Hi. I'm wondering if anyone has any input on this. After building the
Fedora SELinux policy with UBAC support (and rebooting), I've created two
SELinux users: {user_a role_a type_a} and {user_b role_b type_b}, and both
type_a and type_b have the ubac_constrained_type attribute set. My
understanding of UBAC led me to believe that user_a would not have access
to a file of type type_b. Similarly, user_b would not have access to a file
of type type_a. However, these accesses are allowed. What else do I need to
do to get this to work. Thanks.
-jeff
On Fri, Nov 11, 2016 at 4:29 PM, Jeff Becker <jeff.c.becker(a)gmail.com>
wrote:
Some progress...
On Thu, Nov 10, 2016 at 8:48 AM, Jeff Becker <jeff.c.becker(a)gmail.com>
wrote:
> Hi.
>
> On Thu, Nov 10, 2016 at 5:25 AM, Miroslav Grepl <mgrepl(a)redhat.com>
> wrote:
>
>> On 11/09/2016 08:54 PM, Jeff Becker wrote:
>> > Hi. I successfully compiled and loaded the following policy file on
>> > RHEL7 with the latest (as of yesterday) SELinux rpms. However, when I
>> > run "seinfo -tfoo_t -x", I don't see ubac_constrained_type
listed in
>> the
>> > attributes. How do I enable UBAC? Thanks.
>>
>> Hi Jeff,
>> we don't build Fedora/RHEL distribution policy with UBAC support.
>
>
> I suspected that.
>
>
>> You
>> would need to rebuild the policy from srpms to enable it
>
>
I grabbed selinux-policy-3.13.1-103.fc22.src.rpm from
http://kojipkgs.fedoraproject.org. I figured this was close to what I
have installed (selinux-policy-3.13.1-102.el7_3.4.noarch). I enabled UBAC
in build.conf, and built and installed the policy. When I rebooted, I could
see that ubac_constrained_type attribute was present on several types
(including my new ones that I recompiled and loaded). However, it's not
working the way I thought it should. If I log in with SELinux user A and I
try to access a file from SELinux user B (both types have
ubac_constrained_type attribute set), I thought access would be denied, but
it's not, and nothing shows up in the audit log. Am I misunderstanding or
missing something? Thanks.
-jeff
>
>>
>> What is your intention with UBAC?
>>
>
> My use case is that I'd like to have several file types with associated
> SELinux users/roles, such that SELinux users of a certain type cannot
> access files associated with another user's type, regardless of what
> application is used for the access, e.g., my foo_u user below would not be
> able to access files of type bar_t (associated with SELinux user bar_u). I
> need this to be under mandatory access control, so it seems that multi
> category security (MCS) labels would not work, as they are discretionary.
> Is there another way, e.g., role based access control (RBAC) that could be
> used? Thanks.
>
> -jeff
>
>>
>> >
>> > -jeff
>> >
>> > ------------------------------------------------------------
>> ------------------------------------------------------------
>> --------------------------------------
>> >
>> > policy_module(foo, 1.0.0)
>> >
>> > ########################################
>> > #
>> > # Declarations
>> > #
>> > userdom_unpriv_user_template(foo)
>> >
>> > ########################################
>> > #
>> > # foo local policy
>> > #
>> >
>> > domain_use_interactive_fds(foo_t)
>> >
>> > files_read_etc_files(foo_t)
>> >
>> > miscfiles_read_localization(foo_t)
>> >
>> > ubac_constrained(foo_t)
>> >
>> >
>> >
>> > _______________________________________________
>> > selinux mailing list -- selinux(a)lists.fedoraproject.org
>> > To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>> >
>>
>>
>> --
>> Miroslav Grepl
>> Senior Software Engineer, SELinux Solutions
>> Red Hat, Inc.
>>
>
>