Pam_mount and SELinux

[W. Michael Petullo]

As an exercise to help me learn the fundamentals of SELinux policies I
am trying to get pam_mount to work one an enforcing SELinux system.
Pam_mount is a module that allows password-protected volumes to be
mounted when a user logs in using the users normal system password.

Pam_mount requires several special capabilities and I have modified my
su_macros.te to give them to the su command (its a start).

1.  Pam_mount needs be able to work in /var/run/pam_mount:
allow $1_su_t var_run_t:dir { getattr add_name remove_name write };
allow $1_su_t var_run_t:file { create getattr setattr read write lock unlink };

2.  Pam_mount needs to be able to read its configuration file:
allow $1_su_t etc_runtime_t:file { getattr read };
allow $1_su_t user_home_t:dir { getattr read };

3.  Pam_mount needs to be able to execute some commands in /sbin:
allow $1_su_t sbin_t:file { read execute };

4.  Pam_mount needs to be able to execute mount:
allow $1_su_t mount_exec_t:file { read execute };
allow $1_su_t $1_su_t:capability { fsetid };
domain_auto_trans($1_su_t, mount_exec_t, mount_t)

One problem I am having right now is that when pam_mount tries to execute
mount it fails with a "permission denied" error.  But I get no related
AVC log from SELinux.  If I disable SELinux's enforcing then I get no
error and everything works fine.

Other than that, I would like to hear any comments about the additional
requirements pam_mount has.  I am giving more capabilities to su and
therefore increasing risk.  Am I doing so in the right way?  Does anyone
have a better model to propose to accomplish this?

-- 
Mike

:wq

[Daniel J Walsh]

W. Michael Petullo wrote:

> As an exercise to help me learn the fundamentals of SELinux policies
> I
> am trying to get pam_mount to work one an enforcing SELinux system.
> Pam_mount is a module that allows password-protected volumes to be
> mounted when a user logs in using the users normal system password.
>
> Pam_mount requires several special capabilities and I have modified my
> su_macros.te to give them to the su command (its a start).
>
> 1.  Pam_mount needs be able to work in /var/run/pam_mount:
> allow $1_su_t var_run_t:dir { getattr add_name remove_name write };
> allow $1_su_t var_run_t:file { create getattr setattr read write lock unlink };
>   
>  
Look at the macros, You really want to create a transition rule that 
tells the kernel to create
files under a specific context in the /var/run directory.  So a rule like

var_run_domain($1_su) will create a $1_su_var_run_t context.

> 2.  Pam_mount needs to be able to read its configuration file:
> allow $1_su_t etc_runtime_t:file { getattr read };
> allow $1_su_t user_home_t:dir { getattr read };
>
> 3.  Pam_mount needs to be able to execute some commands in /sbin:
> allow $1_su_t sbin_t:file { read execute };
>
>   
>  
What files is it execing.  A better macro for execute privs is
can_exec($1_su_t, sbin_t)

> 4.  Pam_mount needs to be able to execute mount:
> allow $1_su_t mount_exec_t:file { read execute };
> allow $1_su_t $1_su_t:capability { fsetid };
> domain_auto_trans($1_su_t, mount_exec_t, mount_t)
>
>   
>  
domain_auto_trans will provide the first rule.

> One problem I am having right now is that when pam_mount tries to
> execute
> mount it fails with a "permission denied" error.  But I get no related
> AVC log from SELinux.  If I disable SELinux's enforcing then I get no
> error and everything works fine.
>
>   
>  
What is the mount point?  Is there a mounton rule for it?

> Other than that, I would like to hear any comments about the
> additional
> requirements pam_mount has.  I am giving more capabilities to su and
> therefore increasing risk.  Am I doing so in the right way?  Does anyone
> have a better model to propose to accomplish this?
>
>   
>

[W. Michael Petullo]

> > One problem I am having right now is that when pam_mount tries to
> execute
> > mount it fails with a "permission denied" error.  But I get no related
> > AVC log from SELinux.  If I disable SELinux's enforcing then I get no
> > error and everything works fine. 
>  What is the mount point?  Is there a mounton rule for it? 
The permission denied error is because pam_mount does not seem to have
permission to execute mount.

I added a mounton rule, but this did not solve my problem.  I am
especially confused by the fact that SELinux is not logging any failures.
I would expect an "avc: denied" error.  This feels like a traditional
Unix permissions issue but does not occur when SELinux is not enforcing
its policies.

-- 
Mike

:wq

[Colin Walters]

On Wed, 2004-04-14 at 17:50, W. Michael Petullo wrote:

>  I added a mounton rule, but this did not solve my problem.  I am
>  especially confused by the fact that SELinux is not logging any failures.
>  I would expect an "avc: denied" error.  This feels like a traditional
>  Unix permissions issue but does not occur when SELinux is not enforcing
>  its policies. 
There are a few things that SELinux will deny but not generate a log
message for.  is the big one.  That's bitten me in the past.

In your particular case, if pam_mount is being run before su transitions
to the sysadm_r role, then you'll probably get denials from user_r not
being authorized for the mount_t domain.

Solution:

role $1_r types mount_t;

[Colin Walters]

On Wed, 2004-04-14 at 19:21, Colin Walters wrote:
>  On Wed, 2004-04-14 at 17:50, W. Michael Petullo wrote:
>  
>  > I added a mounton rule, but this did not solve my problem.  I am
>  > especially confused by the fact that SELinux is not logging any failures.
>  > I would expect an "avc: denied" error.  This feels like a traditional
>  > Unix permissions issue but does not occur when SELinux is not enforcing
>  > its policies.
>  
>  There are a few things that SELinux will deny but not generate a log
>  message for.  is the big one.  That's bitten me in the past. 
              ^
Disallowed domain transitions

/me kicks Evolution's easy-to-accidentally-press Ctrl-RET keybinding...

[W. Michael Petullo]

[...]
> >1.  Pam_mount needs be able to work in /var/run/pam_mount:
> >allow $1_su_t var_run_t:dir { getattr add_name remove_name write };
> >allow $1_su_t var_run_t:file { create getattr setattr read write lock
> >unlink }; 
>  Look at the macros, You really want to create a transition rule that
>  tells the kernel to create
>  files under a specific context in the /var/run directory.  So a rule like 
         
                                                                      
>  var_run_domain($1_su) will create a $1_su_var_run_t context. 
I think I want to make a pam_mount context of some type.  This is
because login, gdm, su, etc. will all share the same /var/run/pam_mount.
But when I try to do something like "var_run_domain(pam_mount)" I get
the following errors on make load:

[...]
/usr/bin/checkpolicy -o /etc/security/selinux/policy.17 policy.conf
/usr/bin/checkpolicy:  loading policy configuration from policy.conf
domains/user.te:47:ERROR 'name conflict for type pam_mount_var_run_t' at token
';' on line 39900:
type pam_mount_var_run_t, file_type, sysadmfile, pidfile;
#line 47
/usr/bin/checkpolicy:  error(s) encountered while parsing configuration
[...]

Obviously, var_run_domain(pam_mount) is a reach.  Could someone explain
a little more about how that var_run_domain works?

[...]
> > I added a mounton rule, but this did not solve my problem.  I am
> > especially confused by the fact that SELinux is not logging any failures.
> > I would expect an "avc: denied" error.  This feels like a traditional
> > Unix permissions issue but does not occur when SELinux is not enforcing
> > its policies. 
[...]

[...]
>  Solution:
>
>  role $1_r types mount_t; 
[...]

The following does what I need:

domain_auto_trans($1_su_t, mount_exec_t, mount_t)
role $1_r types mount_t;

But out of curiosity, why does the domain_auto_trans statement not imply
the role statement?  Would you ever have a domain_auto_trans without
a role?

-- 
Mike

:wq

[W. Michael Petullo]

> > I added a mounton rule, but this did not solve my problem.  I am
> > especially confused by the fact that SELinux is not logging any failures.
> > I would expect an "avc: denied" error.  This feels like a traditional
> > Unix permissions issue but does not occur when SELinux is not enforcing
> > its policies. 
 
>  There are a few things that SELinux will deny but not generate a log
>  message for.  is the big one.  That's bitten me in the past.
>  
>  In your particular case, if pam_mount is being run before su transitions
>  to the sysadm_r role, then you'll probably get denials from user_r not
>  being authorized for the mount_t domain.
>  
>  Solution:
>  
>  role $1_r types mount_t; 
Great!  The pam_mount module is now working for me in enforcing mode.
Once I go through and clean things up I'll share my work.

Why would SELinux not log some denials?

-- 
Mike

:wq

[Daniel J Walsh]

W. Michael Petullo wrote:

> >>I added a mounton rule, but this did not solve my problem.  I
> am
> >>especially confused by the fact that SELinux is not logging any failures.
> >>I would expect an "avc: denied" error.  This feels like a traditional
> >>Unix permissions issue but does not occur when SELinux is not enforcing
> >>its policies.
> >>      
> >>
>  
>   
>
> >There are a few things that SELinux will deny but not generate a log
> >message for.  is the big one.  That's bitten me in the past.
> >
> >In your particular case, if pam_mount is being run before su transitions
> >to the sysadm_r role, then you'll probably get denials from user_r not
> >being authorized for the mount_t domain.
> >
> >Solution:
> >
> >role $1_r types mount_t;
> >    
> >
>
> Great!  The pam_mount module is now working for me in enforcing mode.
> Once I go through and clean things up I'll share my work.
>
> Why would SELinux not log some denials?
>   
>  
This is a bug in the kernel that has not been upstreamed yet.   
Hopefully it will fixed soon.
This type of think has burnt me several times also.

Dan

[Stephen Smalley]

On Wed, 2004-04-14 at 17:50, W. Michael Petullo wrote:
>  I added a mounton rule, but this did not solve my problem.  I am
>  especially confused by the fact that SELinux is not logging any failures.
>  I would expect an "avc: denied" error.  This feels like a traditional
>  Unix permissions issue but does not occur when SELinux is not enforcing
>  its policies. 
If you are trying to do this from user_r, then it will fail because the
user_r role is not presently authorized for the mount_t domain.  The
preferred approach would be to use the mount_domain() macro to define a
separate user_mount_t domain that is less privileged than the full
mount_t domain, and then authorize user_r for it.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency