On Mon, Jan 14, 2013 at 12:42 PM, Dominick Grift
<dominick.grift(a)gmail.com> wrote:
On Mon, 2013-01-14 at 11:05 +0100, Bruno Vernay wrote:
> On Fri, Jan 11, 2013 at 1:29 PM, Dominick Grift
> <dominick.grift(a)gmail.com> wrote:
> > On Fri, 2013-01-11 at 10:50 +0100, Bruno Vernay wrote:
> >> I am trying to allow OpenVPN to use Amazon Simple Notification Service
> >> (SNS), so that each time a client connects to the VPN, OpenVPN
> >> triggers a bash script that will use Amazon SNS.
> >>
> >> Amazon SNS is a Java program launched via bash scripts.
> >> It is in aws/SimpleNotificationServiceCli/bin/ for the .sh and /lib for the
.jar
> >>
> >> OpenVPN launches a script in /etc/openvpn/client-connect.
> >>
> >>
> >> OpenVPN runs confined and I don't want to poke a big hole just to run
SNS.
> >>
> >> So I tried to "confine" SNS and allow the transition from OpenVPN,
but
> >> it didn't went well. (config files bellow)
> >> I wonder if it could be just as good to allow OpenVPN to escape its
> >> confine to only call the relevant SNS script ?
> >>
> >>
> >> From documentation and audit2allow I got to these configuration files.
> >> But it still doesn't authorize the script to run and now the messages
> >> triggers errors in audit2allow:
> >>
> >> libsepol.mls_from_string: invalid MLS context
> >> libsepol.mls_from_string: could not construct mls context structure
> >> libsepol.context_from_record: could not create context structure
> >> libsepol.context_from_string: could not create context structure
> >> libsepol.sepol_context_to_sid: could not convert
> >> system_u:object_r:proc_t: to sid
> >> libsepol.context_from_record: type op is not defined
> >> libsepol.context_from_record: could not create context structure
> >> libsepol.context_from_string: could not create context structure
> >> libsepol.sepol_context_to_sid: could not convert system_u:object_r:op:s0 to
sid
> >> libsepol.context_from_record: type openvpn_ is not defined
> >> libsepol.context_from_record: could not create context structure
> >> libsepol.context_from_string: could not create context structure
> >> libsepol.sepol_context_to_sid: could not convert
> >> system_u:object_r:openvpn_:s0 to sid
> >> libsepol.context_from_record: type shell_e is not defined
> >> libsepol.context_from_record: could not create context structure
> >> libsepol.context_from_string: could not create context structure
> >> libsepol.sepol_context_to_sid: could not convert
> >> system_u:object_r:shell_e:s0 to sid
> >>
> >
> > Strange question maybe but what test editor did you use to create this
> > policy?
> >
> > It almost seems that your amz_sns.fc messes up the file context
> > specifications (some clients append hidden symbols)
> >
> > Also make sure you end your fc file with a newline
> >
> >>
> >>
> >> $ cat amz_sns.fc
> >> /opt/aws/SimpleNotificationServiceCli.*/bin/.* --
> >> gen_context(system_u:object_r:amz_sns_exec_t,s0)
> >> /opt/aws/SimpleNotificationServiceCli.*/lib(/.*)?
> >> gen_context(system_u:object_r:amz_sns_lib_t,s0)
> >>
> >>
> >> $ cat amz_sns.te
> >> policy_module( amz_sns, 1.0.0)
> >>
> >> require {
> >> type openvpn_t;
> >> type openvpn_tmp_t;
> >> type shell_exec_t;
> >> }
> >>
> >> type amz_sns_t;
> >> type amz_sns_exec_t;
> >> type amz_sns_lib_t;
> >>
> >> files_type(amz_sns_lib_t);
> >>
> >> domain_type(amz_sns_t)
> >> domain_entry_file(amz_sns_t, amz_sns_exec_t)
> >>
> >> allow amz_sns_t amz_sns_exec_t:file { read execute entrypoint };
> >> domain_auto_trans( openvpn_t, amz_sns_exec_t, amz_sns_t );
> >>
> >> role system_r types amz_sns_t; # ???
> >>
> >> # The child process sends a signal to its parent as it dies
> >> allow amz_sns_t openvpn_t:process sigchld;
> >>
> >> allow amz_sns_t openvpn_tmp_t:file write; # For /tmp/debug
> >>
> >> allow amz_sns_t shell_exec_t:file { read open execute execute_no_trans
> >> }; # Bash exec
> >>
> >>
> >> Bruno
> >> --
> >> selinux mailing list
> >> selinux(a)lists.fedoraproject.org
> >>
https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
> >
>
> - I used vi (it is a headless Amazon AMI free tier).
> - it ends with a new line
> - I even checked with hexdump for alien characters and it seems clean to me
Strange, ok shot in the dark but you might try cleaning up the TE file a
bit:
policy_module(amz_sns, 1.0.0)
gen_require(`
type openvpn_t;
type openvpn_tmp_t;
')
type amz_sns_t;
type amz_sns_exec_t;
domain_type(amz_sns_t)
domain_entry_file(amz_sns_t, amz_sns_exec_t)
role system_r types amz_sns_t;
domtrans_pattern(openvpn_t, amz_sns_exec_t, amz_sns_t)
allow amz_sns_t openvpn_tmp_t:file write;
corecmd_exec_shell(amz_sns_t)
Also i am not sure how selinux deals with the underscore in module and type names
(amz_sns)
Sorry for the delay ...
- I renamed "amz_sns" to "amzsns"
- I applied your changes
- I relaunched to go further each time, until I have no more messages.
But it doesn't mean that it is working either.
Now, I have no more messages in audit.log (selinux enabled or not). My
script works only when selinux is disabled.
What could I do now ??
/*************************************************************************************/
$ cat amzsns.fc
/opt/aws/SimpleNotificationServiceCli.*/bin/.* --
gen_context(system_u:object_r:amzsns_exec_t,s0)
/opt/aws/SimpleNotificationServiceCli.*/lib(/.*)?
gen_context(system_u:object_r:amzsns_lib_t,s0)
$ cat amzsns.te
policy_module( amzsns, 1.0.0)
require {
type openvpn_t;
type openvpn_tmp_t;
type shell_exec_t;
type unlabeled_t;
type etc_t;
type openvpn_etc_t;
type openvpn_etc_rw_t;
type proc_t;
type usr_t;
type java_exec_t;
type tmp_t;
type locale_t;
type net_conf_t;
type proc_net_t;
type ephemeral_port_t;
type http_port_t;
type random_device_t;
type urandom_device_t;
type cert_t;
}
type amzsns_t;
type amzsns_exec_t;
type amzsns_lib_t;
domain_type(amzsns_t)
domain_entry_file(amzsns_t, amzsns_exec_t)
role system_r types amzsns_t;
domtrans_pattern(openvpn_t, amzsns_exec_t, amzsns_t)
allow amzsns_t openvpn_tmp_t:file write;
corecmd_exec_shell(amzsns_t)
allow openvpn_t unlabeled_t:file { execute getattr };
allow amzsns_t etc_t:file { read open getattr };
allow amzsns_t openvpn_etc_t:dir { search getattr };
allow amzsns_t proc_t:file { read open getattr };
allow amzsns_t usr_t:lnk_file { read getattr };
allow amzsns_t usr_t:file { getattr read open };
allow amzsns_t amzsns_exec_t:file execute_no_trans;
allow amzsns_t bin_t:file { read open execute getattr execute_no_trans };
allow amzsns_t amzsns_lib_t:dir { read open search getattr };
allow amzsns_t amzsns_lib_t:file { read getattr open };
allow amzsns_t etc_t:lnk_file read;
allow amzsns_t self:fifo_file { read ioctl write getattr };
allow amzsns_t self:process execmem;
allow amzsns_t tmp_t:dir { write add_name create read remove_name } ;
allow amzsns_t tmp_t:file { create read write open unlink };
allow amzsns_t locale_t:file { read open getattr };
allow amzsns_t locale_t:dir { read open search getattr };
allow amzsns_t openvpn_etc_rw_t:file { read write };
allow amzsns_t net_conf_t:file { read open getattr };
allow amzsns_t proc_net_t:file { read open getattr };
allow amzsns_t self:tcp_socket { create listen getattr connect accept
shutdown getopt setopt };
allow amzsns_t self:udp_socket { create connect getattr };
allow amzsns_t self:netlink_route_socket { create bind getattr nlmsg_read };
allow amzsns_t ephemeral_port_t:tcp_socket name_connect;
allow amzsns_t http_port_t:tcp_socket name_connect;
allow amzsns_t random_device_t:chr_file { read getattr open };
allow amzsns_t cert_t:dir search;
allow amzsns_t cert_t:file { getattr read open };
allow amzsns_t urandom_device_t:chr_file { getattr read open };
allow amzsns_t java_exec_t:file { read open execute getattr execute_no_trans };
/*************************************************************************************/
Here are the different steps using audit2allow:
1/ allow openvpn_t unlabeled_t:file { execute getattr };
2/ #============= amzsns_t ==============
allow amzsns_t etc_t:file read;
allow amzsns_t openvpn_etc_t:dir { search getattr };
allow amzsns_t proc_t:file read;
allow amzsns_t usr_t:lnk_file read;
3/ #============= amzsns_t ==============
allow amzsns_t amzsns_exec_t:file execute_no_trans;
allow amzsns_t etc_t:file open;
allow amzsns_t proc_t:file open;
4/#============= amzsns_t ==============
allow amzsns_t bin_t:file execute;
allow amzsns_t etc_t:file getattr;
allow amzsns_t proc_t:file getattr;
5/#============= amzsns_t ==============
allow amzsns_t bin_t:file { read open };
6/#============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:dir read;
allow amzsns_t bin_t:file getattr;
allow amzsns_t etc_t:lnk_file read;
allow amzsns_t self:fifo_file read;
7/ #============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:dir open;
allow amzsns_t bin_t:file execute_no_trans;
allow amzsns_t java_exec_t:file { execute getattr };
8/ #============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:dir search;
allow amzsns_t java_exec_t:file { read open };
allow amzsns_t self:fifo_file ioctl;
9/ #============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:file getattr;
allow amzsns_t java_exec_t:file execute_no_trans;
10/ #============= amzsns_t ==============
allow amzsns_t self:fifo_file { write getattr };
allow amzsns_t self:process execmem;
allow amzsns_t tmp_t:dir write;
11/ #============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:file read;
allow amzsns_t locale_t:file read;
allow amzsns_t openvpn_etc_rw_t:file { read write };
allow amzsns_t tmp_t:dir add_name;
allow amzsns_t usr_t:lnk_file getattr;
12/ #============= amzsns_t ==============
allow amzsns_t amzsns_lib_t:dir getattr;
allow amzsns_t amzsns_lib_t:file open;
allow amzsns_t locale_t:file open;
allow amzsns_t tmp_t:dir create;
13/ #============= amzsns_t ==============
allow amzsns_t locale_t:file getattr;
allow amzsns_t net_conf_t:file read;
allow amzsns_t proc_net_t:file read;
allow amzsns_t random_device_t:chr_file { read getattr };
allow amzsns_t self:tcp_socket create;
allow amzsns_t tmp_t:file create;
allow amzsns_t usr_t:file getattr;
13/ #============= amzsns_t ==============
allow amzsns_t cert_t:dir search;
allow amzsns_t locale_t:dir read;
allow amzsns_t net_conf_t:file open;
allow amzsns_t proc_net_t:file open;
allow amzsns_t random_device_t:chr_file open;
allow amzsns_t self:tcp_socket listen;
allow amzsns_t tmp_t:dir read;
allow amzsns_t tmp_t:file { read write open };
#!!!! This avc can be allowed using the boolean 'global_ssp'
allow amzsns_t urandom_device_t:chr_file getattr;
allow amzsns_t usr_t:file read;
14/ #============= amzsns_t ==============
allow amzsns_t net_conf_t:file getattr;
allow amzsns_t proc_net_t:file getattr;
allow amzsns_t self:netlink_route_socket create;
allow amzsns_t self:udp_socket create;
allow amzsns_t tmp_t:dir remove_name;
#!!!! This avc can be allowed using the boolean 'global_ssp'
allow amzsns_t urandom_device_t:chr_file read;
15/ #============= amzsns_t ==============
allow amzsns_t cert_t:file getattr;
allow amzsns_t locale_t:dir open;
allow amzsns_t self:netlink_route_socket bind;
allow amzsns_t self:tcp_socket getattr;
allow amzsns_t self:udp_socket connect;
allow amzsns_t tmp_t:file unlink;
#!!!! This avc can be allowed using the boolean 'global_ssp'
allow amzsns_t urandom_device_t:chr_file open;
allow amzsns_t usr_t:file open;
16/ #============= amzsns_t ==============
allow amzsns_t locale_t:dir search;
allow amzsns_t self:netlink_route_socket getattr;
allow amzsns_t self:tcp_socket connect;
17/ #============= amzsns_t ==============
allow amzsns_t ephemeral_port_t:tcp_socket name_connect;
allow amzsns_t locale_t:dir getattr;
18/ #============= amzsns_t ==============
allow amzsns_t self:tcp_socket accept;
19/ #============= amzsns_t ==============
allow amzsns_t self:tcp_socket shutdown;
At this point, I have no more messages in audit.log, but the script
isn't working either. So I setenforce 0 to continue:
20/ #============= amzsns_t ==============
allow amzsns_t http_port_t:tcp_socket name_connect;
allow amzsns_t self:netlink_route_socket nlmsg_read;
allow amzsns_t self:tcp_socket { getopt setopt };
allow amzsns_t self:udp_socket getattr;
By the way, do I have to uninstall the previous module or can I just
install the new one "semodule -i amzsns.pp" wihtout issuing a
"semodule -r amzsns" ??? (It takes quite a time)
Regards
Bruno