Newbie asking about first policy file

[leam hall]

Good morning!

I'm trying to learn SELinux and reduce the number of alerts that refer
to normal processes. Postfix is one of the biigies, here's what I've
gotten so far. I'd appreciate critique.

Note that the file is hand transcribed, not cut and pasted. It does
compile and install, so typographic errors are mine.

###

module postfix 0.0.1;
require {
  type kernel_t;
  type postfix_bounce_t;
  type postfix_master_t;
  type postfix_smtp_t;
}

allow postfix_bounce_t kernel_t:system  module_request;
allow postfix_master_t kernel_t;system module_request;
allow postfix_smtp_t kernel_t:system module request;

###

Thanks!

Leam

[Simon Sekidde]

Leam, 

----- Original Message -----
>  From: "leam hall" <leamhall(a)gmail.com&gt;
>  To: selinux(a)lists.fedoraproject.org
>  Sent: Friday, March 30, 2018 1:08:26 PM
>  Subject: Newbie asking about first policy file
>  
>  Good morning!
>  
>  I'm trying to learn SELinux and reduce the number of alerts that refer
>  to normal processes. Postfix is one of the biigies, here's what I've
>  gotten so far. I'd appreciate critique.
>   
This rule should already exist in the current policy to suppress the alerts

  dontaudit postfix_domain kernel_t : system module_request ; 

>  Note that the file is hand transcribed, not cut and pasted. It does
>  compile and install, so typographic errors are mine.
>  
>  ###
>  
>  module postfix 0.0.1;
>  require {
>    type kernel_t;
>    type postfix_bounce_t;
>    type postfix_master_t;
>    type postfix_smtp_t;
>  }
>  
>  allow postfix_bounce_t kernel_t:system  module_request;
>  allow postfix_master_t kernel_t;system module_request;
>  allow postfix_smtp_t kernel_t:system module request;
>  
>  ###
>   
If you are not using IPv6 then make Postfix use IPv4 only by setting the line
'inet_protocols' to ipv4 in /etc/postfix/main.cf 

 # Enable IPv4, and IPv6 if supported
 inet_protocols = all

>  Thanks!
>  
>  Leam
>  _______________________________________________
>  selinux mailing list -- selinux(a)lists.fedoraproject.org
>  To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>   
-- 
Simon Sekidde
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E

[Leam Hall]

Simon, thanks! I'll test that Monday when I'm back at work. I have to 
weed though a few thousand alerts as I learn.  :)

Leam


On 03/30/2018 05:18 PM, Simon Sekidde wrote:
> Leam,
> 
> ----- Original Message -----
>> From: "leam hall" <leamhall(a)gmail.com&gt;
>> To: selinux(a)lists.fedoraproject.org
>> Sent: Friday, March 30, 2018 1:08:26 PM
>> Subject: Newbie asking about first policy file
>>
>> Good morning!
>>
>> I'm trying to learn SELinux and reduce the number of alerts that refer
>> to normal processes. Postfix is one of the biigies, here's what I've
>> gotten so far. I'd appreciate critique.
>>
> 
> This rule should already exist in the current policy to suppress the alerts
> 
>    dontaudit postfix_domain kernel_t : system module_request ;
> 
>> Note that the file is hand transcribed, not cut and pasted. It does
>> compile and install, so typographic errors are mine.
>>
>> ###
>>
>> module postfix 0.0.1;
>> require {
>>    type kernel_t;
>>    type postfix_bounce_t;
>>    type postfix_master_t;
>>    type postfix_smtp_t;
>> }
>>
>> allow postfix_bounce_t kernel_t:system  module_request;
>> allow postfix_master_t kernel_t;system module_request;
>> allow postfix_smtp_t kernel_t:system module request;
>>
>> ###
>>
> 
> If you are not using IPv6 then make Postfix use IPv4 only by setting the line
'inet_protocols' to ipv4 in /etc/postfix/main.cf
> 
>   # Enable IPv4, and IPv6 if supported
>   inet_protocols = all
> 
>> Thanks!
>>
>> Leam
>> _______________________________________________
>> selinux mailing list -- selinux(a)lists.fedoraproject.org
>> To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>>
>

[leam hall]

On Fri, Mar 30, 2018 at 5:18 PM, Simon Sekidde <ssekidde(a)redhat.com&gt; wrote:
>  Leam, 
>  This rule should already exist in the current policy to suppress the
> alerts
>
>    dontaudit postfix_domain kernel_t : system module_request ; 

Didn't see it. Stock and patched RHEL 6.

>  If you are not using IPv6 then make Postfix use IPv4 only by setting the line
> 'inet_protocols' to ipv4 in /etc/postfix/main.cf
>
>   # Enable IPv4, and IPv6 if supported
>   inet_protocols = all 
Made this change, thanks! Will see if it prevents alerts.

Leam

[Lukas Vrabec]

On 04/02/2018 07:20 PM, leam hall wrote:
>  On Fri, Mar 30, 2018 at 5:18 PM, Simon Sekidde
> <ssekidde(a)redhat.com&gt; wrote:
> > Leam,
>  
> > This rule should already exist in the current policy to suppress the alerts
> >
> >   dontaudit postfix_domain kernel_t : system module_request ;
>  
>  
>  Didn't see it. Stock and patched RHEL 6.
>   
This could be kernel bug. We had a discussion about it:
https://github.com/fedora-selinux/selinux-policy/commit/2c13be1fb543c5193...


But if you're running RHEL6, the bug shouldn't be there.
If you're still see these AVCs please dontaudit it like it's mentioned
in email from Simon.

Lukas.


> >
> > If you are not using IPv6 then make Postfix use IPv4 only by setting the line
> 'inet_protocols' to ipv4 in /etc/postfix/main.cf
> >
> >  # Enable IPv4, and IPv6 if supported
> >  inet_protocols = all
>  
>  Made this change, thanks! Will see if it prevents alerts.
>  
>  Leam
>  _______________________________________________
>  selinux mailing list -- selinux(a)lists.fedoraproject.org
>  To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>   

-- 
Lukas Vrabec
Software Engineer, Security Technologies
Red Hat, Inc.

[leam hall]

On Wed, Apr 4, 2018 at 6:19 AM, Lukas Vrabec <lvrabec(a)redhat.com&gt; wrote:
>  On 04/02/2018 07:20 PM, leam hall wrote:
> > On Fri, Mar 30, 2018 at 5:18 PM, Simon Sekidde <ssekidde(a)redhat.com&gt; wrote:
> >> Leam,
> >
> >> This rule should already exist in the current policy to suppress the alerts
> >>
> >>   dontaudit postfix_domain kernel_t : system module_request ;
> >
> >
> > Didn't see it. Stock and patched RHEL 6.
> >
>
>  This could be kernel bug. We had a discussion about it:
>
> https://github.com/fedora-selinux/selinux-policy/commit/2c13be1fb543c5193...
>
>
>  But if you're running RHEL6, the bug shouldn't be there.
>  If you're still see these AVCs please dontaudit it like it's mentioned
>  in email from Simon.
>
>  Lukas. 
Not sure we want to hide the denial. Doesn't that mean SELinux is
preventing Postfix from doing something it thinks it should do?
Wouldn't allowing it be better, assuming Postfix is supposed to do
whatever?

Or do I not understand?

Leam

[Lukas Vrabec]

On 04/04/2018 01:55 PM, leam hall wrote:
>  On Wed, Apr 4, 2018 at 6:19 AM, Lukas Vrabec
> <lvrabec(a)redhat.com&gt; wrote:
> > On 04/02/2018 07:20 PM, leam hall wrote:
> >> On Fri, Mar 30, 2018 at 5:18 PM, Simon Sekidde <ssekidde(a)redhat.com&gt;
> wrote:
> >>> Leam,
> >>
> >>> This rule should already exist in the current policy to suppress the alerts
> >>>
> >>>   dontaudit postfix_domain kernel_t : system module_request ;
> >>
> >>
> >> Didn't see it. Stock and patched RHEL 6.
> >>
> >
> > This could be kernel bug. We had a discussion about it:
> >
> https://github.com/fedora-selinux/selinux-policy/commit/2c13be1fb543c5193...
> >
> >
> > But if you're running RHEL6, the bug shouldn't be there.
> > If you're still see these AVCs please dontaudit it like it's mentioned
> > in email from Simon.
> >
> > Lukas.
>  
>  Not sure we want to hide the denial. Doesn't that mean SELinux is
>  preventing Postfix from doing something it thinks it should do?
>  Wouldn't allowing it be better, assuming Postfix is supposed to do
>  whatever?
>  
This SELinux denial is caused by bug in kernel, most probably postfix
doesn't really need request kernel for add new module. You have 2
options here:

First one, dontaudit it, which means that it won't be allowed and you
want be spammed about this in audit log.

Second one, I don't dontaudit it and wait while it will be (hopefully)
fixed in kernel.

Lukas.


>  Or do I not understand?
>  
>  Leam
>   

-- 
Lukas Vrabec
Software Engineer, Security Technologies
Red Hat, Inc.