SELinux survey (was RE: Stupid F7 boot loop)

[Andrew Kelly]

On Wed, 2007-08-29 at 16:04 +0100, Jonathan Allen wrote:
>  On Wed, Aug 29, 2007 at 09:41:19AM -0500, Mikkel L. Ellertson wrote:
>  > From there you can deside if you want to disable selinux, or relabel
>  > the system so selinux works correctly.
>  
>  How is that (easily) done - I haev to admit that now it is running
>  disabled, I'm very much tempted to leave it that way rather then
>  mess about "in flight" so to speak.  Presumably I'll save a little
>  mill time at a fairly minimal risk on a secure system ...
>  
>  Jonathan
>  
>   
Forgive the invitation to discussion, but....

I personally have immediately disabled SELinux on any and every box I've
ever installed for myself, and grind my teeth any time I even see the
word. 

Would any of you out there care to share with me any of your personal
experiences with SELinux being useful to you (in any way whatsoever), on
a single-user workstation?

I'm quite willing to admit my ig'nerz on the subject and am open to
being taught why the functionality is a Good Thing (tm).

Andy

[Alan Cox]

>  Would any of you out there care to share with me any of your
> personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation? 
I leave it on and haven't had any problems with it for the past few
releases. It makes a large subset of potentially exploitable holes turn
into rather unexploitable ones and that to me is of value.

[Ralf Corsepius]

On Wed, 2007-08-29 at 17:09 +0100, Alan Cox wrote:
>  > Would any of you out there care to share with me any of your
> personal
>  > experiences with SELinux being useful to you (in any way whatsoever), on
>  > a single-user workstation?
>  
>  I leave it on  
On a single-user workstation I'd leave it on, because the real
issue
related to SELinux don't occur on single-user workstations, but in
networks, where SELinux tends to interfere with network services.

>  and haven't had any problems with it for the past few
>  releases.  
Well, sometime earlier this week, an SELinux update caused my old i586
to run out of memory during a yum update - but that's definitely not a
typical situation.

I've also observed similar effects to occur during relabeling when with
mock installed (infinite recursions into /var/lib/mock).

>  It makes a large subset of potentially exploitable holes turn
>  into rather unexploitable ones and that to me is of value. 
Ralf

[Rick Sewill]

On Wed, 2007-08-29 at 17:09 +0100, Alan Cox wrote:
>  > Would any of you out there care to share with me any of your
> personal
>  > experiences with SELinux being useful to you (in any way whatsoever), on
>  > a single-user workstation?
>  
>  I leave it on and haven't had any problems with it for the past few
>  releases. It makes a large subset of potentially exploitable holes turn
>  into rather unexploitable ones and that to me is of value.
>   
I leave it on.

I am notified by setroubleshoot when it stops something.

If I think all the errors reported by setroubleshoot are not errors,
I run a script to permit those accesses.

I got the list of commands for the script from a previous thread:

#!/bin/bash

mkdir -p /root/selinux

pushd /root/selinux

declare name="${1:-local}"

declare rebuild="${2}"

if [ -z "${rebuild}" ]
then
    declare origname="${name}"

    declare -i index=1

    while [ -e "${name}.te" ]
    do
      name="${origname}${index}"
      let index++
    done

    audit2allow -m ${name} -l -i /var/log/audit/audit.log > ${name}.te

    checkmodule -M -m -o ${name}.mod ${name}.te
    
    semodule_package -o ${name}.pp -m ${name}.mod
    
    semodule -i ${name}.pp

else
    declare -i index=1

    for i in ${name}*.te
    do
      checkmodule -M -m -o ${i}.mod ${i}.te
    
      semodule_package -o ${i}.pp -m ${i}.mod
    
      semodule -i ${i}.pp
    done
    
fi

popd

My list of exceptions is kept in the directory /root/selinux.

Each time selinux or the target policy for selinux gets updated I remove
the /root/selinux directory and create a new list of exceptions when
setroubleshoot notifies me.

What I am doing requires I look at each notification message and decide
if the message really is bogus.  If I guess wrong, I will be creating a
security hole.  My hope is the list of notifications remain minimal.

At this moment, I have one file, generated by the
script, /root/selinux/local.te, which contains:

module local 1.0;

require {
        type var_lib_nfs_t;
        type httpd_t;
        type system_dbusd_t;
        class dbus send_msg;
        class dir search;
}

#============= httpd_t ==============
allow httpd_t system_dbusd_t:dbus send_msg;
allow httpd_t var_lib_nfs_t:dir search;

I do not claim to know what these exception actually do.

I feel comfortable with these exception because I use iptables to white
list IP addresses that may access my computer.  If your IP address is
not on my list, for the service I want you to access, iptables is set to
drop the incoming packet from you.

Disclaimer: I want to leave selinux on.  I do not pretend to understand
how to properly control/configure selinux.  I created the script by
reading threads on this mailing list.  If the script does not work or
does something bad, please communicate problems to the mailing list.
This mailing list, or other mailing lists, will be able to give help
with selinux.  Any help from me will be the blind leading the blind.

I would appreciate comments from people who do understand selinux on
what I have done.

[Andrew Kelly]

Oops, inadvertently sent this only to Alan.



On Wed, 2007-08-29 at 17:09 +0100, Alan Cox wrote:
>  > Would any of you out there care to share with me any of your
> personal
>  > experiences with SELinux being useful to you (in any way whatsoever), on
>  > a single-user workstation?
>  
>  I leave it on and haven't had any problems with it for the past few
>  releases. It makes a large subset of potentially exploitable holes turn
>  into rather unexploitable ones and that to me is of value. 
Yes, but what exactly is the value-added for you? Please give me some
examples of exploitations that SELinux has make unexploitable. I'm not
being pissy here, forgive me if it reads that way, I'm just wanting to
understand.

In the last half decade I've deployed dozens and dozens (and dozens) of
servers and workstation to take their places in production environments.
> From a simple workstation for myself, to extranet clusters for
international organisations. Never have I personally experienced a need
for any of the security enhancements that a SELinux or an AppArmor
fantasise about providing. (Heck, I've even deployed Internet facing
resources without a firewall in place, for crying out loud.)

The responses I've read so far (my great thanks to all who've replied,
by the way), are telling me that SELinux has greatly improved in the
last couple FC/Fedora releases, but that it's not yet at THAT stage of
ripeness where it reaps nothing but praise.

In a decade, I've had exactly one box compromised. And that was
completely my poor planning and my fault. I exposed a mail server to the
world about half a day before I really wanted to, because I was in a
rush and needing to do 12 things at once. I got myself rooted through a
broken Apache package that hadn't yet been patched, and I learnt a
valuable lesson.

At any rate, let's assume that SELinux is mature and ripe, that it
interferes with nothing and there are no more issues with updates and
whatnot. It's landed, and can be deployed without worry.
What exactly do I gain by doing it? What have I protected myself from?

Andy

[Rahul Sundaram]

Andrew Kelly wrote:

>  
>  At any rate, let's assume that SELinux is mature and ripe, that it
>  interferes with nothing and there are no more issues with updates and
>  whatnot. It's landed, and can be deployed without worry.
>  What exactly do I gain by doing it? What have I protected myself from? 
If you understand what SELinux is, the gain is immediately obvious. Here 
is a recent article

http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat...

Rahul

[Andrew Kelly]

On Thu, 2007-08-30 at 14:50 +0530, Rahul Sundaram wrote:
>  Andrew Kelly wrote:
>  
>  > 
>  > At any rate, let's assume that SELinux is mature and ripe, that it
>  > interferes with nothing and there are no more issues with updates and
>  > whatnot. It's landed, and can be deployed without worry.
>  > What exactly do I gain by doing it? What have I protected myself from?
>  
>  If you understand what SELinux is, the gain is immediately obvious. Here 
>  is a recent article
>  
>
> http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat...
>  
>  Rahul 
Mea Culpa, Rahul.

Thanks for the pointer, much appreciated.

Andy

[Les Mikesell]

Rahul Sundaram wrote:
>  Andrew Kelly wrote:
>  
> >
> > At any rate, let's assume that SELinux is mature and ripe, that it
> > interferes with nothing and there are no more issues with updates and
> > whatnot. It's landed, and can be deployed without worry.
> > What exactly do I gain by doing it? What have I protected myself from?
>  
>  If you understand what SELinux is, the gain is immediately obvious. Here 
>  is a recent article
>  
>
> http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat...
>  
This article doesn't explain whether it follows standards or will always 
be a single-supplier non-standard extension.  If you are using SELinux, 
can you still transparently replace your local disks with network mounts 
  where the systems hosting the disks are appliances or running some 
other OS?  If you can't do that today, is the standard published to 
permit it eventually?

-- 
   Les Mikesell
    lesmikesell(a)gmail.com

[Rahul Sundaram]

Les Mikesell wrote:
>  Rahul Sundaram wrote: 
> >
> >
> http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat...
>
>  
>  
>  This article doesn't explain whether it follows standards or will always 
>  be a single-supplier non-standard extension. 
That's not the focus of the article. There are other documentation 
available for what you want to know.

What standard are you talking about? There is no single supplier nor is 
this a non-standard extension. SELinux is merged upstream and uses 
extended attributions (xattr) which is not SELinux specific.

Multiple distributions and operating systems support the same 
mechanisms. See http://selinux.sourceforge.net/ and 
http://www.trustedbsd.org/sebsd.html for some details.

All distributions that ship policy today are based on the reference 
policy mechanism with customizations to enable them work with 
differences in distributions or can be tweaked to enforce different 
security restrictions (strict vs targeted or something else)

   If you are using SELinux,
>  can you still transparently replace your local disks with network
> mounts 
>   where the systems hosting the disks are appliances or running some 
>  other OS?  
You can. Most of the software don't require any SELinux specify 
modifications and a central policy will be applied on them. Filesystems 
that don't read the extended attributes will ignore it (an example of 
this is NFS. I believe all others .You can assign a specific context via 
the mount command over a entire mount if the filesystem does not support 
extended attributes. More details on the mount man page.

  If you can't do that today, is the standard published to
>  permit it eventually? 
You can find examples on how to add extended attribute support by 
looking at the existing software if that is what you are asking for.

Rahul

[Les Mikesell]

Rahul Sundaram wrote:
> > This article doesn't explain whether it follows standards or
> will 
> > always be a single-supplier non-standard extension.
>  
>  That's not the focus of the article. There are other documentation 
>  available for what you want to know.
>  
>  What standard are you talking about? There is no single supplier nor is 
>  this a non-standard extension. SELinux is merged upstream and uses 
>  extended attributions (xattr) which is not SELinux specific. 
Is there a published standard for network representation of xattr for 
networked filesystems?

>    If you are using SELinux,
> > can you still transparently replace your local disks with network 
> > mounts  where the systems hosting the disks are appliances or running 
> > some other OS? 
>  
>  You can. Most of the software don't require any SELinux specify 
>  modifications and a central policy will be applied on them. Filesystems 
>  that don't read the extended attributes will ignore it (an example of 
>  this is NFS. I believe all others .You can assign a specific context via 
>  the mount command over a entire mount if the filesystem does not support 
>  extended attributes. More details on the mount man page.
>  
>   If you can't do that today, is the standard published to
> > permit it eventually?
>  
>  You can find examples on how to add extended attribute support by 
>  looking at the existing software if that is what you are asking for. 
For the things that do require the extended attributes in the inodes, 
has a cross-platform standard been published or agreed upon for 
networked filesystems?

-- 
   Les Mikesell

[Alan Cox]

>  Is there a published standard for network representation of xattr for
>
>  networked filesystems? 
There were some kicking around for NFSv4 and posix auth. I don't know if
they deal with full attributes however. Mind you NFS itself isn't really
the smartest of mindsets - its usual model is "trust the client"

[Nigel Henry]

On Thursday 30 August 2007 11:20, Rahul Sundaram wrote:
>  Andrew Kelly wrote:
>  > At any rate, let's assume that SELinux is mature and ripe, that it
>  > interferes with nothing and there are no more issues with updates and
>  > whatnot. It's landed, and can be deployed without worry.
>  > What exactly do I gain by doing it? What have I protected myself from?
>
>  If you understand what SELinux is, the gain is immediately obvious. Here
>  is a recent article
>
>  http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat-e
> nterprise-linux-5/
>
>  Rahul 
Hi Rahul

Thanks for the link to that article above. For the first time when installing 
a distro, I'd left Selinux enabled (enforcing) for Fedora 7. There had been 
no problems, but today I tried to FTP into it from the other machine with no 
success. I ran tail -f /var/log/messages on fedora 7, and tried to FTP in 
again from the other machine, and immediately saw it was an Selinux problem. 

The article showed setroubleshoot, so I thought I may as well try and fix the 
problem, so I fired it up, and it showed how to fix the FTP problem with a 
simple:  (if I've remembered the command correctly)
setbool -P ftp_user_dir=1

It worked like magic. I hope any other Selinux problems that crop up on Fedora 
7 are as easy to fix.

All the best.

Nigel.

[Vivek J. Patankar]

Andrew Kelly wrote:
>  Would any of you out there care to share with me any of your
> personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation? 
SELinux was disabled on all but one of my boxes. I had to disable it on 
the server that had it after an incident.
But I do agree with Alan on the point that it adds value, but only if 
you know how to deal with it and troubleshoot it. I don't, yet.

-- 
Regards,
विवेक ज. पाटणकर (Vivek J. Patankar)

Registered Linux User #374218
Fedora release 7 (Moonshine)
Linux 2.6.22.4-65.fc7 x86_64

[Adam Deacon]

Andrew Kelly wrote:
>  Forgive the invitation to discussion, but....
>
>  I personally have immediately disabled SELinux on any and every box I've
>  ever installed for myself, and grind my teeth any time I even see the
>  word. 
>
>  Would any of you out there care to share with me any of your personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation?
>
>  I'm quite willing to admit my ig'nerz on the subject and am open to
>  being taught why the functionality is a Good Thing (tm).
>
>  Andy
>     
I'm slightly ashamed to say, I disable it most of the time too. I've 
spent many good hours troubleshooting bizarre problems only to find out 
it's SELinux and I've missed the log entry. I think the main problem is 
that I don't understand it properly and it's far too quick and easy to 
disable :-)

Adam

[Tim]

On Wed, 2007-08-29 at 17:17 +0200, Andrew Kelly wrote:

>  I personally have immediately disabled SELinux on any and every box
> I've
>  ever installed for myself, and grind my teeth any time I even see the
>  word. 
>  
>  Would any of you out there care to share with me any of your personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation? 
I don't recall having any real problems with it since about FC3, or on
really slow PCs (it does add to the workload).  Since then, I've left it
on, pretty much with the defaults, but occasionally tweaking some of the
options on machines that run servers (e.g. allowing a bit more access
where sharing homespaces over NFS, and webserving, needed it).

Occasionally, there'll be an update that goofs something, but they're
usually fixed pretty quickly.  It can be too much of a show stopper for
it not to get another update out as fast as possible.

These days, the troubleshooter makes it much easier to see what a
problem is, so you can do something about it.  I get a pop-up warning
near the clock that there was a SELinux alert, and I can click for a
report (which shows what program got its knickers in a twist).

-- 
(This box runs FC5, my others run FC4 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Yuan Yijun]

Me. I don't have any problems either. I read Dan's LJ and learnt a lot
there. It is something really covers every aspect of your computer,
and you can trust it.

With the selinux faq and Dan's latest article regarding
system-config-selinux and installable modules, I think it could be
accepted by more people.



-- 
bbbush ^_^

[Don Russell]

Andrew Kelly wrote:
>  On Wed, 2007-08-29 at 16:04 +0100, Jonathan Allen wrote:
>    
> > On Wed, Aug 29, 2007 at 09:41:19AM -0500, Mikkel L. Ellertson wrote:
> >     
> >> From there you can deside if you want to disable selinux, or relabel
> >> the system so selinux works correctly.
> >>       
> > How is that (easily) done - I haev to admit that now it is running
> > disabled, I'm very much tempted to leave it that way rather then
> > mess about "in flight" so to speak.  Presumably I'll save a little
> > mill time at a fairly minimal risk on a secure system ...
> >
> > Jonathan
> >
> >
> >     
>
>  Forgive the invitation to discussion, but....
>
>  I personally have immediately disabled SELinux on any and every box I've
>  ever installed for myself, and grind my teeth any time I even see the
>  word. 
>
>  Would any of you out there care to share with me any of your personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation?
>
>  I'm quite willing to admit my ig'nerz on the subject and am open to
>  being taught why the functionality is a Good Thing (tm).
>
>  Andy
>     
After reading several replies to this thread, I see "I am not alone" ...

I have SELinux turned on, in permissive mode.... everyday I see various 
denial messages in my Logwatch report which I have not yet taken the 
time to figure out. They are cryptic to say the least. But, like so many 
things that appear complex at first glance, it just takes a little 
reading and experimentation. (eg. iptables CLI commands)

At a high level, I understand the concepts of what SELinux is doing.... 
and like the idea, but I have not tried to learn how to use it. I 
suppose if I were feeling a little more brave, I would turn it on in 
"enforcing" mode then fight whichever fires flared up.

However, I have not made the time to do that...my "plan" (and I use the 
term loosely) is to figure it out, eliminate improper error messages 
from my Logwatch reports, and THEN try SELinux in enforcing mode....

That's the theory... in practice, I will probably wait until I have a 
spare box to run another Linux image on, and play with that one more 
aggressively.... :-)

[Claude Jones]

On Thursday August 30 2007 11:35:42 am Don Russell wrote:
>  That's the theory... in practice, I will probably wait until I
>  have a spare box to run another Linux image on, and play with
>  that one more aggressively.... :-) 
Do you have setroubleshoot installed? It would make your task a 
lot simpler from what you described as your current approach - 
trying to decrypt log files. Setroubleshoot does the heavy 
lifting and gives you several approaches towards resolving the 
problem in plain language

-- 
Claude Jones
Brunswick, MD, USA

[Don Russell]

Claude Jones wrote:
>  On Thursday August 30 2007 11:35:42 am Don Russell wrote:
>    
> > That's the theory... in practice, I will probably wait until I
> > have a spare box to run another Linux image on, and play with
> > that one more aggressively.... :-)
> >     
>
>  Do you have setroubleshoot installed? It would make your task a 
>  lot simpler from what you described as your current approach - 
>  trying to decrypt log files. Setroubleshoot does the heavy 
>  lifting and gives you several approaches towards resolving the 
>  problem in plain language
>     
I just installed setroubleshoot.... thanks for the tip :-)

[Bruno Wolff III]

On Wed, Aug 29, 2007 at 17:17:12 +0200,
  Andrew Kelly <akelly(a)corisweb.org&gt; wrote:
>  
>  Would any of you out there care to share with me any of your personal
>  experiences with SELinux being useful to you (in any way whatsoever), on
>  a single-user workstation? 
Currently it limits damages if a network service is compromised.
You might find the guest user policy if F8 more useful. Without SELinux,
giving someone you don't completely trust access to your systems is very
dangerous. The guest SELinux policy will greatly reduce that risk.
I haven't had any serious problems with SELinux on recent version of
Fedora, except when I tried playing with MCS and found that didn't work
in a way that was very useful and I spent a fair amount of effort trying
to remove the MCS labels that got added places I didn't want them.