May 2010 - selinux - Fedora Mailing-Lists

by Tyler Durvik

I installed Fedora 13 and would like to set up MLS and the X server. I performed the default installation in VMware for testing. Where can I get information on setting this up? Thanks.

13 years, 11 months

2
1
0 / 0

Fedora13 breaks nagios

by Vadym Chepkov

Hi, It seems some changes in were introduced in Fedora 13 that broke nagios. audit2allow suggests #============= nagios_t ============== files_read_usr_files(nagios_t) seems reasonable : time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.739:39): arch=c000003e syscall=4 success=yes exit=0 a0=2658a10 a1=7fffd5ad5590 a2=7fffd5ad5590 a3=20 items=0 ppid=1602 pid=1612 auid=0 uid=494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:na gios_t:s0 key=(null) type=AVC msg=audit(1274807269.739:39): avc: denied { getattr } for pid=1612 comm="nagios" path="/usr/share/perl5/strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file---- time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.739:40): arch=c000003e syscall=2 success=yes exit=128 a0=2658a70 a1=0 a2=1b6 a3=7f1b126c2770 items=0 ppid=1602 pid=1612 auid=0 uid=494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:nagios_t:s0 key=(null) type=AVC msg=audit(1274807269.739:40): avc: denied { open } for pid=1612 comm="nagios" name="strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nag ios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file type=AVC msg=audit(1274807269.739:40): avc: denied { read } for pid=1612 comm="nagios" name="strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file---- time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.740:41): arch=c000003e syscall=16 success=yes exit=128 a0=5 a1=5401 a2=7fffd5ad5300 a3=48 items=0 ppid=1602 pid=1612 auid=0 uid =494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:nagios_t:s0 k ey=(null) type=AVC msg=audit(1274807269.740:41): avc: denied { ioctl } for pid=1612 comm="nagios" path="/usr/share/perl5/strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file---- #============= ping_t ============== allow ping_t nagios_log_t:file { read write }; but I think some transition is missing for ping_t -> nagios_t here time->Tue May 25 13:08:08 2010 type=SYSCALL msg=audit(1274807288.135:43): arch=c000003e syscall=59 success=yes exit=0 a0=1d50730 a1=1d50760 a2=7fffe1999de0 a3=7fffe1999b40 items=0 ppid=1647 id=1648 auid=0 uid=494 gid=488 euid=0 suid=0 fsuid=0 egid=488 sgid=488 fsgid=488 tty=(none) ses=1 comm="ping" exe="/bin/ping" subj=unconfined_u:system_r:ping_t:s0 key=(null) type=AVC msg=audit(1274807288.135:43): avc: denied { read write } for pid=1648 comm="ping" path="/var/log/nagios/spool/checkresults/checkhvg3ZF" dev=dm-2 in=3824 scontext=unconfined_u:system_r:ping_t:s0 tcontext=unconfined_u:object_r:nagios_log_t:s0 tclass=file

13 years, 11 months

3
3
0 / 0

Device nodes have no type when booting a 2.6.32.*.fc12 kernel

by Karl-Michael Schneider

I have fc12 installed on a Lenovo R61 laptop with two kernels: kernel-2.6.31.12-174.2.22.fc12.i686 kernel-2.6.32.12-115.fc12.i686 The 2.6.31 kernel has no problem. But when I try to boot the 2.6.32 kernel it fails because SELinux is blocking access to device nodes. I can only boot the 2.6.32 kernel in single user mode. The reason is that /dev and all files in it have no type: $ ls -lZ /dev crw-------. root root system_u:object_r:unlabeled_t:s0 agpgart drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 block drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 bsg drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 bus drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 char crw-------. root root system_u:object_r:unlabeled_t:s0 console drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 cpu crw-rw----. root root system_u:object_r:unlabeled_t:s0 cpu_dma_latency drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 disk brw-rw----. root root system_u:object_r:unlabeled_t:s0 dm-0 brw-rw----. root root system_u:object_r:unlabeled_t:s0 dm-1 drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 dri crw-r--r--. root root system_u:object_r:unlabeled_t:s0 fb crw-rw----. root root system_u:object_r:unlabeled_t:s0 fb0 crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 full crw-rw----. root root system_u:object_r:unlabeled_t:s0 fw0 crw-rw----. root root system_u:object_r:unlabeled_t:s0 hpet crw-r--r--. root root system_u:object_r:unlabeled_t:s0 hvc0 drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 input crw-rw----. root root system_u:object_r:unlabeled_t:s0 kmsg brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop0 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop1 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop2 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop3 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop4 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop5 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop6 brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop7 drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 mapper crw-rw----. root root system_u:object_r:unlabeled_t:s0 mcelog crw-r-----. root root system_u:object_r:unlabeled_t:s0 mem crw-rw----. root root system_u:object_r:unlabeled_t:s0 network_latency crw-rw----. root root system_u:object_r:unlabeled_t:s0 network_throughput crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 null crw-r-----. root root system_u:object_r:unlabeled_t:s0 nvram crw-rw----. root root system_u:object_r:unlabeled_t:s0 oldmem crw-r-----. root root system_u:object_r:unlabeled_t:s0 port crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 ptmx drwxr-xr-x. root root system_u:object_r:devpts_t:s0 pts crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 random drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 raw lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 root -> /dev/VolGroup00/LogVol00 lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 rtc -> rtc0 crw-rw----. root root system_u:object_r:unlabeled_t:s0 rtc0 lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 scd0 -> sr0 brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda1 brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda2 brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda3 crw-rw----. root root system_u:object_r:unlabeled_t:s0 sg0 crw-rw----. root root system_u:object_r:unlabeled_t:s0 sg1 drwxrwxrwt. root root system_u:object_r:tmpfs_t:s0 shm crw-rw----. root root system_u:object_r:unlabeled_t:s0 snapshot brw-rw----. root root system_u:object_r:unlabeled_t:s0 sr0 crw-r--r--. root root system_u:object_r:unlabeled_t:s0 systty crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 tty crw--w----. root root system_u:object_r:unlabeled_t:s0 tty0 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty1 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty10 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty11 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty12 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty13 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty14 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty15 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty16 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty17 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty18 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty19 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty2 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty20 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty21 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty22 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty23 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty24 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty25 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty26 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty27 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty28 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty29 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty3 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty30 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty31 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty32 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty33 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty34 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty35 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty36 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty37 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty38 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty39 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty4 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty40 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty41 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty42 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty43 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty44 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty45 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty46 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty47 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty48 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty49 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty5 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty50 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty51 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty52 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty53 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty54 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty55 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty56 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty57 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty58 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty59 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty6 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty60 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty61 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty62 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty63 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty7 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty8 crw--w----. root root system_u:object_r:unlabeled_t:s0 tty9 crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS0 crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS1 crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS2 crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS3 crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 urandom crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon0 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon1 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon2 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon3 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon4 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon5 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon6 crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon7 crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcs crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcs1 crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcsa crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcsa1 crw-rw----. root root system_u:object_r:unlabeled_t:s0 vga_arbiter drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 VolGroup00 crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 zero When I boot the 2.6.31 kernel, the device files are correctly labeled: $ ls -lZ /dev crw-rw----. root audio system_u:object_r:sound_device_t:s0 adsp crw-------. root video system_u:object_r:agp_device_t:s0 agpgart crw-rw----. root audio system_u:object_r:sound_device_t:s0 audio drwxr-xr-x. root root system_u:object_r:device_t:s0 block drwxr-xr-x. root root system_u:object_r:device_t:s0 bsg drwxr-xr-x. root root system_u:object_r:device_t:s0 bus lrwxrwxrwx. root root system_u:object_r:device_t:s0 cdrom1 -> sr0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 cdrw1 -> sr0 drwxr-xr-x. root root system_u:object_r:device_t:s0 char crw-------. root root system_u:object_r:console_device_t:s0 console lrwxrwxrwx. root root system_u:object_r:device_t:s0 core -> /proc/kcore drwxr-xr-x. root root system_u:object_r:device_t:s0 cpu crw-rw----. root root system_u:object_r:netcontrol_device_t:s0 cpu_dma_latency drwxr-xr-x. root root system_u:object_r:device_t:s0 disk brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 dm-0 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 dm-1 drwxr-xr-x. root root system_u:object_r:device_t:s0 dri crw-rw----. root audio system_u:object_r:sound_device_t:s0 dsp lrwxrwxrwx. root root system_u:object_r:device_t:s0 dvd1 -> sr0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 dvdrw1 -> sr0 crw-r--r--. root root system_u:object_r:framebuf_device_t:s0 fb crw-rw----. root video system_u:object_r:framebuf_device_t:s0 fb0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 fd -> /proc/self/fd crw-rw-rw-. root root system_u:object_r:null_device_t:s0 full crw-rw-rw-. root root system_u:object_r:fuse_device_t:s0 fuse crw-rw----. root root system_u:object_r:usb_device_t:s0 fw0 crw-rw----. root root system_u:object_r:clock_device_t:s0 hpet drwxr-xr-x. root root system_u:object_r:device_t:s0 hugepages crw-r--r--. root root system_u:object_r:tty_device_t:s0 hvc0 drwxr-xr-x. root root system_u:object_r:device_t:s0 input crw-rw----. root root system_u:object_r:kmsg_device_t:s0 kmsg brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop0 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop1 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop2 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop3 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop4 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop5 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop6 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop7 crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp0 crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp1 crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp2 crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp3 lrwxrwxrwx. root root system_u:object_r:device_t:s0 MAKEDEV -> /sbin/MAKEDEV drwxr-xr-x. root root system_u:object_r:device_t:s0 mapper crw-rw----. root root system_u:object_r:kmsg_device_t:s0 mcelog crw-r-----. root kmem system_u:object_r:memory_device_t:s0 mem crw-rw----. root audio system_u:object_r:sound_device_t:s0 mixer drwxr-xr-x. root root system_u:object_r:device_t:s0 net crw-rw----. root root system_u:object_r:netcontrol_device_t:s0 network_latency crw-rw----. root root system_u:object_r:netcontrol_device_t:s0 network_throughput crw-rw-rw-. root root system_u:object_r:null_device_t:s0 null crw-r-----. root kmem system_u:object_r:nvram_device_t:s0 nvram crw-rw----. root root system_u:object_r:memory_device_t:s0 oldmem crw-r-----. root kmem system_u:object_r:memory_device_t:s0 port crw-------. root root system_u:object_r:ppp_device_t:s0 ppp crw-rw-rw-. root tty system_u:object_r:ptmx_t:s0 ptmx drwxr-xr-x. root root system_u:object_r:devpts_t:s0 pts brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram0 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram1 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram10 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram11 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram12 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram13 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram14 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram15 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram2 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram3 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram4 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram5 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram6 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram7 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram8 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram9 crw-rw-rw-. root root system_u:object_r:random_device_t:s0 random drwxr-xr-x. root root system_u:object_r:device_t:s0 raw crw-rw-r--. root root system_u:object_r:device_t:s0 rfkill lrwxrwxrwx. root root system_u:object_r:device_t:s0 root -> /dev/VolGroup00/LogVol00 lrwxrwxrwx. root root system_u:object_r:device_t:s0 rtc -> rtc0 crw-rw----. root root system_u:object_r:clock_device_t:s0 rtc0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 scd0 -> sr0 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda1 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda2 brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda3 crw-rw----. root audio system_u:object_r:sound_device_t:s0 sequencer crw-rw----. root audio system_u:object_r:sound_device_t:s0 sequencer2 crw-rw----. root disk system_u:object_r:scsi_generic_device_t:s0 sg0 crw-rw----. root cdrom system_u:object_r:scsi_generic_device_t:s0 sg1 drwxrwxrwt. root root system_u:object_r:device_t:s0 shm crw-rw----. root root system_u:object_r:apm_bios_t:s0 snapshot drwxr-xr-x. root root system_u:object_r:device_t:s0 snd brw-rw----. root cdrom system_u:object_r:removable_device_t:s0 sr0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 stderr -> /proc/self/fd/2 lrwxrwxrwx. root root system_u:object_r:device_t:s0 stdin -> /proc/self/fd/0 lrwxrwxrwx. root root system_u:object_r:device_t:s0 stdout -> /proc/self/fd/1 crw-r--r--. root root system_u:object_r:tty_device_t:s0 systty crw-rw-rw-. root tty system_u:object_r:devtty_t:s0 tty crw--w----. root tty system_u:object_r:tty_device_t:s0 tty0 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty1 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty10 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty11 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty12 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty13 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty14 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty15 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty16 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty17 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty18 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty19 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty2 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty20 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty21 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty22 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty23 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty24 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty25 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty26 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty27 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty28 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty29 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty3 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty30 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty31 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty32 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty33 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty34 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty35 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty36 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty37 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty38 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty39 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty4 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty40 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty41 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty42 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty43 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty44 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty45 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty46 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty47 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty48 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty49 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty5 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty50 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty51 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty52 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty53 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty54 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty55 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty56 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty57 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty58 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty59 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty6 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty60 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty61 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty62 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty63 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty7 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty8 crw--w----. root tty system_u:object_r:tty_device_t:s0 tty9 crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS0 crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS1 crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS2 crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS3 crw-rw-rw-. root root system_u:object_r:urandom_device_t:s0 urandom crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon0 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon1 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon2 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon3 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon4 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon5 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon6 crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon7 crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcs crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcs1 crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcsa crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcsa1 crw-rw----. root root system_u:object_r:device_t:s0 vga_arbiter drwxr-xr-x. root root system_u:object_r:device_t:s0 VolGroup00 crw-rw----. root root system_u:object_r:watchdog_device_t:s0 watchdog crw-rw-rw-. root root system_u:object_r:zero_device_t:s0 zero The filesystem is ext3 on LVM: $ cat /etc/fstab /dev/VolGroup00/LogVol00 / ext3 defaults 1 1 ... The filesystem was created when I installed FC9. Later I upgraded to FC12. But the problem only appeared when the kernel was updated from 2.6.31 to 2.6.32. All 2.6.32 kernels so far had the same problem. I have already relabeled the filesystem, but it didn't help. I tried restorecon -R -v /dev after booting the 2.6.32 kernel but it didn't do anything.

13 years, 11 months

2
4
0 / 0

Make patch SELinux compatible

by Vadym Chepkov

Hi, Is there a way to make patch in Redhat SELinux compatible? # ls -Z php.php -rw-r--r-- root root user_u:object_r:httpd_sys_content_t:s0 php.php # patch -p1 < /root/php.patch patching file php.php # ls -Z php.php -rw-r--r-- root root user_u:object_r:tmp_t:s0 php.php Thanks, Vadym Chepkov

13 years, 11 months

3
7
0 / 0

Set context for NFS mounted homes

by Andrew R. Fore

I am having an issue setting the context for NFS mounted homes. I have set the mode to enforcing as well as enabling the booleans for support of NFS home directories. My homes mount and my NIS users can authenticate and see them with no problem. The issue at hand is the following report from the AVC Alert service (note: I have obscured the real hostname in this e-mail): +++ SELinux is preventing the restorecond from using potentially mislabeled files (arfore). Detailed Description: SELinux has denied restorecond access to potentially mislabeled file(s) (arfore). This means that SELinux will not allow restorecond to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want restorecond to access this files, you need to relabel them using restorecon -v 'arfore'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'. Additional Information: Source Context system_u:system_r:restorecond_t Target Context user_u:object_r:user_home_t Target Objects arfore [ lnk_file ] Source restorecond Source Path /usr/sbin/restorecond Port <Unknown> Host xxx.xxxx.xxx Source RPM Packages policycoreutils-1.33.12-14.8.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-279.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name xxx.xxxx.xxx Platform Linux xxx.xxxx.xxx 2.6.18-194.3.1.el5 #1 SMP Sun May 2 04:17:42 EDT 2010 x86_64 x86_64 Alert Count 29 First Seen Tue May 18 15:05:01 2010 Last Seen Tue May 18 15:39:31 2010 Local ID b41fdf79-19aa-4899-8f9f-6449124e61af Line Numbers Raw Audit Messages host=xxx.xxxx.xxx type=AVC msg=audit(1274211571.669:196): avc: denied { read } for pid=2647 comm="restorecond" name="arfore" dev=0:19 ino=24714112 scontext=system_u:system_r:restorecond_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=lnk_file host=xxx.xxxx.xxx type=SYSCALL msg=audit(1274211571.669:196): arch=c000003e syscall=2 success=no exit=-13 a0=2b19408731e0 a1=20000 a2=0 a3=0 items=0 ppid=1 pid=2647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecond" exe="/usr/sbin/restorecond" subj=system_u:system_r:restorecond_t:s0 key=(null) +++ I have tried mounting the filesystem two different ways in an attempt to specify the desired context: Manually: mount -t nfs -o context=user_u:object_r:user_home_t SERVER_IP_HERE:/webroot/home /home /etc/fstab SERVER_IP_HERE:/webroot/home /home nfs context="user_u:object_r:user_home_t:s0" 0 0 In both cases the file context is displayed as desired when running "ls -laZ" on my user home directory: -rw-r--r-- arfore cs user_u:object_r:user_home_t .bash_login However, after logging in via SSH I receive quite a few instances of the alert I listed above. I understand that the long term solution would be to appropriately label each file/directory on the mounted filespace, however at the moment this is not an option since we are still running two production Solaris 10 webservers that mount the same content. Thanks, Andy Fore ------ Andrew R. Fore Systems Services Associate Valdosta State University Ph.: 229-333-7315 Fax: 229-333-4349 Email: arfore(a)valdosta.edu

13 years, 11 months

1
0
0 / 0

xdm fixes

by Dominick Grift

Here are two xdm fixes that i had to apply: Allow xdm_t to read gconf_etc_t else gconf sanity check failes and gnome power manager fails. Signed-off-by: Dominick Grift <domg472(a)gmail.com> ---------------------- policy/modules/services/xserver.te --------------------- index 65d2018..18aa8ef 100644 @@ -722,6 +722,7 @@ optional_policy(` gnome_manage_gconf_home_files(xdm_t) gnome_read_config(xdm_t) + gnome_read_gconf_config(xdm_t) gnome_append_gconf_home_files(xdm_t) ') xdm_t read xdm_etc_t link files. Signed-off-by: Dominick Grift <domg472(a)gmail.com> ---------------------- policy/modules/services/xserver.te --------------------- index 168e133..dd29803 100644 @@ -409,6 +409,7 @@ allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; +allow xdm_t xdm_etc_t:lnk_file read_lnk_file_perms; read_files_pattern(xdm_t, xdm_etc_t, xdm_etc_t) manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)

13 years, 11 months

2
3
0 / 0

Re: Need new secret sauce

by Dominick Grift

On Sun, May 16, 2010 at 01:06:53PM -0700, David Highley wrote: > "Dominick Grift wrote:" > > > > On 05/16/2010 10:51 AM, Dominick Grift wrote: > > > On Sat, May 15, 2010 at 09:33:01PM -0700, David Highley wrote: > > >> "Dominick Grift wrote:" > > >>> > > >>> On 05/08/2010 04:20 AM, David Highley wrote: > > >>> > > >>> I took a quick look at the README file enclosed with the archive, and= > > i > > >>> think the second route may be the better solution since you might be > > >>> able to isolate sshdfilter from ssh for a large part. > > >>> > > >>> This is in my view important because sshd is a trusted service, meani= > > ng > > >>> it is allowed much access becuase it needs it and we rely on sshd for= > > > > >>> security. > > >>> > > >>> Below you will find a starting point for policy for sshdfilter in the= > > > > >>> second scenario. This policy is incomplete and it may also have error= > > s. > > >>> You might be able to use it as a starting point and to perfect the > > >>> policy. That would require testing, extending policy (using audit2all= > > ow > > >>> and common sense) rebuilding, reinstalling policy , retesting etc. un= > > til > > >>> it is perfect. > > >>> > > >>> To do that you must ensure that you have configured the service prope= > > rly > > >>> and that you do the development ofthe policy and testing in a secure > > >>> environment. > > >>> > > >>> 1. Establishing sshdfilter object locations: > > >>> > > >>> So from the README file i understand theres 3 files: > > >>> > > >>> - The initscript (/etc/rc.d/init.d/sshdfilter > > >>> - The config file(s) (/etc/sshdfilterrc.*) > > >>> - The sshdfilter application executable file (/usr/sbin/sshdfilter) > > >>> > > >>> 2. Declare types for sshdfilter objects, the sshdfilter subject, then= > > > > >>> makes the types usable type for their purpose and define file context= > > > > >>> specifications for the sshdfilter file objects. Additionally make the= > > > > >>> sshdfilter subject type permissive (will not work in el5) to make > > >>> testing more easy and secure. > > >>> > > >>> 3. Source policy module for sshdfilter. > > >>> > > >>> Create a work directory. This is where we will store the source polic= > > y > > >>> module for our sshdfilter application. Keep the source policy module,= > > as > > >>> you may need to extend, modify, rebuild it later. > > >>> > > >>> A Selinux source policy module has 3 files. A type enforcement file > > >>> ("modulename".te), A interface file ("modulename.if"), and a file > > >>> context specification file ("modulename".fc). > > >>> > > >>> The type enforcement file has declarations and policy that are local = > > to > > >>> the module. The interface file has policy where the target of the > > >>> interaction is a type declared in the type enforcement file of the > > >>> module. e.g. shared policy. If external domains want to interact with= > > > > >>> sshdfilter in anyway, then the sshdfilter.if file should facilitate a= > > ny > > >>> access required for other domains to interact with it. The file conte= > > xt > > >>> specification file has file object context specifications for file > > >>> object types that are declared in the type enforcement file. > > >>> > > >>> 4. sshdfilter.te > > >>> > > >>> touch a file called sshdfilter.te in your working directory. The file= > > > > >>> will be split in two parts: first the personal declarations and secon= > > d > > >>> the personal policy. > > >>> > > >>> Add the following to the sshdfilter.te file: > > >>> > > >>> policy_module(sshdfilter, 1.0.0) > > >>> > > >>> type sshdfilter_t; > > >>> type sshdfilter_exec_t; > > >>> init_daemon_domain(sshdfilter_t, sshdfilter_exec_t) > > >>> > > >>> type sshdfilter_initrc_exec_t; > > >>> init_script_file(sshdfilter_initrc_exec_t) > > >>> > > >>> type sshdfilter_etc_t; > > >>> files_config_file(sshdfilter_etc_t) > > >>> > > >>> # permissive domains will not work in el5. > > >>> permissve sshdfilter_t; > > >> > > >> Looking at what was needed to get this working with the other install > > >> method I now have the following for the sshdfilter.te file: > > >=20 > > > You can use the following instead. That way you do not have to require = > > external, types classes.=09 > > > =20 > > > policy_module(sshdfilter, 1.0.0) > > > =20 > > > type sshdfilter_t; > > > type sshdfilter_exec_t; > > > init_daemon_domain(sshdfilter_t, sshdfilter_exec_t) > > > =20 > > > type sshdfilter_initrc_exec_t; > > > init_script_file(sshdfilter_initrc_exec_t) > > > =20 > > > type sshdfilter_etc_t; > > > files_config_file(sshdfilter_etc_t) > > >=20 > > > allow iptables_t self:fifo_file rw_fifo_file_perms; > > OK, some progress. The script is now starting and functioning as a > daemon. Just changed the sshdfilter.te file to the following and that > got it running: > policy_module(sshdfilter, 1.0.0) > > type sshdfilter_t; > type sshdfilter_exec_t; > init_daemon_domain(sshdfilter_t, sshdfilter_exec_t) > > type sshdfilter_initrc_exec_t; > init_script_file(sshdfilter_initrc_exec_t) > > type sshdfilter_etc_t; > files_config_file(sshdfilter_etc_t) > > dev_read_urand(sshdfilter_t) > corecmd_search_bin(sshdfilter_t) > miscfiles_read_localization(sshdfilter_t) > > optional_policy(` > iptables_domtrans(sshdfilter_t) > ') > > Had to rework the init.d script and changed the non standard pid file > name. The testing host is not behaving quite right and so far I have > not found out what is causing it. When I do a port scan I should see a > line like this in the secure file: > May 16 12:37:10 spruce sshd[30708]: Did not receive identification > string from 10.2.2.7 > > In testing so far it appears that the script can read the fifo even > though we did not do anything beyond creating the fifo. I would thought > we needed to label it. What do you mean? iptables_t read and writes a fifo_file, not sshdfilter_t: allow iptables_t self:fifo_file rw_fifo_file_perms; > Will let you know when I have done more testing > and think it is ready. Any ideas on how to get this functionality as a > standard RPM? I know how to create RPM's but I do not know how to get it > in the distribution. The fedora website has all the info you need and google can help you find it that info. I have found some article that may be helpful: https://fedoraproject.org/wiki/PackageMaintainers/Join > > > > > Whoops actually the above does not belong here. You already added that > > to your "myiptables" module below. > > > > > allow sshdfilter_t sshdfilter_etc_t:file read_file_perms; > > >=20 > > > dev_read_urand(sshdfilter_t) > > >=20 > > > corecmd_search_bin(sshdfilter_t) > > >=20 > > > miscfiles_read_localization(sshdfilter_t) > > >=20 > > > optional_policy(` > > > iptables_domtrans(sshdfilter_t) > > > ") > > >=20 > > > # I would like to see the raw AVC denial for this. > > > # allow sshdfilter_t var_run_t:file getattr; > > >=20 > > >> > > >> I also tried this modification for iptables: > > >> policy_module(myiptables, 1.0.0) > > >> optional_policy(` > > >> gen_require(` > > >> type iptables_t; > > >> ') > > >> corecmd_read_bin_symlinks(iptables_t) > > >> allow iptables_t self:fifo_file rw_fifo_file_perms; > > >> ') > > >=20 > > > The above looks fine. > > >=20 > > >> I'm not getting any avc audit log etries but the script is getting hun= > > g > > >> at this line of code: > > >> open(TABCHECK,"$iptables -L -n | grep \"^$chain *tcp\"|") || > > >> die("couldn't check $iptables"); > > >> > > >> I run this command logged in as root and it work fine. Block even in > > >> permissive mode. I should have also let you know I'm running Fedora 12= > > =2E > > >> So it would appear that the script is not able to run iptables. > > >=20 > > > You mean to say that it does not work with the system in permissive mod= > > e (setenforce 0)? > > > If it does not work in permissive mode, then you can rule out any SElin= > > ux related issue. > > >=20 > > > If it works in permissive modebut not in enforcing mode then it is a SE= > > linux issue (be aware i mean full permissive mode not permissive domains)= > > > > >=20 > > >=20 > > >>> > > >>> # policy below (todo) > > >>> > > >>> So above we declared types for the 3 files and te process. We started= > > by > > >>> declaring a new policy module called sshdfilter and gave it a version= > > > > >>> number of 1.0.0. Once the module is installed you can use semodule -l= > > to > > >>> list these policy module details. > > >>> > > >>> sshdfilter_t is the type that is declared for the sshdfilter process.= > > > > >>> sshdfilter_exec_t is the type declared for the sshdfilter application= > > > > >>> executable file (/usr/sbin/sshdfilter) > > >>> > > >>> Both type are made a init daemon domain by calling the > > >>> init_daemon_domain() interface with the two types as parameters. This= > > is > > >>> just a macro that gets expanded with m4 to actual policy that the ker= > > nel > > >>> can understand. The macros are used to make policy maintainable for > > >>> humans. Basically its a way to group policy. > > >>> > > >>> The type sshdfilter_initrc_exec_t type is the type for the sshdfilter= > > > > >>> init script (/etc/rc.d/init.d/sshdfilter) > > >>> This type is made a valid init script file type by calling the > > >>> init_script_file interface and supplying the type used for the init > > >>> script as a parameter. > > >>> > > >>> The next type declared is sshdfilter_etc_t, This is the type for the > > >>> sshdfilter configuration files (/etc/sshdfilterrc.*) The type is made= > > > > >>> usuable for configuration files by calling files_config_file(), with = > > the > > >>> type that we have declared for sshdfilters file objects in /etc as it= > > s > > >>> parameter. > > >>> > > >>> Finally we made the subject type sshdfilter_t a "permissive domain". > > >>> This may not work on older selinux implementations. > > >>> > > >>> Permissive domains is a way to run a single domain in permissive mode= > > as > > >>> opposed to running the full system in permissive mode when one runs t= > > he > > >>> setenforce 0 command. This allows you to test a single domain. > > >>> > > >>> We did not add any policy yet to out type enforcement file. This is > > >>> because i do not know what access the application needs. You can find= > > > > >>> out by testing, editing policy, testing etc. The audit2allow command = > > and > > >>> ausearch command can help parse AVC denials which can be used to exte= > > nd > > >>> your sshdfilter_t domain. > > >>> > > >>> 5. sshdfilter.fc > > >>> > > >>> We declared the types for sshdfilter in our type enforcement source > > >>> policy file. Now we must assign the file object types to actual objec= > > ts > > >>> on the file system. e.g. create file object context specifications. > > >>> > > >>> Add the following to the sshdfilter.fc file: > > >>> > > >>> /etc/rc\.d/init\.d/sshdfilter -- > > >>> gen_context(system_u:object_r:sshdfilter_initrc_exec_t, s0) > > >>> /etc/sshdfilterrc.* -- gen_context(system_u:object_r:sshdfilter_etc_t= > > , s0=3D > > >>> ) > > >>> /usr/sbin/sshdfilter -- gen_context(system_u:object_r:sshdfilter_exec= > > _t, =3D > > >>> s0) > > >>> > > >>> That will tell the system what file object to label with the types we= > > > > >>> declared for our domain. > > >>> > > >>> 6. sshdfilter.if > > >>> > > >>> We will skip this section for simplicity. We may need it later, if it= > > > > >>> turns out some other domain wants to interact with out sshdfilter_t > > >>> domain or any file object types it owns. > > >>> > > >>> 7. Building and installing. > > >>> > > >>> By now we should have a solid foundation for our new domain. By solid= > > i > > >>> mean that the domain type is declared (sshfilter_t) and all (known) > > >>> objects own by the sshdfilter_t domain have types declared and file > > >>> object contexts specified. > > >>> > > >>> The init_daemon_domain() interface call provides all policy that is > > >>> needed for init to transition into the sshdfilter_t domain. > > >>> > > >>> The permissive domain sshdfilter_t will allow sshdfilter_t all access= > > > > >>> but will log "would be denied" access vectors. > > >>> > > >>> If you are using an older selinux implementation, you may want to > > >>> comment that line out and do the policy testing with selinux in > > >>> permissive mode instead. > > >>> > > >>> cd into your working dir and run the following to build a binary > > >>> representation of the sshdfilter source policy module: > > >>> > > >>> make -f /usr/share/selinux/devel/Makefile sshdfilter.pp > > >>> > > >>> ( on el5 this requires that you have the selinux-policy-devel package= > > > > >>> installed ) > > >>> > > >>> If all goes well this should create the binary policy module which we= > > > > >>> can load into the policy store with the following command: > > >>> > > >>> sudo semodule -i sshdfilter.pp > > >>> > > >>> Use the semodule command to list, install , reinstall , remove module= > > s. > > >>> > > >>> Now all you have to do is restore the contexts of the objects defined= > > in > > >>> the sshdfilter.fc file to reflect the type we declared in our type > > >>> enforcement file. > > >>> > > >>> Then just run and test the app, either in permissive mode or if possi= > > ble > > >>> using the permissive domain declaration described above. > > >>> > > >>> Collect any AVC denials for dmesg , /var/log/messages > > >>> /var/log/audit/audit.log and use those AVC denials to make policy > > >>> decisions and extend your type enforcement file. > > >>> > > >>> Rebuild a new binary representation afterward, reinstall it into the > > >>> policy store and test it all over again. Repeat this untill all AVC > > >>> denials are gone and untill your application works like it should. > > >>> > > >>> Any questions? Please let me know. > > >>> > > >>> Disclaimer: The may be errors above. Try at your own risk. > > >>> > > >>>> =3D20 > > >>>> I'm attaching the down load. It has two methods of installation so t= > > he > > >>>> files vary depending on approach. I wonder if there would be some wa= > > y t=3D > > >>> o > > >>>> get this into the repo.

13 years, 11 months

1
0
0 / 0

Re: Need new secret sauce

by Dominick Grift

On Sat, May 15, 2010 at 09:33:01PM -0700, David Highley wrote: > "Dominick Grift wrote:" > > > > On 05/08/2010 04:20 AM, David Highley wrote: > > > > I took a quick look at the README file enclosed with the archive, and i > > think the second route may be the better solution since you might be > > able to isolate sshdfilter from ssh for a large part. > > > > This is in my view important because sshd is a trusted service, meaning > > it is allowed much access becuase it needs it and we rely on sshd for > > security. > > > > Below you will find a starting point for policy for sshdfilter in the > > second scenario. This policy is incomplete and it may also have errors. > > You might be able to use it as a starting point and to perfect the > > policy. That would require testing, extending policy (using audit2allow > > and common sense) rebuilding, reinstalling policy , retesting etc. until > > it is perfect. > > > > To do that you must ensure that you have configured the service properly > > and that you do the development ofthe policy and testing in a secure > > environment. > > > > 1. Establishing sshdfilter object locations: > > > > So from the README file i understand theres 3 files: > > > > - The initscript (/etc/rc.d/init.d/sshdfilter > > - The config file(s) (/etc/sshdfilterrc.*) > > - The sshdfilter application executable file (/usr/sbin/sshdfilter) > > > > 2. Declare types for sshdfilter objects, the sshdfilter subject, then > > makes the types usable type for their purpose and define file context > > specifications for the sshdfilter file objects. Additionally make the > > sshdfilter subject type permissive (will not work in el5) to make > > testing more easy and secure. > > > > 3. Source policy module for sshdfilter. > > > > Create a work directory. This is where we will store the source policy > > module for our sshdfilter application. Keep the source policy module, as > > you may need to extend, modify, rebuild it later. > > > > A Selinux source policy module has 3 files. A type enforcement file > > ("modulename".te), A interface file ("modulename.if"), and a file > > context specification file ("modulename".fc). > > > > The type enforcement file has declarations and policy that are local to > > the module. The interface file has policy where the target of the > > interaction is a type declared in the type enforcement file of the > > module. e.g. shared policy. If external domains want to interact with > > sshdfilter in anyway, then the sshdfilter.if file should facilitate any > > access required for other domains to interact with it. The file context > > specification file has file object context specifications for file > > object types that are declared in the type enforcement file. > > > > 4. sshdfilter.te > > > > touch a file called sshdfilter.te in your working directory. The file > > will be split in two parts: first the personal declarations and second > > the personal policy. > > > > Add the following to the sshdfilter.te file: > > > > policy_module(sshdfilter, 1.0.0) > > > > type sshdfilter_t; > > type sshdfilter_exec_t; > > init_daemon_domain(sshdfilter_t, sshdfilter_exec_t) > > > > type sshdfilter_initrc_exec_t; > > init_script_file(sshdfilter_initrc_exec_t) > > > > type sshdfilter_etc_t; > > files_config_file(sshdfilter_etc_t) > > > > # permissive domains will not work in el5. > > permissve sshdfilter_t; > > Looking at what was needed to get this working with the other install > method I now have the following for the sshdfilter.te file: You can use the following instead. That way you do not have to require external, types classes. policy_module(sshdfilter, 1.0.0) type sshdfilter_t; type sshdfilter_exec_t; init_daemon_domain(sshdfilter_t, sshdfilter_exec_t) type sshdfilter_initrc_exec_t; init_script_file(sshdfilter_initrc_exec_t) type sshdfilter_etc_t; files_config_file(sshdfilter_etc_t) allow iptables_t self:fifo_file rw_fifo_file_perms; allow sshdfilter_t sshdfilter_etc_t:file read_file_perms; dev_read_urand(sshdfilter_t) corecmd_search_bin(sshdfilter_t) miscfiles_read_localization(sshdfilter_t) optional_policy(` iptables_domtrans(sshdfilter_t) ") # I would like to see the raw AVC denial for this. # allow sshdfilter_t var_run_t:file getattr; > > I also tried this modification for iptables: > policy_module(myiptables, 1.0.0) > optional_policy(` > gen_require(` > type iptables_t; > ') > corecmd_read_bin_symlinks(iptables_t) > allow iptables_t self:fifo_file rw_fifo_file_perms; > ') The above looks fine. > I'm not getting any avc audit log etries but the script is getting hung > at this line of code: > open(TABCHECK,"$iptables -L -n | grep \"^$chain *tcp\"|") || > die("couldn't check $iptables"); > > I run this command logged in as root and it work fine. Block even in > permissive mode. I should have also let you know I'm running Fedora 12. > So it would appear that the script is not able to run iptables. You mean to say that it does not work with the system in permissive mode (setenforce 0)? If it does not work in permissive mode, then you can rule out any SElinux related issue. If it works in permissive modebut not in enforcing mode then it is a SElinux issue (be aware i mean full permissive mode not permissive domains) > > > > # policy below (todo) > > > > So above we declared types for the 3 files and te process. We started by > > declaring a new policy module called sshdfilter and gave it a version > > number of 1.0.0. Once the module is installed you can use semodule -l to > > list these policy module details. > > > > sshdfilter_t is the type that is declared for the sshdfilter process. > > sshdfilter_exec_t is the type declared for the sshdfilter application > > executable file (/usr/sbin/sshdfilter) > > > > Both type are made a init daemon domain by calling the > > init_daemon_domain() interface with the two types as parameters. This is > > just a macro that gets expanded with m4 to actual policy that the kernel > > can understand. The macros are used to make policy maintainable for > > humans. Basically its a way to group policy. > > > > The type sshdfilter_initrc_exec_t type is the type for the sshdfilter > > init script (/etc/rc.d/init.d/sshdfilter) > > This type is made a valid init script file type by calling the > > init_script_file interface and supplying the type used for the init > > script as a parameter. > > > > The next type declared is sshdfilter_etc_t, This is the type for the > > sshdfilter configuration files (/etc/sshdfilterrc.*) The type is made > > usuable for configuration files by calling files_config_file(), with the > > type that we have declared for sshdfilters file objects in /etc as its > > parameter. > > > > Finally we made the subject type sshdfilter_t a "permissive domain". > > This may not work on older selinux implementations. > > > > Permissive domains is a way to run a single domain in permissive mode as > > opposed to running the full system in permissive mode when one runs the > > setenforce 0 command. This allows you to test a single domain. > > > > We did not add any policy yet to out type enforcement file. This is > > because i do not know what access the application needs. You can find > > out by testing, editing policy, testing etc. The audit2allow command and > > ausearch command can help parse AVC denials which can be used to extend > > your sshdfilter_t domain. > > > > 5. sshdfilter.fc > > > > We declared the types for sshdfilter in our type enforcement source > > policy file. Now we must assign the file object types to actual objects > > on the file system. e.g. create file object context specifications. > > > > Add the following to the sshdfilter.fc file: > > > > /etc/rc\.d/init\.d/sshdfilter -- > > gen_context(system_u:object_r:sshdfilter_initrc_exec_t, s0) > > /etc/sshdfilterrc.* -- gen_context(system_u:object_r:sshdfilter_etc_t, s0= > > ) > > /usr/sbin/sshdfilter -- gen_context(system_u:object_r:sshdfilter_exec_t, = > > s0) > > > > That will tell the system what file object to label with the types we > > declared for our domain. > > > > 6. sshdfilter.if > > > > We will skip this section for simplicity. We may need it later, if it > > turns out some other domain wants to interact with out sshdfilter_t > > domain or any file object types it owns. > > > > 7. Building and installing. > > > > By now we should have a solid foundation for our new domain. By solid i > > mean that the domain type is declared (sshfilter_t) and all (known) > > objects own by the sshdfilter_t domain have types declared and file > > object contexts specified. > > > > The init_daemon_domain() interface call provides all policy that is > > needed for init to transition into the sshdfilter_t domain. > > > > The permissive domain sshdfilter_t will allow sshdfilter_t all access > > but will log "would be denied" access vectors. > > > > If you are using an older selinux implementation, you may want to > > comment that line out and do the policy testing with selinux in > > permissive mode instead. > > > > cd into your working dir and run the following to build a binary > > representation of the sshdfilter source policy module: > > > > make -f /usr/share/selinux/devel/Makefile sshdfilter.pp > > > > ( on el5 this requires that you have the selinux-policy-devel package > > installed ) > > > > If all goes well this should create the binary policy module which we > > can load into the policy store with the following command: > > > > sudo semodule -i sshdfilter.pp > > > > Use the semodule command to list, install , reinstall , remove modules. > > > > Now all you have to do is restore the contexts of the objects defined in > > the sshdfilter.fc file to reflect the type we declared in our type > > enforcement file. > > > > Then just run and test the app, either in permissive mode or if possible > > using the permissive domain declaration described above. > > > > Collect any AVC denials for dmesg , /var/log/messages > > /var/log/audit/audit.log and use those AVC denials to make policy > > decisions and extend your type enforcement file. > > > > Rebuild a new binary representation afterward, reinstall it into the > > policy store and test it all over again. Repeat this untill all AVC > > denials are gone and untill your application works like it should. > > > > Any questions? Please let me know. > > > > Disclaimer: The may be errors above. Try at your own risk. > > > > >=20 > > > I'm attaching the down load. It has two methods of installation so the > > > files vary depending on approach. I wonder if there would be some way t= > > o > > > get this into the repo.

13 years, 11 months

1
1
0 / 0

[[selinux-policy] patch 1/1] Update libcgroup/cgroup policy.

by Dominick Grift

This is a diff between what i currently have implemented and what Fedora has implemented. This works for me IN enforcing mode. Signed-off-by: Dominick Grift <domg472(a)gmail.com> --- :100644 100644 11e5cd9... 2ba1a74... M policy/modules/kernel/filesystem.if :100644 100644 480f526... 70c2b44... M policy/modules/services/cgroup.fc :100644 100644 95d1a68... 03b7ffc... M policy/modules/services/cgroup.if :100644 100644 9c5d9b0... d0c5a19... M policy/modules/services/cgroup.te :100644 100644 9ecb76c... d15bb0f... M policy/modules/system/init.te :100644 100644 c068936... 7c5ed53... M policy/modules/system/userdomain.if policy/modules/kernel/filesystem.if | 95 ++++++++++----- policy/modules/services/cgroup.fc | 15 ++- policy/modules/services/cgroup.if | 232 +++++++++++++++++++++++++++++++++-- policy/modules/services/cgroup.te | 47 +++++--- policy/modules/system/init.te | 9 +- policy/modules/system/userdomain.if | 6 + 6 files changed, 337 insertions(+), 67 deletions(-) diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index 11e5cd9..2ba1a74 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -559,6 +559,24 @@ interface(`fs_register_binary_executable_type',` ######################################## ## <summary> +## Delete directories on cgroupfs. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fs_delete_cgroupfs_dirs', ` + gen_require(` + type cgroupfs_t; + ') + + delete_dirs_pattern($1, cgroupfs_t, cgroupfs_t) +') + +######################################## +## <summary> ## Mount a cgroup filesystem. ## </summary> ## <param name="domain"> @@ -621,53 +639,32 @@ interface(`fs_unmount_cgroupfs', ` ## Domain allowed access. ## </summary> ## </param> -## <rolecap/> # interface(`fs_getattr_cgroupfs',` gen_require(` - type cifs_t; + type cgroupfs_t; ') - allow $1 cifs_t:filesystem getattr; -') - -######################################## -## <summary> -## list dirs on cgroup -## file systems. -## </summary> -## <param name="domain"> -## <summary> -## Domain allowed access. -## </summary> -## </param> -# -interface(`fs_list_cgroupfs_dirs', ` - gen_require(` - type cgroupfs_t; - - ') - - list_dirs_pattern($1, cgroupfs_t, cgroupfs_t) + allow $1 cgroupfs_t:filesystem getattr; ') ######################################## ## <summary> -## Do not audit attempts to read -## dirs on a CIFS or SMB filesystem. +## list dirs on cgroup +## file systems. ## </summary> ## <param name="domain"> ## <summary> -## Domain to not audit. +## Domain allowed access. ## </summary> ## </param> # -interface(`fs_dontaudit_list_cifs_dirs',` +interface(`fs_list_cgroupfs_dirs', ` gen_require(` - type cifs_t; + type cgroupfs_t; ') - dontaudit $1 cifs_t:dir list_dir_perms; + list_dirs_pattern($1, cgroupfs_t, cgroupfs_t) ') ######################################## @@ -743,7 +740,6 @@ interface(`fs_read_cgroupfs_files',` interface(`fs_write_cgroupfs_files', ` gen_require(` type cgroupfs_t; - ') write_files_pattern($1, cgroupfs_t, cgroupfs_t) @@ -771,6 +767,45 @@ interface(`fs_rw_cgroupfs_files',` ######################################## ## <summary> +## Do not audit attempts to getattr, +## open, read and write files on cgroup +## file systems. +## </summary> +## <param name="domain"> +## <summary> +## Domain to not audit. +## </summary> +## </param> +# +interface(`fs_dontaudit_rw_cgroupfs_files',` + gen_require(` + type cgroupfs_t; + ') + + dontaudit $1 cgroupfs_t:file rw_file_perms; +') + +######################################## +## <summary> +## Do not audit attempts to read +## dirs on a CIFS or SMB filesystem. +## </summary> +## <param name="domain"> +## <summary> +## Domain to not audit. +## </summary> +## </param> +# +interface(`fs_dontaudit_list_cifs_dirs',` + gen_require(` + type cifs_t; + ') + + dontaudit $1 cifs_t:dir list_dir_perms; +') + +######################################## +## <summary> ## Mount a CIFS or SMB network filesystem. ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/cgroup.fc b/policy/modules/services/cgroup.fc index 480f526..70c2b44 100644 --- a/policy/modules/services/cgroup.fc +++ b/policy/modules/services/cgroup.fc @@ -1,9 +1,12 @@ -/etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t, s0) -/etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t, s0) +/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0) -/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t, s0) -/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfigparser_exec_t, s0) +/etc/cgconfig.conf -- gen_context(system_u:object_r:cgconfig_etc_t,s0) +/etc/cgrules.conf -- gen_context(system_u:object_r:cgrules_etc_t,s0) -/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t, s0) +/etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0) +/etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t,s0) -/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t, s0) +/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfigparser_exec_t,s0) +/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0) + +/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0) diff --git a/policy/modules/services/cgroup.if b/policy/modules/services/cgroup.if index 95d1a68..03b7ffc 100644 --- a/policy/modules/services/cgroup.if +++ b/policy/modules/services/cgroup.if @@ -1,21 +1,181 @@ -## <summary>Control group rules engine daemon.</summary> +## <summary>libcg is a library that abstracts the control group file system in Linux.</summary> ## <desc> ## <p> -## cgrulesengd is a daemon, which distributes processes -## to control groups. When any process changes its -## effective UID or GID, cgred inspects list of -## rules loaded from cgrules.conf file and moves the -## process to the appropriate control group. -## </p> -## <p> -## The list of rules is read during the daemon startup and -## are cached in daemons memory. The daemon reloads the -## list of rules when it receives SIGUSR2 signal. +## libcg aims to provide programmers easily usable APIs to use the control group file system. ## </p> ## </desc> ######################################## ## <summary> +## Execute a domain transition to run cgconfig. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`cgroup_domtrans_cgconfigparser',` + gen_require(` + type cgconfigparser_t, cgconfigparser_exec_t; + ') + + domtrans_pattern($1, cgconfigparser_exec_t, cgconfigparser_t) + corecmd_search_bin($1) +') + +######################################## +## <summary> +## Execute cgconfigparser server in the +## cgconfigparser domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`cgroup_initrc_domtrans_cgconfigparser',` + gen_require(` + type cgconfig_initrc_exec_t; + ') + + files_search_etc($1) + init_labeled_script_domtrans($1, cgconfig_initrc_exec_t) +') + +######################################## +## <summary> +## Execute a domain transition to run cgred. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`cgroup_domtrans_cgred',` + gen_require(` + type cgred_t, cgred_exec_t; + ') + + domtrans_pattern($1, cgred_exec_t, cgred_t) + corecmd_search_bin($1) +') + +######################################## +## <summary> +## Execute cgred server in the +## cgred domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`cgroup_initrc_domtrans_cgred',` + gen_require(` + type cgred_initrc_exec_t; + ') + + files_search_etc($1) + init_labeled_script_domtrans($1, cgred_initrc_exec_t) +') + +######################################## +## <summary> +## Delete cgroup directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`cgroup_delete_cgroup_dirs', ` + gen_require(` + type cgroup_t; + ') + + delete_dirs_pattern($1, cgroup_t, cgroup_t) + cgroup_search_cgroup_dirs($1) +') + +######################################## +## <summary> +## List cgroup directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`cgroup_list_cgroup_dirs', ` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:dir list_dir_perms; +') + +######################################## +## <summary> +## Manage cgroup directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`cgroup_manage_cgroup_dirs', ` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:dir manage_dir_perms; +') + +######################################## +## <summary> +## Read and write cgroup directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`cgroup_rw_cgroup_dirs', ` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:dir rw_dir_perms; +') + +######################################## +## <summary> +## Search cgroup directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`cgroup_search_cgroup_dirs', ` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:dir search_dir_perms; +') + +######################################## +## <summary> ## Read and write cgred sock file in /var/run. ## </summary> ## <param name="domain"> @@ -29,7 +189,55 @@ interface(`cgroup_stream_connect', ` type cgred_var_run_t, cgred_t; ') - files_search_pids($1) stream_connect_pattern($1, cgred_var_run_t, cgred_var_run_t, cgred_t) + files_search_pids($1) ') +######################################## +## <summary> +## All of the rules required to administrate +## an cgroup environment +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`cgroup_admin',` + gen_require(` + type cgred_t, cgconfigparser_t, cgred_var_run_t; + type cgconfig_etc_t, cgconfig_initrc_exec_t, cgred_initrc_exec_t; + type cgred_etc_t, cgroup_t, cgroupfs_t; + ') + + allow $1 cgconfigparser_t:process { ptrace signal_perms getattr }; + read_files_pattern($1, cgconfigparser_t, cgconfigparser_t) + + allow $1 cgred_t:process { ptrace signal_perms getattr }; + read_files_pattern($1, cgred_t, cgred_t) + + admin_pattern($1, cgroup_t) + admin_pattern($1, cgroupfs_t) + + files_search_etc($1) + admin_pattern($1, cgconfig_etc_t) + admin_pattern($1, cgred_etc_t) + + files_list_var($1) + admin_pattern($1, cgred_var_run_t) + + cgroup_initrc_domtrans_cgconfigparser($1) + domain_system_change_exemption($1) + role_transition $2 cgconfig_initrc_exec_t system_r; + allow $2 system_r; + + cgroup_initrc_domtrans_cgred($1) + role_transition $2 cgred_initrc_exec_t system_r; +') diff --git a/policy/modules/services/cgroup.te b/policy/modules/services/cgroup.te index 9c5d9b0..d0c5a19 100644 --- a/policy/modules/services/cgroup.te +++ b/policy/modules/services/cgroup.te @@ -1,7 +1,16 @@ + policy_module(cgroup, 1.0.0) ######################################## # +# cgroup global declarations. +# + +type cgroup_t; +files_mountpoint(cgroup_t) + +######################################## +# # cgred personal declarations. # @@ -15,8 +24,8 @@ init_script_file(cgred_initrc_exec_t) type cgred_var_run_t; files_pid_file(cgred_var_run_t) -type cgroup_t; -files_mountpoint(cgroup_t) +type cgrules_etc_t; +files_config_file(cgrules_etc_t) ######################################## # @@ -30,8 +39,8 @@ init_daemon_domain(cgconfigparser_t, cgconfigparser_exec_t) type cgconfig_initrc_exec_t; init_script_file(cgconfig_initrc_exec_t) -permissive cgconfigparser_t; -permissive cgred_t; +type cgconfig_etc_t; +files_config_file(cgconfig_etc_t) ######################################## # @@ -42,36 +51,40 @@ allow cgred_t self:capability { net_admin sys_ptrace dac_override }; allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:unix_dgram_socket { write create connect }; -manage_sock_files_pattern(cgred_t, cgred_var_run_t, -cgred_var_run_t) +allow cgred_t cgrules_etc_t:file read_file_perms; + +manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t) files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file) -domain_read_all_domains_state(cgred_t) +kernel_read_system_state(cgred_t) -files_read_etc_files(cgred_t) +domain_read_all_domains_state(cgred_t) files_search_all(cgred_t) files_getattr_all_files(cgred_t) files_getattr_all_dirs(cgred_t) files_getattr_all_sockets(cgred_t) files_getattr_all_pipes(cgred_t) -files_getattr_all_symlinks(cgred_t) -# read all link files. +files_read_all_symlinks(cgred_t) -kernel_read_system_state(cgred_t) +# /etc/group +files_read_etc_files(cgred_t) + +fs_write_cgroupfs_files(cgred_t) logging_send_syslog_msg(cgred_t) miscfiles_read_localization(cgred_t) -optional_policy(` - fs_write_cgroupfs_files(cgred_t) -') - ######################################## # # cgconfig personal policy. # + +allow cgconfigparser_t self:capability { chown sys_admin }; + +allow cgconfigparser_t cgconfig_etc_t:file read_file_perms; + manage_dirs_pattern(cgconfigparser_t, cgroup_t, cgroup_t) manage_files_pattern(cgconfigparser_t, cgroup_t, cgroup_t) allow cgconfigparser_t cgroup_t:dir mounton; @@ -79,9 +92,11 @@ allow cgconfigparser_t cgroup_t:dir mounton; kernel_list_unlabeled(cgconfigparser_t) kernel_read_system_state(cgconfigparser_t) +# /etc/nsswitch.conf files_read_etc_files(cgconfigparser_t) fs_manage_cgroupfs_dirs(cgconfigparser_t) +fs_mount_cgroupfs(cgconfigparser_t) fs_rw_cgroupfs_files(cgconfigparser_t) +fs_unmount_cgroupfs(cgconfigparser_t) fs_setattr_cgroupfs_files(cgconfigparser_t) -fs_mount_cgroupfs(cgconfigparser_t) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 9ecb76c..d15bb0f 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -403,9 +403,6 @@ fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) fs_search_all(initrc_t) fs_getattr_nfsd_files(initrc_t) -fs_rw_cgroupfs_files(initrc_t) -fs_setattr_cgroupfs_files(initrc_t) -fs_manage_cgroupfs_dirs(initrc_t) # initrc_t needs to do a pidof which requires ptrace mcs_ptrace_all(initrc_t) @@ -551,6 +548,12 @@ ifdef(`distro_redhat',` fs_read_tmpfs_symlinks(initrc_t) fs_rw_tmpfs_chr_files(initrc_t) + # /sbin/cgclear + fs_delete_cgroupfs_dirs(initrc_t) + fs_list_cgroupfs_dirs(initrc_t) + # w for /bin/cgcexec and rw for /sbin/cgclear + fs_rw_cgroupfs_files(initrc_t) + storage_manage_fixed_disk(initrc_t) storage_dev_filetrans_fixed_disk(initrc_t) storage_getattr_removable_dev(initrc_t) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index c068936..7c5ed53 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -116,6 +116,7 @@ template(`userdom_base_user_template',` files_exec_usr_files($1_t) fs_list_cgroupfs_dirs($1_usertype) + fs_dontaudit_rw_cgroupfs_files($1_usertype) storage_rw_fuse($1_usertype) @@ -139,6 +140,10 @@ template(`userdom_base_user_template',` ') optional_policy(` + cgroup_list_cgroup_dirs($1_usertype) + ') + + optional_policy(` ssh_rw_stream_sockets($1_usertype) ssh_delete_tmp($1_t) ssh_signal($1_t) @@ -554,6 +559,7 @@ template(`userdom_common_user_template',` files_read_config_files($1_usertype) fs_read_noxattr_fs_files($1_usertype) fs_read_noxattr_fs_symlinks($1_usertype) + fs_rw_cgroupfs_files($1_usertype) logging_send_syslog_msg($1_usertype) logging_send_audit_msgs($1_usertype) -- 1.7.0.1

13 years, 11 months

1
1
0 / 0

RE: New to SELinux: 2nd Edition of The SELinux Notebook released (fwd)

by James Morris

FYI for those not on the main SELinux list, this should be very useful. ---------- Forwarded message ---------- Date: Wed, 12 May 2010 12:40:23 +0000 (GMT) From: Richard Haines <richard_c_haines(a)btinternet.com> To: selinux(a)tycho.nsa.gov, David-P63356Thomson <David.Thomson(a)gdc4s.com>, Vacheh Sardarian <vsardarian(a)gmail.com> Subject: RE: New to SELinux: 2nd Edition of The SELinux Notebook released I've just finished the 2nd edition of the SELinux Notebook that is available at: http://www.freetechbooks.com/the-selinux-notebook-the-foundations-t785.html It is aimed at those new to SELinux and as a reference for the policy language and configuration files. If anyone has comments on how to improve, what other areas to cover, corrections etc. please let me know. I'll now update the selinuxproject.org site with the new content as part of the SELinux documentation project. The main updates are: Split the Notebook into two volumes: Volume 1 - The Foundations - covers SELinux and its supporting services. Volume 2 - Sample Policy Source - contains sample application and policy source code to build a simple message filter and experiment with X-Windows. Updated all relevant sections to reflect Fedora 12 release and correct errors. Added secolors.conf and VM configuration files, typebounds Policy language statement. Added sections on: XSELinux for X-Windows support and sample polyinstantiation code and policy. Virtual machine support with examples. SE-PostgreSQL support with an example database. Apache / SELinux-Plus support. Richard

13 years, 12 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2010