Re: AW: WG: Adoption to Ref-Policy sysadm_t

[Daniel J Walsh]

Fedora policy is more complete.  We list all of selinux policy config
types as security_files

grep files_security_file selinuxutil.te
files_security_file(selinux_config_t)
files_security_file(selinux_login_config_t)
files_security_file(default_context_t)
files_security_file(file_context_t)
files_security_file(semanage_store_t)


On 03/31/2014 03:25 PM, Philipp wrote:
>  Yes, config/SELinux is in MLS mode. Currently running with my self
>  compiled one.
>
>   
>
>  I know that it is not possible to really stop such an admin, I want to
>  make it more difficult to attack the system. It also shouldn’t be
>  possible to change file contexts (from a special directory), but that
>  would be the next step…
>
>   
>
>  Do you have any hints where to search for those rules (discussed
>  before) or why do they get generated even if I comment out the rules
>  in sysadm.te?
>
>   
>
>  I commented out the following entries in sysadm.te
>
>   
>
>  #optional_policy(`
>
>  #       secadm_role_change(sysadm_r)
>
>  #')
>
>   
>
>  #optional_policy(`
>
>  #       seutil_run_setfiles(sysadm_t, sysadm_r)
>
>  #       seutil_run_runinit(sysadm_t, sysadm_r)
>
>  #')
>
>   
>
>  That are the most appropriate entries…
>
>   
>
>  Thanks!
>
>   
>
>  *Von:*Daniel J Walsh [mailto:[e-mail]]
>  *Gesendet:* Montag, 31. März 2014 20:19
>  *An:* Philipp; selinux(a)lists.fedoraproject.org
>  *Betreff:* Re: WG: Adoption to Ref-Policy sysadm_t
>
>   
>
>  Yes that separation is more used in MLS Mdde. 
>
>  Is SELinux config files in MLS Mode.
>
>  But if you are trying to stop an evil admin, I believe you will not be
>  able to get it done.  Removing sysadm privs is kind of difficult and
>  backwards.  You really want to define what an admin can do, rather
>  then can't.
>
>  On 03/31/2014 11:04 AM, Philipp wrote:
>
>       
>
>      Already tried that, but then the user isn’t able to open e.g the
>      /var/log/audit/audit.log. This is also mentioned in the
>      sysadm_secadm.te file.
>
>       
>
>      logging_manage_audit_log(sysadm_t)
>
>      logging_manage_audit_config(sysadm_t)
>
>      logging_run_auditctl(sysadm_t, sysadm_r)
>
>      logging_stream_connect_syslog(sysadm_t)
>
>       
>
>       
>
>      The user is still able to read/write SELinux config files…
>
>       
>
>      *Von:*Daniel J Walsh [mailto:[e-mail]]
>      *Gesendet:* Montag, 31. März 2014 16:59
>      *An:* Philipp; selinux(a)lists.fedoraproject.org
>      <mailto:[e-mail]>
>      *Betreff:* Re: Adoption to Ref-Policy sysadm_t
>
>       
>
>      Does disabling sysadm_secadm package give you the separation you need.
>
>      semodule -d sysadm_secadm
>
>      On 03/31/2014 09:22 AM, Philipp wrote:
>
>          Hi all,
>
>           
>
>          I am trying to adopt the reference policy in a way that the
>          sysadm_t domain isn’t able to open SELinux configuration files
>          or run any related binaries like semange. My approach was to
>          edit the sysadm.te file and uncomment the related lines in
>          there. Thus far, I haven’t found the right entries:
>
>           
>
>          I looked up with sesearch for the following lines:
>
>           
>
>          sesearch --all -s sysadm_t -t selinux_config_t |
>
>           
>
>          Output:
>
>           
>
>          allow sysadm_t non_security_file_type : file { ioctl read
>          write create getattr setattr lock relabelfrom relabelto append
>          unlink link rename open } ;
>
>             allow sysadm_t non_security_file_type : dir { ioctl read
>          write create getattr setattr lock relabelfrom relabelto unlink
>          link rename add_name remove_name reparent search rmdir open } ;
>
>             allow sysadm_t non_security_file_type : lnk_file { ioctl
>          read write create getattr setattr lock relabelfrom relabelto
>          append unlink link rename } ;
>
>             allow sysadm_t non_security_file_type : chr_file { getattr
>          relabelfrom relabelto } ;
>
>             allow sysadm_t non_security_file_type : blk_file { getattr
>          relabelfrom relabelto } ;
>
>             allow sysadm_t non_security_file_type : sock_file { getattr
>          relabelfrom relabelto } ;
>
>             allow sysadm_t non_security_file_type : fifo_file { getattr
>          relabelfrom relabelto } ;
>
>             allow sysadm_t file_type : filesystem getattr ;
>
>             allow sysadm_usertype file_type : filesystem getattr ;
>
>             allow sysadm_t selinux_config_t : dir { getattr search open } ;
>
>             allow sysadm_usertype selinux_config_t : file { ioctl read
>          getattr lock open } ;
>
>             allow sysadm_usertype selinux_config_t : dir { ioctl read
>          getattr lock search open } ;
>
>             allow sysadm_usertype selinux_config_t : lnk_file { read
>          getattr } ;
>
>           
>
>           
>
>          I thought that there must be some entries corresponding the
>          last few lines, but as already mentioned I haven’t found any
>          in the
>          rpmbuild/SOURCES/serefpolicy-3.7.19/policy/modules/roles/sysadm*
>          files.
>
>           
>
>          What I am doing wrong or where do I have to change something?
>
>           
>
>          Thank you in advance!
>
>
>
>
>          --
>
>          selinux mailing list
>
>          selinux(a)lists.fedoraproject.org <mailto:[e-mail]>
>
>          https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>       
>
>
>
>
>      --
>
>      selinux mailing list
>
>      selinux(a)lists.fedoraproject.org <mailto:[e-mail]>
>
>      https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>   
>
>
>
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux