fixfile.cron added.

[Daniel J Walsh]

Todays policycoreutils has a new cron job, fixfiles.cron, that will run 
in /etc/cron.daily.   This script will run a check on the file system on 
a daily basis looking for file contexts in the wrong state.  It will 
them mail a list of files with the incorrect context to the root account. 

The following environment variables are set and can be overridden in the 
/etc/selinux/config directory.

CRONTYPE="check"  # You could change this to "restore" to have the 
script automatically clean up
INVALIDFILE=/var/tmp/badcontext # Name of the file to store the 
badcontext file list
CRONMAILTO="root"  # Account to send mail to

Suggestions on improvements?  Comments?

Dan

[Jeremy Katz]

On Thu, 2004-07-01 at 08:14 -0400, Daniel J Walsh wrote:
>  INVALIDFILE=/var/tmp/badcontext # Name of the file to store the 
>  badcontext file list 
[snip]
>  Suggestions on improvements?  Comments? 
This need to be mkstemp'd.  Otherwise, you have a nice little race that
I can use for causing all sorts of havoc :)

Jeremy

/sbin/fixfiles bug (was Re: fixfile.cron added.

On Thu, 01 Jul 2004 08:14:09 EDT, Daniel J Walsh <dwalsh(a)redhat.com&gt;  said:
>  Todays policycoreutils has a new cron job, fixfiles.cron, that will
> run 
>  in /etc/cron.daily.   This script will run a check on the file system on  
>  Suggestions on improvements?  Comments? 
(I'd bugzilla this but I'm offline as I write this)

FC2 devel tree, with policycoreutils-1.14.1-1

The cronjob tosses a few error messages due to a fixfiles bug:

/etc/cron.daily/fixfiles.cron:

/sbin/fixfiles: line 111: [: =: unary operator expected
/sbin/fixfiles: line 111: [: =: unary operator expected
logging to /var/tmp/fixfiles.WBgGN24978

Patch follows:

% diff -up /sbin/fixfiles.dist /sbin/fixfiles
--- /sbin/fixfiles.dist 2004-06-30 13:40:47.000000000 -0400
+++ /sbin/fixfiles      2004-07-03 13:22:59.403549435 -0400
@@ -30,6 +30,7 @@ rpmFlag=0
 rpmFiles=""
 outfileFlag=0
 OUTFILES=""
+logfileFlag=0
 LOGFILE=`mktemp /var/tmp/fixfiles.XXXXXXXXXX`  || exit 1
 SETFILES=/usr/sbin/setfiles
 FILESYSTEMS=`mount | grep -v "context=" | egrep -v
'\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*rw/{print
$3}';`


I also need to figure out why /var/tmp/badcontexts seems to be
totally broken.  In the run-parts output, setfiles says for /var:

/usr/sbin/setfiles:  labeling files under /var
/usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/TOC/464 from
root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t
/usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/index/464 from
root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t
/usr/sbin/setfiles:  relabeling /var/run/lpd.515 from system_u:object_r:lpd_var_run_t to
system_u:object_r:var_run_t
/usr/sbin/setfiles:  relabeling /var/run/lprng from system_u:object_r:var_run_t to
system_u:object_r:lpd_var_run_t
/usr/sbin/setfiles:  hash table stats: 1264 elements, 1264/65536 buckets used, longest
chain len

OK... So I have 4 files with context issues on /var (which is an issue in and
of itself, but not the point here. badfilecontexts however contains:

/var/lib/rpm/__db.001
/var/lib/rpm/__db.002
/var/lib/rpm/__db.003
/var/lib/alternatives/print
/var/lib/scrollkeeper/TOC/495
/var/lib/scrollkeeper/TOC/496
/var/lib/scrollkeeper/TOC/497
/var/lib/scrollkeeper/TOC/498
/var/lib/scrollkeeper/TOC/499
<<many lines elided>>
/var/lib/scrollkeeper/TOC/528
/var/lib/scrollkeeper/TOC/529
/var/lib/scrollkeeper/TOC/464
/var/lib/scrollkeeper/index/495
/var/lib/scrollkeeper/index/496
/var/lib/scrollkeeper/index/497
<more lines elided>>
/var/lib/scrollkeeper/index/529
/var/lib/scrollkeeper/index/464
/var/lib/scrollkeeper/scrollkeeper_docs
/var/lib/texmf/ls-R
/var/cache/man/cat8/grub-install.8.bz2
/var/cache/man/cat8/acpid.8.bz2
/var/lock/subsys/psacct
/var/lock/rpm/transaction
/var/run/lpd.515
/var/run/lprng

Total output of the relabelling is about 150 lines, but /var/tmp/badcontexts
is 86,978 lines, many of which make no sense at all (for instance,
it flagged apparently every single file in my Linux kernel source trees
for no apparent reason - consider the following spot check:

# egrep 'linux[^/]*/Makefile$' /var/tmp/badcontext
/usr/src/linux-2.6.7-mm4/Makefile
/usr/src/linux-2.6.7-mm5/security/selinux/Makefile
/usr/src/linux-2.6.7-mm5/Makefile
/usr/src/linux-2.6.7-mm3/Makefile
# ls -l --context /usr/src/linux-2.6.7-mm[345]/Makefile
/usr/src/linux-2.6.7-mm5/security/selinux/Makefile
-rw-r--r--  valdis   valdis   system_u:object_r:src_t         
/usr/src/linux-2.6.7-mm3/Makefile
-rw-r--r--  valdis   valdis   system_u:object_r:src_t         
/usr/src/linux-2.6.7-mm4/Makefile
-rw-r--r--  valdis   valdis   system_u:object_r:src_t         
/usr/src/linux-2.6.7-mm5/Makefile
-rw-r--r--  valdis   valdis   system_u:object_r:src_t         
/usr/src/linux-2.6.7-mm5/security/selinux/Makefile

When actually relabelling, fixfiles doesn't see anything wrong with
these 4 Makefiles...

/sbin/fixfiles bug (was Re: fixfile.cron added.

[Russell Coker]

On Sun, 4 Jul 2004 03:47, Valdis.Kletnieks(a)vt.edu wrote:
>  /usr/sbin/setfiles:  labeling files under /var
>  /usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/TOC/464 from
>  root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t
>  /usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/index/464 from
>  root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t 
It seems that rpm_var_lib_t doesn't differ much in access from var_lib_t.  I 
think that it would be appropriate to remove the line var_lib_domain(rpm) and 
allow the rpm files in question to have type var_lib_t.

Dan, what do you think?

Of course we have another problem in that rpm_t should not be creating such 
files, the script which does so should run as rpm_script_t.

>  /usr/sbin/setfiles:  relabeling /var/run/lpd.515 from
>  system_u:object_r:lpd_var_run_t to system_u:object_r:var_run_t 
What is this lpd.515 file?  Is that always the name for it?  We need to get a 
matching entry in lpd.fc.

>  /usr/sbin/setfiles:  relabeling /var/run/lprng from
>  system_u:object_r:var_run_t to system_u:object_r:lpd_var_run_t
>  /usr/sbin/setfiles:  hash table stats: 1264 elements, 1264/65536 buckets
>  used, longest chain len 
How is this created?  Does an init.d script run mkdir?

>  OK... So I have 4 files with context issues on /var (which is an
> issue in
>  and of itself, but not the point here. badfilecontexts however contains:
>
>  /var/lib/rpm/__db.001
>  /var/lib/rpm/__db.002
>  /var/lib/rpm/__db.003 
What is the context of these?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

/sbin/fixfiles bug (was Re: fixfile.cron added.

[Daniel J Walsh]

Russell Coker wrote:

> On Sun, 4 Jul 2004 03:47, Valdis.Kletnieks(a)vt.edu wrote:
>   
>
> >/usr/sbin/setfiles:  labeling files under /var
> >/usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/TOC/464 from
> >root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t
> >/usr/sbin/setfiles:  relabeling /var/lib/scrollkeeper/index/464 from
> >root:object_r:rpm_var_lib_t to system_u:object_r:var_lib_t
> >    
> >
>
> It seems that rpm_var_lib_t doesn't differ much in access from var_lib_t.  I 
> think that it would be appropriate to remove the line var_lib_domain(rpm) and 
> allow the rpm files in question to have type var_lib_t.
>
> Dan, what do you think?
>   
>  
I agree.

> Of course we have another problem in that rpm_t should not be creating
> such 
> files, the script which does so should run as rpm_script_t.
>
>   
>  
Don't know why.

> >/usr/sbin/setfiles:  relabeling /var/run/lpd.515 from
> >system_u:object_r:lpd_var_run_t to system_u:object_r:var_run_t
> >    
> >
>
> What is this lpd.515 file?  Is that always the name for it?  We need to get a 
> matching entry in lpd.fc.
>   
>  
Added

/var/run/lpd.*            system_u:object_r:lpd_var_run_t

>   
>
> >/usr/sbin/setfiles:  relabeling /var/run/lprng from
> >system_u:object_r:var_run_t to system_u:object_r:lpd_var_run_t
> >/usr/sbin/setfiles:  hash table stats: 1264 elements, 1264/65536 buckets
> >used, longest chain len
> >    
> >
>
> How is this created?  Does an init.d script run mkdir?
>
>   
>
> >OK... So I have 4 files with context issues on /var (which is an issue in
> >and of itself, but not the point here. badfilecontexts however contains:
> >
> >/var/lib/rpm/__db.001
> >/var/lib/rpm/__db.002
> >/var/lib/rpm/__db.003
> >    
> >
>
> What is the context of these?
>
>   
>
> ------------------------------------------------------------------------
>
> # bootloader
> /etc/lilo\.conf.*	--	system_u:object_r:bootloader_etc_t
> /initrd\.img.*		-l	system_u:object_r:boot_t
> /sbin/lilo.*		--	system_u:object_r:bootloader_exec_t
> /sbin/grub.*		--	system_u:object_r:bootloader_exec_t
> /vmlinuz.*		-l	system_u:object_r:boot_t
> /usr/sbin/mkinitrd	--	system_u:object_r:bootloader_exec_t
> /sbin/mkinitrd		--	system_u:object_r:bootloader_exec_t
> /etc/mkinitrd/scripts/.* --	system_u:object_r:bootloader_exec_t
> /sbin/ybin.*		--	system_u:object_r:bootloader_exec_t
> /etc/yaboot\.conf.*	--	system_u:object_r:bootloader_etc_t
> /boot/grub/menu.lst	--	system_u:object_r:boot_runtime_t
>   
>
> ------------------------------------------------------------------------
>
> #DESC Initrc - System initialization scripts
> #
> # Authors:  Stephen Smalley <sds(a)epoch.ncsc.mil&gt; and Timothy Fraser  
> # X-Debian-Packages: sysvinit policycoreutils
> #
>
> #################################
> #
> # Rules for the initrc_t domain.
> #
> # initrc_t is the domain of the init rc scripts.
> # initrc_exec_t is the type of the init program.
> #
> ifdef(`sendmail.te', `
> # do not use privmail for sendmail as it creates a type transition conflict
> type initrc_t, ifdef(`unlimitedServices', `admin, etc_writer, fs_domain, privmem,
> auth_write, ') domain, privlog, privowner, privmodule, sysctl_kernel_writer;
> allow system_mail_t initrc_t:fd use;
> allow system_mail_t initrc_t:fifo_file write;
> ', `
> type initrc_t, ifdef(`unlimitedServices', `admin, etc_writer, fs_domain,
> privmem,auth_write, ') domain, privlog, privowner, privmodule, sysctl_kernel_writer,
> privmail;
> ')
> role system_r types initrc_t;
> uses_shlib(initrc_t);
> can_ypbind(initrc_t)
> type initrc_exec_t, file_type, sysadmfile, exec_type;
>
> # for halt to down interfaces
> allow initrc_t self:udp_socket create_socket_perms;
>
> # read files in /etc/init.d
> allow initrc_t etc_t:lnk_file r_file_perms;
>
> read_locale(initrc_t)
>
> r_dir_file(initrc_t, usr_t)
>
> # Read system information files in /proc.
> allow initrc_t proc_t:dir r_dir_perms;
> allow initrc_t proc_t:{ file lnk_file } r_file_perms;
>
> # Allow IPC with self
> allow initrc_t self:unix_dgram_socket create_socket_perms;
> allow initrc_t self:unix_stream_socket { connectto create_stream_socket_perms };
> allow initrc_t self:fifo_file rw_file_perms;
>
> # Read the root directory of a usbdevfs filesystem, and
> # the devices and drivers files.  Permit stating of the
> # device nodes, but nothing else.
> allow initrc_t usbdevfs_t:dir r_dir_perms;
> allow initrc_t usbdevfs_t:lnk_file r_file_perms;
> allow initrc_t usbdevfs_t:file getattr;
>
> # allow initrc to fork and renice itself
> allow initrc_t self:process { fork sigchld setsched setpgid setrlimit };
>
> # Can create ptys for open_init_pty
> can_create_pty(initrc)
>
> tmp_domain(initrc)
>
> var_run_domain(initrc)
> allow initrc_t var_run_t:{ file sock_file lnk_file } unlink;
> allow initrc_t var_run_t:dir { create rmdir };
>
> allow initrc_t framebuf_device_t:chr_file r_file_perms;
>
> # Use capabilities.
> allow initrc_t self:capability ~{ sys_admin sys_module };
>
> # Use system operations.
> allow initrc_t kernel_t:system *;
>
> # Set values in /proc/sys.
> can_sysctl(initrc_t)
>
> # Run helper programs in the initrc_t domain.
> allow initrc_t {bin_t sbin_t }:dir r_dir_perms;
> allow initrc_t {bin_t sbin_t }:lnk_file read;
> can_exec(initrc_t, etc_t)
> can_exec(initrc_t, lib_t)
> can_exec(initrc_t, bin_t)
> can_exec(initrc_t, sbin_t)
> can_exec(initrc_t, exec_type)
> #
> #  These rules are here to allow init scripts to su
> #
> ifdef(`su.te', `
> su_restricted_domain(initrc,system)
> role system_r types initrc_su_t;
> ')
> allow initrc_t self:passwd rootok;
>
> # read /lib/modules
> allow initrc_t modules_object_t:dir { search read };
>
> # Read conf.modules.
> allow initrc_t modules_conf_t:file r_file_perms;
>
> # Run other rc scripts in the initrc_t domain.
> can_exec(initrc_t, initrc_exec_t)
>
> # Run init (telinit) in the initrc_t domain.
> can_exec(initrc_t, init_exec_t)
>
> # Communicate with the init process.
> allow initrc_t initctl_t:fifo_file rw_file_perms;
>
> # Send messages to portmap and ypbind.
> ifdef(`portmap.te', `can_udp_send(initrc_t, portmap_t)')
> ifdef(`ypbind.te', `can_udp_send(initrc_t, ypbind_t)')
>
> # Read /proc/PID directories for all domains.
> r_dir_file(initrc_t, domain)
> allow initrc_t domain:process { getattr getsession };
>
> # Mount and unmount file systems.
> allow initrc_t fs_type:filesystem mount_fs_perms;
> allow initrc_t { file_t default_t }:dir { read search getattr mounton };
>
> # Create runtime files in /etc, e.g. /etc/mtab, /etc/HOSTNAME.
> file_type_auto_trans(initrc_t, etc_t, etc_runtime_t, file)
>
> # Update /etc/ld.so.cache.
> allow initrc_t ld_so_cache_t:file rw_file_perms;
>
> ifdef(`sendmail.te', `
> # Update /etc/mail.
> allow initrc_t etc_mail_t:file { setattr rw_file_perms };
> ')
>
> ifdef(`xfs.te', `
> # Unlink the xfs socket.
> allow initrc_t xfs_tmp_t:dir rw_dir_perms;
> allow initrc_t xfs_tmp_t:dir rmdir;
> allow initrc_t xfs_tmp_t:sock_file { read getattr unlink };
> allow initrc_t fonts_t:dir create_dir_perms;
> allow initrc_t fonts_t:file create_file_perms;
> ')
>
> # Update /var/log/wtmp and /var/log/dmesg.
> allow initrc_t wtmp_t:file { setattr rw_file_perms };
> allow initrc_t var_log_t:file { setattr rw_file_perms };
> allow initrc_t lastlog_t:file { setattr rw_file_perms };
>
> # remove old locks
> allow initrc_t lockfile:dir rw_dir_perms;
> allow initrc_t lockfile:file { getattr unlink };
>
> # Access /var/lib/random-seed.
> allow initrc_t var_lib_t:file rw_file_perms;
> allow initrc_t var_lib_t:file unlink;
>
> # Create lock file.
> allow initrc_t var_lock_t:dir create_dir_perms;
> allow initrc_t var_lock_t:file create_file_perms;
>
> # Set the clock.
> allow initrc_t clock_device_t:devfile_class_set rw_file_perms;
>
> # Kill all processes.
> allow initrc_t domain:process signal_perms;
>
> # Read and unlink /var/run/*.pid files.
> allow initrc_t pidfile:file { getattr read unlink };
>
> # Write to /dev/urandom.
> allow initrc_t urandom_device_t:chr_file rw_file_perms;
>
> # Set device ownerships/modes.
> allow initrc_t framebuf_device_t:lnk_file read;
> allow initrc_t framebuf_device_t:devfile_class_set setattr;
> allow initrc_t misc_device_t:devfile_class_set setattr;
> allow initrc_t device_t:devfile_class_set setattr;
> allow initrc_t fixed_disk_device_t:devfile_class_set setattr;
> allow initrc_t removable_device_t:devfile_class_set setattr;
> allow initrc_t device_t:lnk_file read;
>
> # Stat any file.
> allow initrc_t file_type:file_class_set getattr;
> allow initrc_t file_type:dir { search getattr };
>
> # Read and write console and ttys.
> allow initrc_t devtty_t:chr_file rw_file_perms;
> allow initrc_t console_device_t:chr_file rw_file_perms;
> allow initrc_t tty_device_t:chr_file rw_file_perms;
> allow initrc_t ttyfile:chr_file rw_file_perms;
> allow initrc_t ptyfile:chr_file rw_file_perms;
>
> # Reset tty labels.
> allow initrc_t ttyfile:chr_file relabelfrom;
> allow initrc_t tty_device_t:chr_file relabelto;
>
> ifdef(`rpm.te', `
> # Create and read /boot/kernel.h and /boot/System.map.
> # Redhat systems typically create this file at boot time.
> allow initrc_t boot_t:lnk_file rw_file_perms;
> file_type_auto_trans(initrc_t, boot_t, boot_runtime_t, file)
> ')
>
> allow initrc_t system_map_t:{ file lnk_file } r_file_perms;
>
> ifdef(`rhgb.te', `
> allow initrc_t ramfs_t:dir search;
> allow initrc_t ramfs_t:sock_file write;
> allow initrc_t rhgb_t:unix_stream_socket { read write };
> ')
>
> # Unlink /halt.
> # for /halt /.autofsck and other flag files
> file_type_auto_trans(initrc_t, root_t, etc_runtime_t, file)
>
> ifdef(`gpm.te', `allow initrc_t gpmctl_t:sock_file setattr;')
>
> allow initrc_t var_spool_t:file rw_file_perms;
>
> # Allow access to the sysadm TTYs. Note that this will give access to the 
> # TTYs to any process in the initrc_t domain. Therefore, daemons and such
> # started from init should be placed in their own domain.
> allow initrc_t admin_tty_type:chr_file rw_file_perms;
>
> # Access sound device and files.
> allow initrc_t sound_device_t:chr_file { setattr ioctl read write };
> ifdef(`sound.te', `allow initrc_t sound_file_t:file { setattr write };')
>
> ifdef(`rpm.te', `
> # Access /var/lib/rpm.
> allow initrc_t var_lib_rpm_t:dir rw_dir_perms;
> allow initrc_t var_lib_rpm_t:file create_file_perms;
> ')
>
> ifdef(`apmd.te',
> `# Access /dev/apm_bios.
> allow initrc_t apm_bios_t:chr_file { setattr getattr };')
>
> ifdef(`lpd.te',
> `# Read printconf files.
> allow initrc_t printconf_t:dir r_dir_perms;
> allow initrc_t printconf_t:file r_file_perms;')
>
> # Read user home directories.
> allow initrc_t { home_root_t home_type }:dir r_dir_perms;
> allow initrc_t home_type:file r_file_perms;
>
> # for system start scripts
> allow initrc_t pidfile:dir rw_dir_perms;
> allow initrc_t pidfile:sock_file unlink;
> rw_dir_create_file(initrc_t, var_lib_t)
>
> # allow start scripts to clean /tmp
> allow initrc_t { unlabeled_t tmpfile }:dir { rw_dir_perms rmdir };
> allow initrc_t { unlabeled_t tmpfile }:notdevfile_class_set { getattr unlink };
>
> # for lsof which is used by alsa shutdown
> dontaudit initrc_t domain:{ udp_socket tcp_socket fifo_file unix_dgram_socket } getattr;
> dontaudit initrc_t proc_kmsg_t:file getattr;
>
> #################################
> #
> # Rules for the run_init_t domain.
> #
> run_program(sysadm_t, sysadm_r, init, initrc_exec_t, initrc_t)
> allow initrc_t privfd:fd use;
>
> # Transition to system_r:initrc_t upon executing init scripts.
> ifdef(`direct_sysadm_daemon', `
> role_transition sysadm_r initrc_exec_t system_r;
> domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t)
> ')
>
> #
> # Shutting down xinet causes these
> #
> # Fam
> dontaudit initrc_t device_t:dir { read write };
> # Rsync
> dontaudit initrc_t mail_spool_t:lnk_file read;
>
> allow initrc_t sysfs_t:dir { getattr read search };
> allow initrc_t sysfs_t:file { getattr read };
> allow initrc_t sysfs_t:lnk_file { getattr read };
> allow initrc_t udev_runtime_t:file rw_file_perms;
> allow initrc_t device_type:chr_file { setattr };
> allow initrc_t binfmt_misc_fs_t:dir { getattr search };
> allow initrc_t binfmt_misc_fs_t:file { getattr ioctl write };
> ifdef(`pam.te', `
> allow initrc_t pam_var_run_t:dir rw_dir_perms;
> allow initrc_t pam_var_run_t:file { getattr read unlink };
> ')
>
> # for lsof in shutdown scripts
> allow initrc_t security_t:dir getattr;
> allow initrc_t krb5_conf_t:file read;
> dontaudit initrc_t krb5_conf_t:file write;
> #
> # Wants to remove udev.tbl
> #
> allow initrc_t device_t:dir rw_dir_perms;
> allow initrc_t device_t:lnk_file { unlink };
> allow initrc_t initrc_t:process { getsched };
>
> ifdef(`unlimitedServices', `
> unconfined_domain(initrc_t) 
> ')
>   
>
> ------------------------------------------------------------------------
>
> # init rc scripts
> /etc/X11/prefdm		--	system_u:object_r:initrc_exec_t
> /etc/rc\.d/rc		--	system_u:object_r:initrc_exec_t
> /etc/rc\.d/rc\.sysinit	--	system_u:object_r:initrc_exec_t
> /etc/rc\.d/rc\.local	--	system_u:object_r:initrc_exec_t
> /etc/rc\.d/init\.d/.*	--	system_u:object_r:initrc_exec_t
> /etc/rc\.d/init\.d/functions -- system_u:object_r:etc_t
> /etc/init\.d/.*		--	system_u:object_r:initrc_exec_t
> /etc/init\.d/functions	--	system_u:object_r:etc_t
> /var/run/utmp		--	system_u:object_r:initrc_var_run_t
> /var/run/runlevel\.dir		system_u:object_r:initrc_var_run_t
> /var/run/random-seed	--	system_u:object_r:initrc_var_run_t
> /var/run/setmixer_flag	--	system_u:object_r:initrc_var_run_t
> # run_init
> /usr/sbin/run_init	--	system_u:object_r:run_init_exec_t
> /usr/sbin/open_init_pty	--	system_u:object_r:initrc_exec_t
> /etc/nologin.*		--	system_u:object_r:etc_runtime_t
> /etc/nohotplug		--	system_u:object_r:etc_runtime_t
> /halt			--	system_u:object_r:etc_runtime_t
> /\.autofsck		--	system_u:object_r:etc_runtime_t
>   
>

More /sbin/fixfiles oddities (was Re: fixfile.cron added.

On Thu, 01 Jul 2004 08:14:09 EDT, Daniel J Walsh <dwalsh(a)redhat.com&gt;  said:
>  Todays policycoreutils has a new cron job, fixfiles.cron, that will
> run 
>  in /etc/cron.daily.   This script will run a check on the file system on  
>  Suggestions on improvements?  Comments? 
1) /sbin/fixfiles ends up spewing to a logfile whether we want it or not:

logging to /var/tmp/fixfiles.byapo27529
and then it does a '| tee $LOGFILE'.

And after a few days, we have:

 ls -l /var/tmp/fix*
-rw-------  1 root root     0 Jun 15 21:47 /var/tmp/fixfiles.FjBnJn1029
-rw-------  1 root root  3079 Jul  2 10:27 /var/tmp/fixfiles.SlZmt16952
-rw-------  1 root root 17899 Jul  3 04:20 /var/tmp/fixfiles.WBgGN24978
-rw-------  1 root root     0 Jul  3 13:48 /var/tmp/fixfiles.byapo27529
-rw-------  1 root root     0 Jun 15 21:49 /var/tmp/fixfiles.ffmJNN1054
-rw-------  1 root root     0 Jun 15 21:47 /var/tmp/fixfiles.xpFMrd1036

This wouldn't be so bad, if it was possible to get fixfiles.cron to
pass a '-l /dev/null' to /sbin/fixfiles or some other way to tell
/sbin/fixfiles that no, you didn't want a copy saved in a file (because
cron will save a copy, or you did a tee yourself, or....)

2) I can't convince myself that the following lines in /sbin/fixfiles are right:

restoreLabels () {
echo "logging to $LOGFILE"
if [ ! -z "$1" ]; then
    for i in `echo $1 | sed 's/,/ /g'`; do
        rpm -q -l $i | restorecon ${OUTFILES} -v -f - 2>&1 | tee $LOGFILE
    done
else
    ${SETFILES} ${OUTFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMS} 2>&1 | tee
$LOGFILE
fi
}

$OUTFILES *twice*?

3) fixfiles didn't exhibit the 86K badcontexts issue when running from
a shell that had context=root:sysadm_r:sysadm_t.  I'm wondering if it
got an odd context from cron which confused it.  Film at 11 (or 4AM,
really)..I added a call to /usr/bin/id to /sbin/fixfiles so I find out...

And another fixfiles comment... (was Re: fixfile.cron added.

On Thu, 01 Jul 2004 08:14:09 EDT, Daniel J Walsh <dwalsh(a)redhat.com&gt;  said:
>  Todays policycoreutils has a new cron job, fixfiles.cron, that will
> run 
>  in /etc/cron.daily.   This script will run a check on the file system on  
Currently, fixfiles does some interesting grepping through the mounts
to only work on R/W mounts.  This has 2 problems when run on a system
that has many filesystems mounted with some combo of ro/nosuid/nodev/noexec:

1) It's possible for the sysadmin to not realize that fixfiles isn't
relabelling a filesystem because it's R/O (note that this problem is
shared by the 'make relabel' target in /etc/selinux/*/src/policy/Makefile).

2) If we're only checking, we should do R/O filesystems as well - the fact
that they're R/O when the cronjob runs doesn't mean that they weren't R/W
and picked up some bad labels at some previous time.

Lightly tested patch:

--- /sbin/fixfiles.dist	2004-06-30 13:40:47.000000000 -0400
+++ /sbin/fixfiles	2004-07-05 04:53:24.000000000 -0400
@@ -30,9 +30,12 @@ rpmFlag=0
 rpmFiles=""
 outfileFlag=0
 OUTFILES=""
+logfileFlag=0
 LOGFILE=`mktemp /var/tmp/fixfiles.XXXXXXXXXX`  || exit 1
 SETFILES=/usr/sbin/setfiles
-FILESYSTEMS=`mount | grep -v "context=" | egrep -v
'\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*rw/{print
$3}';`
+FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v
'\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*\(rw/{print
$3}';`
+FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v
'\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*\(ro/{print
$3}';`
+FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
 SELINUXTYPE="targeted"
 
 if [ -e /etc/selinux/config ]; then
@@ -60,7 +63,11 @@ if [ ! -z "$1" ]; then
 	rpm -q -l $i | restorecon ${OUTFILES} -v -f - 2>&1 | tee $LOGFILE
     done
 else
-    ${SETFILES} ${OUTFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMS} 2>&1 | tee
$LOGFILE
+    if [ "x$FILESYSTEMSRO" != "x" ]; then
+        echo "Warning: Skipping the following R/O filesystems:"
+        echo "$FILESYSTEMSRO"
+    fi
+    ${SETFILES} ${OUTFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMSRW} 2>&1 | tee
$LOGFILE
 fi
 }
 
@@ -73,7 +80,11 @@ if [ ! -z "$1" ]; then
 	rpm -q -l $i | restorecon ${OUTFILES} -v -f - 2>&1 | tee $LOGFILE
     done
 else
-    ${SETFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMS} 2>&1 | tee $LOGFILE
+    if [ "x$FILESYSTEMSRO" != "x" ]; then
+        echo "Warning: Skipping the following R/O filesystems:"
+        echo "$FILESYSTEMSRO"
+    fi
+    ${SETFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMSRW} 2>&1 | tee $LOGFILE
 fi
 }
 relabelCheck() {

And another fixfiles comment... (was Re: fixfile.cron added.

[Daniel J Walsh]

Valdis.Kletnieks(a)vt.edu wrote:

> On Thu, 01 Jul 2004 08:14:09 EDT, Daniel J Walsh
> <dwalsh(a)redhat.com&gt;  said:
>   
>
> >Todays policycoreutils has a new cron job, fixfiles.cron, that will run 
> >in /etc/cron.daily.   This script will run a check on the file system on 
> >    
> >
>
> Currently, fixfiles does some interesting grepping through the mounts
> to only work on R/W mounts.  This has 2 problems when run on a system
> that has many filesystems mounted with some combo of ro/nosuid/nodev/noexec:
>
> 1) It's possible for the sysadmin to not realize that fixfiles isn't
> relabelling a filesystem because it's R/O (note that this problem is
> shared by the 'make relabel' target in /etc/selinux/*/src/policy/Makefile).
>
> 2) If we're only checking, we should do R/O filesystems as well - the fact
> that they're R/O when the cronjob runs doesn't mean that they weren't R/W
> and picked up some bad labels at some previous time.
>
> Lightly tested patch:
>
> --- /sbin/fixfiles.dist	2004-06-30 13:40:47.000000000 -0400
> +++ /sbin/fixfiles	2004-07-05 04:53:24.000000000 -0400
> @@ -30,9 +30,12 @@ rpmFlag=0
>  rpmFiles=""
>  outfileFlag=0
>  OUTFILES=""
> +logfileFlag=0
>  LOGFILE=`mktemp /var/tmp/fixfiles.XXXXXXXXXX`  || exit 1
>  SETFILES=/usr/sbin/setfiles
> -FILESYSTEMS=`mount | grep -v "context=" | egrep -v
> '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*rw/{print
> $3}';`
> +FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v
> '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*\(rw/{print
> $3}';`
> +FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v
> '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs | reiserfs ).*\(ro/{print
> $3}';`
> +FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
>  SELINUXTYPE="targeted"
>  
>  if [ -e /etc/selinux/config ]; then
> @@ -60,7 +63,11 @@ if [ ! -z "$1" ]; then
>  	rpm -q -l $i | restorecon ${OUTFILES} -v -f - 2>&1 | tee $LOGFILE
>      done
>  else
> -    ${SETFILES} ${OUTFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMS} 2>&1 | tee
> $LOGFILE
> +    if [ "x$FILESYSTEMSRO" != "x" ]; then
> +        echo "Warning: Skipping the following R/O filesystems:"
> +        echo "$FILESYSTEMSRO"
> +    fi
> +    ${SETFILES} ${OUTFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMSRW} 2>&1 | tee
> $LOGFILE
>  fi
>  }
>  
> @@ -73,7 +80,11 @@ if [ ! -z "$1" ]; then
>  	rpm -q -l $i | restorecon ${OUTFILES} -v -f - 2>&1 | tee $LOGFILE
>      done
>  else
> -    ${SETFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMS} 2>&1 | tee $LOGFILE
> +    if [ "x$FILESYSTEMSRO" != "x" ]; then
> +        echo "Warning: Skipping the following R/O filesystems:"
> +        echo "$FILESYSTEMSRO"
> +    fi
> +    ${SETFILES} ${OUTFILES} -v ${FC} ${FILESYSTEMSRW} 2>&1 | tee $LOGFILE
>  fi
>  }
>  relabelCheck() {
>   
>  
Added to fixfiles.

>   
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>

[Ivan Gyurdiev]

>  Suggestions on improvements?  Comments? 
Just wondering why I have hundreds of denials
from sysadm_crond_t in my system log with /usr/bin/setfiles in them.

Latest policy, permissive mode.

[Stephen Smalley]

On Mon, 2004-07-05 at 21:44, Ivan Gyurdiev wrote:
>  > Suggestions on improvements?  Comments?
>  
>  Just wondering why I have hundreds of denials
>  from sysadm_crond_t in my system log with /usr/bin/setfiles in them.
>  
>  Latest policy, permissive mode. 
sysadm_crond_t or system_crond_t?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Ivan Gyurdiev]

On Wed, 2004-07-07 at 15:04 -0400, Stephen Smalley wrote:
>  On Mon, 2004-07-05 at 21:44, Ivan Gyurdiev wrote:
>  > > Suggestions on improvements?  Comments?
>  > 
>  > Just wondering why I have hundreds of denials
>  > from sysadm_crond_t in my system log with /usr/bin/setfiles in them.
>  > 
>  > Latest policy, permissive mode.
>  
>  sysadm_crond_t or system_crond_t? 
sysadm is correct (audit2allow in verbose mode):

allow sysadm_crond_t adjtime_t:file { getattr };
        #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr
        #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr
                                                                                
allow sysadm_crond_t admin_passwd_exec_t:file { getattr };
        #EXE=/usr/sbin/setfiles  PATH=/usr/sbin/vipw   :  getattr
        #EXE=/usr/sbin/setfiles  PATH=/usr/sbin/vipw   :  getattr
                                                                                
allow sysadm_crond_t agp_device_t:chr_file { getattr };
        #EXE=/usr/sbin/setfiles  PATH=/dev/agpgart   :  getattr
        #EXE=/usr/sbin/setfiles  PATH=/dev/agpgart   :  getattr
                                                                                
allow sysadm_crond_t amanda_amandates_t:file { getattr };
        #EXE=/usr/sbin/setfiles  PATH=/etc/amandates   :  getattr
        #EXE=/usr/sbin/setfiles  PATH=/etc/amandates   :  getattr

...etc

[Stephen Smalley]

On Wed, 2004-07-07 at 23:22, Ivan Gyurdiev wrote:
>  sysadm is correct (audit2allow in verbose mode):
>  
>  allow sysadm_crond_t adjtime_t:file { getattr };
>          #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr
>          #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr 
Interesting.  Bug in crond?  Should be running in system_crond_t.
Any interesting output in /var/log/cron?  What version of vixie-cron are
you running?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Ivan Gyurdiev]

On Thu, 2004-07-08 at 08:23 -0400, Stephen Smalley wrote:
>  On Wed, 2004-07-07 at 23:22, Ivan Gyurdiev wrote:
>  > sysadm is correct (audit2allow in verbose mode):
>  > 
>  > allow sysadm_crond_t adjtime_t:file { getattr };
>  >         #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr
>  >         #EXE=/usr/sbin/setfiles  PATH=/etc/adjtime   :  getattr
>  
>  Interesting.  Bug in crond?  Should be running in system_crond_t.
>  Any interesting output in /var/log/cron?  
Not really.

>   What version of vixie-cron are
>  you running? 
vixie-cron-3.0.1-86.

I see now that this is old - there's a 94 on rawhide.
It is not cool that yum does not upgrade packages when you expect it to.
This one I built myself (along with a bunch of others), and it just
won't upgrade despite the newer version on rawhide. On the other hand I
get bitten every time when developers fall back to an older version and
yum does not do the same. Yum needs improvement.

I'll report any problems I see with this cron (94).

[Stephen Smalley]

On Thu, 2004-07-08 at 13:40, Ivan Gyurdiev wrote:
>  I'll report any problems I see with this cron (94). 
Likely need the following rules added to crond.te:

r_dir_file(system_crond_t, file_context_t)
can_getsecurity(system_crond_t)

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Daniel J Walsh]

Stephen Smalley wrote:

> On Thu, 2004-07-08 at 13:40, Ivan Gyurdiev wrote:
>   
>
> >I'll report any problems I see with this cron (94).
> >    
> >
>
> Likely need the following rules added to crond.te:
>
> r_dir_file(system_crond_t, file_context_t)
> can_getsecurity(system_crond_t)
>
>   
>  
We might want to add a tunable to allow system_crond_t to exec 
setfiles_t.   You can modify the
/etc/selinux/config file and add
CRONTYPE="restore"
CRONMAILTO="dwalsh(a)redhat.com"

Which would cause setfiles to restore the security contexts when 
fixfiles.cron runs. and send mail to the specified user.

Dan

[Stephen Smalley]

On Thu, 2004-07-08 at 14:40, Daniel J Walsh wrote:
>  We might want to add a tunable to allow system_crond_t to exec 
>  setfiles_t.   You can modify the
>  /etc/selinux/config file and add
>  CRONTYPE="restore"
>  CRONMAILTO="dwalsh(a)redhat.com"
>  
>  Which would cause setfiles to restore the security contexts when 
>  fixfiles.cron runs. and send mail to the specified user. 
Patch below (replaces patch sent earlier for running setfiles without
changing domains just to check contexts).

Index: policy/domains/program/crond.te
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/policy/domains/program/crond.te,v
retrieving revision 1.23
diff -u -r1.23 crond.te
--- policy/domains/program/crond.te	16 Jun 2004 17:07:45 -0000	1.23
+++ policy/domains/program/crond.te	8 Jul 2004 18:56:41 -0000
@@ -194,3 +194,10 @@
 dontaudit userdomain system_crond_t:fd { use };
 
 r_dir_file(crond_t, selinux_config_t)
+
+ifdef(`cron_can_relabel', `
+domain_auto_trans(system_crond_t, setfiles_exec_t, setfiles_t)
+', `
+r_dir_file(system_crond_t, file_context_t)
+can_getsecurity(system_crond_t)
+')
Index: policy/tunables/tunable.te
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/policy/tunables/tunable.te,v
retrieving revision 1.4
diff -u -r1.4 tunable.te
--- policy/tunables/tunable.te	17 Jun 2004 16:59:30 -0000	1.4
+++ policy/tunables/tunable.te	8 Jul 2004 18:56:09 -0000
@@ -100,3 +100,5 @@
 # Allow user to rw usb devices
 dnl define(`user_rw_usb')
 
+# Allow system cron job to relabel filesystem for restoring file contexts.
+dnl define(`cron_can_relabel')

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[lonely wolf]

Ivan Gyurdiev wrote:

>  This one I built myself (along with a bunch of others), and it just
>  won't upgrade despite the newer version on rawhide. 
make sure that %epoch=0 in
your rpm

[Stephen Smalley]

On Thu, 2004-07-01 at 08:14, Daniel J Walsh wrote:
>  Todays policycoreutils has a new cron job, fixfiles.cron, that will
> run 
>  in /etc/cron.daily.   This script will run a check on the file system on 
>  a daily basis looking for file contexts in the wrong state.  It will 
>  them mail a list of files with the incorrect context to the root account. 
>  
>  The following environment variables are set and can be overridden in the 
>  /etc/selinux/config directory.
>  
>  CRONTYPE="check"  # You could change this to "restore" to have the 
>  script automatically clean up
>  INVALIDFILE=/var/tmp/badcontext # Name of the file to store the 
>  badcontext file list
>  CRONMAILTO="root"  # Account to send mail to
>  
>  Suggestions on improvements?  Comments? 
Has the policy been adjusted to allow this to run?  Is it being run in
system_crond_t (I would assume, given that it is under /etc/cron.daily)
or sysadm_crond_t (should only be applied to /var/spool/cron/root)?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency