I recently installed FC3 on a machine (we had previously been using FC1), so this is my first exposure to selinux. Consequently, we are running the targeted policy in permissive mode. We use syslog-ng (rather than sysklogd) and have updated the syslog-ng.conf to monitor/log/distribute log events on a number of other ports beyond the standard syslog distribution.
Among other things that we do in syslog-ng include: - open non-standard UDP/TCP ports - open non-standard files - call non-standard routines
As a complete newbie to selinux, I don't know whether it is easier/simpler/better/(or even how) to modify the syslog policy or the attributes of the executables/files/directories that it touches. I would appreciate some advice and guidance.
AVC log events:
Dec 27 04:02:17 gsi10 kernel: audit(1104138137.142:0): avc: denied { write } for pid=16201 exe=/sbin/syslog-ng name=kmsg dev=proc ino=-268435446 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.145:0): avc: denied { read } for pid=16202 exe=/bin/bash name=mtab dev=dm-0 ino=7146016 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:etc_runtime_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.145:0): avc: denied { getattr } for pid=16202 exe=/bin/bash path=/etc/mtab dev=dm-0 ino=7146016 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:etc_runtime_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.150:0): avc: denied { write } for pid=16202 exe=_executable_1_ name=status dev=dm-0 ino=166481 scontext=system_u:system_r:syslogd_t tcontext=user_u:object_r:usr_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.150:0): avc: denied { getattr } for pid=16202 exe=_executable_1_ path=_file_1_ dev=dm-0 ino=166481 scontext=system_u:system_r:syslogd_t tcontext=user_u:object_r:usr_t tclass=file Dec 27 10:47:27 gsi10 kernel: audit(1104162447.513:0): avc: denied { sys_admin } for pid=16201 exe=/sbin/syslog-ng capability=21 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { write } for pid=16201 exe=/sbin/syslog-ng name=log dev=dm-0 ino=166417 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { add_name } for pid=16201 exe=/sbin/syslog-ng name=e27.log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { create } for pid=16201 exe=/sbin/syslog-ng name=e27.log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { setattr } for pid=16201 exe=/sbin/syslog-ng name=e27.log dev=dm-0 ino=166450 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { chown } for pid=16201 exe=/sbin/syslog-ng capability=0 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { fowner } for pid=16201 exe=/sbin/syslog-ng capability=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { fsetid } for pid=16201 exe=/sbin/syslog-ng capability=4 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { append } for pid=16201 exe=/sbin/syslog-ng path=_file_2_ dev=dm-0 ino=166450 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { write } for pid=16202 exe=_executable_1_ path=_file_3_ dev=dm-0 ino=166444 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { getattr } for pid=16202 exe=_executable_1_ path=_file_4_ dev=dm-0 ino=166472 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { read } for pid=16202 exe=_executable_1_ path=_file_5_ dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { remove_name } for pid=16202 exe=_executable_1_ name=delete_next dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { unlink } for pid=16202 exe=_executable_1_ name=delete_next dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { search } for pid=1633 exe=_executable_1_ name=bin dev=dm-0 ino=1245185 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { read } for pid=1633 exe=_executable_1_ name=sh dev=dm-0 ino=3850242 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=lnk_file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { execute } for pid=1633 exe=_executable_1_ name=bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.320:0): avc: denied { execute_no_trans } for pid=1633 exe=_executable_1_ path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.320:0): avc: denied { read } for pid=1633 exe=_executable_1_ path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.321:0): avc: denied { read } for pid=1633 exe=/bin/bash name=meminfo dev=proc ino=-268435454 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.321:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.322:0): avc: denied { search } for pid=1633 exe=/bin/bash name=sbin dev=dm-0 ino=7356417 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:sbin_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.322:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { execute } for pid=1633 exe=/bin/bash name=rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { execute_no_trans } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { read } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file
Steve Friedman
You could add these lines to syslog.te can_exec(syslog_t, { bin_t shell_exec_t } ) allow syslogd_t etc_runtime_t:file { getattr read }; allow syslogd_t proc_kmsg_t:file write; allow syslogd_t proc_t:file { getattr read }; allow syslogd_t sbin_t:dir search; allow syslogd_t self:capability { chown fowner fsetid sys_admin };
There is some directory in /usr that needs to be relabeled syslogd_var_run_t to eliminate the following
allow syslogd_t usr_t:dir { add_name remove_name write }; allow syslogd_t usr_t:file { append create getattr read setattr unlink write };
On Thu, 2004-12-30 at 22:43 -0500, Daniel J Walsh wrote:
You could add these lines to syslog.te
Will it work to add them to local.te?
can_exec(syslog_t, { bin_t shell_exec_t } ) allow syslogd_t etc_runtime_t:file { getattr read }; allow syslogd_t proc_kmsg_t:file write; allow syslogd_t proc_t:file { getattr read }; allow syslogd_t sbin_t:dir search; allow syslogd_t self:capability { chown fowner fsetid sys_admin };
I see these and a few more from using audit2allow. How did you decide which to use? Does can_exec() replace some of the rules? These ones, at least:
allow syslogd_t bin_t:file { execute execute_no_trans getattr read }; allow syslogd_t shell_exec_t:file { execute execute_no_trans getattr read };
There is some directory in /usr that needs to be relabeled syslogd_var_run_t to eliminate the following
allow syslogd_t usr_t:dir { add_name remove_name write }; allow syslogd_t usr_t:file { append create getattr read setattr unlink write };
In other words, relabel the directory in /usr so that these rules are not needed?
thx - Karsten
Karsten Wade wrote:
On Thu, 2004-12-30 at 22:43 -0500, Daniel J Walsh wrote:
You could add these lines to syslog.te
Will it work to add them to local.te?
Yes
can_exec(syslog_t, { bin_t shell_exec_t } ) allow syslogd_t etc_runtime_t:file { getattr read }; allow syslogd_t proc_kmsg_t:file write; allow syslogd_t proc_t:file { getattr read }; allow syslogd_t sbin_t:dir search; allow syslogd_t self:capability { chown fowner fsetid sys_admin };
I see these and a few more from using audit2allow. How did you decide which to use? Does can_exec() replace some of the rules? These ones, at least:
allow syslogd_t bin_t:file { execute execute_no_trans getattr read }; allow syslogd_t shell_exec_t:file { execute execute_no_trans getattr read };
Yes, Seeing the execute priv, I relized what it is trying to do. So just adding can_exec is usually better than trying to explicitely give individual privs. Also some times audit2allow will tell you some process wants read privs, invariably it will ask for getattr as soon as I grant read, so we usually give both privs right away.
There is some directory in /usr that needs to be relabeled syslogd_var_run_t to eliminate the following
allow syslogd_t usr_t:dir { add_name remove_name write }; allow syslogd_t usr_t:file { append create getattr read setattr unlink write };
In other words, relabel the directory in /usr so that these rules are not needed?
Yes, not knowing which directory this is, but say their is a /usr/syslog directory, relabel it via chcon
chcon -R -t syslogd_var_run_t /usr/syslog
You would also want to add an entry under file contexts for
/usr/syslog(/.*)? system_u:object_r:syslogd_var_run_t
in either in policy/file_contexts/program/syslog.fc or in policy/file_contexts/misc/misc.fc
thx - Karsten
On Friday 31 December 2004 03:03, Steve Friedman steve@adsi-m4.com wrote:
I recently installed FC3 on a machine (we had previously been using FC1), so this is my first exposure to selinux. Consequently, we are running the targeted policy in permissive mode. We use syslog-ng (rather than sysklogd) and have updated the syslog-ng.conf to monitor/log/distribute log events on a number of other ports beyond the standard syslog distribution.
Among other things that we do in syslog-ng include:
- open non-standard UDP/TCP ports
- open non-standard files
- call non-standard routines
As a complete newbie to selinux, I don't know whether it is easier/simpler/better/(or even how) to modify the syslog policy or the attributes of the executables/files/directories that it touches. I would appreciate some advice and guidance.
AVC log events:
Dec 27 04:02:17 gsi10 kernel: audit(1104138137.142:0): avc: denied { write } for pid=16201 exe=/sbin/syslog-ng name=kmsg dev=proc ino=-268435446 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file Dec 27 04:02:17 gsi10
If you remove klogd.te from the policy source then that access will be allowed. I guess we could just assume that syslog-ng is being used if there is no klogd.te and put the necessary rules for TCP access in the same section.
selinux@lists.fedoraproject.org
-
Daniel J Walsh -
Karsten Wade -
Russell Coker -
Steve Friedman