Re: Requesting feedback on providing containment of sslh
On 04/30/2015 01:35 PM, Miroslav Grepl wrote:
On 04/29/2015 06:28 PM, James Hogarth wrote:
> Hi,
>
> I'm the maintainer of sslh and looking to get some feedback on a
> policy I'm writing for it.
>
> It has recently been added to the fedora repositories running
> unconfined and I'm looking to improve this with running it within its
> own confined domain.
>
> The 'default' state is to listen on tcp/443 and to be able to connect
> to tcp/80, tcp/443, tcp/5222, tcp/1194 (on both localhost and
> arbitrary systems) which the default policy is configured for with the
> option via booleans to let it listen on or connect to any port.
>
> I've tried to style this after the services in fedora-selinux on
> github in an attempt to make it consistent with existing policies.
>
> I'd be grateful for any feedback on these before requesting this to be
> added to the fedora targeted policy.
>
> Kind regards,
>
> James
>
>
> sslh te file:
>
> policy_module(sslh,1.0.0)
>
> ########################################
> #
> # Declarations
> #
>
> ## <desc>
> ## <p>
> ## Determine whether sslh can connect
> ## to any tcp port or if it is restricted
> ## to the standard http, openvpn and jabber ports.
> ## </p>
> ## </desc>
> gen_tunable(sslh_can_connect_any_port, false)
>
> ## <desc>
> ## <p>
> ## Determine whether sslh can listen
> ## on any tcp port or if it is restricted
> ## to the standard http.
> ## </p>
> ## </desc>
> gen_tunable(sslh_can_bind_any_port, false)
>
>
> type sslh_t;
> type sslh_exec_t;
> init_daemon_domain(sslh_t, sslh_exec_t)
>
> type sslh_config_t;
> files_config_file(sslh_config_t)
>
> type sslh_initrc_exec_t;
> init_script_file(sslh_initrc_exec_t)
>
> type sslh_var_run_t;
> files_pid_file(sslh_var_run_t)
>
> type sslh_unit_file_t;
> systemd_unit_file(sslh_unit_file_t)
>
> ########################################
> #
> # sslh local policy
> #
>
> allow sslh_t sslh_config_t:file read_file_perms;
>
> auth_read_passwd(sslh_t)
>
> allow sslh_t self:capability { setuid setgid };
> allow sslh_t self:process { setcap getcap };
>
> allow sslh_t self:tcp_socket create_stream_socket_perms;
>
> sysnet_dns_name_resolve(sslh_t)
>
> corenet_all_recvfrom_unlabeled(sslh_t)
> corenet_all_recvfrom_netlabel(sslh_t)
> corenet_tcp_sendrecv_generic_if(sslh_t)
> corenet_udp_sendrecv_generic_if(sslh_t)
> corenet_tcp_sendrecv_generic_node(sslh_t)
> corenet_udp_sendrecv_generic_node(sslh_t)
> corenet_tcp_bind_generic_node(sslh_t)
> corenet_udp_bind_generic_node(sslh_t)
>
> corenet_tcp_bind_http_port(sslh_t)
>
> corenet_tcp_sendrecv_http_port(sslh_t)
> corenet_tcp_connect_http_port(sslh_t)
>
> corenet_tcp_connect_ssh_port(sslh_t)
> corenet_tcp_sendrecv_ssh_port(sslh_t)
>
> corenet_tcp_connect_openvpn_port(sslh_t)
> corenet_tcp_sendrecv_openvpn_port(sslh_t)
>
> corenet_tcp_connect_jabber_client_port(sslh_t)
> corenet_tcp_sendrecv_jabber_client_port(sslh_t)
>
>
> tunable_policy(`sslh_can_connect_any_port',`
> # allow sslh to connect to any port
> corenet_tcp_sendrecv_all_ports(sslh_t)
> corenet_tcp_connect_all_ports(sslh_t)
> ')
>
> tunable_policy(`sslh_can_bind_any_port',`
> # allow sslh to bind to any port
> corenet_tcp_sendrecv_all_ports(sslh_t)
> corenet_tcp_bind_all_ports(sslh_t)
> ')
>
> sslh fc file:
>
> /usr/sbin/sslh -- gen_context(system_u:object_r:sslh_exec_t,s0)
> /usr/sbin/sslh-select -- gen_context(system_u:object_r:sslh_exec_t,s0)
> /etc/rc\.d/init\.d/sslh --
> gen_context(system_u:object_r:sslh_initrc_exec_t,s0)
> /etc/sslh.cfg -- gen_context(system_u:object_r:sslh_config_t,s0)
> /usr/lib/systemd/system/sslh.* --
> gen_context(system_u:object_r:sslh_unit_file_t,s0)
> /usr/lib/systemd/system/sslh(a)*.* --
> gen_context(system_u:object_r:sslh_unit_file_t,s0)
> /var/run/sslh(/.*)? gen_context(system_u:object_r:sslh_var_run_t,s0)
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
It looks good. Just I see
/var/run/sslh(/.*)?
gen_context(system_u:object_r:sslh_var_run_t,s0)
but I don't see rules for it. Also you should provide also sslh.if
policy file.
I don't see a reason for
/usr/lib/systemd/system/sslh(a)*.* --
gen_context(system_u:object_r:sslh_unit_file_t,s0)
which is covered by the previous decl.
If you provide also sslh.if we can review it at all and send possible
patches.
Thank you.
Hi,
As Mirek said, check his notes, and add .if source file. You can find
some examples in our selinux-policy repo.
https://github.com/fedora-selinux/selinux-policy/tree/rawhide-contrib.
Then you could create pull request for this policy.
Thank you.
--
Lukas Vrabec
SELinux Solutions
Red Hat, Inc.