How do I create an initial policy for a new app?

[Brian Ginn]

using the polgengui, i get an error that the type is unknown (see below).



I compared the generated files to /usr/share/selinux/devel/example.*

I can see that I need to add the initial type myapp2_t;



... there are some other differences.  For example:



Polgengui's myapp2.te:

corecmd_executable_file(pbrun_exec_t)



example.te:

domain_type(myapp_t)

domain_entry_file(myapp_t, myapp_exec_t)



Do these accomplish essentially the same thing?





Thanks,

Brian





+ . ./myapp2.sh

++ set -x

++ make -f /usr/share/selinux/devel/Makefile

Compiling targeted myapp2 module

/usr/bin/checkmodule:  loading policy configuration from tmp/myapp2.tmp

myapp2.te:22:ERROR 'unknown type myapp2_t' at token ';' on line 83532:



allow myapp2_t myapp2_rw_t:file { create getattr setattr read write append rename link
unlink ioctl lock };

/usr/bin/checkmodule:  error(s) encountered while parsing configuration

make: *** [tmp/myapp2.mod] Error 1

++ /usr/sbin/semodule -i myapp2.pp

libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
system_chkpwd_t:process { transition };

libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
updpwd_t:process { transition };

libsepol.check_assertion_helper: assertion on line 0 violated by allow system_chkpwd_t
myapp2_t:process { sigchld };

libsepol.check_assertion_helper: assertion on line 0 violated by allow updpwd_t
myapp2_t:process { sigchld };

libsepol.check_assertions: 4 assertion violations occured

libsemanage.semanage_expand_sandbox: Expand module failed

/usr/sbin/semodule:  Failed!

++ /sbin/restorecon -F -R -v /usr/local/bin/myapp2

/sbin/restorecon reset /usr/local/bin/myapp2 context
system_u:object_r:bin_t:s0->system_u:object_r:bin_t:s0

++ /sbin/restorecon -F -R -v /etc/pb.settings

/sbin/restorecon reset /etc/pb.settings context
system_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0

++ /usr/sbin/semanage port -a -t myapp2_port_t -p tcp 23000

libsepol.context_from_record: type myapp2_port_t is not defined

libsepol.context_from_record: could not create context structure

libsepol.port_from_record: could not create port structure for range 23000:23000 (tcp)

libsepol.sepol_port_modify: could not load port range 23000 - 23000 (tcp)

libsemanage.dbase_policydb_modify: could not modify record value

libsemanage.semanage_base_merge_components: could not merge local modifications into
policy

/usr/sbin/semanage: Could not add port tcp/23000

++ echo -ne '\033]0;root@localhost:~'

[root@localhost ~]#



`

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Brian Ginn wrote:
>  using the polgengui, i get an error that the type is unknown (see
> below).
>  
>  
>  
>  I compared the generated files to /usr/share/selinux/devel/example.*
>  
>  I can see that I need to add the initial type myapp2_t;
>  
>  
>  
>  ... there are some other differences.  For example:
>  
>  
>  
>  Polgengui's myapp2.te:
>  
>  corecmd_executable_file(pbrun_exec_t)
>   
>  
>  
>  example.te:
>  
>  domain_type(myapp_t)
>  
>  domain_entry_file(myapp_t, myapp_exec_t)
>  
>  
>  
>  Do these accomplish essentially the same thing?
>  
>  
Not really corecmd_executable_file just identifies the label as being an
executable, which lots of apps will be allowed to execute without a
transition.

domain_type identifies the label as something that applies to a process,
domain_entry_file says that you can start a process labeled myapp_t, by
executing an executable labeled myapp_exec_t.  BUT you still need to
write a transition rule, like domtrans_pattern(unconfined_t,
myapp_exec_t, myapp_t)

Which would say when a process labeled unconfined_t executes an
executable labeled myapp_exec_t, it will transition to a process labeled
myapp_t.

>  
>  
>  
>  Thanks,
>  
>  Brian
>  
>  
>  
>  
>  
>  + . ./myapp2.sh
>  
>  ++ set -x
>  
>  ++ make -f /usr/share/selinux/devel/Makefile
>  
>  Compiling targeted myapp2 module
>  
>  /usr/bin/checkmodule:  loading policy configuration from tmp/myapp2.tmp
>  
>  myapp2.te:22:ERROR 'unknown type myapp2_t' at token ';' on line 83532:
>  
>  
>  
>  allow myapp2_t myapp2_rw_t:file { create getattr setattr read write append rename link
> unlink ioctl lock };
>  
>  /usr/bin/checkmodule:  error(s) encountered while parsing configuration
>  
>  make: *** [tmp/myapp2.mod] Error 1
>  
>  ++ /usr/sbin/semodule -i myapp2.pp
>  
>  libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
> system_chkpwd_t:process { transition };
>  
>  libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
> updpwd_t:process { transition };
>  
>  libsepol.check_assertion_helper: assertion on line 0 violated by allow system_chkpwd_t
> myapp2_t:process { sigchld };
>  
>  libsepol.check_assertion_helper: assertion on line 0 violated by allow updpwd_t
> myapp2_t:process { sigchld };
>  
>  libsepol.check_assertions: 4 assertion violations occured
>  
>  libsemanage.semanage_expand_sandbox: Expand module failed
>  
>  /usr/sbin/semodule:  Failed!
>  
>  ++ /sbin/restorecon -F -R -v /usr/local/bin/myapp2
>  
>  /sbin/restorecon reset /usr/local/bin/myapp2 context
> system_u:object_r:bin_t:s0->system_u:object_r:bin_t:s0
>  
>  ++ /sbin/restorecon -F -R -v /etc/pb.settings
>  
>  /sbin/restorecon reset /etc/pb.settings context
> system_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0
>  
>  ++ /usr/sbin/semanage port -a -t myapp2_port_t -p tcp 23000
>  
>  libsepol.context_from_record: type myapp2_port_t is not defined
>  
>  libsepol.context_from_record: could not create context structure
>  
>  libsepol.port_from_record: could not create port structure for range 23000:23000 (tcp)
>  
>  libsepol.sepol_port_modify: could not load port range 23000 - 23000 (tcp)
>  
>  libsemanage.dbase_policydb_modify: could not modify record value
>  
>  libsemanage.semanage_base_merge_components: could not merge local modifications into
> policy
>  
>  /usr/sbin/semanage: Could not add port tcp/23000
>  
>  ++ echo -ne '\033]0;root@localhost:~'
>  
>  [root@localhost ~]#
>  
>  
>  
>  `
>  
>  
>  
>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkmxJWMACgkQrlYvE4MpobP8gQCeIBGJ5MY2vk/v5qwaqNR1jAfH
> oLsAn1zdQLWspzC0PKeqA140rhTBgN/4
> =TzQA
> -----END PGP SIGNATURE-----

[Miroslav Grepl]

Daniel J Walsh wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  Brian Ginn wrote:
>    
> > using the polgengui, i get an error that the type is unknown (see below).
> >
> >
> >
> > I compared the generated files to /usr/share/selinux/devel/example.*
> >
> > I can see that I need to add the initial type myapp2_t;
> >
> >
> >
> > ... there are some other differences.  For example:
> >
> >
> >
> > Polgengui's myapp2.te:
> >
> > corecmd_executable_file(pbrun_exec_t)
> >
> >     
>
>    
> > example.te:
> >
> > domain_type(myapp_t)
> >
> > domain_entry_file(myapp_t, myapp_exec_t)
> >
> >
> >
> > Do these accomplish essentially the same thing?
> >
> >
> >     
>  Not really corecmd_executable_file just identifies the label as being an
>  executable, which lots of apps will be allowed to execute without a
>  transition.
>
>  domain_type identifies the label as something that applies to a process,
>  domain_entry_file says that you can start a process labeled myapp_t, by
>  executing an executable labeled myapp_exec_t.  BUT you still need to
>  write a transition rule, like domtrans_pattern(unconfined_t,
>  myapp_exec_t, myapp_t)
>
>  Which would say when a process labeled unconfined_t executes an
>  executable labeled myapp_exec_t, it will transition to a process labeled
>  myapp_t.
>
>     
The example of an initial policy for a app, in this case for ceterim app.

centerim.te:

policy_module(centerim,1.0.0)

type centerim_t;
type centerim_exec_t;
application_domain(centerim_t, centerim_exec_t)
role unconfined_r types centerim_t;

###########################

# definiton of transition from unconfined_t to centerim_t
unconfined_domtrans_to(centerim_t, centerim_exec_t)

libs_use_ld_so(centerim_t)
libs_use_shared_libs(centerim_t)

miscfiles_read_localization(centerim_t)

# set permissive mode for centerim_t
permissive centerim_t;


centerim.fc:

/usr/bin/centerim        --      
gen_context(system_u:object_r:centerim_exec_t,s0)

> >
> > Thanks,
> >
> > Brian
> >
> >
> >
> >
> >
> > + . ./myapp2.sh
> >
> > ++ set -x
> >
> > ++ make -f /usr/share/selinux/devel/Makefile
> >
> > Compiling targeted myapp2 module
> >
> > /usr/bin/checkmodule:  loading policy configuration from tmp/myapp2.tmp
> >
> > myapp2.te:22:ERROR 'unknown type myapp2_t' at token ';' on line
> 83532:
> >
> >
> >
> > allow myapp2_t myapp2_rw_t:file { create getattr setattr read write append rename
> link unlink ioctl lock };
> >
> > /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> >
> > make: *** [tmp/myapp2.mod] Error 1
> >
> > ++ /usr/sbin/semodule -i myapp2.pp
> >
> > libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
> system_chkpwd_t:process { transition };
> >
> > libsepol.check_assertion_helper: assertion on line 0 violated by allow myapp2_t
> updpwd_t:process { transition };
> >
> > libsepol.check_assertion_helper: assertion on line 0 violated by allow
> system_chkpwd_t myapp2_t:process { sigchld };
> >
> > libsepol.check_assertion_helper: assertion on line 0 violated by allow updpwd_t
> myapp2_t:process { sigchld };
> >
> > libsepol.check_assertions: 4 assertion violations occured
> >
> > libsemanage.semanage_expand_sandbox: Expand module failed
> >
> > /usr/sbin/semodule:  Failed!
> >
> > ++ /sbin/restorecon -F -R -v /usr/local/bin/myapp2
> >
> > /sbin/restorecon reset /usr/local/bin/myapp2 context
> system_u:object_r:bin_t:s0->system_u:object_r:bin_t:s0
> >
> > ++ /sbin/restorecon -F -R -v /etc/pb.settings
> >
> > /sbin/restorecon reset /etc/pb.settings context
> system_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0
> >
> > ++ /usr/sbin/semanage port -a -t myapp2_port_t -p tcp 23000
> >
> > libsepol.context_from_record: type myapp2_port_t is not defined
> >
> > libsepol.context_from_record: could not create context structure
> >
> > libsepol.port_from_record: could not create port structure for range 23000:23000
> (tcp)
> >
> > libsepol.sepol_port_modify: could not load port range 23000 - 23000 (tcp)
> >
> > libsemanage.dbase_policydb_modify: could not modify record value
> >
> > libsemanage.semanage_base_merge_components: could not merge local modifications into
> policy
> >
> > /usr/sbin/semanage: Could not add port tcp/23000
> >
> > ++ echo -ne '\033]0;root@localhost:~'
> >
> > [root@localhost ~]#
> >
> >
> >
> > `
> >
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >     
>
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.9 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> >
> >  iEYEARECAAYFAkmxJWMACgkQrlYvE4MpobP8gQCeIBGJ5MY2vk/v5qwaqNR1jAfH
> >  oLsAn1zdQLWspzC0PKeqA140rhTBgN/4
> >  =TzQA
> >  -----END PGP SIGNATURE----- 
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>