X-user xauthed to execute a "root"/system level configuration helper yield denials

[Francis K Shim]

Edited to make relevant details clear:

execute_no_trans
	exe=/usr/sbin/userhelper
	path=/usr/X11R6/bin/xauth
	scontext=user:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:xauth_exec_t
	tclass=file
write
	exe=/usr/X11R6/bin/xauth
	name=user
	scontext=user:staff_r:staff_userhelper_t
	tcontext=user:object_r:staff_home_dir_t
	tclass=dir
add_name
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority-c
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=dir
create
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority-c
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
link
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority-c
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
write
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:staff_home_xauth_t
	tclass=file
remove_name
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority-c
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=dir
unlink
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority-c
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
setattr
	exe=/usr/sbin/userhelper
	name=.xauthxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
write
	exe=/usr/X11R6/bin/xauth
	path=.xauthxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
read
	exe=/usr/X11R6/bin/xauth
	name=.xauthxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
getattr
	exe=/usr/X11R6/bin/xauth
	path=/home/USER/.xauthgxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file
execute_no_trans
	exe=/usr/sbin/userhelper
	path=/usr/X11R6/bin/xauth
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:xauth_exec_t
	tclass=file
write
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:staff_home_xauth_t
	tclass=file
read
	exe=/sbin/iptables
	path=/var/run/sudo/USER/unknown
	scontext=USER:system_r:iptables_t
	tcontext=USER:object_r:pam_var_run_t
	tclass=file
read
	exe=/sbin/hwclock
	path=/var/run/sudo/USER/unknown
	scontext=USER:system_r:hwclock_t
	tcontext=USER:object_r:pam_var_run_t
	tclass=file
execute_no_trans
	exe=/usr/sbin/userhelper
	path=/usr/X11R6/bin/xauth
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:xauth_exec_t
	tclass=file
write
	exe=/usr/X11R6/bin/xauth
	name=.Xauthority
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=system_u:object_r:staff_home_xauth_t
	tclass=file
read
	exe=/sbin/iptables
	path=/var/run/sudo/USER/unknown
	scontext=USER:system_r:iptables_t
	tcontext=USER:object_r:pam_var_run_t
	tclass=file
read
	exe=/usr/sbin/ntpdate
	path=/var/run/sudo/USER/unknown
	scontext=USER:system_r:ntpd_t
	tcontext=USER:object_r:pam_var_run_t
	tclass=file
read
	exe=/sbin/hwclock
	path=/var/run/sudo/USER/unknown
	scontext=USER:system_r:hwclock_t
	tcontext=USER:object_r:pam_var_run_t
	tclass=file
write
	exe=/usr/sbin/userhelper
	name=USER
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=dir
remove_name
	exe/usr/sbin/userhelper
	name=.xauthxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=dir
unlink
	exe=/usr/sbin/userhelper
	name=.xauthxxxxx
	scontext=USER:staff_r:staff_userhelper_t
	tcontext=USER:object_r:staff_home_dir_t
	tclass=file

-- 
Francis K Shim <francis.shim(a)sympatico.ca&gt;

[Russell Coker]

On Thu, 17 Jun 2004 22:08, Francis K Shim <francis.shim(a)sympatico.ca&gt; wrote:
>  Edited to make relevant details clear:
>
>  execute_no_trans
>  	exe=/usr/sbin/userhelper
>  	path=/usr/X11R6/bin/xauth
>  	scontext=user:staff_r:staff_userhelper_t
>  	tcontext=system_u:object_r:xauth_exec_t
>  	tclass=file 
In macros/program/userhelper_macros.te at (or near) line 133 there is the 
following:
domain_trans($1_userhelper_t, xauth_exec_t, $1_xauth_t)

That expands to:
domain_auto_trans(staff_userhelper_t, xauth_exec_t, staff_xauth_t)

It's strange that you aren't seeing it automatically run in staff_xauth_t.
What version of the policy are you using?

>  read
>  	exe=/sbin/iptables
>  	path=/var/run/sudo/USER/unknown
>  	scontext=USER:system_r:iptables_t
>  	tcontext=USER:object_r:pam_var_run_t
>  	tclass=file
>  read
>  	exe=/usr/sbin/ntpdate
>  	path=/var/run/sudo/USER/unknown
>  	scontext=USER:system_r:ntpd_t
>  	tcontext=USER:object_r:pam_var_run_t
>  	tclass=file
>  read
>  	exe=/sbin/hwclock
>  	path=/var/run/sudo/USER/unknown
>  	scontext=USER:system_r:hwclock_t
>  	tcontext=USER:object_r:pam_var_run_t
>  	tclass=file 
For these, I guess that the file handle is inherited from userhelper.  The 
code which opens /var/run/sudo/USER/unknown should either set it as 
close-on-exec or explicitly close it before a child is executed.

>  write
>  	exe=/usr/sbin/userhelper
>  	name=USER
>  	scontext=USER:staff_r:staff_userhelper_t
>  	tcontext=USER:object_r:staff_home_dir_t
>  	tclass=dir
>  remove_name
>  	exe/usr/sbin/userhelper
>  	name=.xauthxxxxx
>  	scontext=USER:staff_r:staff_userhelper_t
>  	tcontext=USER:object_r:staff_home_dir_t
>  	tclass=dir
>  unlink
>  	exe=/usr/sbin/userhelper
>  	name=.xauthxxxxx
>  	scontext=USER:staff_r:staff_userhelper_t
>  	tcontext=USER:object_r:staff_home_dir_t
>  	tclass=file 
What's this about?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Francis K Shim]

On Fri, 2004-06-18 at 00:35, Russell Coker wrote:
>  On Thu, 17 Jun 2004 22:08, Francis K Shim
> <francis.shim(a)sympatico.ca&gt; wrote:
>  > Edited to make relevant details clear:
>  >
>  > execute_no_trans
>  > 	exe=/usr/sbin/userhelper
>  > 	path=/usr/X11R6/bin/xauth
>  > 	scontext=user:staff_r:staff_userhelper_t
>  > 	tcontext=system_u:object_r:xauth_exec_t
>  > 	tclass=file
>  
>  In macros/program/userhelper_macros.te at (or near) line 133 there is the 
>  following:
>  domain_trans($1_userhelper_t, xauth_exec_t, $1_xauth_t)
>  
>  That expands to:
>  domain_auto_trans(staff_userhelper_t, xauth_exec_t, staff_xauth_t)
>  
>  It's strange that you aren't seeing it automatically run in staff_xauth_t.
>  What version of the policy are you using? 
I checked the userhelper_macros.te file and what I have is the
following:

ifdef(`xauth.te', `
domain_trans($1_userhelper_t, xauth_exec_t, $1_xauth_t)
allow $1_userhelper_t $1_home_xauth_t:file { getattr read };
')

The versions of the packages are as follows:

policy-sources-1.11.3-3
checkpolicy-1.10-1
policy-1.11.3-3
policycoreutils-1.11-2
libselinux-1.11.4-1

>  > read
>  > 	exe=/sbin/iptables
>  > 	path=/var/run/sudo/USER/unknown
>  > 	scontext=USER:system_r:iptables_t
>  > 	tcontext=USER:object_r:pam_var_run_t
>  > 	tclass=file
>  > read
>  > 	exe=/usr/sbin/ntpdate
>  > 	path=/var/run/sudo/USER/unknown
>  > 	scontext=USER:system_r:ntpd_t
>  > 	tcontext=USER:object_r:pam_var_run_t
>  > 	tclass=file
>  > read
>  > 	exe=/sbin/hwclock
>  > 	path=/var/run/sudo/USER/unknown
>  > 	scontext=USER:system_r:hwclock_t
>  > 	tcontext=USER:object_r:pam_var_run_t
>  > 	tclass=file
>  
>  For these, I guess that the file handle is inherited from userhelper.  The 
>  code which opens /var/run/sudo/USER/unknown should either set it as 
>  close-on-exec or explicitly close it before a child is executed. 
Okay.  I am using the GNOME desktop manager and session manager so my
guess would be that it would be the gnome userhelper application.

>  
>  > write
>  > 	exe=/usr/sbin/userhelper
>  > 	name=USER
>  > 	scontext=USER:staff_r:staff_userhelper_t
>  > 	tcontext=USER:object_r:staff_home_dir_t
>  > 	tclass=dir
>  > remove_name
>  > 	exe/usr/sbin/userhelper
>  > 	name=.xauthxxxxx
>  > 	scontext=USER:staff_r:staff_userhelper_t
>  > 	tcontext=USER:object_r:staff_home_dir_t
>  > 	tclass=dir
>  > unlink
>  > 	exe=/usr/sbin/userhelper
>  > 	name=.xauthxxxxx
>  > 	scontext=USER:staff_r:staff_userhelper_t
>  > 	tcontext=USER:object_r:staff_home_dir_t
>  > 	tclass=file
>  
>  What's this about? 
I am not sure; however, I do remember restarting the userhelper
application and noticing that I was not being prompted for the root
password the second time around!!!... however, the third restart and on,
it seemed to prompt for the password.  Puzzling.  It might have to do
with a timing of the close of the child process from above.


-- 
Francis K Shim <francis.shim(a)sympatico.ca&gt;