1:29 p.m.
Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
now boots in strict/enforcing.
Many AVCs, and there is a problem
with runlevel 5 (graphical login, etc.) preventing
login, (but text login works).
Here are the first, early AVCs: (I'll dig for more later.)
Aug 28 10:23:40 fedora kernel: usbcore: registered new driver usblp
Aug 28 10:23:40 fedora kernel: drivers/usb/class/usblp.c: v0.13: USB
Printer Device Class driver
Aug 28 10:23:40 fedora acpid: acpid startup succeeded
Aug 28 10:23:40 fedora kernel: ACPI: Power Button (FF) [PWRF]
Aug 28 10:23:40 fedora kernel: ACPI: Sleep Button (CM) [FUTS]
Aug 28 10:23:40 fedora kernel: EXT3 FS on hda2, internal journal
Aug 28 10:23:41 fedora kernel: audit(1093713783.757:0): avc: denied {
search } for pid=1264 exe=/sbin/udev name=contexts dev=hda2 ino=4509745
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:default_context_t tclass=dir
Aug 28 10:23:41 fedora kernel: audit(1093713783.790:0): avc: denied {
execute_no_trans } for pid=1271 exe=/sbin/udev
path=/etc/udev/scripts/pam_console.dev dev=hda2 ino=574019
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:etc_t
tclass=file
Aug 28 10:23:41 fedora kernel: audit(1093713783.790:0): avc: denied {
write }
for pid=1264 exe=/sbin/udev name=fscreate dev=proc ino=82837526
scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t
tclass=file
There repeat many times. When run in permissive mode, this sequence
becomes:
Aug 28 10:32:25 fedora kernel: EXT3 FS on hda2, internal journal
Aug 28 10:32:25 fedora kernel: audit(1093714297.852:0): avc: denied {
search } for pid=1283 exe=/sbin/udev name=contexts dev=hda2 ino=4509745
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:default_context_t tclass=dir
Aug 28 10:32:25 fedora kernel: audit(1093714297.859:0): avc: denied {
search } for pid=1283 exe=/sbin/udev name=files dev=hda2 ino=4509746
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:file_context_t tclass=dir
Aug 28 10:32:25 fedora kernel: audit(1093714297.872:0): avc: denied {
read } for pid=1283 exe=/sbin/udev name=file_contexts dev=hda2
ino=4505700 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:file_context_t tclass=file
Aug 28 10:32:25 fedora kernel: audit(1093714297.872:0): avc: denied {
getattr
} for pid=1283 exe=/sbin/udev
path=/etc/selinux/strict/contexts/files/file_contexts dev=hda2
ino=4505700 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:file_context_t tclass=file
Aug 28 10:32:25 fedora kernel: audit(1093714298.077:0): avc: denied {
execute_no_trans } for pid=1285 exe=/sbin/udev
path=/etc/udev/scripts/pam_console.dev dev=hda2 ino=574019
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:etc_t
tclass=file
Aug 28 10:32:25 fedora kernel: audit(1093714298.109:0): avc: denied {
search } for pid=1285 exe=/bin/bash name=console dev=hda2 ino=4456494
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:pam_var_console_t tclass=dir
Aug 28 10:32:25 fedora kernel: audit(1093714298.113:0): avc: denied {
write }
for pid=1283 exe=/sbin/udev name=fscreate dev=proc ino=84082710
scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t
tclass=file
Aug 28 10:32:25 fedora kernel: audit(1093714298.113:0): avc: denied {
setfscreate } for pid=1283 exe=/sbin/udev
scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t
tclass=process
Aug 28 10:32:25 fedora kernel: audit(1093714317.126:0): avc: denied {
search } for pid=1671 exe=/sbin/udev name=files dev=hda2 ino=4509746
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:file_context_t tclass=dir
Audit2allow on this says:
allow : { write };
allow udev_t default_context_t:dir { search };
allow udev_t etc_t:file { execute_no_trans };
allow udev_t file_context_t:dir { search };
allow udev_t file_context_t:file { read };
allow udev_t pam_var_console_t:dir { search };
allow udev_t udev_t:process { setfscreate };
The funny 'allow : { write };' is for the write of 'fscreate' in /proc.
After obtaining the graphical login screen, here is the offending AVC:
Aug 28 10:24:42 fedora gdm(pam_unix)[3888]: session opened for user tbl
by (uid=0)
Aug 28 10:24:43 fedora kernel: audit(1093713883.626:0): avc: denied {
create } for pid=4042 exe=/usr/bin/dbus-daemon-1
scontext=user_u:user_r:user_t tcontext=user_u:user_r:user_t
tclass=netlink_selinux_socket
An error window pops up reporting an SELinux/AVC type failure. It then
returns to the login screen.
Just prior to that, there are many 'denied's from udev and hald. Here
are a few:
Aug 28 10:24:21 fedora dbus: avc: denied { send_msg } for
scontext=system_u:system_r:hald_t tcontext=system_u:system_r:updfstab_t
tclass=dbus
Aug 28 10:24:21 fedora kernel: audit(1093713853.755:0): avc: denied {
execute
} for pid=3466 exe=/usr/sbin/hald name=hal-hotplug-map dev=hda2
ino=606213 scontext=system_u:system_r:hald_t
tcontext=system_u:object_r:bin_t tclass=file
Aug 28 10:24:21 fedora udev[3953]: creating device node '/dev/vcs7'
Aug 28 10:24:22 fedora dbus: avc: denied { send_msg } for
scontext=system_u:system_r:hald_t tcontext=system_u:system_r:updfstab_t
tclass=dbus
Aug 28 10:24:22 fedora kernel: audit(1093713853.817:0): avc: denied {
search } for pid=3798 exe=/sbin/udev name=contexts dev=hda2 ino=4509745
scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:default_context_t tclass=dir
Aug 28 10:24:22 fedora dbus: avc: denied { send_msg } for
scontext=system_u:system_r:hald_t tcontext=system_u:system_r:updfstab_t
tclass=dbus
Aug 28 10:24:22 fedora kernel: audit(1093713853.819:0): avc: denied {
execute_no_trans } for pid=3846 exe=/sbin/udev
path=/etc/udev/scripts/pam_console.dev dev=hda2 ino=574019
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:etc_t
tclass=file
Aug 28 10:24:22 fedora dbus: avc: denied { send_msg } for
scontext=system_u:system_r:updfstab_t tcontext=system_u:system_r:hald_t
tclass=dbus
Aug 28 10:24:22 fedora kernel: audit(1093713853.820:0): avc: denied {
write }
for pid=3798 exe=/sbin/udev name=fscreate dev=proc ino=248905750
scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t
tclass=file
[BTW: When I reboot, /etc/fstab has been relabeled to type tmp_t.
Is the above causing this?]
I rebooted strict/permissive, and things appear OK, including loading
of sound modules.
However, as noted above, something is relabeling /etc/fstab to tmp_t:
Aug 28 10:33:21 fedora gdm(pam_unix)[3786]: session opened for user tbl
by (uid=0)
Aug 28 10:33:21 fedora kernel: audit(1093714401.349:0): avc: denied {
read } for pid=3786 exe=/usr/bin/gdm-binary name=fstab dev=hda2
ino=4654141 scontext=system_u:system_r:xdm_t
tcontext=system_u:object_r:tmp_t tclass=file
Aug 28 10:33:21 fedora kernel: audit(1093714401.350:0): avc: denied {
getattr
} for pid=3786 exe=/usr/bin/gdm-binary path=/etc/fstab dev=hda2
ino=4654141 scontext=system_u:system_r:xdm_t
tcontext=system_u:object_r:tmp_t tclass=file
I believe I'm running a 'stock' Rawhide system.
tom
2:37 a.m.
On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net> wrote:
Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
now boots in strict/enforcing.
I've attached a diff against the CVS policy as well as the .te and .fc files
for udev changes which fix this and address some other issues as well.
Please try it out and let me know how it goes.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
5:06 a.m.
btw i didn't see an acknowledgement from the person who sent the
last udev patch (dan was it you?)
the use of the "mode" argument it is clear has not been used,
to call i think it was matchpathcon.
instead, because i had three near-identical code portions all
of which had different S_IFXXX thingies, dan-i-think-it-was
moved the near-identical code into a function with a "mode"
argument...
... and forgot to use the "mode" argument such that matchpathcon
is called with S_IFDIR.
given that i haven't seen an acknowledgement of this issue
either in my inbox or on the mailing lists (which i am checking
manually) i thought it best to hassle people until i know it's
been spotted.
this is IMPORTANT because it will impact the contexts on
inodes and stuff created in /dev: the "optimising" argument
"mode" passed to matchpathcon and setfscreatecon, if wrong,
results in relevant (and correct!) file_context entries being
skipped!
l.
On Sun, Aug 29, 2004 at 05:37:17PM +1000, Russell Coker wrote:
On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net>
wrote:
> Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
> kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
> now boots in strict/enforcing.
I've attached a diff against the CVS policy as well as the .te and .fc files
for udev changes which fix this and address some other issues as well.
1:17 p.m.
Luke Kenneth Casson Leighton wrote:
btw i didn't see an acknowledgement from the person who sent the
last udev patch (dan was it you?)
the use of the "mode" argument it is clear has not been used,
to call i think it was matchpathcon.
instead, because i had three near-identical code portions all
of which had different S_IFXXX thingies, dan-i-think-it-was
moved the near-identical code into a function with a "mode"
argument...
... and forgot to use the "mode" argument such that matchpathcon
is called with S_IFDIR.
given that i haven't seen an acknowledgement of this issue
either in my inbox or on the mailing lists (which i am checking
manually) i thought it best to hassle people until i know it's
been spotted.
this is IMPORTANT because it will impact the contexts on
inodes and stuff created in /dev: the "optimising" argument
"mode" passed to matchpathcon and setfscreatecon, if wrong,
results in relevant (and correct!) file_context entries being
skipped!
l.
On Sun, Aug 29, 2004 at 05:37:17PM +1000, Russell Coker wrote:
>On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net> wrote:
>
>
>>Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>>kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>>now boots in strict/enforcing.
>>
>>
>I've attached a diff against the CVS policy as well as the .te and .fc files
>for udev changes which fix this and address some other issues as well.
>
>
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/fedora-selinux-list
Yes it was me and I modified out udev rpm, but I guess I never
responded. Sorry about that.
Luke thanks for the fix.
Dan
--- udev-030/Makefile.selinux 2004-07-09 13:59:09.000000000 -0400
+++ udev-030/Makefile 2004-08-27 09:28:25.000000000 -0400
@@ -25,6 +25,8 @@
# Leave this set to `false' for production use.
DEBUG = false
+# Set this to compile with Security-Enhanced Linux support.
+USE_SELINUX = true
ROOT = udev
DAEMON = udevd
@@ -172,6 +174,11 @@
CFLAGS += -I$(PWD)/libsysfs
+ifeq ($(strip $(USE_SELINUX)),true)
+ CFLAGS += -DUSE_SELINUX
+ LIB_OBJS += -lselinux
+endif
+
all: $(ROOT) $(SENDER) $(DAEMON) $(INFO) $(TESTER) $(STARTER)
@extras="$(EXTRAS)" ; for target in $$extras ; do \
echo $$target ; \
@@ -216,6 +223,7 @@
udevdb.h \
klibc_fixups.h \
logging.h \
+ selinux.h \
list.h
ifeq ($(strip $(USE_KLIBC)),true)
--- udev-030/selinux.h.selinux 2004-08-27 15:27:32.211405217 -0400
+++ udev-030/selinux.h 2004-08-27 15:26:31.620370476 -0400
@@ -0,0 +1,80 @@
+#ifndef SELINUX_H
+#define SELINUX_H
+
+#ifndef USE_SELINUX
+
+static inline void selinux_setfilecon(char *file, unsigned int mode) { }
+static inline void selinux_setfscreatecon(char *file, unsigned int mode) {}
+static inline void selinux_init(void) {}
+static inline void selinux_restore(void) {}
+
+#else
+
+#include <selinux/selinux.h>
+
+static int selinux_enabled=-1;
+static security_context_t prev_scontext=NULL;
+
+static inline int is_selinux_running(void) {
+ if ( selinux_enabled==-1 )
+ return selinux_enabled=is_selinux_enabled()>0;
+ return selinux_enabled;
+}
+static inline void selinux_setfilecon(char *file, unsigned int mode) {
+ if (is_selinux_running()) {
+ security_context_t scontext=NULL;
+ if (matchpathcon(file, mode, &scontext) < 0) {
+ dbg("matchpathcon(%s) failed\n", file);
+ } else {
+
+ if (setfilecon(file, scontext) < 0)
+ dbg("setfiles %s failed with error '%s'",
+ file, strerror(errno));
+ freecon(scontext);
+ }
+ }
+}
+
+static inline void selinux_setfscreatecon(char *file, unsigned int mode) {
+ int retval = 0;
+ security_context_t scontext=NULL;
+
+ if (is_selinux_running()) {
+ if (matchpathcon(file, mode, &scontext) < 0) {
+ dbg("matchpathcon(%s) failed\n", file);
+ } else {
+ retval=setfscreatecon(scontext);
+ if (retval < 0)
+ dbg("setfiles %s failed with error '%s'",
+ file, strerror(errno));
+ freecon(scontext);
+ }
+ }
+}
+static inline void selinux_init(void) {
+ /* record the present security context, for file-creation
+ * restoration creation purposes.
+ *
+ */
+
+ if (is_selinux_running())
+ {
+ if (getfscreatecon(&prev_scontext) < 0) {
+ dbg("getfscreatecon failed\n");
+ }
+ prev_scontext=NULL;
+ }
+}
+static inline void selinux_restore(void) {
+ if (is_selinux_running()) {
+ /* reset the file create context to its former glory */
+ if ( setfscreatecon(prev_scontext) < 0 )
+ dbg("setfscreatecon failed\n");
+ if (prev_scontext) {
+ freecon(prev_scontext);
+ prev_scontext=NULL;
+ }
+ }
+}
+#endif /* USE_SELINUX */
+#endif /* SELINUX_H */
--- udev-030/udev-add.c.selinux 2004-08-26 13:06:56.000000000 -0400
+++ udev-030/udev-add.c 2004-08-26 14:16:05.000000000 -0400
@@ -50,6 +50,8 @@
#define LOCAL_USER "$local"
+#include "selinux.h"
+
/*
* Right now the major/minor of a device is stored in a file called
* "dev" in sysfs.
@@ -92,6 +94,7 @@
break;
*pos = 0x00;
if (stat(p, &stats)) {
+ selinux_setfscreatecon(p, S_IFDIR);
retval = mkdir(p, 0755);
if (retval != 0) {
dbg("mkdir(%s) failed with error '%s'",
@@ -117,6 +120,7 @@
if (((stats.st_mode & S_IFMT) == S_IFBLK || (stats.st_mode & S_IFMT) == S_IFCHR)
&&
(stats.st_rdev == makedev(major, minor))) {
dbg("preserve file '%s', cause it has correct dev_t", file);
+ selinux_setfilecon(file,stats.st_mode);
if (udev_preserve_owner)
goto exit;
else
@@ -129,6 +133,7 @@
dbg("already present file '%s' unlinked", file);
create:
+ selinux_setfscreatecon(file, mode);
retval = mknod(file, mode, makedev(major, minor));
if (retval != 0) {
dbg("mknod(%s, %#o, %u, %u) failed with error '%s'",
@@ -307,6 +312,7 @@
dbg("symlink(%s, %s)", linktarget, filename);
if (!fake) {
+ selinux_setfscreatecon(filename, S_IFLNK);
unlink(filename);
if (symlink(linktarget, filename) != 0)
dbg("symlink(%s, %s) failed with error '%s'",
@@ -441,6 +447,7 @@
dbg("name='%s'", dev.name);
+ selinux_init();
switch (dev.type) {
case 'b':
case 'c':
@@ -478,6 +485,7 @@
}
exit:
+ selinux_restore();
sysfs_close_class_device(class_dev);
return retval;
4:16 p.m.
On Mon, Aug 30, 2004 at 02:17:30PM -0400, Daniel J Walsh wrote:
Luke Kenneth Casson Leighton wrote:
>btw i didn't see an acknowledgement from the person who sent the
>last udev patch (dan was it you?)
>
>the use of the "mode" argument it is clear has not been used,
>to call i think it was matchpathcon.
>
>instead, because i had three near-identical code portions all
>of which had different S_IFXXX thingies, dan-i-think-it-was
>moved the near-identical code into a function with a "mode"
>argument...
>
>... and forgot to use the "mode" argument such that matchpathcon
>is called with S_IFDIR.
>
>given that i haven't seen an acknowledgement of this issue
>either in my inbox or on the mailing lists (which i am checking
>manually) i thought it best to hassle people until i know it's
>been spotted.
>
>this is IMPORTANT because it will impact the contexts on
>inodes and stuff created in /dev: the "optimising" argument
>"mode" passed to matchpathcon and setfscreatecon, if wrong,
>results in relevant (and correct!) file_context entries being
>skipped!
>
>l.
>
>On Sun, Aug 29, 2004 at 05:37:17PM +1000, Russell Coker wrote:
>
>
>
>>On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net> wrote:
>>
>>
>>>Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>>>kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>>>now boots in strict/enforcing.
>>>
>>>
>>I've attached a diff against the CVS policy as well as the .te and .fc
>>files for udev changes which fix this and address some other issues as
>>well.
>>
>>
>--
>fedora-selinux-list mailing list
>fedora-selinux-list(a)redhat.com
>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>
Yes it was me and I modified out udev rpm, but I guess I never
responded. Sorry about that.
not a problem, just making sure.
i have to manually check the fedora-selinux list: if you did i
must have missed it.
*whew*.
l.
2:32 p.m.
Russell,
Thanks, but it didn't quite work. The following change to dbusd.te seems
to make graphical login work under strict/enforcing.
Please correct/improve... :)
tom
--- /root/src.package/policy/domains/program/dbusd.te 2004-08-29
11:38:27.000000000 -0700
+++ dbusd.te 2004-08-29 12:19:25.000000000 -0700
@@ -32,3 +32,7 @@
# SE-DBus specific permissions
allow { dbus_client_domain userdomain } { dbusd_t self }:dbus { send_msg };
+
+allow user_t etc_dbusd_t:dir { search };
+allow user_t etc_dbusd_t:file { getattr read };
+allow user_t user_t:netlink_selinux_socket { bind create };
Russell Coker wrote:
On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net>
wrote:
>Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>now boots in strict/enforcing.
>
>
I've attached a diff against the CVS policy as well as the .te and .fc files
for udev changes which fix this and address some other issues as well.
Please try it out and let me know how it goes.
3:59 p.m.
On Sun, 2004-08-29 at 12:32 -0700, Tom London wrote:
Russell,
Thanks, but it didn't quite work. The following change to dbusd.te seems
to make graphical login work under strict/enforcing.
I think we need to rework the dbusd.te to break it into dbusd_system_t
and dbusd_{user,staff}_t.
1:37 a.m.
On Mon, 30 Aug 2004 05:32, Tom London <selinux(a)comcast.net> wrote:
--- /root/src.package/policy/domains/program/dbusd.te 2004-08-29
11:38:27.000000000 -0700
+++ dbusd.te 2004-08-29 12:19:25.000000000 -0700
@@ -32,3 +32,7 @@
# SE-DBus specific permissions
allow { dbus_client_domain userdomain } { dbusd_t self }:dbus { send_msg
}; +
+allow user_t etc_dbusd_t:dir { search };
+allow user_t etc_dbusd_t:file { getattr read };
+allow user_t user_t:netlink_selinux_socket { bind create };
One thing to remember is that any time you see user_t in policy it's a local
customisation or a bug.
In this case it seems to me that one correct way of writing policy for this is
the following:
allow { dbus_client_domain userdomain } etc_dbusd_t:dir { search };
allow { dbus_client_domain userdomain } etc_dbusd_t:file { getattr read };
allow { dbus_client_domain userdomain } user_t:netlink_selinux_socket { bind
create };
But then we are granting almost every domain that has any significance in the
security of the system read access. So why not just label the files as etc_t
and remove the etc_dbusd_t type entirely?
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
6:33 a.m.
On Wed, 2004-09-01 at 02:37, Russell Coker wrote:
One thing to remember is that any time you see user_t in policy
it's a local
customisation or a bug.
In this case it seems to me that one correct way of writing policy for this is
the following:
allow { dbus_client_domain userdomain } etc_dbusd_t:dir { search };
allow { dbus_client_domain userdomain } etc_dbusd_t:file { getattr read };
allow { dbus_client_domain userdomain } user_t:netlink_selinux_socket { bind
create };
But then we are granting almost every domain that has any significance in the
security of the system read access. So why not just label the files as etc_t
and remove the etc_dbusd_t type entirely?
These permissions shouldn't be granted directly to the user domains. We
need per-userdomain dbusd domains defined via a macro for the
per-session message bus.
--
Stephen Smalley <sds(a)epoch.ncsc.mil>
National Security Agency
6:52 a.m.
On Wed, 2004-09-01 at 07:33, Stephen Smalley wrote:
These permissions shouldn't be granted directly to the user
domains. We
need per-userdomain dbusd domains defined via a macro for the
per-session message bus.
BTW, note that in the rawhide policy, Dan (or someone) has added a
domain_auto_trans(userdomain, dbusd_exec_t, dbusd_t) to dbusd.te as a
workaround so that the per-session bus daemons also run in dbusd_t, but
that isn't truly what we want in the long term.
--
Stephen Smalley <sds(a)epoch.ncsc.mil>
National Security Agency
2:53 p.m.
Russell,
The following changes to udev.te seem needed....
(If udev shouldn't be reading file_contexts, then dontaudit?)
Please correct/improve,
tom
--- /tmp/patches/udev.te 2004-08-29 11:35:48.000000000 -0700
+++ udev.te 2004-08-29 12:40:58.000000000 -0700
@@ -44,7 +44,9 @@
# to read the file_contexts file
allow udev_t { selinux_config_t default_context_t }:dir search;
-allow udev_t default_context_t:file { getattr read };
+allow udev_t { selinux_config_t default_context_t }:file { getattr read };
+allow udev_t file_context_t:dir { search };
+allow udev_t file_context_t:file { getattr read };
allow udev_t policy_config_t:dir { search };
allow udev_t proc_t:file { read };
Russell Coker wrote:
On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net>
wrote:
>Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>now boots in strict/enforcing.
>
>
I've attached a diff against the CVS policy as well as the .te and .fc files
for udev changes which fix this and address some other issues as well.
Please try it out and let me know how it goes.
1:20 p.m.
Tom London wrote:
Russell,
The following changes to udev.te seem needed....
(If udev shouldn't be reading file_contexts, then dontaudit?)
udev needs to read file_contexts. It is doing a matchpathcon in order
to setup the devices with the correct context.
Please correct/improve,
tom
--- /tmp/patches/udev.te 2004-08-29 11:35:48.000000000 -0700
+++ udev.te 2004-08-29 12:40:58.000000000 -0700
@@ -44,7 +44,9 @@
# to read the file_contexts file
allow udev_t { selinux_config_t default_context_t }:dir search;
-allow udev_t default_context_t:file { getattr read };
+allow udev_t { selinux_config_t default_context_t }:file { getattr
read };
+allow udev_t file_context_t:dir { search };
+allow udev_t file_context_t:file { getattr read };
allow udev_t policy_config_t:dir { search };
allow udev_t proc_t:file { read };
Russell Coker wrote:
> On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net> wrote:
>
>
>> Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>> kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>> now boots in strict/enforcing.
>>
>
>
> I've attached a diff against the CVS policy as well as the .te and
> .fc files for udev changes which fix this and address some other
> issues as well.
>
> Please try it out and let me know how it goes.
>
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
http://www.redhat.com/mailman/listinfo/fedora-selinux-list
3:33 p.m.
On Mon, Aug 30, 2004 at 02:20:32PM -0400, Daniel J Walsh wrote:
Tom London wrote:
>Russell,
>
>The following changes to udev.te seem needed....
>(If udev shouldn't be reading file_contexts, then dontaudit?)
>
udev needs to read file_contexts. It is doing a matchpathcon in order
to setup the devices with the correct context.
dan, dan, you MUST fix the bug in that patch before making changes to
the selinux policy files for udev!!!
matchpathcon() is being called with S_IFDIR not with the mode argument!
l.
3:42 p.m.
Thanks Russell and Tom. Merged into sourceforge policy using
r_dir_file() for selinux_config_t, file_context_t, and
default_context_t.
Showing only the part changed from Russell's patch:
--- domains/program/unused/udev.te 27 Aug 2004 13:14:05 -0000 1.17
+++ domains/program/unused/udev.te 30 Aug 2004 19:36:44 -0000
@@ -32,19 +31,19 @@
allow udev_t device_t:blk_file create_file_perms;
allow udev_t device_t:chr_file create_file_perms;
allow udev_t device_t:sock_file create_file_perms;
-allow udev_t etc_t:file { getattr read execute };
+allow udev_t device_t:lnk_file create_lnk_perms;
+allow udev_t etc_t:file { getattr read };
allow udev_t { bin_t sbin_t }:dir r_dir_perms;
allow udev_t { sbin_t bin_t }:lnk_file read;
-can_exec(udev_t, { shell_exec_t bin_t sbin_t } )
+allow udev_t bin_t:lnk_file read;
+can_exec(udev_t, { shell_exec_t bin_t sbin_t etc_t } )
can_exec(udev_t, udev_exec_t)
-can_exec(udev_t, hostname_exec_t)
-can_exec(udev_t, iptables_exec_t)
r_dir_file(udev_t, sysfs_t)
allow udev_t sysadm_tty_device_t:chr_file { read write };
allow udev_t { device_t device_type }:{chr_file blk_file} { relabelfrom relabelto
create_file_perms };
-# to read the file_contexts file?
-r_dir_file(udev_t, policy_config_t)
+# to read the file_contexts file
+r_dir_file(udev_t, { selinux_config_t file_context_t default_context_t } )
allow udev_t policy_config_t:dir { search };
allow udev_t proc_t:file { read };
On Sun, 2004-08-29 at 15:53, Tom London wrote:
Russell,
The following changes to udev.te seem needed....
(If udev shouldn't be reading file_contexts, then dontaudit?)
Please correct/improve,
tom
--- /tmp/patches/udev.te 2004-08-29 11:35:48.000000000 -0700
+++ udev.te 2004-08-29 12:40:58.000000000 -0700
@@ -44,7 +44,9 @@
# to read the file_contexts file
allow udev_t { selinux_config_t default_context_t }:dir search;
-allow udev_t default_context_t:file { getattr read };
+allow udev_t { selinux_config_t default_context_t }:file { getattr read };
+allow udev_t file_context_t:dir { search };
+allow udev_t file_context_t:file { getattr read };
allow udev_t policy_config_t:dir { search };
allow udev_t proc_t:file { read };
Russell Coker wrote:
>On Sun, 29 Aug 2004 04:29, Tom London <selinux(a)comcast.net> wrote:
>
>
>>Newest Rawhide updates (including udev-030-10, mkinitrd-4.1.8-1,
>>kernel-2.6.8-1.532, and selinux-policy-strict-1.17.5-2)
>>now boots in strict/enforcing.
>>
>>
>
>I've attached a diff against the CVS policy as well as the .te and .fc files
>for udev changes which fix this and address some other issues as well.
>
>Please try it out and let me know how it goes.
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo(a)tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
--
James Carter <jwcart2(a)epoch.ncsc.mil>
National Security Agency
7175
days inactive
7179
days old
selinux@lists.fedoraproject.org
13 comments
7 participants
participants (7)
-
Colin Walters -
Daniel J Walsh -
James Carter -
Luke Kenneth Casson Leighton -
Russell Coker -
Stephen Smalley -
Tom London