Re: I need a script invoked from procmail_t to run unconfined.

[Robert Nichols]

On 05/01/2013 05:01 AM, Dominick Grift wrote:
>  On Tue, 2013-04-30 at 16:02 -0500, Robert Nichols wrote:
> > I tried setting up a domain transition, but it looks like a transition from
> > procmail_t to unconfined_t just isn't going to be allowed.  Since
> > unconfined_t already has an entrypoint unconfined_exec_t, the module I
> > installed is:
> >
> >       module procmail_uncon 1.0;
> >
> >       require {
> > 	type unconfined_t;
> > 	type unconfined_exec_t;
> > 	type procmail_t;
> > 	class process { transition sigchld };
> >       }
> >
> >       allow procmail_t unconfined_t : process { transition sigchld };
> >
>
>  Looks like you are missing an actual domain transition rule. There is
>  also something fishy going on with role based access control.
>
>  Try this:
>
>  sudo semodule -r procmail_uncon
>
>  cat > mytest.te <<EOF
>  policy_module(mytest, 1.0.0)
>  optional_policy(`
>  gen_require(`
>  type procmail_t, unconfined_t, unconfined_exec_t;
>  ')
>  domtrans_pattern(procmail_t, unconfined_exec_t, unconfined_t)
>  ')
>  EOF
>
>  make -f /usr/share/selinux/devel/Makefile mytest.pp
>  sudo semodule -i mytest.pp
>
>
>  Then try again, but keep a look out for any "SELINUX_ERR" messages in
>  audit.log
>
>  There may be some RBAC related issues yet to resolve.
>
>  First things first: see where this gets you 
I _finally_ discovered that makefile last night (a web page that I think
was in Portugese was the first place I found that referenced it), and
that let me use Dan's blog page as a model.  I did get it to work, but I
had to use a custom type my_uncon_exec_t:

     policy_module(procmail_uncon, 1.0.18)

     gen_require(`
	type unconfined_t;
	type unconfined_exec_t;
	type procmail_t;
	role system_r;
     ')

     type my_uncon_exec_t;
     files_type(my_uncon_exec_t)

     allow procmail_t unconfined_t : process { transition sigchld };
     domain_auto_trans(procmail_t, my_uncon_exec_t, unconfined_t)
     role system_r types unconfined_t;

If I try to do that with unconfined_exec_t in the domain_auto_trans(),
I get these AVCs:

type=AVC msg=audit(1367415022.653:1349): avc:  denied  { transition } for 
pid=11841 comm="procmail" path="/home/rnichols/bin/stock-alert"
dev=sda6 
ino=229247 scontext=system_u:system_r:procmail_t:s0 
tcontext=system_u:unconfined_r:unconfined_t:s0 tclass=process

type=SYSCALL msg=audit(1367415022.653:1349): arch=c000003e syscall=59 success=no 
exit=-13 a0=7fffee5d82dc a1=bbf100 a2=bc00d0 a3=8 items=0 ppid=1 pid=11841 
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=12 
fsgid=500 tty=(none) ses=4294967295 comm="procmail"
exe="/usr/bin/procmail" 
subj=system_u:system_r:procmail_t:s0 key=(null)

Running those through audit2allow yields:

#============= procmail_t ==============
#!!!! This avc is a constraint violation.  You will need to add an attribute to 
either the source or target type to make it work.
#Contraint rule:
allow procmail_t unconfined_t:process transition;

No way in Hell am I ever going through this again.  The next time SELinux
gives me any trouble, it gets shut off and that's the end of it.

-- 
Bob Nichols     "NOSPAM" is really part of my email address.
                 Do NOT delete it.