dear all, thank you for the comments/tips.<div><br></div><div>The reason for asking these questions is that although i think SELinux is good in many ways, eg, it allows the implementation of RBAC and MAC and such, and yes indeed, we can use tools like APOL's domain analysis to find out if one domain can 'reach' another domain, but the right questions have to be asked. Maybe this is too far fetched, but if a paranoid administrator wants to fully know what is at risk before deploying the system, would it be a good practice to generate some domain reachability tree for each of the services that is facing the Internet / network?</div>
<div><br></div><div>Or another way for this paranoid administrator is to use a strict policy (instead of targeted) and manually every rule, which is only manageable if the machine is having a very specific function like a firewall or file server?</div>
<div><br></div><div>thank you..</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br><br><div class="gmail_quote">On Wed, Aug 19, 2009 at 5:49 AM, Daniel J Walsh <span dir="ltr"><<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On 08/17/2009 01:05 AM, adrian golding wrote:<br>
> To refine my questions in the earlier email:<br>
> 1) many of the things the attacker can do if he exploits the Samba<br>
> vulnerability can be found in the source policy. but there are also so many<br>
> other rules in the policy (hundreds?), my question is how do I know if the<br>
> other rules matter much? there are >300 rules related to smbd_t, and it<br>
> just *seems* a lot can go wrong with the system.<br>
><br>
</div>Yes you got to ask the questions. You can ask a question in APOL about whether the smbd_t can read a file.<br>
<br>
A simple query<br>
sesearch --allow -s smbd_t -t user_home_t -c file -p read<br>
<br>
asks whether smbd_t can read files labeled user_home_t directly. You can use apol to look for transition rules that might allow it.<br>
<br>
SELinux is all about types so you need to user commands like<br>
<br>
semanage port -l<br>
<br>
To list the types that ports are assigned to or /etc/selinux/targeted/context/files/files.context to see what types are assigned to files, by default.<br>
<div class="im"><br>
> 2) how do we verify the part about what the attackers cannot do? does it<br>
> mean, if i cannot find a rule that links smbd_t with user_home_t with the<br>
> 'read' permission, the attacker cannot read/manipulate user home<br>
> directories? Or it is not as trivial?<br>
</div>Anything that is not allowed is denied. See above.<br>
<div class="im">><br>
> 3) i am assuming ports 137-139 and 445 are labelled smbd_port_t, but where<br>
> can i find this assignment in the policy? i am currently using apol.<br>
><br>
</div>semanage port -l<br>
<div class="im"><br>
> thank you<br>
><br>
><br>
> On Mon, Aug 17, 2009 at 10:42 AM, adrian golding <<a href="mailto:adriangolding@gmail.com">adriangolding@gmail.com</a>>wrote:<br>
><br>
>> dear all, can you please point me to the right place:<br>
>> with reference to: <a href="http://danwalsh.livejournal.com/10131.html" target="_blank">http://danwalsh.livejournal.com/10131.html</a><br>
>><br>
>> i am interested in how dan knows what an attacker can make use of the samba<br>
>> vulnerability to do by default, and what the attacker cannot do. More<br>
>> generally speaking, how do we look at a service or application in a SELinux<br>
>> system, and finding out what the attacker can do and cannot do in the case<br>
>> of the service being exploited?<br>
>><br>
>> in that page, he looked at some of the relevant booleans and i guess<br>
>> "samba_enable_home_dirs ---> off" prevents the attacker to read/manipulate<br>
>> the user's home directories. But what about the rest? What other things can<br>
>> an end user (who is not very experienced in SELinux) examine to know what<br>
>> the attacker can / cannot do?<br>
>><br>
>> thank you<br>
>><br>
>><br>
>><br>
><br>
><br>
</div><div><div></div><div class="h5">> ------------------------------------------------------------------------<br>
><br>
> --<br>
> fedora-selinux-list mailing list<br>
> <a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a><br>
> <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a><br>
<br>
</div></div></blockquote></div><br></div>