Hello world and first question concerning Munin

[Gabriele Pohl]

Hi all,

my name is Gabriele Pohl. I live in Bonn, Germany
and use Fedora for a few years (starting with
Core 4 and upgraded to 9 some months ago)

I use Munin (http://munin.projects.linpro.no/)
to monitor my computers hardware and services.
After upgrading to Fedora 9 I decided to use SELinux
in mode *enforce* and run into lots of problems 
concerning SELinux and Munin-Plugins, that need 
high system privileges to access block devices a.s.o.

I would like to solve this issues in a good
manner and therefore subscribed to this list
to ask the experts, how to do it.

Now my first question:

Plugin smart_ is written in Python.
It calls "smartctl" from the smartmontools package
(http://smartmontools.sourceforge.net/) to read the
values of the SMART-Attributes from the harddisks.

To activate the plugin, one has to create a link
within the service directory. 

Actually the link looks like this:
lrwxrwxrwx  root root unconfined_u:object_r:munin_etc_t:s0 smart_sda
-> /usr/share/munin/plugins/smart_

The plugins file looks like this:
-rwxr-xr-x  root root
system_u:object_r:munin_exec_t:s0 /usr/share/munin/plugins/smart_

Executable smartctl looks like this:
-rwxr-xr-x  root root
system_u:object_r:fsadm_exec_t:s0 /usr/sbin/smartctl

It needs access to the disks block device /dev/sda
that looks like this:
brw-rw----  root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda 

I have policy type targeted active and 
policy module munin 1.4.0 installed.

I get the following raw audit messages, when 
calling smart_sda:

host=calex.dipohl.com type=AVC msg=audit(1221221404.542:709): avc:
denied { getattr } for pid=18327 comm="python" path="/dev/sda"
dev=tmpfs
ino=298 scontext=unconfined_u:system_r:munin_t:s0
tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file

host=calex.dipohl.com type=SYSCALL msg=audit(1221221404.542:709):
arch=40000003 syscall=195 success=no exit=-13 a0=8fbe278 a1=bfcdf038
a2=3e8ff4 a3=8f481b8 items=0 ppid=18220 pid=18327 auid=500 uid=0 gid=491
euid=0 suid=0 fsuid=0 egid=491 sgid=491 fsgid=491 tty=(none) ses=1
comm="python" exe="/usr/bin/python"
subj=unconfined_u:system_r:munin_t:s0 key=(null) 

As the FAQ said, I fed these messages into audit2allow:
audit2allow -M mine < avcs

and get the following mine.te:
-------------------------------
module mine 1.0;

require {
	type munin_t;
	type fixed_disk_device_t;
	class blk_file getattr;
}
require {
	type munin_t;
	type fixed_disk_device_t;
	class blk_file getattr;
}

#============= munin_t ==============
allow munin_t fixed_disk_device_t:blk_file getattr;
-------------------------------

and a mine.pp

Will it be ok to load that into the kernel using 
semodule -i mine.pp ?

And why are there two identical *require* structs?
Can / Should I delete one of them?
What shall I do with the message of type "SYSCALL"
if it were wrong to put it into the avcs-File?

Should I make adjustments to the files above
(service-link, plugin-file)

Anything else, that you can advise?

So far for now & cheers,

Gabriele

[Stephen Smalley]

On Fri, 2008-09-12 at 14:35 +0200, Gabriele Pohl wrote:
>  Hi all,
>  
>  my name is Gabriele Pohl. I live in Bonn, Germany
>  and use Fedora for a few years (starting with
>  Core 4 and upgraded to 9 some months ago)
>  
>  I use Munin (http://munin.projects.linpro.no/)
>  to monitor my computers hardware and services.
>  After upgrading to Fedora 9 I decided to use SELinux
>  in mode *enforce* and run into lots of problems 
>  concerning SELinux and Munin-Plugins, that need 
>  high system privileges to access block devices a.s.o.
>  
>  I would like to solve this issues in a good
>  manner and therefore subscribed to this list
>  to ask the experts, how to do it.
>  
>  Now my first question:
>  
>  Plugin smart_ is written in Python.
>  It calls "smartctl" from the smartmontools package
>  (http://smartmontools.sourceforge.net/) to read the
>  values of the SMART-Attributes from the harddisks.
>  
>  To activate the plugin, one has to create a link
>  within the service directory. 
>  
>  Actually the link looks like this:
>  lrwxrwxrwx  root root unconfined_u:object_r:munin_etc_t:s0 smart_sda
>  -> /usr/share/munin/plugins/smart_
>  
>  The plugins file looks like this:
>  -rwxr-xr-x  root root
>  system_u:object_r:munin_exec_t:s0 /usr/share/munin/plugins/smart_
>  
>  Executable smartctl looks like this:
>  -rwxr-xr-x  root root
>  system_u:object_r:fsadm_exec_t:s0 /usr/sbin/smartctl
>  
>  It needs access to the disks block device /dev/sda
>  that looks like this:
>  brw-rw----  root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda 
>  
>  I have policy type targeted active and 
>  policy module munin 1.4.0 installed.
>  
>  I get the following raw audit messages, when 
>  calling smart_sda:
>  
>  host=calex.dipohl.com type=AVC msg=audit(1221221404.542:709): avc:
>  denied { getattr } for pid=18327 comm="python" path="/dev/sda"
> dev=tmpfs
>  ino=298 scontext=unconfined_u:system_r:munin_t:s0
>  tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>  
>  host=calex.dipohl.com type=SYSCALL msg=audit(1221221404.542:709):
>  arch=40000003 syscall=195 success=no exit=-13 a0=8fbe278 a1=bfcdf038
>  a2=3e8ff4 a3=8f481b8 items=0 ppid=18220 pid=18327 auid=500 uid=0 gid=491
>  euid=0 suid=0 fsuid=0 egid=491 sgid=491 fsgid=491 tty=(none) ses=1
>  comm="python" exe="/usr/bin/python"
>  subj=unconfined_u:system_r:munin_t:s0 key=(null) 
>  
>  As the FAQ said, I fed these messages into audit2allow:
>  audit2allow -M mine < avcs
>  
>  and get the following mine.te:
>  -------------------------------
>  module mine 1.0;
>  
>  require {
>  	type munin_t;
>  	type fixed_disk_device_t;
>  	class blk_file getattr;
>  }
>  require {
>  	type munin_t;
>  	type fixed_disk_device_t;
>  	class blk_file getattr;
>  }
>  
>  #============= munin_t ==============
>  allow munin_t fixed_disk_device_t:blk_file getattr;
>  -------------------------------
>  
>  and a mine.pp
>  
>  Will it be ok to load that into the kernel using 
>  semodule -i mine.pp ?
>  
>  And why are there two identical *require* structs?
>  Can / Should I delete one of them?
>  What shall I do with the message of type "SYSCALL"
>  if it were wrong to put it into the avcs-File?
>  
>  Should I make adjustments to the files above
>  (service-link, plugin-file)
>  
>  Anything else, that you can advise? 
Ideally the munin_t domain itself shouldn't need any access to the raw
device - it should transition into the existing domain for smartd
(fsdaemon_t) upon executing the smartctl program.  I don't know offhand
if the existing munin policy module has such a domain transition rule.

However, mere getattr access (i.e. the ability to stat the file) isn't a
big deal, so you could likely grant that one w/o difficulty.  What would
be more problematic is allowing read or write access to the raw device.

The duplicate require blocks look like a bug in audit2allow.

-- 
Stephen Smalley
National Security Agency

Revert to default settings after seedit relabel, was: Re: Hello world and first question concerning Munin

[Gabriele Pohl]

Hi Stephen and all,

I searched for a possibility to see
what rules are defined in the Selinux 
module for munin.

After reading a lot of man pages of all the Selinux tools 
that I found on my system, without a result for this issue,
I took a look to the selinux knowledge base here:
http://fedoraproject.org/wiki/SELinux

and saw "seedit" selinux policy editor (and accompanying simplified
policy language)

http://seedit.sourceforge.net/

"You can try SELinux Policy Editor on Fedora Core 6,7,8 or CentOS 4,
Cent OS5.  It will not affect existing SELinux policies so it is
possible to revert to the default settings easily."

Hmmm, at the first call it asks for initialization.
I agreed. It needs a reboot and after that, all 
policy rules were replaced by *simple* ones.
And mode is now *permissive* not longer *targeted*.

I find no possibility to load a module for edit.
(as e.g. munin targeted module). So this experiment
was useless for my purpose.

After switching the mode *targeted* again
(but no reboot since now) I see none of the
old modules. All contexts are *unconfined*.

How can I get the original state back?

Am Freitag, den 12.09.2008, 09:49 -0400 schrieb Stephen Smalley:
>  On Fri, 2008-09-12 at 14:35 +0200, Gabriele Pohl wrote:
>  > I use Munin (http://munin.projects.linpro.no/)
>  > Now my first question:
>  > 
>  > Plugin smart_ is written in Python.
>  > It calls "smartctl" from the smartmontools package
>  > (http://smartmontools.sourceforge.net/) to read the
>  > values of the SMART-Attributes from the harddisks.
>  > 
>  > #============= munin_t ==============
>  > allow munin_t fixed_disk_device_t:blk_file getattr;
>  > -------------------------------
>  > 
>  Ideally the munin_t domain itself shouldn't need any access to the raw
>  device - it should transition into the existing domain for smartd
>  (fsdaemon_t) upon executing the smartctl program.  
How can this be done?

>  I don't know offhand
>  if the existing munin policy module has such a domain transition rule. 
I would like to look at the rules definded in
the policy module. How can I do this?

>  However, mere getattr access (i.e. the ability to stat the file)
> isn't a
>  big deal, so you could likely grant that one w/o difficulty.  What would
>  be more problematic is allowing read or write access to the raw device. 
ok, thanks! I'll add this rule as soon
as I have my original states restored on the system.

Kind regards,

Gabriele

Revert to default settings after seedit relabel, was: Re: Hello world and first question concerning Munin

[Gabriele Pohl]

Am Samstag, den 04.10.2008, 12:29 +0200 schrieb Gabriele Pohl:
>  http://seedit.sourceforge.net/
>  
>  "You can try SELinux Policy Editor on Fedora Core 6,7,8 or CentOS 4,
>  Cent OS5.  It will not affect existing SELinux policies so it is
>  possible to revert to the default settings easily."
>  
>  After switching the mode *targeted* again
>  (but no reboot since now) I see none of the
>  old modules. All contexts are *unconfined*. 
this is ok now, after the reboot.

>  Am Freitag, den 12.09.2008, 09:49 -0400 schrieb Stephen Smalley:
>  > On Fri, 2008-09-12 at 14:35 +0200, Gabriele Pohl wrote:
>  > > I use Munin (http://munin.projects.linpro.no/)
>  > > Now my first question:
>  > > 
>  I would like to look at the rules definded in
>  the policy module. How can I do this? 
this is my question left now.

Kind regards,

Gabriele

Revert to default settings after seedit relabel, was: Re: Hello world and first question concerning Munin

[Daniel J Walsh]

Gabriele Pohl wrote:
>  Am Samstag, den 04.10.2008, 12:29 +0200 schrieb Gabriele Pohl:
> > http://seedit.sourceforge.net/
> >
> > "You can try SELinux Policy Editor on Fedora Core 6,7,8 or CentOS 4,
> > Cent OS5.  It will not affect existing SELinux policies so it is
> > possible to revert to the default settings easily."
> >
> > After switching the mode *targeted* again
> > (but no reboot since now) I see none of the
> > old modules. All contexts are *unconfined*.
>  
>  this is ok now, after the reboot.
>  
> > Am Freitag, den 12.09.2008, 09:49 -0400 schrieb Stephen Smalley:
> >> On Fri, 2008-09-12 at 14:35 +0200, Gabriele Pohl wrote:
> >>> I use Munin (http://munin.projects.linpro.no/)
> >>> Now my first question:
> >>>
> > I would like to look at the rules definded in
> > the policy module. How can I do this?
>  
>  this is my question left now.
>  
>  Kind regards,
>  
>  Gabriele
>  
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
You can get most of the
rules defined for a domain by using sesearch
and/or apol

sesearch --allow -s munin_t

Or you could always down load the src.rpm and just look at the munin.te
file.

Rawhide version attached.


policy_module(munin, 1.5.0)

########################################
#
# Declarations
#

type munin_t alias lrrd_t;
type munin_exec_t alias lrrd_exec_t;
init_daemon_domain(munin_t, munin_exec_t)

type munin_etc_t alias lrrd_etc_t;
files_config_file(munin_etc_t)

type munin_initrc_exec_t;
init_script_file(munin_initrc_exec_t)

type munin_log_t alias lrrd_log_t;
logging_log_file(munin_log_t)

type munin_tmp_t alias lrrd_tmp_t;
files_tmp_file(munin_tmp_t)

type munin_var_lib_t alias lrrd_var_lib_t;
files_type(munin_var_lib_t)

type munin_var_run_t alias lrrd_var_run_t;
files_pid_file(munin_var_run_t)

########################################
#
# Local policy
#

allow munin_t self:capability { chown dac_override setgid setuid sys_rawio };
dontaudit munin_t self:capability sys_tty_config;
allow munin_t self:process { getsched setsched signal_perms };
allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow munin_t self:unix_dgram_socket { create_socket_perms sendto };
allow munin_t self:tcp_socket create_stream_socket_perms;
allow munin_t self:udp_socket create_socket_perms;
allow munin_t self:fifo_file manage_fifo_file_perms;

can_exec(munin_t, munin_exec_t)

allow munin_t munin_etc_t:dir list_dir_perms;
read_files_pattern(munin_t, munin_etc_t, munin_etc_t)
read_lnk_files_pattern(munin_t, munin_etc_t, munin_etc_t)
files_search_etc(munin_t)

manage_dirs_pattern(munin_t, munin_log_t,  munin_log_t)
manage_files_pattern(munin_t, munin_log_t,  munin_log_t)
logging_log_filetrans(munin_t, munin_log_t, { file dir })

manage_dirs_pattern(munin_t, munin_tmp_t, munin_tmp_t)
manage_files_pattern(munin_t, munin_tmp_t, munin_tmp_t)
files_tmp_filetrans(munin_t, munin_tmp_t, { file dir })

# Allow access to the munin databases
manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
files_search_var_lib(munin_t)

manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
manage_sock_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
files_pid_filetrans(munin_t, munin_var_run_t, file)

kernel_read_system_state(munin_t)
kernel_read_network_state(munin_t)
kernel_read_all_sysctls(munin_t)

corecmd_exec_bin(munin_t)
corecmd_exec_shell(munin_t)

corenet_all_recvfrom_unlabeled(munin_t)
corenet_all_recvfrom_netlabel(munin_t)
corenet_tcp_sendrecv_generic_if(munin_t)
corenet_udp_sendrecv_generic_if(munin_t)
corenet_tcp_sendrecv_all_nodes(munin_t)
corenet_udp_sendrecv_all_nodes(munin_t)
corenet_tcp_sendrecv_all_ports(munin_t)
corenet_udp_sendrecv_all_ports(munin_t)
corenet_tcp_bind_munin_port(munin_t)
corenet_tcp_connect_munin_port(munin_t)
corenet_tcp_connect_http_port(munin_t)
corenet_tcp_bind_all_nodes(munin_t)

dev_read_sysfs(munin_t)
dev_read_urand(munin_t)

domain_use_interactive_fds(munin_t)
domain_dontaudit_read_all_domains_state(munin_t)

files_read_etc_files(munin_t)
files_read_etc_runtime_files(munin_t)
files_read_usr_files(munin_t)
files_list_spool(munin_t)

fs_getattr_all_fs(munin_t)
fs_search_auto_mountpoints(munin_t)

auth_use_nsswitch(munin_t)

libs_use_ld_so(munin_t)
libs_use_shared_libs(munin_t)

logging_send_syslog_msg(munin_t)

miscfiles_read_fonts(munin_t)
miscfiles_read_localization(munin_t)

sysnet_exec_ifconfig(munin_t)
netutils_domtrans_ping(munin_t)

userdom_dontaudit_use_unpriv_user_fds(munin_t)
sysadm_dontaudit_search_home_dirs(munin_t)

optional_policy(`
	# for accessing the output directory
	apache_search_sys_content(munin_t)
')

optional_policy(`
	cron_system_entry(munin_t,munin_exec_t)
')

optional_policy(`
	fstools_domtrans(munin_t)
')

optional_policy(`
	mta_read_config(munin_t)
	mta_send_mail(munin_t)
')

optional_policy(`
	mysql_read_config(munin_t)
	mysql_stream_connect(munin_t)
')

optional_policy(`
	sendmail_read_log(munin_t)
')

optional_policy(`
	seutil_sigchld_newrole(munin_t)
')

optional_policy(`
	udev_read_db(munin_t)
')

#============= http munin policy ==============
apache_content_template(munin)

manage_dirs_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)