[PATCH] selinux: policycoreutils: sepolicy: seisolate feature
by Leonidas Da Silva Barbosa
This feature enable the user to create a SEuser adm
based on SElinux adm role and link a LOGIN against
it (seisolate: Isolate admin), that way complementing
sepolicy adm roles create.
diff --git a/policycoreutils/sepolicy/sepolicy.py b/policycoreutils/sepolicy/sepolicy.py
index b25d3b2..0380604 100755
--- a/policycoreutils/sepolicy/sepolicy.py
+++ b/policycoreutils/sepolicy/sepolicy.py
@@ -446,6 +446,27 @@ def gen_generate_args(parser):
help=_("Generate Policy for %s") % poltype[XUSER])
pol.set_defaults(func=generate)
+# Will create a SElinux adm user or (as defined here) a Isolate adm.
+def isolateadm(args):
+ from sepolicy import seisolate
+
+ if args.adminrole and args.login:
+ seisolate.create_user(args.adminrole, args.login)
+ seisolate.link(args.adminrole, args.login)
+
+
+def gen_isolateadm_args(parser):
+ isoadm = parser.add_parser("isolateadm",
+ help=_("Create a link beteween LOGIN and SEadm user"))
+ isoadm.add_argument("-a", "--adminrole", dest="adminrole",
+ action="store", required=True,
+ help=_("Receive an admin role name"))
+ isoadm.add_argument("-l", "--login", dest="login",
+ action="store", required=True,
+ help=_("Receive a LOGIN to create the SEadm user"))
+ isoadm.set_defaults(func=isolateadm)
+
+
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='SELinux Policy Inspection Tool')
subparsers = parser.add_subparsers(help=_("commands"))
@@ -459,6 +480,7 @@ if __name__ == '__main__':
gen_manpage_args(subparsers)
gen_network_args(subparsers)
gen_transition_args(subparsers)
+ gen_isolateadm_args(subparsers)
try:
args = parser.parse_args()
diff --git a/policycoreutils/sepolicy/sepolicy/seisolate.py b/policycoreutils/sepolicy/sepolicy/seisolate.py
index e69de29..f9be58a 100644
--- a/policycoreutils/sepolicy/sepolicy/seisolate.py
+++ b/policycoreutils/sepolicy/sepolicy/seisolate.py
@@ -0,0 +1,62 @@
+#! /usr/bin/python -Es
+
+import sys
+import seobject
+import sepolicy
+
+from shutil import copy2
+from os import chmod as set_permissions
+
+# PATH to staff_u that will be base to new users created.
+STAFF_U = "staff_u"
+COMMON_PATH = "/etc/selinux/targeted/contexts/users/"
+
+# These are constants used to create SEADM user to a Isolate Admin environment.
+SELEVEL = "s0"
+PREFIX = "user"
+SERANGE = "s0-s0:c0.c1023"
+
+SUDOERS_PATH = "/etc/sudoers.d/"
+SUDOERS_ENTRY = "%s ALL=(ALL) ROLE=%s TYPE=%s ALL"
+
+# Initialize adm roles list.
+ADM_ROLES = [adm_r for adm_r in sepolicy.get_all_roles() if (adm_r[:-2]).
+ endswith('adm')]
+# Initialize a dictionary of se_adm_users with adm_role as key.
+ADM_USERS = {key: 'se_'+key[:-2]+'_u' for key in ADM_ROLES}
+
+
+store = ""
+__create_user = seobject.seluserRecords(store)
+__create_link = seobject.loginRecords(store)
+
+
+def create_user(adm_role, login):
+ import pwd
+ try:
+ pwd.getpwnam(login)
+ except KeyError:
+ print("User/Login %s doesn't exist" % login)
+ sys.exit(1)
+
+ seadm_user = ADM_USERS[adm_role]
+ roles = "staff_r {role1} {role2}".format(role1=adm_role,
+ role2="system_r" if adm_role == "sysadm_r" else "")
+
+ if not seadm_user in sepolicy.get_all_users():
+ __create_user.add(seadm_user, roles.split(), SELEVEL,
+ SERANGE, PREFIX)
+ copy2(COMMON_PATH+STAFF_U, COMMON_PATH+seadm_user)
+
+
+def create_link(adm_role, login):
+ seadm_user = ADM_USERS[adm_role]
+ adm_domain = adm_role.replace("_r", "_t")
+
+ if seadm_user in sepolicy.get_all_users():
+ __create_link.add(login, seadm_user, SERANGE)
+
+ with open(SUDOERS_PATH+login, 'w') as f:
+ f.write(SUDOERS_ENTRY % (login, adm_role, adm_domain))
+
+ set_permissions(SUDOERS_PATH+login, 0440)
10 years, 6 months
iotop policy development advice
by William
Hi,
I recently raised a bug[1] that while using confined users / system
administrators iotop would not work. Normally, iotop only runs as root,
so reasonably, it shouldn't run as staff_t, but it should be able to run
while in sysadm_t.
Initially I have created the template with:
sepolicy generate --application /usr/sbin/iotop
I have build and installed this basic template for now, and of course as
predicted I'm still having some issues with denials.
Am I on the right track to setup iotop with a iotop_t policy so that it
can access the kernel resources it needs when a user with sysadm_t calls
it? Given the messages I am seeing now are as follows:
type=AVC msg=audit(1381226118.448:6322): avc: denied { create } for
pid=19326 comm="iotop" scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
tcontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_socket
I assume that sysadm_t is not allowed to transition to iotop_t. What is
the right way to write this into my te file? I note that in the selinux
reference policy there are a number of calls to:
optional_policy(`
uml_role(sysadm_r, sysadm_t)
')
What is the function of the <domain>_role() call, and is this what I
should be using (I have iotop_role in my if)
Following that, what is the correct way to allow the sysadm_t to execute
this, but not staff_t etc?
[1] https://bugzilla.redhat.com/show_bug.cgi?id=10163
--
Sincerely,
William Brown
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xEFC416D781A8099A
10 years, 6 months
Semanage, sepolicy Python code and new feature
by Leonidas Da Silva Barbosa
Hi,
this is my first participation here, not sure I'd introduce
myself, but anyway, I'd like to colaborate with some pieces of
code in SElinux, and these are my first attempt to.
1) In semanage file (policycoreutils/semanage/semanage)
I saw that 'import selinux' and selinux module is not used in
any place. Is it really need?
2) still in semanage file I could notice that there are
assignments to a variable called 'object', object is also
a Python keyword/global variable used to create class. Wondering
if it can not mess up the things in the future? My suggest is
change 'object' to '__object'.
3) I also realized that almost of the code is not compliant
with PEP08, is there any code style to follow in order to
colaborate with these .py ?
In case of these ^ points (1) and (2 ) be accepted, I can send
the patches.
Regarding sepolicy, I had a discussions with Daniel about
a new tool/feature that will be responsible to link an unix user
to a SElinux admin user. I start to digging into sepolicy code
to understand more about what it does, since sepolicy will be/is the
tool responsible to create policies and new roles/admin roles.
Once is through these admin roles, e.g. logadm_r, that a SElinux admin
is created, I was wondering if that linker feature fits in sepolicy
or if should be a separated tool, would like to have thoughts about
that.
Thanks in advance,
Leonidas.
10 years, 6 months
[PATCH] policycoreutils: semanage: changed object variable to __object
by Leonidas Da Silva Barbosa
This patch fix object variable to __object in semanage. object is
a keyword and also an object in Python what could cause issues.
>From 58c66622a5c344597722b726df9496411d4414dc Mon Sep 17 00:00:00 2001
From: Leonidas Da Silva Barbosa <leosilva(a)linux.vnet.ibm.com>
Date: Fri, 4 Oct 2013 14:04:35 -0300
Subject: [PATCH] policycoreutils: semanage: changed object var name to
__object to avoid issues with Python object
---
policycoreutils/semanage/semanage | 74 +++++++++++++++++++--------------------
1 file changed, 37 insertions(+), 37 deletions(-)
diff --git a/policycoreutils/semanage/semanage b/policycoreutils/semanage/semanage
index 6e33c85..6260914 100644
--- a/policycoreutils/semanage/semanage
+++ b/policycoreutils/semanage/semanage
@@ -216,10 +216,10 @@ Object-specific Options (see above):
if len(argv) == 0:
return
- object = argv[0]
+ __object = argv[0]
option_dict=get_options()
- if object not in option_dict.keys():
- usage(_("Invalid parameter %s not defined") % object)
+ if __object not in option_dict.keys():
+ usage(_("Invalid parameter %s not defined") % __object)
args = argv[1:]
@@ -258,8 +258,8 @@ Object-specific Options (see above):
usage(_("Options Error %s ") % error.msg)
for o, a in gopts:
- if o not in option_dict[object]:
- sys.stderr.write(_("%s not valid for %s objects\n") % ( o, object) );
+ if o not in option_dict[__object]:
+ sys.stderr.write(_("%s not valid for %s objects\n") % ( o, __object) );
return
for o,a in gopts:
@@ -348,40 +348,40 @@ Object-specific Options (see above):
value = "off"
modify = True
- if object == "login":
+ if __object == "login":
OBJECT = seobject.loginRecords(store)
- if object == "user":
+ if __object == "user":
OBJECT = seobject.seluserRecords(store)
- if object == "port":
+ if __object == "port":
OBJECT = seobject.portRecords(store)
- if object == "interface":
+ if __object == "interface":
OBJECT = seobject.interfaceRecords(store)
- if object == "node":
+ if __object == "node":
OBJECT = seobject.nodeRecords(store)
- if object == "fcontext":
+ if __object == "fcontext":
OBJECT = seobject.fcontextRecords(store)
- if object == "boolean":
+ if __object == "boolean":
OBJECT = seobject.booleanRecords(store)
if use_file:
modify = True
- if object == "module":
+ if __object == "module":
OBJECT = seobject.moduleRecords(store)
- if object == "permissive":
+ if __object == "permissive":
OBJECT = seobject.permissiveRecords(store)
- if object == "dontaudit":
+ if __object == "dontaudit":
OBJECT = seobject.dontauditClass(store)
if list:
- if object == "boolean":
+ if __object == "boolean":
OBJECT.list(heading, locallist, use_file)
else:
OBJECT.list(heading, locallist)
@@ -394,7 +394,7 @@ Object-specific Options (see above):
if extract:
for i in OBJECT.customized():
- print "%s %s" % (object, str(i))
+ print "%s %s" % (__object, str(i))
return
if len(cmds) != 1:
@@ -402,61 +402,61 @@ Object-specific Options (see above):
target = cmds[0]
- if object == "dontaudit":
+ if __object == "dontaudit":
OBJECT.toggle(target)
return
if add:
- if object == "login":
+ if __object == "login":
OBJECT.add(target, seuser, serange)
return
- if object == "user":
+ if __object == "user":
OBJECT.add(target, roles.split(), selevel, serange, prefix)
return
- if object == "port":
+ if __object == "port":
OBJECT.add(target, proto, serange, setype)
return
- if object == "interface":
+ if __object == "interface":
OBJECT.add(target, serange, setype)
return
- if object == "module":
+ if __object == "module":
OBJECT.add(target)
return
- if object == "node":
+ if __object == "node":
OBJECT.add(target, mask, proto, serange, setype)
return
- if object == "fcontext":
+ if __object == "fcontext":
if equal == "":
OBJECT.add(target, setype, ftype, serange, seuser)
else:
OBJECT.add_equal(target, equal)
return
- if object == "permissive":
+ if __object == "permissive":
OBJECT.add(target)
return
if modify:
- if object == "boolean":
+ if __object == "boolean":
OBJECT.modify(target, value, use_file)
return
- if object == "login":
+ if __object == "login":
OBJECT.modify(target, seuser, serange)
return
- if object == "user":
+ if __object == "user":
rlist = roles.split()
OBJECT.modify(target, rlist, selevel, serange, prefix)
return
- if object == "module":
+ if __object == "module":
if enable:
OBJECT.enable(target)
elif disable:
@@ -465,19 +465,19 @@ Object-specific Options (see above):
OBJECT.modify(target)
return
- if object == "port":
+ if __object == "port":
OBJECT.modify(target, proto, serange, setype)
return
- if object == "interface":
+ if __object == "interface":
OBJECT.modify(target, serange, setype)
return
- if object == "node":
+ if __object == "node":
OBJECT.modify(target, mask, proto, serange, setype)
return
- if object == "fcontext":
+ if __object == "fcontext":
if equal == "":
OBJECT.modify(target, setype, ftype, serange, seuser)
else:
@@ -485,13 +485,13 @@ Object-specific Options (see above):
return
if delete:
- if object == "port":
+ if __object == "port":
OBJECT.delete(target, proto)
- elif object == "fcontext":
+ elif __object == "fcontext":
OBJECT.delete(target, ftype)
- elif object == "node":
+ elif __object == "node":
OBJECT.delete(target, mask, proto)
else:
--
1.8.3.1
10 years, 6 months
SELinux Alerts Help
by manojhanse＠gmail.com
Hi Team,
I just Subscribed to the SELinux mailing list. my id is :
manojhanse(a)gmail.com
I have been seeing some SELinux Alerts recently. I have attached These
alert logs to the mail.
It would be very helpful if you could suggest relevant action on it. I am
new to it.
Thanks & Regards,
Manoj Hanse | +91-8600626185
* Pune, India-411017*
10 years, 6 months
