MLS X on Fedora 13
by Tyler Durvik
I installed Fedora 13 and would like to set up MLS and the X server.
I performed the default installation in VMware for testing. Where can
I get information on setting this up?
Thanks.
13 years, 11 months
Fedora13 breaks nagios
by Vadym Chepkov
Hi,
It seems some changes in were introduced in Fedora 13 that broke nagios.
audit2allow suggests
#============= nagios_t ==============
files_read_usr_files(nagios_t)
seems reasonable :
time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.739:39): arch=c000003e syscall=4 success=yes exit=0 a0=2658a10 a1=7fffd5ad5590 a2=7fffd5ad5590 a3=20 items=0 ppid=1602 pid=1612
auid=0 uid=494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:na
gios_t:s0 key=(null)
type=AVC msg=audit(1274807269.739:39): avc: denied { getattr } for pid=1612 comm="nagios" path="/usr/share/perl5/strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file----
time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.739:40): arch=c000003e syscall=2 success=yes exit=128 a0=2658a70 a1=0 a2=1b6 a3=7f1b126c2770 items=0 ppid=1602 pid=1612 auid=0
uid=494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:nagios_t:s0 key=(null)
type=AVC msg=audit(1274807269.739:40): avc: denied { open } for pid=1612 comm="nagios" name="strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nag
ios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file
type=AVC msg=audit(1274807269.739:40): avc: denied { read } for pid=1612 comm="nagios" name="strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file----
time->Tue May 25 13:07:49 2010type=SYSCALL msg=audit(1274807269.740:41): arch=c000003e syscall=16 success=yes exit=128 a0=5 a1=5401 a2=7fffd5ad5300 a3=48 items=0 ppid=1602 pid=1612 auid=0 uid
=494 gid=488 euid=494 suid=494 fsuid=494 egid=488 sgid=488 fsgid=488 tty=hvc0 ses=1 comm="nagios" exe="/usr/sbin/nagios" subj=unconfined_u:system_r:nagios_t:s0 k
ey=(null)
type=AVC msg=audit(1274807269.740:41): avc: denied { ioctl } for pid=1612 comm="nagios" path="/usr/share/perl5/strict.pm" dev=dm-4 ino=138658 scontext=unconfined_u:system_r:nagios_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file----
#============= ping_t ==============
allow ping_t nagios_log_t:file { read write };
but I think some transition is missing for ping_t -> nagios_t here
time->Tue May 25 13:08:08 2010
type=SYSCALL msg=audit(1274807288.135:43): arch=c000003e syscall=59 success=yes exit=0 a0=1d50730 a1=1d50760 a2=7fffe1999de0 a3=7fffe1999b40 items=0 ppid=1647 id=1648 auid=0 uid=494 gid=488 euid=0 suid=0 fsuid=0 egid=488 sgid=488 fsgid=488 tty=(none) ses=1 comm="ping" exe="/bin/ping" subj=unconfined_u:system_r:ping_t:s0 key=(null)
type=AVC msg=audit(1274807288.135:43): avc: denied { read write } for pid=1648 comm="ping" path="/var/log/nagios/spool/checkresults/checkhvg3ZF" dev=dm-2 in=3824 scontext=unconfined_u:system_r:ping_t:s0 tcontext=unconfined_u:object_r:nagios_log_t:s0 tclass=file
13 years, 11 months
Device nodes have no type when booting a 2.6.32.*.fc12 kernel
by Karl-Michael Schneider
I have fc12 installed on a Lenovo R61 laptop with two kernels:
kernel-2.6.31.12-174.2.22.fc12.i686
kernel-2.6.32.12-115.fc12.i686
The 2.6.31 kernel has no problem. But when I try to boot the 2.6.32
kernel it fails because SELinux is blocking access to device nodes. I
can only boot the 2.6.32 kernel in single user mode. The reason is
that /dev and all files in it have no type:
$ ls -lZ /dev
crw-------. root root system_u:object_r:unlabeled_t:s0 agpgart
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 block
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 bsg
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 bus
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 char
crw-------. root root system_u:object_r:unlabeled_t:s0 console
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 cpu
crw-rw----. root root system_u:object_r:unlabeled_t:s0 cpu_dma_latency
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 disk
brw-rw----. root root system_u:object_r:unlabeled_t:s0 dm-0
brw-rw----. root root system_u:object_r:unlabeled_t:s0 dm-1
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 dri
crw-r--r--. root root system_u:object_r:unlabeled_t:s0 fb
crw-rw----. root root system_u:object_r:unlabeled_t:s0 fb0
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 full
crw-rw----. root root system_u:object_r:unlabeled_t:s0 fw0
crw-rw----. root root system_u:object_r:unlabeled_t:s0 hpet
crw-r--r--. root root system_u:object_r:unlabeled_t:s0 hvc0
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 input
crw-rw----. root root system_u:object_r:unlabeled_t:s0 kmsg
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop0
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop1
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop2
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop3
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop4
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop5
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop6
brw-rw----. root disk system_u:object_r:unlabeled_t:s0 loop7
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 mapper
crw-rw----. root root system_u:object_r:unlabeled_t:s0 mcelog
crw-r-----. root root system_u:object_r:unlabeled_t:s0 mem
crw-rw----. root root system_u:object_r:unlabeled_t:s0 network_latency
crw-rw----. root root system_u:object_r:unlabeled_t:s0 network_throughput
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 null
crw-r-----. root root system_u:object_r:unlabeled_t:s0 nvram
crw-rw----. root root system_u:object_r:unlabeled_t:s0 oldmem
crw-r-----. root root system_u:object_r:unlabeled_t:s0 port
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 ptmx
drwxr-xr-x. root root system_u:object_r:devpts_t:s0 pts
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 random
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 raw
lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 root ->
/dev/VolGroup00/LogVol00
lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 rtc -> rtc0
crw-rw----. root root system_u:object_r:unlabeled_t:s0 rtc0
lrwxrwxrwx. root root system_u:object_r:unlabeled_t:s0 scd0 -> sr0
brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda
brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda1
brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda2
brw-rw----. root root system_u:object_r:unlabeled_t:s0 sda3
crw-rw----. root root system_u:object_r:unlabeled_t:s0 sg0
crw-rw----. root root system_u:object_r:unlabeled_t:s0 sg1
drwxrwxrwt. root root system_u:object_r:tmpfs_t:s0 shm
crw-rw----. root root system_u:object_r:unlabeled_t:s0 snapshot
brw-rw----. root root system_u:object_r:unlabeled_t:s0 sr0
crw-r--r--. root root system_u:object_r:unlabeled_t:s0 systty
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 tty
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty0
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty1
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty10
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty11
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty12
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty13
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty14
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty15
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty16
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty17
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty18
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty19
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty2
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty20
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty21
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty22
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty23
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty24
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty25
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty26
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty27
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty28
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty29
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty3
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty30
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty31
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty32
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty33
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty34
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty35
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty36
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty37
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty38
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty39
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty4
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty40
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty41
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty42
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty43
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty44
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty45
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty46
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty47
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty48
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty49
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty5
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty50
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty51
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty52
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty53
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty54
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty55
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty56
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty57
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty58
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty59
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty6
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty60
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty61
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty62
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty63
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty7
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty8
crw--w----. root root system_u:object_r:unlabeled_t:s0 tty9
crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS0
crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS1
crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS2
crw-rw----. root root system_u:object_r:unlabeled_t:s0 ttyS3
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 urandom
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon0
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon1
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon2
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon3
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon4
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon5
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon6
crw-rw----. root root system_u:object_r:unlabeled_t:s0 usbmon7
crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcs
crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcs1
crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcsa
crw-rw----. root root system_u:object_r:unlabeled_t:s0 vcsa1
crw-rw----. root root system_u:object_r:unlabeled_t:s0 vga_arbiter
drwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 VolGroup00
crw-rw-rw-. root root system_u:object_r:unlabeled_t:s0 zero
When I boot the 2.6.31 kernel, the device files are correctly labeled:
$ ls -lZ /dev
crw-rw----. root audio system_u:object_r:sound_device_t:s0 adsp
crw-------. root video system_u:object_r:agp_device_t:s0 agpgart
crw-rw----. root audio system_u:object_r:sound_device_t:s0 audio
drwxr-xr-x. root root system_u:object_r:device_t:s0 block
drwxr-xr-x. root root system_u:object_r:device_t:s0 bsg
drwxr-xr-x. root root system_u:object_r:device_t:s0 bus
lrwxrwxrwx. root root system_u:object_r:device_t:s0 cdrom1 -> sr0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 cdrw1 -> sr0
drwxr-xr-x. root root system_u:object_r:device_t:s0 char
crw-------. root root system_u:object_r:console_device_t:s0 console
lrwxrwxrwx. root root system_u:object_r:device_t:s0 core -> /proc/kcore
drwxr-xr-x. root root system_u:object_r:device_t:s0 cpu
crw-rw----. root root system_u:object_r:netcontrol_device_t:s0
cpu_dma_latency
drwxr-xr-x. root root system_u:object_r:device_t:s0 disk
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 dm-0
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 dm-1
drwxr-xr-x. root root system_u:object_r:device_t:s0 dri
crw-rw----. root audio system_u:object_r:sound_device_t:s0 dsp
lrwxrwxrwx. root root system_u:object_r:device_t:s0 dvd1 -> sr0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 dvdrw1 -> sr0
crw-r--r--. root root system_u:object_r:framebuf_device_t:s0 fb
crw-rw----. root video system_u:object_r:framebuf_device_t:s0 fb0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 fd -> /proc/self/fd
crw-rw-rw-. root root system_u:object_r:null_device_t:s0 full
crw-rw-rw-. root root system_u:object_r:fuse_device_t:s0 fuse
crw-rw----. root root system_u:object_r:usb_device_t:s0 fw0
crw-rw----. root root system_u:object_r:clock_device_t:s0 hpet
drwxr-xr-x. root root system_u:object_r:device_t:s0 hugepages
crw-r--r--. root root system_u:object_r:tty_device_t:s0 hvc0
drwxr-xr-x. root root system_u:object_r:device_t:s0 input
crw-rw----. root root system_u:object_r:kmsg_device_t:s0 kmsg
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop0
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop1
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop2
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop3
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop4
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop5
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop6
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 loop7
crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp0
crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp1
crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp2
crw-rw----. root lp system_u:object_r:printer_device_t:s0 lp3
lrwxrwxrwx. root root system_u:object_r:device_t:s0 MAKEDEV ->
/sbin/MAKEDEV
drwxr-xr-x. root root system_u:object_r:device_t:s0 mapper
crw-rw----. root root system_u:object_r:kmsg_device_t:s0 mcelog
crw-r-----. root kmem system_u:object_r:memory_device_t:s0 mem
crw-rw----. root audio system_u:object_r:sound_device_t:s0 mixer
drwxr-xr-x. root root system_u:object_r:device_t:s0 net
crw-rw----. root root system_u:object_r:netcontrol_device_t:s0
network_latency
crw-rw----. root root system_u:object_r:netcontrol_device_t:s0
network_throughput
crw-rw-rw-. root root system_u:object_r:null_device_t:s0 null
crw-r-----. root kmem system_u:object_r:nvram_device_t:s0 nvram
crw-rw----. root root system_u:object_r:memory_device_t:s0 oldmem
crw-r-----. root kmem system_u:object_r:memory_device_t:s0 port
crw-------. root root system_u:object_r:ppp_device_t:s0 ppp
crw-rw-rw-. root tty system_u:object_r:ptmx_t:s0 ptmx
drwxr-xr-x. root root system_u:object_r:devpts_t:s0 pts
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram0
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram1
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram10
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram11
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram12
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram13
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram14
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram15
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram2
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram3
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram4
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram5
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram6
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram7
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram8
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 ram9
crw-rw-rw-. root root system_u:object_r:random_device_t:s0 random
drwxr-xr-x. root root system_u:object_r:device_t:s0 raw
crw-rw-r--. root root system_u:object_r:device_t:s0 rfkill
lrwxrwxrwx. root root system_u:object_r:device_t:s0 root ->
/dev/VolGroup00/LogVol00
lrwxrwxrwx. root root system_u:object_r:device_t:s0 rtc -> rtc0
crw-rw----. root root system_u:object_r:clock_device_t:s0 rtc0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 scd0 -> sr0
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda1
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda2
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 sda3
crw-rw----. root audio system_u:object_r:sound_device_t:s0 sequencer
crw-rw----. root audio system_u:object_r:sound_device_t:s0 sequencer2
crw-rw----. root disk system_u:object_r:scsi_generic_device_t:s0 sg0
crw-rw----. root cdrom system_u:object_r:scsi_generic_device_t:s0 sg1
drwxrwxrwt. root root system_u:object_r:device_t:s0 shm
crw-rw----. root root system_u:object_r:apm_bios_t:s0 snapshot
drwxr-xr-x. root root system_u:object_r:device_t:s0 snd
brw-rw----. root cdrom system_u:object_r:removable_device_t:s0 sr0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 stderr ->
/proc/self/fd/2
lrwxrwxrwx. root root system_u:object_r:device_t:s0 stdin ->
/proc/self/fd/0
lrwxrwxrwx. root root system_u:object_r:device_t:s0 stdout ->
/proc/self/fd/1
crw-r--r--. root root system_u:object_r:tty_device_t:s0 systty
crw-rw-rw-. root tty system_u:object_r:devtty_t:s0 tty
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty0
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty1
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty10
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty11
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty12
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty13
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty14
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty15
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty16
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty17
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty18
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty19
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty2
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty20
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty21
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty22
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty23
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty24
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty25
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty26
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty27
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty28
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty29
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty3
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty30
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty31
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty32
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty33
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty34
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty35
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty36
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty37
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty38
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty39
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty4
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty40
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty41
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty42
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty43
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty44
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty45
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty46
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty47
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty48
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty49
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty5
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty50
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty51
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty52
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty53
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty54
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty55
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty56
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty57
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty58
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty59
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty6
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty60
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty61
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty62
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty63
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty7
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty8
crw--w----. root tty system_u:object_r:tty_device_t:s0 tty9
crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS0
crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS1
crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS2
crw-rw----. root dialout system_u:object_r:tty_device_t:s0 ttyS3
crw-rw-rw-. root root system_u:object_r:urandom_device_t:s0 urandom
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon0
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon1
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon2
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon3
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon4
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon5
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon6
crw-rw----. root root system_u:object_r:usb_device_t:s0 usbmon7
crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcs
crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcs1
crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcsa
crw-rw----. vcsa tty system_u:object_r:tty_device_t:s0 vcsa1
crw-rw----. root root system_u:object_r:device_t:s0 vga_arbiter
drwxr-xr-x. root root system_u:object_r:device_t:s0 VolGroup00
crw-rw----. root root system_u:object_r:watchdog_device_t:s0 watchdog
crw-rw-rw-. root root system_u:object_r:zero_device_t:s0 zero
The filesystem is ext3 on LVM:
$ cat /etc/fstab
/dev/VolGroup00/LogVol00 / ext3 defaults 1 1
...
The filesystem was created when I installed FC9. Later I upgraded to
FC12. But the problem only appeared when the kernel was updated from
2.6.31 to 2.6.32. All 2.6.32 kernels so far had the same problem.
I have already relabeled the filesystem, but it didn't help. I tried
restorecon -R -v /dev after booting the 2.6.32 kernel but it didn't do
anything.
13 years, 11 months
Make patch SELinux compatible
by Vadym Chepkov
Hi,
Is there a way to make patch in Redhat SELinux compatible?
# ls -Z php.php
-rw-r--r-- root root user_u:object_r:httpd_sys_content_t:s0 php.php
# patch -p1 < /root/php.patch
patching file php.php
# ls -Z php.php
-rw-r--r-- root root user_u:object_r:tmp_t:s0 php.php
Thanks,
Vadym Chepkov
13 years, 11 months
Set context for NFS mounted homes
by Andrew R. Fore
I am having an issue setting the context for NFS mounted homes. I have set the mode to enforcing as well as enabling the booleans for support of NFS home directories. My homes mount and my NIS users can authenticate and see them with no problem.
The issue at hand is the following report from the AVC Alert service (note: I have obscured the real hostname in this e-mail):
+++
SELinux is preventing the restorecond from using potentially mislabeled files
(arfore).
Detailed Description:
SELinux has denied restorecond access to potentially mislabeled file(s)
(arfore). This means that SELinux will not allow restorecond to use these files.
It is common for users to edit files in their home directory or tmp directories
and then move (mv) them to system directories. The problem is that the files end
up with the wrong file context which confined applications are not allowed to
access.
Allowing Access:
If you want restorecond to access this files, you need to relabel them using
restorecon -v 'arfore'. You might want to relabel the entire directory using
restorecon -R -v '<Unknown>'.
Additional Information:
Source Context system_u:system_r:restorecond_t
Target Context user_u:object_r:user_home_t
Target Objects arfore [ lnk_file ]
Source restorecond
Source Path /usr/sbin/restorecond
Port <Unknown>
Host xxx.xxxx.xxx
Source RPM Packages policycoreutils-1.33.12-14.8.el5
Target RPM Packages
Policy RPM selinux-policy-2.4.6-279.el5
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name home_tmp_bad_labels
Host Name xxx.xxxx.xxx
Platform Linux xxx.xxxx.xxx 2.6.18-194.3.1.el5 #1 SMP
Sun May 2 04:17:42 EDT 2010 x86_64 x86_64
Alert Count 29
First Seen Tue May 18 15:05:01 2010
Last Seen Tue May 18 15:39:31 2010
Local ID b41fdf79-19aa-4899-8f9f-6449124e61af
Line Numbers
Raw Audit Messages
host=xxx.xxxx.xxx type=AVC msg=audit(1274211571.669:196): avc: denied { read } for pid=2647 comm="restorecond" name="arfore" dev=0:19 ino=24714112 scontext=system_u:system_r:restorecond_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=lnk_file
host=xxx.xxxx.xxx type=SYSCALL msg=audit(1274211571.669:196): arch=c000003e syscall=2 success=no exit=-13 a0=2b19408731e0 a1=20000 a2=0 a3=0 items=0 ppid=1 pid=2647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecond" exe="/usr/sbin/restorecond" subj=system_u:system_r:restorecond_t:s0 key=(null)
+++
I have tried mounting the filesystem two different ways in an attempt to specify the desired context:
Manually:
mount -t nfs -o context=user_u:object_r:user_home_t SERVER_IP_HERE:/webroot/home /home
/etc/fstab
SERVER_IP_HERE:/webroot/home /home nfs context="user_u:object_r:user_home_t:s0" 0 0
In both cases the file context is displayed as desired when running "ls -laZ" on my user home directory:
-rw-r--r-- arfore cs user_u:object_r:user_home_t .bash_login
However, after logging in via SSH I receive quite a few instances of the alert I listed above.
I understand that the long term solution would be to appropriately label each file/directory on the mounted filespace, however at the moment this is not an option since we are still running two production Solaris 10 webservers that mount the same content.
Thanks,
Andy Fore
------
Andrew R. Fore
Systems Services Associate
Valdosta State University
Ph.: 229-333-7315
Fax: 229-333-4349
Email: arfore(a)valdosta.edu
13 years, 11 months
xdm fixes
by Dominick Grift
Here are two xdm fixes that i had to apply:
Allow xdm_t to read gconf_etc_t else gconf sanity check failes and gnome power manager fails.
Signed-off-by: Dominick Grift <domg472(a)gmail.com>
---------------------- policy/modules/services/xserver.te ---------------------
index 65d2018..18aa8ef 100644
@@ -722,6 +722,7 @@
optional_policy(`
gnome_manage_gconf_home_files(xdm_t)
gnome_read_config(xdm_t)
+ gnome_read_gconf_config(xdm_t)
gnome_append_gconf_home_files(xdm_t)
')
xdm_t read xdm_etc_t link files.
Signed-off-by: Dominick Grift <domg472(a)gmail.com>
---------------------- policy/modules/services/xserver.te ---------------------
index 168e133..dd29803 100644
@@ -409,6 +409,7 @@
allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
+allow xdm_t xdm_etc_t:lnk_file read_lnk_file_perms;
read_files_pattern(xdm_t, xdm_etc_t, xdm_etc_t)
manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
13 years, 11 months
Re: Need new secret sauce
by Dominick Grift
On Sun, May 16, 2010 at 01:06:53PM -0700, David Highley wrote:
> "Dominick Grift wrote:"
> >
> > On 05/16/2010 10:51 AM, Dominick Grift wrote:
> > > On Sat, May 15, 2010 at 09:33:01PM -0700, David Highley wrote:
> > >> "Dominick Grift wrote:"
> > >>>
> > >>> On 05/08/2010 04:20 AM, David Highley wrote:
> > >>>
> > >>> I took a quick look at the README file enclosed with the archive, and=
> > i
> > >>> think the second route may be the better solution since you might be
> > >>> able to isolate sshdfilter from ssh for a large part.
> > >>>
> > >>> This is in my view important because sshd is a trusted service, meani=
> > ng
> > >>> it is allowed much access becuase it needs it and we rely on sshd for=
> >
> > >>> security.
> > >>>
> > >>> Below you will find a starting point for policy for sshdfilter in the=
> >
> > >>> second scenario. This policy is incomplete and it may also have error=
> > s.
> > >>> You might be able to use it as a starting point and to perfect the
> > >>> policy. That would require testing, extending policy (using audit2all=
> > ow
> > >>> and common sense) rebuilding, reinstalling policy , retesting etc. un=
> > til
> > >>> it is perfect.
> > >>>
> > >>> To do that you must ensure that you have configured the service prope=
> > rly
> > >>> and that you do the development ofthe policy and testing in a secure
> > >>> environment.
> > >>>
> > >>> 1. Establishing sshdfilter object locations:
> > >>>
> > >>> So from the README file i understand theres 3 files:
> > >>>
> > >>> - The initscript (/etc/rc.d/init.d/sshdfilter
> > >>> - The config file(s) (/etc/sshdfilterrc.*)
> > >>> - The sshdfilter application executable file (/usr/sbin/sshdfilter)
> > >>>
> > >>> 2. Declare types for sshdfilter objects, the sshdfilter subject, then=
> >
> > >>> makes the types usable type for their purpose and define file context=
> >
> > >>> specifications for the sshdfilter file objects. Additionally make the=
> >
> > >>> sshdfilter subject type permissive (will not work in el5) to make
> > >>> testing more easy and secure.
> > >>>
> > >>> 3. Source policy module for sshdfilter.
> > >>>
> > >>> Create a work directory. This is where we will store the source polic=
> > y
> > >>> module for our sshdfilter application. Keep the source policy module,=
> > as
> > >>> you may need to extend, modify, rebuild it later.
> > >>>
> > >>> A Selinux source policy module has 3 files. A type enforcement file
> > >>> ("modulename".te), A interface file ("modulename.if"), and a file
> > >>> context specification file ("modulename".fc).
> > >>>
> > >>> The type enforcement file has declarations and policy that are local =
> > to
> > >>> the module. The interface file has policy where the target of the
> > >>> interaction is a type declared in the type enforcement file of the
> > >>> module. e.g. shared policy. If external domains want to interact with=
> >
> > >>> sshdfilter in anyway, then the sshdfilter.if file should facilitate a=
> > ny
> > >>> access required for other domains to interact with it. The file conte=
> > xt
> > >>> specification file has file object context specifications for file
> > >>> object types that are declared in the type enforcement file.
> > >>>
> > >>> 4. sshdfilter.te
> > >>>
> > >>> touch a file called sshdfilter.te in your working directory. The file=
> >
> > >>> will be split in two parts: first the personal declarations and secon=
> > d
> > >>> the personal policy.
> > >>>
> > >>> Add the following to the sshdfilter.te file:
> > >>>
> > >>> policy_module(sshdfilter, 1.0.0)
> > >>>
> > >>> type sshdfilter_t;
> > >>> type sshdfilter_exec_t;
> > >>> init_daemon_domain(sshdfilter_t, sshdfilter_exec_t)
> > >>>
> > >>> type sshdfilter_initrc_exec_t;
> > >>> init_script_file(sshdfilter_initrc_exec_t)
> > >>>
> > >>> type sshdfilter_etc_t;
> > >>> files_config_file(sshdfilter_etc_t)
> > >>>
> > >>> # permissive domains will not work in el5.
> > >>> permissve sshdfilter_t;
> > >>
> > >> Looking at what was needed to get this working with the other install
> > >> method I now have the following for the sshdfilter.te file:
> > >=20
> > > You can use the following instead. That way you do not have to require =
> > external, types classes.=09
> > > =20
> > > policy_module(sshdfilter, 1.0.0)
> > > =20
> > > type sshdfilter_t;
> > > type sshdfilter_exec_t;
> > > init_daemon_domain(sshdfilter_t, sshdfilter_exec_t)
> > > =20
> > > type sshdfilter_initrc_exec_t;
> > > init_script_file(sshdfilter_initrc_exec_t)
> > > =20
> > > type sshdfilter_etc_t;
> > > files_config_file(sshdfilter_etc_t)
> > >=20
> > > allow iptables_t self:fifo_file rw_fifo_file_perms;
>
> OK, some progress. The script is now starting and functioning as a
> daemon. Just changed the sshdfilter.te file to the following and that
> got it running:
> policy_module(sshdfilter, 1.0.0)
>
> type sshdfilter_t;
> type sshdfilter_exec_t;
> init_daemon_domain(sshdfilter_t, sshdfilter_exec_t)
>
> type sshdfilter_initrc_exec_t;
> init_script_file(sshdfilter_initrc_exec_t)
>
> type sshdfilter_etc_t;
> files_config_file(sshdfilter_etc_t)
>
> dev_read_urand(sshdfilter_t)
> corecmd_search_bin(sshdfilter_t)
> miscfiles_read_localization(sshdfilter_t)
>
> optional_policy(`
> iptables_domtrans(sshdfilter_t)
> ')
>
> Had to rework the init.d script and changed the non standard pid file
> name. The testing host is not behaving quite right and so far I have
> not found out what is causing it. When I do a port scan I should see a
> line like this in the secure file:
> May 16 12:37:10 spruce sshd[30708]: Did not receive identification
> string from 10.2.2.7
>
> In testing so far it appears that the script can read the fifo even
> though we did not do anything beyond creating the fifo. I would thought
> we needed to label it.
What do you mean? iptables_t read and writes a fifo_file, not sshdfilter_t:
allow iptables_t self:fifo_file rw_fifo_file_perms;
> Will let you know when I have done more testing
> and think it is ready. Any ideas on how to get this functionality as a
> standard RPM? I know how to create RPM's but I do not know how to get it
> in the distribution.
The fedora website has all the info you need and google can help you find it that info.
I have found some article that may be helpful:
https://fedoraproject.org/wiki/PackageMaintainers/Join
>
> >
> > Whoops actually the above does not belong here. You already added that
> > to your "myiptables" module below.
> >
> > > allow sshdfilter_t sshdfilter_etc_t:file read_file_perms;
> > >=20
> > > dev_read_urand(sshdfilter_t)
> > >=20
> > > corecmd_search_bin(sshdfilter_t)
> > >=20
> > > miscfiles_read_localization(sshdfilter_t)
> > >=20
> > > optional_policy(`
> > > iptables_domtrans(sshdfilter_t)
> > > ")
> > >=20
> > > # I would like to see the raw AVC denial for this.
> > > # allow sshdfilter_t var_run_t:file getattr;
> > >=20
> > >>
> > >> I also tried this modification for iptables:
> > >> policy_module(myiptables, 1.0.0)
> > >> optional_policy(`
> > >> gen_require(`
> > >> type iptables_t;
> > >> ')
> > >> corecmd_read_bin_symlinks(iptables_t)
> > >> allow iptables_t self:fifo_file rw_fifo_file_perms;
> > >> ')
> > >=20
> > > The above looks fine.
> > >=20
> > >> I'm not getting any avc audit log etries but the script is getting hun=
> > g
> > >> at this line of code:
> > >> open(TABCHECK,"$iptables -L -n | grep \"^$chain *tcp\"|") ||
> > >> die("couldn't check $iptables");
> > >>
> > >> I run this command logged in as root and it work fine. Block even in
> > >> permissive mode. I should have also let you know I'm running Fedora 12=
> > =2E
> > >> So it would appear that the script is not able to run iptables.
> > >=20
> > > You mean to say that it does not work with the system in permissive mod=
> > e (setenforce 0)?
> > > If it does not work in permissive mode, then you can rule out any SElin=
> > ux related issue.
> > >=20
> > > If it works in permissive modebut not in enforcing mode then it is a SE=
> > linux issue (be aware i mean full permissive mode not permissive domains)=
> >
> > >=20
> > >=20
> > >>>
> > >>> # policy below (todo)
> > >>>
> > >>> So above we declared types for the 3 files and te process. We started=
> > by
> > >>> declaring a new policy module called sshdfilter and gave it a version=
> >
> > >>> number of 1.0.0. Once the module is installed you can use semodule -l=
> > to
> > >>> list these policy module details.
> > >>>
> > >>> sshdfilter_t is the type that is declared for the sshdfilter process.=
> >
> > >>> sshdfilter_exec_t is the type declared for the sshdfilter application=
> >
> > >>> executable file (/usr/sbin/sshdfilter)
> > >>>
> > >>> Both type are made a init daemon domain by calling the
> > >>> init_daemon_domain() interface with the two types as parameters. This=
> > is
> > >>> just a macro that gets expanded with m4 to actual policy that the ker=
> > nel
> > >>> can understand. The macros are used to make policy maintainable for
> > >>> humans. Basically its a way to group policy.
> > >>>
> > >>> The type sshdfilter_initrc_exec_t type is the type for the sshdfilter=
> >
> > >>> init script (/etc/rc.d/init.d/sshdfilter)
> > >>> This type is made a valid init script file type by calling the
> > >>> init_script_file interface and supplying the type used for the init
> > >>> script as a parameter.
> > >>>
> > >>> The next type declared is sshdfilter_etc_t, This is the type for the
> > >>> sshdfilter configuration files (/etc/sshdfilterrc.*) The type is made=
> >
> > >>> usuable for configuration files by calling files_config_file(), with =
> > the
> > >>> type that we have declared for sshdfilters file objects in /etc as it=
> > s
> > >>> parameter.
> > >>>
> > >>> Finally we made the subject type sshdfilter_t a "permissive domain".
> > >>> This may not work on older selinux implementations.
> > >>>
> > >>> Permissive domains is a way to run a single domain in permissive mode=
> > as
> > >>> opposed to running the full system in permissive mode when one runs t=
> > he
> > >>> setenforce 0 command. This allows you to test a single domain.
> > >>>
> > >>> We did not add any policy yet to out type enforcement file. This is
> > >>> because i do not know what access the application needs. You can find=
> >
> > >>> out by testing, editing policy, testing etc. The audit2allow command =
> > and
> > >>> ausearch command can help parse AVC denials which can be used to exte=
> > nd
> > >>> your sshdfilter_t domain.
> > >>>
> > >>> 5. sshdfilter.fc
> > >>>
> > >>> We declared the types for sshdfilter in our type enforcement source
> > >>> policy file. Now we must assign the file object types to actual objec=
> > ts
> > >>> on the file system. e.g. create file object context specifications.
> > >>>
> > >>> Add the following to the sshdfilter.fc file:
> > >>>
> > >>> /etc/rc\.d/init\.d/sshdfilter --
> > >>> gen_context(system_u:object_r:sshdfilter_initrc_exec_t, s0)
> > >>> /etc/sshdfilterrc.* -- gen_context(system_u:object_r:sshdfilter_etc_t=
> > , s0=3D
> > >>> )
> > >>> /usr/sbin/sshdfilter -- gen_context(system_u:object_r:sshdfilter_exec=
> > _t, =3D
> > >>> s0)
> > >>>
> > >>> That will tell the system what file object to label with the types we=
> >
> > >>> declared for our domain.
> > >>>
> > >>> 6. sshdfilter.if
> > >>>
> > >>> We will skip this section for simplicity. We may need it later, if it=
> >
> > >>> turns out some other domain wants to interact with out sshdfilter_t
> > >>> domain or any file object types it owns.
> > >>>
> > >>> 7. Building and installing.
> > >>>
> > >>> By now we should have a solid foundation for our new domain. By solid=
> > i
> > >>> mean that the domain type is declared (sshfilter_t) and all (known)
> > >>> objects own by the sshdfilter_t domain have types declared and file
> > >>> object contexts specified.
> > >>>
> > >>> The init_daemon_domain() interface call provides all policy that is
> > >>> needed for init to transition into the sshdfilter_t domain.
> > >>>
> > >>> The permissive domain sshdfilter_t will allow sshdfilter_t all access=
> >
> > >>> but will log "would be denied" access vectors.
> > >>>
> > >>> If you are using an older selinux implementation, you may want to
> > >>> comment that line out and do the policy testing with selinux in
> > >>> permissive mode instead.
> > >>>
> > >>> cd into your working dir and run the following to build a binary
> > >>> representation of the sshdfilter source policy module:
> > >>>
> > >>> make -f /usr/share/selinux/devel/Makefile sshdfilter.pp
> > >>>
> > >>> ( on el5 this requires that you have the selinux-policy-devel package=
> >
> > >>> installed )
> > >>>
> > >>> If all goes well this should create the binary policy module which we=
> >
> > >>> can load into the policy store with the following command:
> > >>>
> > >>> sudo semodule -i sshdfilter.pp
> > >>>
> > >>> Use the semodule command to list, install , reinstall , remove module=
> > s.
> > >>>
> > >>> Now all you have to do is restore the contexts of the objects defined=
> > in
> > >>> the sshdfilter.fc file to reflect the type we declared in our type
> > >>> enforcement file.
> > >>>
> > >>> Then just run and test the app, either in permissive mode or if possi=
> > ble
> > >>> using the permissive domain declaration described above.
> > >>>
> > >>> Collect any AVC denials for dmesg , /var/log/messages
> > >>> /var/log/audit/audit.log and use those AVC denials to make policy
> > >>> decisions and extend your type enforcement file.
> > >>>
> > >>> Rebuild a new binary representation afterward, reinstall it into the
> > >>> policy store and test it all over again. Repeat this untill all AVC
> > >>> denials are gone and untill your application works like it should.
> > >>>
> > >>> Any questions? Please let me know.
> > >>>
> > >>> Disclaimer: The may be errors above. Try at your own risk.
> > >>>
> > >>>> =3D20
> > >>>> I'm attaching the down load. It has two methods of installation so t=
> > he
> > >>>> files vary depending on approach. I wonder if there would be some wa=
> > y t=3D
> > >>> o
> > >>>> get this into the repo.
13 years, 11 months
Re: Need new secret sauce
by Dominick Grift
On Sat, May 15, 2010 at 09:33:01PM -0700, David Highley wrote:
> "Dominick Grift wrote:"
> >
> > On 05/08/2010 04:20 AM, David Highley wrote:
> >
> > I took a quick look at the README file enclosed with the archive, and i
> > think the second route may be the better solution since you might be
> > able to isolate sshdfilter from ssh for a large part.
> >
> > This is in my view important because sshd is a trusted service, meaning
> > it is allowed much access becuase it needs it and we rely on sshd for
> > security.
> >
> > Below you will find a starting point for policy for sshdfilter in the
> > second scenario. This policy is incomplete and it may also have errors.
> > You might be able to use it as a starting point and to perfect the
> > policy. That would require testing, extending policy (using audit2allow
> > and common sense) rebuilding, reinstalling policy , retesting etc. until
> > it is perfect.
> >
> > To do that you must ensure that you have configured the service properly
> > and that you do the development ofthe policy and testing in a secure
> > environment.
> >
> > 1. Establishing sshdfilter object locations:
> >
> > So from the README file i understand theres 3 files:
> >
> > - The initscript (/etc/rc.d/init.d/sshdfilter
> > - The config file(s) (/etc/sshdfilterrc.*)
> > - The sshdfilter application executable file (/usr/sbin/sshdfilter)
> >
> > 2. Declare types for sshdfilter objects, the sshdfilter subject, then
> > makes the types usable type for their purpose and define file context
> > specifications for the sshdfilter file objects. Additionally make the
> > sshdfilter subject type permissive (will not work in el5) to make
> > testing more easy and secure.
> >
> > 3. Source policy module for sshdfilter.
> >
> > Create a work directory. This is where we will store the source policy
> > module for our sshdfilter application. Keep the source policy module, as
> > you may need to extend, modify, rebuild it later.
> >
> > A Selinux source policy module has 3 files. A type enforcement file
> > ("modulename".te), A interface file ("modulename.if"), and a file
> > context specification file ("modulename".fc).
> >
> > The type enforcement file has declarations and policy that are local to
> > the module. The interface file has policy where the target of the
> > interaction is a type declared in the type enforcement file of the
> > module. e.g. shared policy. If external domains want to interact with
> > sshdfilter in anyway, then the sshdfilter.if file should facilitate any
> > access required for other domains to interact with it. The file context
> > specification file has file object context specifications for file
> > object types that are declared in the type enforcement file.
> >
> > 4. sshdfilter.te
> >
> > touch a file called sshdfilter.te in your working directory. The file
> > will be split in two parts: first the personal declarations and second
> > the personal policy.
> >
> > Add the following to the sshdfilter.te file:
> >
> > policy_module(sshdfilter, 1.0.0)
> >
> > type sshdfilter_t;
> > type sshdfilter_exec_t;
> > init_daemon_domain(sshdfilter_t, sshdfilter_exec_t)
> >
> > type sshdfilter_initrc_exec_t;
> > init_script_file(sshdfilter_initrc_exec_t)
> >
> > type sshdfilter_etc_t;
> > files_config_file(sshdfilter_etc_t)
> >
> > # permissive domains will not work in el5.
> > permissve sshdfilter_t;
>
> Looking at what was needed to get this working with the other install
> method I now have the following for the sshdfilter.te file:
You can use the following instead. That way you do not have to require external, types classes.
policy_module(sshdfilter, 1.0.0)
type sshdfilter_t;
type sshdfilter_exec_t;
init_daemon_domain(sshdfilter_t, sshdfilter_exec_t)
type sshdfilter_initrc_exec_t;
init_script_file(sshdfilter_initrc_exec_t)
type sshdfilter_etc_t;
files_config_file(sshdfilter_etc_t)
allow iptables_t self:fifo_file rw_fifo_file_perms;
allow sshdfilter_t sshdfilter_etc_t:file read_file_perms;
dev_read_urand(sshdfilter_t)
corecmd_search_bin(sshdfilter_t)
miscfiles_read_localization(sshdfilter_t)
optional_policy(`
iptables_domtrans(sshdfilter_t)
")
# I would like to see the raw AVC denial for this.
# allow sshdfilter_t var_run_t:file getattr;
>
> I also tried this modification for iptables:
> policy_module(myiptables, 1.0.0)
> optional_policy(`
> gen_require(`
> type iptables_t;
> ')
> corecmd_read_bin_symlinks(iptables_t)
> allow iptables_t self:fifo_file rw_fifo_file_perms;
> ')
The above looks fine.
> I'm not getting any avc audit log etries but the script is getting hung
> at this line of code:
> open(TABCHECK,"$iptables -L -n | grep \"^$chain *tcp\"|") ||
> die("couldn't check $iptables");
>
> I run this command logged in as root and it work fine. Block even in
> permissive mode. I should have also let you know I'm running Fedora 12.
> So it would appear that the script is not able to run iptables.
You mean to say that it does not work with the system in permissive mode (setenforce 0)?
If it does not work in permissive mode, then you can rule out any SElinux related issue.
If it works in permissive modebut not in enforcing mode then it is a SElinux issue (be aware i mean full permissive mode not permissive domains)
> >
> > # policy below (todo)
> >
> > So above we declared types for the 3 files and te process. We started by
> > declaring a new policy module called sshdfilter and gave it a version
> > number of 1.0.0. Once the module is installed you can use semodule -l to
> > list these policy module details.
> >
> > sshdfilter_t is the type that is declared for the sshdfilter process.
> > sshdfilter_exec_t is the type declared for the sshdfilter application
> > executable file (/usr/sbin/sshdfilter)
> >
> > Both type are made a init daemon domain by calling the
> > init_daemon_domain() interface with the two types as parameters. This is
> > just a macro that gets expanded with m4 to actual policy that the kernel
> > can understand. The macros are used to make policy maintainable for
> > humans. Basically its a way to group policy.
> >
> > The type sshdfilter_initrc_exec_t type is the type for the sshdfilter
> > init script (/etc/rc.d/init.d/sshdfilter)
> > This type is made a valid init script file type by calling the
> > init_script_file interface and supplying the type used for the init
> > script as a parameter.
> >
> > The next type declared is sshdfilter_etc_t, This is the type for the
> > sshdfilter configuration files (/etc/sshdfilterrc.*) The type is made
> > usuable for configuration files by calling files_config_file(), with the
> > type that we have declared for sshdfilters file objects in /etc as its
> > parameter.
> >
> > Finally we made the subject type sshdfilter_t a "permissive domain".
> > This may not work on older selinux implementations.
> >
> > Permissive domains is a way to run a single domain in permissive mode as
> > opposed to running the full system in permissive mode when one runs the
> > setenforce 0 command. This allows you to test a single domain.
> >
> > We did not add any policy yet to out type enforcement file. This is
> > because i do not know what access the application needs. You can find
> > out by testing, editing policy, testing etc. The audit2allow command and
> > ausearch command can help parse AVC denials which can be used to extend
> > your sshdfilter_t domain.
> >
> > 5. sshdfilter.fc
> >
> > We declared the types for sshdfilter in our type enforcement source
> > policy file. Now we must assign the file object types to actual objects
> > on the file system. e.g. create file object context specifications.
> >
> > Add the following to the sshdfilter.fc file:
> >
> > /etc/rc\.d/init\.d/sshdfilter --
> > gen_context(system_u:object_r:sshdfilter_initrc_exec_t, s0)
> > /etc/sshdfilterrc.* -- gen_context(system_u:object_r:sshdfilter_etc_t, s0=
> > )
> > /usr/sbin/sshdfilter -- gen_context(system_u:object_r:sshdfilter_exec_t, =
> > s0)
> >
> > That will tell the system what file object to label with the types we
> > declared for our domain.
> >
> > 6. sshdfilter.if
> >
> > We will skip this section for simplicity. We may need it later, if it
> > turns out some other domain wants to interact with out sshdfilter_t
> > domain or any file object types it owns.
> >
> > 7. Building and installing.
> >
> > By now we should have a solid foundation for our new domain. By solid i
> > mean that the domain type is declared (sshfilter_t) and all (known)
> > objects own by the sshdfilter_t domain have types declared and file
> > object contexts specified.
> >
> > The init_daemon_domain() interface call provides all policy that is
> > needed for init to transition into the sshdfilter_t domain.
> >
> > The permissive domain sshdfilter_t will allow sshdfilter_t all access
> > but will log "would be denied" access vectors.
> >
> > If you are using an older selinux implementation, you may want to
> > comment that line out and do the policy testing with selinux in
> > permissive mode instead.
> >
> > cd into your working dir and run the following to build a binary
> > representation of the sshdfilter source policy module:
> >
> > make -f /usr/share/selinux/devel/Makefile sshdfilter.pp
> >
> > ( on el5 this requires that you have the selinux-policy-devel package
> > installed )
> >
> > If all goes well this should create the binary policy module which we
> > can load into the policy store with the following command:
> >
> > sudo semodule -i sshdfilter.pp
> >
> > Use the semodule command to list, install , reinstall , remove modules.
> >
> > Now all you have to do is restore the contexts of the objects defined in
> > the sshdfilter.fc file to reflect the type we declared in our type
> > enforcement file.
> >
> > Then just run and test the app, either in permissive mode or if possible
> > using the permissive domain declaration described above.
> >
> > Collect any AVC denials for dmesg , /var/log/messages
> > /var/log/audit/audit.log and use those AVC denials to make policy
> > decisions and extend your type enforcement file.
> >
> > Rebuild a new binary representation afterward, reinstall it into the
> > policy store and test it all over again. Repeat this untill all AVC
> > denials are gone and untill your application works like it should.
> >
> > Any questions? Please let me know.
> >
> > Disclaimer: The may be errors above. Try at your own risk.
> >
> > >=20
> > > I'm attaching the down load. It has two methods of installation so the
> > > files vary depending on approach. I wonder if there would be some way t=
> > o
> > > get this into the repo.
13 years, 11 months
[[selinux-policy] patch 1/1] Update libcgroup/cgroup policy.
by Dominick Grift
This is a diff between what i currently have implemented and what Fedora has implemented.
This works for me IN enforcing mode.
Signed-off-by: Dominick Grift <domg472(a)gmail.com>
---
:100644 100644 11e5cd9... 2ba1a74... M policy/modules/kernel/filesystem.if
:100644 100644 480f526... 70c2b44... M policy/modules/services/cgroup.fc
:100644 100644 95d1a68... 03b7ffc... M policy/modules/services/cgroup.if
:100644 100644 9c5d9b0... d0c5a19... M policy/modules/services/cgroup.te
:100644 100644 9ecb76c... d15bb0f... M policy/modules/system/init.te
:100644 100644 c068936... 7c5ed53... M policy/modules/system/userdomain.if
policy/modules/kernel/filesystem.if | 95 ++++++++++-----
policy/modules/services/cgroup.fc | 15 ++-
policy/modules/services/cgroup.if | 232 +++++++++++++++++++++++++++++++++--
policy/modules/services/cgroup.te | 47 +++++---
policy/modules/system/init.te | 9 +-
policy/modules/system/userdomain.if | 6 +
6 files changed, 337 insertions(+), 67 deletions(-)
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 11e5cd9..2ba1a74 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -559,6 +559,24 @@ interface(`fs_register_binary_executable_type',`
########################################
## <summary>
+## Delete directories on cgroupfs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`fs_delete_cgroupfs_dirs', `
+ gen_require(`
+ type cgroupfs_t;
+ ')
+
+ delete_dirs_pattern($1, cgroupfs_t, cgroupfs_t)
+')
+
+########################################
+## <summary>
## Mount a cgroup filesystem.
## </summary>
## <param name="domain">
@@ -621,53 +639,32 @@ interface(`fs_unmount_cgroupfs', `
## Domain allowed access.
## </summary>
## </param>
-## <rolecap/>
#
interface(`fs_getattr_cgroupfs',`
gen_require(`
- type cifs_t;
+ type cgroupfs_t;
')
- allow $1 cifs_t:filesystem getattr;
-')
-
-########################################
-## <summary>
-## list dirs on cgroup
-## file systems.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`fs_list_cgroupfs_dirs', `
- gen_require(`
- type cgroupfs_t;
-
- ')
-
- list_dirs_pattern($1, cgroupfs_t, cgroupfs_t)
+ allow $1 cgroupfs_t:filesystem getattr;
')
########################################
## <summary>
-## Do not audit attempts to read
-## dirs on a CIFS or SMB filesystem.
+## list dirs on cgroup
+## file systems.
## </summary>
## <param name="domain">
## <summary>
-## Domain to not audit.
+## Domain allowed access.
## </summary>
## </param>
#
-interface(`fs_dontaudit_list_cifs_dirs',`
+interface(`fs_list_cgroupfs_dirs', `
gen_require(`
- type cifs_t;
+ type cgroupfs_t;
')
- dontaudit $1 cifs_t:dir list_dir_perms;
+ list_dirs_pattern($1, cgroupfs_t, cgroupfs_t)
')
########################################
@@ -743,7 +740,6 @@ interface(`fs_read_cgroupfs_files',`
interface(`fs_write_cgroupfs_files', `
gen_require(`
type cgroupfs_t;
-
')
write_files_pattern($1, cgroupfs_t, cgroupfs_t)
@@ -771,6 +767,45 @@ interface(`fs_rw_cgroupfs_files',`
########################################
## <summary>
+## Do not audit attempts to getattr,
+## open, read and write files on cgroup
+## file systems.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`fs_dontaudit_rw_cgroupfs_files',`
+ gen_require(`
+ type cgroupfs_t;
+ ')
+
+ dontaudit $1 cgroupfs_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to read
+## dirs on a CIFS or SMB filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`fs_dontaudit_list_cifs_dirs',`
+ gen_require(`
+ type cifs_t;
+ ')
+
+ dontaudit $1 cifs_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
## Mount a CIFS or SMB network filesystem.
## </summary>
## <param name="domain">
diff --git a/policy/modules/services/cgroup.fc b/policy/modules/services/cgroup.fc
index 480f526..70c2b44 100644
--- a/policy/modules/services/cgroup.fc
+++ b/policy/modules/services/cgroup.fc
@@ -1,9 +1,12 @@
-/etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t, s0)
-/etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t, s0)
+/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0)
-/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t, s0)
-/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfigparser_exec_t, s0)
+/etc/cgconfig.conf -- gen_context(system_u:object_r:cgconfig_etc_t,s0)
+/etc/cgrules.conf -- gen_context(system_u:object_r:cgrules_etc_t,s0)
-/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t, s0)
+/etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t,s0)
-/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t, s0)
+/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfigparser_exec_t,s0)
+/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
+
+/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0)
diff --git a/policy/modules/services/cgroup.if b/policy/modules/services/cgroup.if
index 95d1a68..03b7ffc 100644
--- a/policy/modules/services/cgroup.if
+++ b/policy/modules/services/cgroup.if
@@ -1,21 +1,181 @@
-## <summary>Control group rules engine daemon.</summary>
+## <summary>libcg is a library that abstracts the control group file system in Linux.</summary>
## <desc>
## <p>
-## cgrulesengd is a daemon, which distributes processes
-## to control groups. When any process changes its
-## effective UID or GID, cgred inspects list of
-## rules loaded from cgrules.conf file and moves the
-## process to the appropriate control group.
-## </p>
-## <p>
-## The list of rules is read during the daemon startup and
-## are cached in daemons memory. The daemon reloads the
-## list of rules when it receives SIGUSR2 signal.
+## libcg aims to provide programmers easily usable APIs to use the control group file system.
## </p>
## </desc>
########################################
## <summary>
+## Execute a domain transition to run cgconfig.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cgroup_domtrans_cgconfigparser',`
+ gen_require(`
+ type cgconfigparser_t, cgconfigparser_exec_t;
+ ')
+
+ domtrans_pattern($1, cgconfigparser_exec_t, cgconfigparser_t)
+ corecmd_search_bin($1)
+')
+
+########################################
+## <summary>
+## Execute cgconfigparser server in the
+## cgconfigparser domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cgroup_initrc_domtrans_cgconfigparser',`
+ gen_require(`
+ type cgconfig_initrc_exec_t;
+ ')
+
+ files_search_etc($1)
+ init_labeled_script_domtrans($1, cgconfig_initrc_exec_t)
+')
+
+########################################
+## <summary>
+## Execute a domain transition to run cgred.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cgroup_domtrans_cgred',`
+ gen_require(`
+ type cgred_t, cgred_exec_t;
+ ')
+
+ domtrans_pattern($1, cgred_exec_t, cgred_t)
+ corecmd_search_bin($1)
+')
+
+########################################
+## <summary>
+## Execute cgred server in the
+## cgred domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cgroup_initrc_domtrans_cgred',`
+ gen_require(`
+ type cgred_initrc_exec_t;
+ ')
+
+ files_search_etc($1)
+ init_labeled_script_domtrans($1, cgred_initrc_exec_t)
+')
+
+########################################
+## <summary>
+## Delete cgroup directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgroup_delete_cgroup_dirs', `
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ delete_dirs_pattern($1, cgroup_t, cgroup_t)
+ cgroup_search_cgroup_dirs($1)
+')
+
+########################################
+## <summary>
+## List cgroup directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgroup_list_cgroup_dirs', `
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ allow $1 cgroup_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+## Manage cgroup directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgroup_manage_cgroup_dirs', `
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ allow $1 cgroup_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+## Read and write cgroup directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgroup_rw_cgroup_dirs', `
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ allow $1 cgroup_t:dir rw_dir_perms;
+')
+
+########################################
+## <summary>
+## Search cgroup directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgroup_search_cgroup_dirs', `
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ allow $1 cgroup_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
## Read and write cgred sock file in /var/run.
## </summary>
## <param name="domain">
@@ -29,7 +189,55 @@ interface(`cgroup_stream_connect', `
type cgred_var_run_t, cgred_t;
')
- files_search_pids($1)
stream_connect_pattern($1, cgred_var_run_t, cgred_var_run_t, cgred_t)
+ files_search_pids($1)
')
+########################################
+## <summary>
+## All of the rules required to administrate
+## an cgroup environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`cgroup_admin',`
+ gen_require(`
+ type cgred_t, cgconfigparser_t, cgred_var_run_t;
+ type cgconfig_etc_t, cgconfig_initrc_exec_t, cgred_initrc_exec_t;
+ type cgred_etc_t, cgroup_t, cgroupfs_t;
+ ')
+
+ allow $1 cgconfigparser_t:process { ptrace signal_perms getattr };
+ read_files_pattern($1, cgconfigparser_t, cgconfigparser_t)
+
+ allow $1 cgred_t:process { ptrace signal_perms getattr };
+ read_files_pattern($1, cgred_t, cgred_t)
+
+ admin_pattern($1, cgroup_t)
+ admin_pattern($1, cgroupfs_t)
+
+ files_search_etc($1)
+ admin_pattern($1, cgconfig_etc_t)
+ admin_pattern($1, cgred_etc_t)
+
+ files_list_var($1)
+ admin_pattern($1, cgred_var_run_t)
+
+ cgroup_initrc_domtrans_cgconfigparser($1)
+ domain_system_change_exemption($1)
+ role_transition $2 cgconfig_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ cgroup_initrc_domtrans_cgred($1)
+ role_transition $2 cgred_initrc_exec_t system_r;
+')
diff --git a/policy/modules/services/cgroup.te b/policy/modules/services/cgroup.te
index 9c5d9b0..d0c5a19 100644
--- a/policy/modules/services/cgroup.te
+++ b/policy/modules/services/cgroup.te
@@ -1,7 +1,16 @@
+
policy_module(cgroup, 1.0.0)
########################################
#
+# cgroup global declarations.
+#
+
+type cgroup_t;
+files_mountpoint(cgroup_t)
+
+########################################
+#
# cgred personal declarations.
#
@@ -15,8 +24,8 @@ init_script_file(cgred_initrc_exec_t)
type cgred_var_run_t;
files_pid_file(cgred_var_run_t)
-type cgroup_t;
-files_mountpoint(cgroup_t)
+type cgrules_etc_t;
+files_config_file(cgrules_etc_t)
########################################
#
@@ -30,8 +39,8 @@ init_daemon_domain(cgconfigparser_t, cgconfigparser_exec_t)
type cgconfig_initrc_exec_t;
init_script_file(cgconfig_initrc_exec_t)
-permissive cgconfigparser_t;
-permissive cgred_t;
+type cgconfig_etc_t;
+files_config_file(cgconfig_etc_t)
########################################
#
@@ -42,36 +51,40 @@ allow cgred_t self:capability { net_admin sys_ptrace dac_override };
allow cgred_t self:netlink_socket { write bind create read };
allow cgred_t self:unix_dgram_socket { write create connect };
-manage_sock_files_pattern(cgred_t, cgred_var_run_t,
-cgred_var_run_t)
+allow cgred_t cgrules_etc_t:file read_file_perms;
+
+manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file)
-domain_read_all_domains_state(cgred_t)
+kernel_read_system_state(cgred_t)
-files_read_etc_files(cgred_t)
+domain_read_all_domains_state(cgred_t)
files_search_all(cgred_t)
files_getattr_all_files(cgred_t)
files_getattr_all_dirs(cgred_t)
files_getattr_all_sockets(cgred_t)
files_getattr_all_pipes(cgred_t)
-files_getattr_all_symlinks(cgred_t)
-# read all link files.
+files_read_all_symlinks(cgred_t)
-kernel_read_system_state(cgred_t)
+# /etc/group
+files_read_etc_files(cgred_t)
+
+fs_write_cgroupfs_files(cgred_t)
logging_send_syslog_msg(cgred_t)
miscfiles_read_localization(cgred_t)
-optional_policy(`
- fs_write_cgroupfs_files(cgred_t)
-')
-
########################################
#
# cgconfig personal policy.
#
+
+allow cgconfigparser_t self:capability { chown sys_admin };
+
+allow cgconfigparser_t cgconfig_etc_t:file read_file_perms;
+
manage_dirs_pattern(cgconfigparser_t, cgroup_t, cgroup_t)
manage_files_pattern(cgconfigparser_t, cgroup_t, cgroup_t)
allow cgconfigparser_t cgroup_t:dir mounton;
@@ -79,9 +92,11 @@ allow cgconfigparser_t cgroup_t:dir mounton;
kernel_list_unlabeled(cgconfigparser_t)
kernel_read_system_state(cgconfigparser_t)
+# /etc/nsswitch.conf
files_read_etc_files(cgconfigparser_t)
fs_manage_cgroupfs_dirs(cgconfigparser_t)
+fs_mount_cgroupfs(cgconfigparser_t)
fs_rw_cgroupfs_files(cgconfigparser_t)
+fs_unmount_cgroupfs(cgconfigparser_t)
fs_setattr_cgroupfs_files(cgconfigparser_t)
-fs_mount_cgroupfs(cgconfigparser_t)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 9ecb76c..d15bb0f 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -403,9 +403,6 @@ fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
fs_search_all(initrc_t)
fs_getattr_nfsd_files(initrc_t)
-fs_rw_cgroupfs_files(initrc_t)
-fs_setattr_cgroupfs_files(initrc_t)
-fs_manage_cgroupfs_dirs(initrc_t)
# initrc_t needs to do a pidof which requires ptrace
mcs_ptrace_all(initrc_t)
@@ -551,6 +548,12 @@ ifdef(`distro_redhat',`
fs_read_tmpfs_symlinks(initrc_t)
fs_rw_tmpfs_chr_files(initrc_t)
+ # /sbin/cgclear
+ fs_delete_cgroupfs_dirs(initrc_t)
+ fs_list_cgroupfs_dirs(initrc_t)
+ # w for /bin/cgcexec and rw for /sbin/cgclear
+ fs_rw_cgroupfs_files(initrc_t)
+
storage_manage_fixed_disk(initrc_t)
storage_dev_filetrans_fixed_disk(initrc_t)
storage_getattr_removable_dev(initrc_t)
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index c068936..7c5ed53 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -116,6 +116,7 @@ template(`userdom_base_user_template',`
files_exec_usr_files($1_t)
fs_list_cgroupfs_dirs($1_usertype)
+ fs_dontaudit_rw_cgroupfs_files($1_usertype)
storage_rw_fuse($1_usertype)
@@ -139,6 +140,10 @@ template(`userdom_base_user_template',`
')
optional_policy(`
+ cgroup_list_cgroup_dirs($1_usertype)
+ ')
+
+ optional_policy(`
ssh_rw_stream_sockets($1_usertype)
ssh_delete_tmp($1_t)
ssh_signal($1_t)
@@ -554,6 +559,7 @@ template(`userdom_common_user_template',`
files_read_config_files($1_usertype)
fs_read_noxattr_fs_files($1_usertype)
fs_read_noxattr_fs_symlinks($1_usertype)
+ fs_rw_cgroupfs_files($1_usertype)
logging_send_syslog_msg($1_usertype)
logging_send_audit_msgs($1_usertype)
--
1.7.0.1
13 years, 12 months
RE: New to SELinux: 2nd Edition of The SELinux Notebook released (fwd)
by James Morris
FYI for those not on the main SELinux list, this should be very useful.
---------- Forwarded message ----------
Date: Wed, 12 May 2010 12:40:23 +0000 (GMT)
From: Richard Haines <richard_c_haines(a)btinternet.com>
To: selinux(a)tycho.nsa.gov, David-P63356Thomson <David.Thomson(a)gdc4s.com>,
Vacheh Sardarian <vsardarian(a)gmail.com>
Subject: RE: New to SELinux: 2nd Edition of The SELinux Notebook released
I've just finished the 2nd edition of the SELinux Notebook that is available at:
http://www.freetechbooks.com/the-selinux-notebook-the-foundations-t785.html
It is aimed at those new to SELinux and as a reference for the policy language and configuration files.
If anyone has comments on how to improve, what other areas to cover, corrections etc. please let me know.
I'll now update the selinuxproject.org site with the new content as part of the SELinux documentation project.
The main updates are:
Split the Notebook into two volumes:
Volume 1 - The Foundations - covers SELinux and its supporting services.
Volume 2 - Sample Policy Source - contains sample application and
policy source code to build a simple message filter and experiment with
X-Windows.
Updated all relevant sections to reflect Fedora 12 release and correct
errors.
Added secolors.conf and VM configuration files, typebounds Policy
language statement.
Added sections on:
XSELinux for X-Windows support and sample polyinstantiation code and policy.
Virtual machine support with examples.
SE-PostgreSQL support with an example database.
Apache / SELinux-Plus support.
Richard
13 years, 12 months