: system_u:system_r:initrc_t:s0-s15:c0.c1023 We've traces this back through the selinux-policy src RPM and to the upstream refpolicy and see that config/appconfig-mcs/initrc_context is: system_u:system_r:initrc_t:s0 whereas config/appconfig-mls/initrc_context is: system_u:system_r:initrc_t:s0-mls_systemhigh So under mls init's context is SystemHigh, but under mcs/targeted it doesn't have any categories. So the long question is should config/appconfig-mcs/initrc_context really be: system_u:system_r:initrc_t:mcs_systemhigh as it seems odd that the more secure mls policy would run init at SystemHigh but targeted doesn't. Thanks Phil Seeley

3 3

using an interface defined in another loaded module
by SZIGETVÁRI János 03 Apr '19

03 Apr '19

Dear Members, My new topic is slightly related to my last message. Since then I managed to sort things out, and my new policy seems to work fine, at least far as I was able to test it. My current situation is the following: I had a policy that I created for the main application "A" a while ago. Now I am creating a policy for a submodule of application "A", called "B" for the sake of illustrating it. "B" is a separate helper application that communicates with "A", but "A" can perfectly work without "B" being in use. In this situation it makes sense to create a separate policy for "A" and "B". Now, if submodule "B" is in use, then I would need to make use some interfaces, defined in the SELinux policy of "B", within the policy belonging to "A". Now how should I do this? I tried googling around for a few hours, but practically found no examples of this on the web. The policy module of "B" is built and loaded first, and when I'm compiling the now extended policy of "A", I get the following: Compiling targeted syslog_ng module /usr/bin/checkmodule: loading policy configuration from tmp/A.tmp A.te:5:ERROR 'syntax error' at token 'transition_to_B_t' on line 3212: transition_to_B_t(A_t) /usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/A.mod] Error 1 How do I need to reference the interface defined in another module, that is already loaded, when trying to use it? Currently this is the interface file of policy module "B": ================================================================================= ######################################## ## <summary> ## Allow the specified program domain ## to manage to the B socket. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process for which ## to allow managing the socket ## </summary> ## </param> # interface(`B_sock_manage', ` gen_require(` type B_t, B_sock_t; ') manage_sock_files_pattern($1, B_sock_t, B_sock_t) ') ######################################## ## <summary> ## Allow the specified program domain ## to transition to B_t through the entry point. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process for which to allow transitioning to B_t ## </summary> ## </param> # interface(`transition_to_B_t',` gen_require(` type B_t, B_exec_t; ') domtrans_pattern($1, B_exec_t, B_t) ') ######################################## ## <summary> ## Allow the specified program domain ## to read B_exec_t files. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process for which to allow read access ## to B_exec_t ## </summary> ## </param> # interface(`read_B_exec_t',` gen_require(` type B_exec_t; ') allow $1 B_exec_t:lnk_file { read }; allow $1 B_exec_t:file { read }; ') ================================================================================= And this is the way I am trying to access it from the policy module of "A": ================================================================================= transition_to_B_t(A_t) B_sock_manage(A_t) filetrans_pattern(A_t, A_var_run_t, B_sock_t, sock_file, "B.sock") read_B_exec_t(A_t) ================================================================================= I would be thankful for any suggestions for this! Thanks for your help in advance! Best Regards, János Szigetvári -- Janos SZIGETVARI RHCE, License no. 150-053-692 <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> LinkedIn: linkedin.com/in/janosszigetvari E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com Phone: +36209440412 (Hungary) __@__˚V˚ Make the switch to open (source) applications, protocols, formats now: - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice - msn -> jabber protocol (Pidgin, Google Talk) - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

1 1

binding and listening to port work with SELinux, but the process is unable receive data from clients
by SZIGETVÁRI János 20 Mar '19

20 Mar '19

Dear Members, Sorry for bothering you with my questions but I am kind of stuck with my problem, that's why I turn to you now. I am in the process of creating a SELinux policy for a software module, of a larger application. The module is simply a server, that listens on a port, and forwards the received information through a Unix domain socket to the main application. I got most parts of the policy right by now, in the sense that the module can start, and I don't see any AVC denied entries in the SELinux audit log. The relevant parts of my policy are the following (I have substituted the module's name with ABCD): type ABCD_t; type ABCD_port_t; corenet_port(ABCD_port_t); corenet_tcp_bind_generic_node(ABCD_t); corenet_tcp_sendrecv_generic_node(ABCD_t); corenet_tcp_sendrecv_generic_if(ABCD_t); allow ABCD_t ABCD_port_t:tcp_socket { name_bind }; allow ABCD_t self:unix_dgram_socket { create connect getattr setopt }; allow ABCD_t self:tcp_socket { accept bind create getattr listen setopt }; In the policy builder script also use semanage port -a -t ABCD_port_t -p tcp 1234 2>/dev/null || semanage port -m -t ABCD_port_t -p tcp 1234 2>/dev/null What I see with my current policy (with SELinux in Enforcing mode), is that the module starts up seemingly okay, it binds to the appropriate port, but see errors like this: 2019-03-19T16:08:14.314+0100 ERROR HTTP server error when serving connection "172.16.0.90:5986"<->"172.16.0.92:53952": error when reading request headers: read tcp4 172.16.0.90:5986->172.16.0.92:53952: read: permission denied 2019-03-19T16:08:14.315+0100 ERROR HTTP server error when serving connection "172.16.0.90:5986"<->"172.16.0.92:53953": error when reading request headers: read tcp4 172.16.0.90:5986->172.16.0.92:53953: read: permission denied In addition to this, I see nothing in the SELinux audit log, and when I put SELinux in permissive mode, things start working again. I am puzzled at this point why I'm not seeing anything in audit.log. If it is in deed SELinux that's blocking the read attempts, then there should be some information about that. Right? Thank you for your help! Best Regards, János Szigetvári -- Janos SZIGETVARI RHCE, License no. 150-053-692 <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> LinkedIn: linkedin.com/in/janosszigetvari E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com Phone: +36209440412 (Hungary) __@__˚V˚ Make the switch to open (source) applications, protocols, formats now: - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice - msn -> jabber protocol (Pidgin, Google Talk) - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2019