total newbie audit2allow question

[Richard Greenwood]

I have a CGI application named "mapserv" that needs to write to a specific
location: "/rwg/mapserver/tmp". I ran audit2allow which produced the
test.te file file below. I ran "semodule -i test.pp" and my CGI application
is now happy, and so you would think that I should be happy also. But I am
confused/concerned because I do not see "mapserv" nor do I see
"/rwg/mapserver/tmp" in the te file. So my uninformed interpretation of the
te file below is that I have just granted all httpd scripts permission to
write to any directory. I did a quick test and this is thankfully *NOT* the
case, but how does selinx know that I am granting only the "mapserv"
application write permissions to only the "/rwg/mapserver/tmp" directory? I
feel like there is a big piece that I am completely missing.

Thanks for your patience with a newbie.
Rich


module test 1.0;

require {
        type httpd_sys_content_t;
        type httpd_sys_script_t;
        class dir add_name;
        class file { write create };
}

#============= httpd_sys_script_t ==============
allow httpd_sys_script_t httpd_sys_content_t:dir add_name;
allow httpd_sys_script_t httpd_sys_content_t:file { write create };


-- 
Richard Greenwood
richard.greenwood(a)gmail.com
www.greenwoodmap.com

[Rejy M Cyriac]

On 04/17/2013 03:53 AM, Richard Greenwood wrote:
>  I have a CGI application named "mapserv" that needs to
> write to a
>  specific location: "/rwg/mapserver/tmp". I ran audit2allow which
>  produced the test.te file file below. I ran "semodule -i test.pp" and my
>  CGI application is now happy, and so you would think that I should be
>  happy also. But I am confused/concerned because I do not see "mapserv"
>  nor do I see "/rwg/mapserver/tmp" in the te file. So my uninformed
>  interpretation of the te file below is that I have just granted all
>  httpd scripts permission to write to any directory. I did a quick test
>  and this is thankfully /NOT/ the case, but how does selinx know that I
>  am granting only the "mapserv" application write permissions to only the
>  "/rwg/mapserver/tmp" directory? I feel like there is a big piece that I
>  am completely missing.
>  
>  Thanks for your patience with a newbie.
>  Rich
>  
>  
>  module test 1.0;
>  
>  require {
>          type httpd_sys_content_t;
>          type httpd_sys_script_t;
>          class dir add_name;
>          class file { write create };
>  }
>  
>  #============= httpd_sys_script_t ==============
>  allow httpd_sys_script_t httpd_sys_content_t:dir add_name;
>  allow httpd_sys_script_t httpd_sys_content_t:file { write create };
>  
>  
>  -- 
>  Richard Greenwood
>  richard.greenwood(a)gmail.com <mailto:[e-mail]>
>  www.greenwoodmap.com <http://www.greenwoodmap.com>
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
Hello Richard,

The new rules that you have put in, gives access rights to processes
having the 'httpd_sys_script_t' SELinux type (domain) on directories and
files having the 'httpd_sys_content_t' SELinux type. So strictly
speaking, this is not just for the "mapserv" application that you have,
but for all httpd CGI scripts in general, on all 'web-content'
directories. However, this is fine, and is the usual way that SELinux is
used, as long as you have control over what CGI scripts are deployed on
the system, and that only specific directories have the 'web-content'
SELinux type.

If you desire to have the rules allowed only for a specific process on
specific directories and files, you have to define special SELinux types
for the CGI scripts, process, directories and files, rules for the
process to transition to the expected type (domain), and rules for the
types to be persistent on the directories and files, and finally access
rules using those special SELinux types.

-- 
Cheers!

Rejy M Cyriac (rmc)

[Rejy M Cyriac]

On 04/17/2013 11:29 AM, Rejy M Cyriac wrote:
>  On 04/17/2013 03:53 AM, Richard Greenwood wrote:
> > I have a CGI application named "mapserv" that needs to write to a
> > specific location: "/rwg/mapserver/tmp". I ran audit2allow which
> > produced the test.te file file below. I ran "semodule -i test.pp" and my
> > CGI application is now happy, and so you would think that I should be
> > happy also. But I am confused/concerned because I do not see "mapserv"
> > nor do I see "/rwg/mapserver/tmp" in the te file. So my uninformed
> > interpretation of the te file below is that I have just granted all
> > httpd scripts permission to write to any directory. I did a quick test
> > and this is thankfully /NOT/ the case, but how does selinx know that I
> > am granting only the "mapserv" application write permissions to only the
> > "/rwg/mapserver/tmp" directory? I feel like there is a big piece that I
> > am completely missing.
> >
> > Thanks for your patience with a newbie.
> > Rich
> >
> >
> > module test 1.0;
> >
> > require {
> >         type httpd_sys_content_t;
> >         type httpd_sys_script_t;
> >         class dir add_name;
> >         class file { write create };
> > }
> >
> > #============= httpd_sys_script_t ==============
> > allow httpd_sys_script_t httpd_sys_content_t:dir add_name;
> > allow httpd_sys_script_t httpd_sys_content_t:file { write create };
> >
> >
> > -- 
> > Richard Greenwood
> > richard.greenwood(a)gmail.com <mailto:[e-mail]>
> > www.greenwoodmap.com <http://www.greenwoodmap.com>
> >
> >
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
>  Hello Richard,
>  
>  The new rules that you have put in, gives access rights to processes
>  having the 'httpd_sys_script_t' SELinux type (domain) on directories and
>  files having the 'httpd_sys_content_t' SELinux type. So strictly
>  speaking, this is not just for the "mapserv" application that you have,
>  but for all httpd CGI scripts in general, on all 'web-content'
>  directories. However, this is fine, and is the usual way that SELinux is
>  used, as long as you have control over what CGI scripts are deployed on
>  the system, and that only specific directories have the 'web-content'
>  SELinux type.
>  
>  If you desire to have the rules allowed only for a specific process on
>  specific directories and files, you have to define special SELinux types
>  for the CGI scripts, process, directories and files, rules for the
>  process to transition to the expected type (domain), and rules for the
>  types to be persistent on the directories and files, and finally access
>  rules using those special SELinux types.
>   
By 'special' SELinux types mentioned here, I actually meant
*'custom'*
SELinux types.

-- 
Regards,

Rejy M Cyriac (rmc)

[Dominick Grift]

On Wed, 2013-04-17 at 11:29 +0530, Rejy M Cyriac wrote:
>  On 04/17/2013 03:53 AM, Richard Greenwood wrote:
>  > I have a CGI application named "mapserv" that needs to write to a
>  > specific location: "/rwg/mapserver/tmp". I ran audit2allow which
>  > produced the test.te file file below. I ran "semodule -i test.pp" and my
>  > CGI application is now happy, and so you would think that I should be
>  > happy also. But I am confused/concerned because I do not see "mapserv"
>  > nor do I see "/rwg/mapserver/tmp" in the te file. So my uninformed
>  > interpretation of the te file below is that I have just granted all
>  > httpd scripts permission to write to any directory. I did a quick test
>  > and this is thankfully /NOT/ the case, but how does selinx know that I
>  > am granting only the "mapserv" application write permissions to only the
>  > "/rwg/mapserver/tmp" directory? I feel like there is a big piece that I
>  > am completely missing.
>  > 
>  > Thanks for your patience with a newbie.
>  > Rich
>  > 
>  > 
>  > module test 1.0;
>  > 
>  > require {
>  >         type httpd_sys_content_t;
>  >         type httpd_sys_script_t;
>  >         class dir add_name;
>  >         class file { write create };
>  > }
>  > 
>  > #============= httpd_sys_script_t ==============
>  > allow httpd_sys_script_t httpd_sys_content_t:dir add_name;
>  > allow httpd_sys_script_t httpd_sys_content_t:file { write create };
>  > 
>  > 
>  > -- 
>  > Richard Greenwood
>  > richard.greenwood(a)gmail.com <mailto:[e-mail]>
>  > www.greenwoodmap.com <http://www.greenwoodmap.com>
>  > 
>  > 
>  > --
>  > selinux mailing list
>  > selinux(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  > 
>  Hello Richard,
>  
>  The new rules that you have put in, gives access rights to processes
>  having the 'httpd_sys_script_t' SELinux type (domain) on directories and
>  files having the 'httpd_sys_content_t' SELinux type. So strictly
>  speaking, this is not just for the "mapserv" application that you have,
>  but for all httpd CGI scripts in general, on all 'web-content'
>  directories. However, this is fine, and is the usual way that SELinux is
>  used, as long as you have control over what CGI scripts are deployed on
>  the system, and that only specific directories have the 'web-content'
>  SELinux type.
>  
>  If you desire to have the rules allowed only for a specific process on
>  specific directories and files, you have to define special SELinux types
>  for the CGI scripts, process, directories and files, rules for the
>  process to transition to the expected type (domain), and rules for the
>  types to be persistent on the directories and files, and finally access
>  rules using those special SELinux types.
>   
There is a API available that makes it pretty easy to create a new set
of types for a cgi webapp.

example:

cat > mywebapp.te << EOF
policy_module(mywebappp, 1.0.0)
apache_content_template(mywebapp)
EOF

make -f /usr/share/selinux/devel/Makefile mywebapp.pp
sudo semodule -i mywebapp

Now you can use the following new types:

httpd_mywebapp_script_t (mywebapp process type)
httpd_mywebapp_script_exec_t (mywebapp cgi executable file type)
httpd_mywebapp_content_t (mywebapp readonly file type)
httpd_mywebapp_content_rw_t (mywebapp read/write file type)
httpd_mywebapp_content_ra_t (mywebapp read/append file type)
httpd_mywebapp_htaccess_t (mywebapp htaccess file types)

Baiscally you can just label the cgi script with the mywebapp script
executable file type and then the mywebapp process will run with the
mywebapp process type creating files with the mywebapp content file
types.

Example:

semanage fcontext -a -t
httpd_mywebapp_script_exec_t /var/www/cgi-bin/mywebapp.pl
restorecon -R -v -F /var/www/cgi-bin/mywebapp.pl

That is, of course if you label /rwg/mapserver/tmp appropriately (it
should probably be tmp_t)

There is a command that allows one to make locations eqivalent to other
locations in terms of selinux file contexts.

So to make /rwg/mapserver/tmp equivalent to /tmp:

semanage fcontext -a -e /tmp /rwg/mapserver/tmp
restorecon -R -v -F /rwg/mapserver/tmp

(or atleast something along those lines)

Then all should be set and then your webapp and its assets will be
isolated/protected from other confined webapps. (at least to some higher
degree)

[Dominick Grift]

On Wed, 2013-04-17 at 10:01 +0200, Dominick Grift wrote:

>  That is, of course if you label /rwg/mapserver/tmp appropriately (it
>  should probably be tmp_t)
>  
>  There is a command that allows one to make locations eqivalent to other
>  locations in terms of selinux file contexts.
>  
>  So to make /rwg/mapserver/tmp equivalent to /tmp:
>  
>  semanage fcontext -a -e /tmp /rwg/mapserver/tmp
>  restorecon -R -v -F /rwg/mapserver/tmp
>  
>  (or atleast something along those lines) 
Actually, i guess the whole mapserver directory is a asset of your
webapp? In that case you can just:

semanage fcontext -a -t httpd_mywebapp_content_rw_t
"/rwg/mapserver(/.*)?"
restorecon -R -v -F /rwg/mapserver

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/16/2013 03:23 PM, Richard Greenwood wrote:
>  I have a CGI application named "mapserv" that needs to
> write to a specific 
>  location: "/rwg/mapserver/tmp". I ran audit2allow which produced the
>  test.te file file below. I ran "semodule -i test.pp" and my CGI application
>  is now happy, and so you would think that I should be happy also. But I am 
>  confused/concerned because I do not see "mapserv" nor do I see 
>  "/rwg/mapserver/tmp" in the te file. So my uninformed interpretation of the
>  te file below is that I have just granted all httpd scripts permission to
>  write to any directory. I did a quick test and this is thankfully /NOT/ the
>  case, but how does selinx know that I am granting only the "mapserv"
>  application write permissions to only the "/rwg/mapserver/tmp" directory? I
>  feel like there is a big piece that I am completely missing.
>  
>  Thanks for your patience with a newbie. Rich
>  
>  
>  module test 1.0;
>  
>  require { type httpd_sys_content_t; type httpd_sys_script_t; class dir
>  add_name; class file { write create }; }
>  
>  #============= httpd_sys_script_t ============== allow httpd_sys_script_t
>  httpd_sys_content_t:dir add_name; allow httpd_sys_script_t
>  httpd_sys_content_t:file { write create };
>  
>  
>  -- Richard Greenwood richard.greenwood(a)gmail.com
>  <mailto:[e-mail]> www.greenwoodmap.com
>  <http://www.greenwoodmap.com>
>  
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
I just wrote a blog on this.

http://danwalsh.livejournal.com/63137.html


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlFun9EACgkQrlYvE4MpobMGSQCgz8ln7JFGDZTmwq/ruqR2bQVE
> pjwAnjRKFXGT8Dbeo+1V3jWw+lFRn3ks
> =B7w0
> -----END PGP SIGNATURE-----

[Richard Greenwood]

On Wed, Apr 17, 2013 at 7:12 AM, Daniel J Walsh <dwalsh(a)redhat.com&gt; wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  On 04/16/2013 03:23 PM, Richard Greenwood wrote:
>  > I have a CGI application named "mapserv" that needs to write to a
>  specific
>  > location: "/rwg/mapserver/tmp". I ran audit2allow which produced the
>  > test.te file file below. I ran "semodule -i test.pp" and my CGI
>  application
>  > is now happy, and so you would think that I should be happy also. But I
>  am
>  > confused/concerned because I do not see "mapserv" nor do I see
>  > "/rwg/mapserver/tmp" in the te file. So my uninformed interpretation of
>  the
>  > te file below is that I have just granted all httpd scripts permission to
>  > write to any directory. I did a quick test and this is thankfully /NOT/
>  the
>  > case, but how does selinx know that I am granting only the "mapserv"
>  > application write permissions to only the "/rwg/mapserver/tmp"
>  directory? I
>  > feel like there is a big piece that I am completely missing.
>  >
>  > Thanks for your patience with a newbie. Rich
>  >
>  >
>  > module test 1.0;
>  >
>  > require { type httpd_sys_content_t; type httpd_sys_script_t; class dir
>  > add_name; class file { write create }; }
>  >
>  > #============= httpd_sys_script_t ============== allow httpd_sys_script_t
>  > httpd_sys_content_t:dir add_name; allow httpd_sys_script_t
>  > httpd_sys_content_t:file { write create };
>  >
>  >
>  > -- Richard Greenwood richard.greenwood(a)gmail.com
>  > <mailto:[e-mail]> www.greenwoodmap.com
>  > <http://www.greenwoodmap.com>
>  >
>  >
>  > -- selinux mailing list selinux(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  >
>
>  I just wrote a blog on this.
>
>  http://danwalsh.livejournal.com/63137.html
>
>  
Rejy, Dominick and Daniel,

Thank you for the detail explanations and blog post. I'm not really having
a problem with my CGI app, nor am I trying to create a custom type. I'm
just trying to get a better understanding of SELinux generally, and
specifically what policies audit2allow is creating. Your answers have
gotten me a little closer.

Thanks,
Rich

-- 
Richard Greenwood
richard.greenwood(a)gmail.com
www.greenwoodmap.com

[Dominick Grift]

On Wed, 2013-04-17 at 09:12 -0600, Richard Greenwood wrote:

>  
>  
>  Thank you for the detail explanations and blog post. I'm not really
>  having a problem with my CGI app, nor am I trying to create a custom
>  type. I'm just trying to get a better understanding of SELinux
>  generally, and specifically what policies audit2allow is creating.
>  Your answers have gotten me a little closer.
>   
audit2allow is just translating AVC denials into type enforcement policy
rules. e.g. picking out the source type, target type, target object
class and permission(s). Then it just prepends that with either allow or
dontaudit access vector depending on what you tell it to do (thats a
audit2allow option, defaults to allow)

example:

allow source_type target_type:target_object_class { permissions };

it is very limited. It can only do basic type enforcement translation
and it cannot make security decisions (for example decide whether to
create a file with a inherited file type or to create it with a type
transition. Similarly it cannot decide whether to just run a executable
file or run it with a domain type transition) It always just does the
former.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/17/2013 01:01 PM, Dominick Grift wrote:
>  On Wed, 2013-04-17 at 09:12 -0600, Richard Greenwood wrote:
>  
> > 
> > 
> > Thank you for the detail explanations and blog post. I'm not really 
> > having a problem with my CGI app, nor am I trying to create a custom 
> > type. I'm just trying to get a better understanding of SELinux generally,
> > and specifically what policies audit2allow is creating. Your answers have
> > gotten me a little closer.
> > 
>  
>  audit2allow is just translating AVC denials into type enforcement policy 
>  rules. e.g. picking out the source type, target type, target object class
>  and permission(s). Then it just prepends that with either allow or 
>  dontaudit access vector depending on what you tell it to do (thats a 
>  audit2allow option, defaults to allow)
>  
>  example:
>  
>  allow source_type target_type:target_object_class { permissions };
>  
>  it is very limited. It can only do basic type enforcement translation and
>  it cannot make security decisions (for example decide whether to create a
>  file with a inherited file type or to create it with a type transition.
>  Similarly it cannot decide whether to just run a executable file or run it
>  with a domain type transition) It always just does the former.
>  
>  
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
Boy if it could figure out whether or not to do a transition, that would be
cool.  It also can not do a good job of figuring out what would be the best
type to set a target to, if you want to allow write.

Although we could do a better job then we do now.  I think I made
setroubleshoot sort the list of types based on type prefix.

Having uristics on the path would be cool also.

allow httpd_t var_log_t:file append;
If audit2allow would suggest perhaps you should change the label of file to
httpd_var_log_t.


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlFu4+gACgkQrlYvE4MpobMu9ACeIII+WNbC1d17ZEfIGKPpoY8d
> QlwAn0PBNfM2Z3Qe4/LgmD9Ncr/4M84a
> =idWN
> -----END PGP SIGNATURE-----

[Dominick Grift]

On Wed, 2013-04-17 at 09:12 -0600, Richard Greenwood wrote:

>  
>  Rejy, Dominick and Daniel,
>  
>  
>  Thank you for the detail explanations and blog post. I'm not really
>  having a problem with my CGI app, nor am I trying to create a custom
>  type. I'm just trying to get a better understanding of SELinux
>  generally, and specifically what policies audit2allow is creating.
>  Your answers have gotten me a little closer.
>   
In a sense you do have a problem with your cgi app. You were "breaking"
the policy by changing the meaning of the httpd_sys_content_t type.

The httpd_sys_content_t type is meant to be read-only to httpd process
types. You used audit2allow to implement rules that allow the
httpd_sys_script_t process type to create and write httpd_sys_content_t
files.

If you would be able to figure out that httpd_sys_content_rw_t is a more
suitable type for your cgi app writable content then there would be less
of a problem.

There are ways to do this. By using the seinfo, sesearch and semanage
tools one can figure out the "meaning" or properties of a given type.
That will allow one to make better decisions with regard to choosing the
best type for any given job.

This is not something audit2allow can do for you.