user home - disable execution
by Hal
Hi all
I am new to selinux and I want to use it to acheive 3 main goals:
1. disable execution of any executables located in users' home dir trees.
2. disable users to see what other users exist on the system.
3. disable users to see who is logged in and what processes is running.
Does anybody have any policy modules doing something similar? I
need a starting point. A clue, what ever to point me the right direction.
I have been reading "Selinux by example" and "SELINUX NSA'a open source
Security Enhabced linux" but both books seem quite out of date. All I have
learned is
how to write useless rules, because I do not know how to make a modile how to
use module to override the default policy etc.
Thanks in advance!
Hal
____________________________________________________________________________________
Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online.
http://smallbusiness.yahoo.com/webhosting
16 years, 9 months
Re: Debian testing +selinux
by Justin Conover
On 7/23/07, Stephen Smalley <sds(a)tycho.nsa.gov> wrote:
>
> On Mon, 2007-07-23 at 09:23 -0500, Justin Conover wrote:
> >
> >
> > On 7/23/07, Stephen Smalley <sds(a)tycho.nsa.gov> wrote:
> > On Mon, 2007-07-23 at 09:09 -0500, Justin Conover wrote:
> > > I'm not sure if there is a regular selinux mailing list or
> > not, I
> > > mainly use Fedora but thought someone here might be able to
> > help.
> >
> > http://www.nsa.gov/selinux/info/list.cfm
> >
> >
> > Thank you, I saw that list but it said "SELinux Developers mailing
> > list" and I'm not a developer so I thought that excluded me :)
>
> Nope.
>
> > So if I remove the rule entirely, does that mean take it out of
> > local.te? The parts talking about hald.
>
> Only one that is relevant to this assertion is the one between hald_t
> and memory_device_t.
>
> --
> Stephen Smalley
> National Security Agency
>
> Ok, I have removed the hald_t memory_device part:
comatose:~# grep hald local.te
type hald_t;
#============= hald_t ==============
#allow hald_t memory_device_t:chr_file read;
allow hald_t var_t:file { read getattr };
comatose:~# checkmodule -M -m -o local.mod local.te
checkmodule: loading policy configuration from local.te
checkmodule: policy configuration loaded
checkmodule: writing binary representation (version 6) to local.mod
comatose:~# semodule_package -o local.pp -m local.mod
comatose:~# semodule -i local.pp
comatose:~#
Another question, does doing this audit2allow method sort of mean "I have no
idea what I'm doing, so allow it all", or is that why it caught the hald_t
memory portion and said NO, don't do this!
16 years, 9 months
Debian testing +selinux
by Justin Conover
I'm not sure if there is a regular selinux mailing list or not, I mainly use
Fedora but thought someone here might be able to help.
I'm playing with selinux on Debian Testing and decided to try and write a
policy from following the fc5 faq
http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385
Here is what I have done:
comatose:~# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: permissive
Mode from config file: permissive
Policy version: 21
Policy from config file: refpolicy-targeted
comatose:~# audit2allow -m local -l -i /var/log/audit/audit.log > local.te
comatose:~# checkmodule -M -m -o local.mod local.te
checkmodule: loading policy configuration from local.te
checkmodule: policy configuration loaded
checkmodule: writing binary representation (version 6) to local.mod
comatose:~# semodule_package -o local.pp -m local.mod
comatose:~# semodule -i local.pp
libsepol.check_assertion_helper: assertion on line 0 violated by allow
hald_t memory_device_t:chr_file { read };
libsepol.check_assertions: 1 assertion violations occured
libsemanage.semanage_expand_sandbox: Expand module failed
semodule: Failed!
comatose:~# cat local.te
module local 1.0;
require {
type unconfined_t;
type lib_t;
type xserver_log_t;
type mount_t;
type var_run_t;
type syslogd_t;
type etc_runtime_t;
type initrc_t;
type xdm_t;
type udev_t;
type device_t;
type hald_t;
type xdm_xserver_t;
type memory_device_t;
type insmod_t;
type dhcpc_t;
type var_t;
type etc_t;
type security_t;
class fifo_file write;
class process { execstack execmem signal };
class unix_stream_socket { read write };
class chr_file read;
class fd use;
class file { write rename getattr append read create unlink
execute_no_trans };
class filesystem getattr;
class dir { write remove_name create add_name rmdir };
}
#============= dhcpc_t ==============
allow dhcpc_t etc_runtime_t:file unlink;
#============= hald_t ==============
allow hald_t memory_device_t:chr_file read;
allow hald_t var_t:file { read getattr };
#============= insmod_t ==============
allow insmod_t xdm_t:fd use;
allow insmod_t xdm_xserver_t:unix_stream_socket { read write };
allow insmod_t xserver_log_t:file write;
#============= mount_t ==============
allow mount_t security_t:filesystem getattr;
#============= syslogd_t ==============
allow syslogd_t device_t:fifo_file write;
#============= udev_t ==============
allow udev_t etc_t:dir { write remove_name add_name };
allow udev_t etc_t:file { write rename create unlink append };
allow udev_t initrc_t:process signal;
allow udev_t lib_t:file execute_no_trans;
allow udev_t var_run_t:dir { create rmdir };
#============= unconfined_t ==============
allow unconfined_t self:process { execstack execmem };
16 years, 9 months
insmod_t wants sys_nice ....
by Tom London
After installing this morning's Rawhide, including
selinux-policy-targeted-3.0.3-3.fc8, selinux-policy-3.0.3-3.fc8 and
selinux-policy-devel-3.0.3-3.fc8, I get lots of
Jul 21 10:39:01 localhost kernel: audit(1185039533.420:74): avc:
denied { sys_nice } for pid=1796 comm="modprobe" capability=23
scontext=system_u:system_r:insmod_t:s0
tcontext=system_u:system_r:insmod_t:s0 tclass=capability
Jul 21 10:39:01 localhost kernel: audit(1185039533.920:75): avc:
denied { sys_nice } for pid=1829 comm="modprobe" capability=23
scontext=system_u:system_r:insmod_t:s0
tcontext=system_u:system_r:insmod_t:s0 tclass=capability
in /var/log/messages, and similar
type=AVC msg=audit(1185039594.415:93): avc: denied { sys_nice } for
pid=3157 comm="modprobe" capability=23
scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability
type=SYSCALL msg=audit(1185039594.415:93): arch=40000003 syscall=128
success=yes exit=0 a0=b7f13008 a1=180f4 a2=a0166f8 a3=a0166f8 items=0
ppid=3133 pid=3157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="modprobe" exe="/sbin/modprobe"
subj=system_u:system_r:insmod_t:s0-s0:c0.c1023 key=(null)
in /var/log/audit/audit.log
tom
--
Tom London
16 years, 9 months
gconf AVCs....
by Tom London
Login spawns these:
type=USER_LOGIN msg=audit(1184940747.700:30): user pid=3063 uid=0
auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500:
exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain,
addr=127.0.0.1, terminal=:0 res=success)'
type=AVC msg=audit(1184940749.700:31): avc: denied { associate } for
pid=3234 comm="gconfd-2" name=".testing.writeability"
scontext=system_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1184940749.700:31): arch=40000003 syscall=5
success=no exit=-13 a0=811ef20 a1=41 a2=1c0 a3=811ef20 items=0 ppid=1
pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) comm="gconfd-2"
exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0
key=(null)
type=AVC msg=audit(1184940756.200:32): avc: denied { associate } for
pid=3234 comm="gconfd-2" name=".testing.writeability"
scontext=system_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1184940756.200:32): arch=40000003 syscall=5
success=no exit=-13 a0=8345d90 a1=41 a2=1c0 a3=8345d90 items=0 ppid=1
pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) comm="gconfd-2"
exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0
key=(null)
type=AVC msg=audit(1184940779.699:33): avc: denied { associate } for
pid=3234 comm="gconfd-2" name="saved_state.tmp"
scontext=system_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1184940779.699:33): arch=40000003 syscall=5
success=no exit=-13 a0=834c8a0 a1=241 a2=1c0 a3=811d230 items=0 ppid=1
pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) comm="gconfd-2"
exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0
key=(null)
tom
--
Tom London
16 years, 9 months
EnCase
by Marcio B. Jr.
Dear list,
is there any documentation regarding SE Linux and the forensic solution
named EnCase Enterprise?
Thank you in advance,
--
Marcio Barbado, Jr.
==============
==============
16 years, 9 months
Text console not setting category
by Forrest Taylor
I have a user that has a category different than the default. When I
log in to the GUI or via ssh, the category is set. However, when I
login to the text console, the category is not set. Is this a bug in
login or do I have unreasonable expectations?
# semanage translation -l
s0:c1 admin1
# semanage login -l
student user_u admin1
Through ssh/GUI:
$ id -Z
user_u:system_r:unconfined_t:admin1
Through text console:
$ id -Z
system_u:system_r:unconfined_t:SystemLow-SystemHigh
Now that I write this, I notice that the user and role have changed as
well. I also notice this in the audit log:
type=USER_ROLE_CHANGE msg=audit(1184777815.107:4063): user pid=5517
uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='pam: default-context=user_u:system_r:unconfined_t:s0:c1 selected-
context=?: exe="/bin/login" (hostname=?, addr=?, terminal=tty1
res=success)'
This is running on RHEL 5.0.0 targeted policy. Any clues?
Thanks,
Forrest
16 years, 9 months
mindterm (java_t) AVCs
by Tom London
Running latest rawhide, targeted enforcing:
Running 'java -jar mindterm.jar' with mindterm-3.1.2 produced AVC.
Putting in permissive mode and running, I get these:
type=AVC msg=audit(1184596927.029:42): avc: denied { unix_read } for
pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=AVC msg=audit(1184596927.029:42): avc: denied { read } for
pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=SYSCALL msg=audit(1184596927.029:42): arch=40000003 syscall=117
success=yes exit=0 a0=15 a1=110017 a2=1000 a3=bfd97ef8 items=0
ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg"
subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1184596927.029:43): avc: denied { getattr
associate } for pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=SYSCALL msg=audit(1184596927.029:43): arch=40000003 syscall=117
success=yes exit=0 a0=18 a1=110017 a2=102 a3=0 items=0 ppid=3206
pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg"
subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1184596928.029:44): avc: denied { unix_write }
for pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=AVC msg=audit(1184596928.029:44): avc: denied { write } for
pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=SYSCALL msg=audit(1184596928.029:44): arch=40000003 syscall=117
success=yes exit=0 a0=15 a1=118017 a2=0 a3=bfd97ef8 items=0 ppid=3206
pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg"
subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
or
allow xdm_xserver_t java_t:shm { write unix_read getattr unix_write
associate read };
BTW, the app appears to run in enforcing mode, even with the AVC.
Here is the only enforcing AVC:
type=AVC msg=audit(1184596881.529:40): avc: denied { unix_read } for
pid=3208 comm="X" key=0
scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
tcontext=system_u:system_r:java_t:s0 tclass=shm
type=SYSCALL msg=audit(1184596881.529:40): arch=40000003 syscall=117
success=no exit=-13 a0=15 a1=108017 a2=1000 a3=bfd97ef8 items=0
ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg"
subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
tom
--
Tom London
16 years, 9 months
cups AVC...
by Tom London
Seem to be getting this one from cups. Haven't seen 'anon_inodefs' before....
Printing to HP5MP seems to work however....
tom
type=AVC msg=audit(1184938825.408:32): avc: denied { ioctl } for
pid=5296 comm="cupsd" name="[eventpoll]" dev=anon_inodefs ino=385
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
type=SYSCALL msg=audit(1184938825.408:32): arch=40000003 syscall=54
success=no exit=-13 a0=1 a1=5401 a2=bfda72ac a3=bfda73cc items=0
ppid=5295 pid=5296 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="cupsd" exe="/usr/sbin/cupsd"
subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
type=AVC_PATH msg=audit(1184938825.408:32): path="anon_inode:[eventpoll]"
type=LABEL_LEVEL_CHANGE msg=audit(1184938825.408:33): user pid=5296
uid=0 auid=500 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023
msg='printer=HP5MP uri=hp:/par/HP_LaserJet_5MP?device=/dev/parport0
banners=none,none range=unknown: exe="/usr/sbin/cupsd"
(hostname=localhost.localdomain, addr=127.0.0.1, terminal=?
res=success)'
--
Tom London
16 years, 9 months
Messages from update to selinux-policy-3.0.3-2.fc8
by Tom London
[root@localhost Downloads]# rpm -Uvh selinux*
Preparing... ########################################### [100%]
1:selinux-policy ########################################### [ 33%]
2:selinux-policy-devel ########################################### [ 67%]
3:selinux-policy-targeted########################################### [100%]
libsemanage.semanage_commit_sandbox: Error while renaming
/etc/selinux/targeted/modules/active to
/etc/selinux/targeted/modules/previous.
/usr/sbin/semanage: Could not add SELinux user guest_u
libsemanage.semanage_commit_sandbox: Error while renaming
/etc/selinux/targeted/modules/active to
/etc/selinux/targeted/modules/previous.
/usr/sbin/semanage: Could not add SELinux user xguest_u
[root@localhost Downloads]#
Got this AVC:
type=AVC msg=audit(1184939434.913:47): avc: denied { rename } for
pid=5453 comm="semanage" name="active" dev=dm-0 ino=11076264
scontext=system_u:system_r:semanage_t:s0
tcontext=system_u:object_r:selinux_config_t:s0 tclass=dir
type=SYSCALL msg=audit(1184939434.913:47): arch=40000003 syscall=38
success=no exit=-13 a0=85a0d40 a1=85a0d70 a2=1975c4 a3=bf9eec98
items=0 ppid=5443 pid=5453 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts0 comm="semanage" exe="/usr/bin/python"
subj=system_u:system_r:semanage_t:s0 key=(null)
type=USER_ROLE_CHANGE msg=audit(1184939434.913:48): user pid=5453
uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=add
SELinux user record acct="xguest_u" old-seuser=? old-role=?
old-range=? new-seuser=xguest_u new-role=xguest_r new-range=s0
exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=pts/0
res=failed)'
[similar one for 'guest_u']
tom
--
Tom London
16 years, 9 months