[PATCH] serefpolicy: named getattr AVC accessing /dev/random

[Ted Toth]

When I was configuring a local dns server I noticed the following AVC:

type=AVC msg=audit(1301591991.675:24730): avc:  denied  { getattr }
for  pid=23587 comm="named" path="/dev/random" dev=dm-0 ino=533878
scontext=system_u:system_r:named_t:s0
tcontext=system_u:object_r:named_zone_t:s0 tclass=chr_file

[root@localhost BUILD]# find / -inum 533878
/var/named/chroot/dev/random

I've included a proposed patch below.

Ted

--- serefpolicy-3.9.7/policy/modules/services/bind.fc.orig	2011-03-31
12:54:32.128829155 -0500
+++ serefpolicy-3.9.7/policy/modules/services/bind.fc	2011-03-31
12:58:11.849410409 -0500
@@ -60,4 +60,6 @@
 /var/named/chroot/var/named/named\.ca --
gen_context(system_u:object_r:named_conf_t,s0)
 /var/named/chroot/var/log/named.*	--	gen_context(system_u:object_r:named_log_t,s0)
 /var/named/dynamic(/.*)?		gen_context(system_u:object_r:named_cache_t,s0)
+/var/named/chroot/dev/random		--	gen_context(system_u:object_r:random_device_t:s0)
+/var/named/chroot/dev/zero		--	gen_context(system_u:object_r:zero_device_t:s0)
 ')

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/31/2011 08:10 PM, Ted Toth wrote:
>  When I was configuring a local dns server I noticed the following
> AVC:
>  
>  type=AVC msg=audit(1301591991.675:24730): avc:  denied  { getattr }
>  for  pid=23587 comm="named" path="/dev/random" dev=dm-0 ino=533878
>  scontext=system_u:system_r:named_t:s0
>  tcontext=system_u:object_r:named_zone_t:s0 tclass=chr_file
>  
>  [root@localhost BUILD]# find / -inum 533878
>  /var/named/chroot/dev/random
>  
>  I've included a proposed patch below.
>  
>  Ted
>  
>  --- serefpolicy-3.9.7/policy/modules/services/bind.fc.orig	2011-03-31
>  12:54:32.128829155 -0500
>  +++ serefpolicy-3.9.7/policy/modules/services/bind.fc	2011-03-31
>  12:58:11.849410409 -0500
>  @@ -60,4 +60,6 @@
>   /var/named/chroot/var/named/named\.ca --
>  gen_context(system_u:object_r:named_conf_t,s0)
>   /var/named/chroot/var/log/named.*	--	gen_context(system_u:object_r:named_log_t,s0)
>   /var/named/dynamic(/.*)?		gen_context(system_u:object_r:named_cache_t,s0)
>  +/var/named/chroot/dev/random		--	gen_context(system_u:object_r:random_device_t:s0)
>  +/var/named/chroot/dev/zero		--	gen_context(system_u:object_r:zero_device_t:s0) 
Already there in /policy/modules/kernel/devices.fc

/var/named/chroot/dev/random -c
gen_context(system_u:object_r:random_device_t,s0)
/var/named/chroot/dev/zero -c
gen_context(system_u:object_r:zero_device_t,s0)

Along with:

/var/named/chroot/dev	-d	gen_context(system_u:object_r:device_t,s0)
/var/named/chroot/dev/null -c
gen_context(system_u:object_r:null_device_t,s0)

>   ')
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.16 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk2UzOcACgkQMlxVo39jgT/XlgCcCJMja8RUvo/veDzFoYrRYwMi
> QeUAn2Z8vpFKBIk9wnJGQ/ys+ba87AtL
> =piRH
> -----END PGP SIGNATURE-----

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/31/2011 08:50 PM, Dominick Grift wrote:
>  On 03/31/2011 08:10 PM, Ted Toth wrote:
> > When I was configuring a local dns server I noticed the following AVC:
>  
> > type=AVC msg=audit(1301591991.675:24730): avc:  denied  { getattr }
> > for  pid=23587 comm="named" path="/dev/random" dev=dm-0
> ino=533878
> > scontext=system_u:system_r:named_t:s0
> > tcontext=system_u:object_r:named_zone_t:s0 tclass=chr_file
>  
> > [root@localhost BUILD]# find / -inum 533878
> > /var/named/chroot/dev/random
>  
> > I've included a proposed patch below.
>  
> > Ted
>  
> > --- serefpolicy-3.9.7/policy/modules/services/bind.fc.orig	2011-03-31
> > 12:54:32.128829155 -0500
> > +++ serefpolicy-3.9.7/policy/modules/services/bind.fc	2011-03-31
> > 12:58:11.849410409 -0500
> > @@ -60,4 +60,6 @@
> >  /var/named/chroot/var/named/named\.ca --
> > gen_context(system_u:object_r:named_conf_t,s0)
> >  /var/named/chroot/var/log/named.*	--	gen_context(system_u:object_r:named_log_t,s0)
> >  /var/named/dynamic(/.*)?		gen_context(system_u:object_r:named_cache_t,s0)
> > +/var/named/chroot/dev/random		--	gen_context(system_u:object_r:random_device_t:s0)
> > +/var/named/chroot/dev/zero		--	gen_context(system_u:object_r:zero_device_t:s0)
>  
>  Already there in /policy/modules/kernel/devices.fc
>  
>  /var/named/chroot/dev/random -c
>  gen_context(system_u:object_r:random_device_t,s0)
>  /var/named/chroot/dev/zero -c
>  gen_context(system_u:object_r:zero_device_t,s0)
>  
>  Along with:
>  
>  /var/named/chroot/dev	-d	gen_context(system_u:object_r:device_t,s0)
>  /var/named/chroot/dev/null -c
>  gen_context(system_u:object_r:null_device_t,s0)
>   
In theory your patch would not fix it since -- mean single file, and we
are we 're dealing with character files here ( -c instead of -- ).

I guess this may be a good case for "using last path component in type
transition rules".

So that i guess named or initrc can create these nodes with a proper
type based on their name, instead of just relying on fc spec and restorecon.

> >  ')
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> >   
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.16 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk2U4ekACgkQMlxVo39jgT8avgCfeNgVrZclMYWLacP4LNSgXtXy
> TRQAn0WgGcTZVO+1gceaJ9VygsrnvlGN
> =PKt6
> -----END PGP SIGNATURE-----

[Ted Toth]

On Thu, Mar 31, 2011 at 3:19 PM, Dominick Grift <domg472(a)gmail.com&gt; wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  On 03/31/2011 08:50 PM, Dominick Grift wrote:
> > On 03/31/2011 08:10 PM, Ted Toth wrote:
> >> When I was configuring a local dns server I noticed the following AVC:
> >
> >> type=AVC msg=audit(1301591991.675:24730): avc:  denied  { getattr }
> >> for  pid=23587 comm="named" path="/dev/random" dev=dm-0
> ino=533878
> >> scontext=system_u:system_r:named_t:s0
> >> tcontext=system_u:object_r:named_zone_t:s0 tclass=chr_file
> >
> >> [root@localhost BUILD]# find / -inum 533878
> >> /var/named/chroot/dev/random
> >
> >> I've included a proposed patch below.
> >
> >> Ted
> >
> >> --- serefpolicy-3.9.7/policy/modules/services/bind.fc.orig   2011-03-31
> >> 12:54:32.128829155 -0500
> >> +++ serefpolicy-3.9.7/policy/modules/services/bind.fc        2011-03-31
> >> 12:58:11.849410409 -0500
> >> @@ -60,4 +60,6 @@
> >>  /var/named/chroot/var/named/named\.ca --
> >> gen_context(system_u:object_r:named_conf_t,s0)
> >>  /var/named/chroot/var/log/named.*   --    
>  gen_context(system_u:object_r:named_log_t,s0)
> >>  /var/named/dynamic(/.*)?          
>  gen_context(system_u:object_r:named_cache_t,s0)
> >> +/var/named/chroot/dev/random                --    
>  gen_context(system_u:object_r:random_device_t:s0)
> >> +/var/named/chroot/dev/zero          --    
>  gen_context(system_u:object_r:zero_device_t:s0)
> >
> > Already there in /policy/modules/kernel/devices.fc
> >
> > /var/named/chroot/dev/random -c
> > gen_context(system_u:object_r:random_device_t,s0)
> > /var/named/chroot/dev/zero -c
> > gen_context(system_u:object_r:zero_device_t,s0)
> >
> > Along with:
> >
> > /var/named/chroot/dev -d      gen_context(system_u:object_r:device_t,s0)
> > /var/named/chroot/dev/null -c
> > gen_context(system_u:object_r:null_device_t,s0)
> >
>
>  In theory your patch would not fix it since -- mean single file, and we
>  are we 're dealing with character files here ( -c instead of -- ). 
-c, right that's what I meant to type ;)

>  I guess this may be a good case for "using last path component in type
>  transition rules". 
Yes it seem that this would be a reasonable use of this new type of
transition rule.

>  So that i guess named or initrc can create these nodes with a proper
>  type based on their name, instead of just relying on fc spec and restorecon.
>
> >>  ')
> >> --
> >> selinux mailing list
> >> selinux(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v2.0.16 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >
> >  iEYEARECAAYFAk2U4ekACgkQMlxVo39jgT8avgCfeNgVrZclMYWLacP4LNSgXtXy
> >  TRQAn0WgGcTZVO+1gceaJ9VygsrnvlGN
> >  =PKt6
> >  -----END PGP SIGNATURE----- 
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>