Individual Domains for Particular PHP Scripts.

[Tobias]

Hi SELinux users!

I've
read:
http://fedora.redhat.com/docs/selinux-apache-fc3/sn-further-approaches.ht...

My Testbed: FC4 with selinux-policy-strict-sources-1.23.16-6.

My Steps:

#ls -laZ /var/www/html/
drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t .
drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t ..
-rw-r--r--  root     root     system_u:object_r:httpd_php_script_a_t a.php
-rw-r--r--  root     root     system_u:object_r:httpd_php_script_b_t b.php
-rw-r--r--  root     root     system_u:object_r:httpd_sys_content_t
index.html

#cat a.php
<?php
$fp = fopen("b.php","r");
if ($fp)
{
echo "sorry, could access the another domain :-(";
}
fclose($fp);
?>

#cat myphp.te
#file types httpd_php_script_x_t
type httpd_php_script_a_t, file_type, sysadmfile;
type httpd_php_script_b_t, file_type, sysadmfile;

#process domains httpd_php_domain_x_t
type httpd_php_domain_a_t, domain, privmail;
type httpd_php_domain_b_t, domain, privmail;

#allow apache acces the new types
allow httpd_t httpd_php_script_a_t:file { getattr read };
allow httpd_t httpd_php_script_b_t:file { getattr read };

#authorize system_r for httpd_php_domain_x_t;
role system_r types httpd_php_domain_a_t;
role system_r types httpd_php_domain_b_t;

#domain auto transition
domain_auto_trans(httpd_t, httpd_php_script_a_t, httpd_php_domain_a_t);
domain_auto_trans(httpd_t, httpd_php_script_b_t, httpd_php_domain_a_t);

# make reload

#cat /selinux/enforce
1

Now, i'll expect an Error, or Acces Denied while Browseraccess
to http://localhost/a.php, but a.php reports "sorry, could access
the another domain :-(". Neither avc denied messages, nor any other Errors.

What's wrong in my policy?  Doesn't works the domain auto transition
properly ? How to separate PHP Scripts in their own domains?

Any Help welcome! Thanks in Advance!
Toby


-- 
-- 
TobyD

Geschenkt: 3 Monate GMX ProMail gratis + 3 Ausgaben stern gratis
++ Jetzt anmelden & testen ++ http://www.gmx.net/de/go/promail ++

[Daniel J Walsh]

TobyD(a)wolke7.net wrote:

> Hi SELinux users!
>
> I've
> read:
> http://fedora.redhat.com/docs/selinux-apache-fc3/sn-further-approaches.ht...
>
> My Testbed: FC4 with selinux-policy-strict-sources-1.23.16-6.
>
> My Steps:
>
> #ls -laZ /var/www/html/
> drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t .
> drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t ..
> -rw-r--r--  root     root     system_u:object_r:httpd_php_script_a_t a.php
> -rw-r--r--  root     root     system_u:object_r:httpd_php_script_b_t b.php
> -rw-r--r--  root     root     system_u:object_r:httpd_sys_content_t
> index.html
>
> #cat a.php
> <?php
> $fp = fopen("b.php","r");
> if ($fp)
> {
> echo "sorry, could access the another domain :-(";
> }
> fclose($fp);
> ?>
>
> #cat myphp.te
> #file types httpd_php_script_x_t
> type httpd_php_script_a_t, file_type, sysadmfile;
> type httpd_php_script_b_t, file_type, sysadmfile;
>
> #process domains httpd_php_domain_x_t
> type httpd_php_domain_a_t, domain, privmail;
> type httpd_php_domain_b_t, domain, privmail;
>
> #allow apache acces the new types
> allow httpd_t httpd_php_script_a_t:file { getattr read };
> allow httpd_t httpd_php_script_b_t:file { getattr read };
>
> #authorize system_r for httpd_php_domain_x_t;
> role system_r types httpd_php_domain_a_t;
> role system_r types httpd_php_domain_b_t;
>
> #domain auto transition
> domain_auto_trans(httpd_t, httpd_php_script_a_t, httpd_php_domain_a_t);
> domain_auto_trans(httpd_t, httpd_php_script_b_t, httpd_php_domain_a_t);
>
> # make reload
>
> #cat /selinux/enforce
> 1
>
> Now, i'll expect an Error, or Acces Denied while Browseraccess
> to http://localhost/a.php, but a.php reports "sorry, could access
> the another domain :-(". Neither avc denied messages, nor any other Errors.
>
> What's wrong in my policy?  Doesn't works the domain auto transition
> properly ? How to separate PHP Scripts in their own domains?
>
> Any Help welcome! Thanks in Advance!
> Toby
>
>
>   
>  
A better approach would be to create a te file with the following


more domains/program/myphp.te
#myphp.te
apache_domain(myphp)

And
more file_contexts/program/myphp.fc
/var/www/cgi-bin/myphp          -- 
system_u:object_r:httpd_myphp_script_exec_t

This will create file_types of

type httpd_myphp_content_t, file_type, httpdcontent, sysadmfile, 
customizable;
type httpd_myphp_htaccess_t, file_type, sysadmfile, customizable;
type httpd_myphp_script_exec_t, file_type, sysadmfile, customizable;
type httpd_myphp_script_ro_t, file_type, httpdcontent, sysadmfile, 
customizable;
type httpd_myphp_script_rw_t, file_type, httpdcontent, sysadmfile, 
customizable;
type httpd_myphp_script_ra_t, file_type, httpdcontent, sysadmfile, 
customizable;

Which you can define in your fc file to files/directories depending on 
what your script wants to do.  You can also add additional allow rules 
to your te file to grant it access.

[Tobias]

Hi Daniel, hi Maillist,

>  A better approach would be to create a te file with the following
>  
>  
>  more domains/program/myphp.te
>  #myphp.te
>  apache_domain(myphp)
>  
>  And
>  more file_contexts/program/myphp.fc
>  /var/www/cgi-bin/myphp          -- 
>  system_u:object_r:httpd_myphp_script_exec_t
>   
It doesn't work, or we got us wrong.

#cat myphp.te
apache_domain(myphp_a);
apache_domain(myphp_b);

# ls -laZ /var/www/html/
drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t .
drwxr-xr-x  root     root     system_u:object_r:httpd_sys_content_t ..
-rw-r--r--  root     root     system_u:object_r:httpd_myphp_a_script_exec_t
a.php
-rw-r--r--  root     root     system_u:object_r:httpd_myphp_b_script_exec_t
b.php

# cat /var/www/html/a.php
<?php
echo "hello. i'm a.php and now i'll try to read b.php. ";
$fp = fopen("b.php","r");
if ($fp)
{ echo "oops, i've got the b.php, but it must not happen :-("; }
fclose($fp);
?>

Script a.php will try to open (read) Script b.php.
My goal is to protect/separate script b.php from script a.php
and a.php from b.php, so when one is buggy, this one couldn't
access the another script (same szenario as above mentioned
on:
http://fedora.redhat.com/docs/selinux-apache-fc3/sn-further-approaches.ht...
but there are .cgi scripts and here .php).
A thought crossed my mind, i'll assign invidual domains
for a.php and b.php and use a domain_auto_trans,
so that requested a.php transit automatically
from httpd_t into his new domain and now occur
access denied while try to read b.php with his new type.

With Daniel's proposal to use macro apache_domain(myphp_X)
it doesn't works. a.php still opens b.php.
Have You any Idea how to tix that ?

Thanks! :)
Toby


-- 
Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie!
Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

[Colin Walters]

On Thu, 2005-06-23 at 12:50 +0200, TobyD(a)wolke7.net wrote:
>  Hi SELinux users!
>  
>  I've
>  read:
>
> http://fedora.redhat.com/docs/selinux-apache-fc3/sn-further-approaches.ht...
Need to update that for FC4...soon, hopefully :)

>  What's wrong in my policy?  Doesn't works the domain auto
> transition
>  properly ? How to separate PHP Scripts in their own domains? 
Are these PHP scripts actually being executed as separate processes? 

SELinux policy is applied at the level of processes; there is no builtin
mechanism for confining different PHP scripts that run in the same httpd
process.  It would be possible to achieve some level of security by
using dynamic domain transitions e.g. with an Apache module, but no one
has written it yet.

Hi Colin, hi
ML,

> http://fedora.redhat.com/docs/selinux-apache-fc3/sn-further-approaches.ht...
>  
>  Need to update that for FC4...soon, hopefully :) 
:) 

>  
>  > What's wrong in my policy?  Doesn't works the domain auto transition
>  > properly ? How to separate PHP Scripts in their own domains?
>  
>  Are these PHP scripts actually being executed as separate processes? 
>
>  SELinux policy is applied at the level of processes; there is no builtin
>  mechanism for confining different PHP scripts that run in the same httpd
>  process.  It would be possible to achieve some level of security by
>  using dynamic domain transitions e.g. with an Apache module, but no one
>  has written it yet. 
 
I've a bit experience with domain_auto_trans related by executable binaries 
(flow: user_t->execute binary->newtype_t->other_rights_than_user_t)
and i hoped apache and php-scripts are similar 
(flow: httpd_t->execute script->httpd_new_t->other_rights_than_httpd_t).
 
See my previous email (reply to Daniel Walsh), please.

TIA :)
Toby


-- 
Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie!
Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

[Stephen Smalley]

On Fri, 2005-06-24 at 03:05 +0200, Tobias wrote:
>  I've a bit experience with domain_auto_trans related by
> executable binaries 
>  (flow: user_t->execute binary->newtype_t->other_rights_than_user_t)
>  and i hoped apache and php-scripts are similar 
>  (flow: httpd_t->execute script->httpd_new_t->other_rights_than_httpd_t).
>   
>  See my previous email (reply to Daniel Walsh), please. 
Depends on whether apache forks and execs the interpreter in a separate
process, or just directly executes an interpreter in its own process
(via mod_php).  My impression was that php is typically run in-process
by apache, thus you couldn't change domains for it without introducing
some kind of mod_dyntras module that performs a dynamic domain
transition in the apache process.

-- 
Stephen Smalley
National Security Agency

Hi Stephen, hi ML,

>  On Fri, 2005-06-24 at 03:05 +0200, Tobias wrote:
>  > I've a bit experience with domain_auto_trans related by executable
>  binaries 
>  > (flow: user_t->execute binary->newtype_t->other_rights_than_user_t)
>  > and i hoped apache and php-scripts are similar 
>  > (flow: httpd_t->execute script->httpd_new_t->other_rights_than_httpd_t).
>  >  
>  > See my previous email (reply to Daniel Walsh), please.
>  
>  Depends on whether apache forks and execs the interpreter in a separate
>  process, or just directly executes an interpreter in its own process
>  (via mod_php).  My impression was that php is typically run in-process
>  by apache, thus you couldn't change domains for it without introducing
>  some kind of mod_dyntras module that performs a dynamic domain
>  transition in the apache process. 
I see. This means that my goal is only possible,
when use php as cgi modules, or?

Thanks for the clarification! Now, i know my way.

Maybe can Colin write examples in his update for
"Understanding and Customizing the Apache HTTP SELinux Policy" ;)

Cheers
Toby


 
>  -- 
>  Stephen Smalley
>  National Security Agency
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
-- 
Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie!
Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

[Stephen Smalley]

On Fri, 2005-06-24 at 16:24 +0200, Tobias wrote:
>  I see. This means that my goal is only possible,
>  when use php as cgi modules, or? 
Yes, any mechanism that causes it to exec the script in a separate
process.  Looks like there is some information at
http://www.php.net/manual/en/security.cgi-bin.php FWIW.

>  Thanks for the clarification! Now, i know my way.
>  
>  Maybe can Colin write examples in his update for
>  "Understanding and Customizing the Apache HTTP SELinux Policy" ;) 
Yes.  It would also likely be an interesting project for someone to try
writing an apache module that uses setcon() to perform a dynamic context
transition for scripts that are directly run by apache, so that they
could at least run with reduced permissions.  exec-based transitions are
certainly preferable, but that may not be an option for everyone.

-- 
Stephen Smalley
National Security Agency