selinux-policy-3.6.12-72.fc11.noarch selinux-policy-targeted-3.6.12-72.fc11.noarch ipsec-tools-0.7.2-1.fc11.x86_64
I'm getting a handful of racoon denials with what I believe is a pretty common setup — is there anything I could be doing differently?
allow racoon_t shadow_t:file { read getattr open };
This is needed for racoon to do XAuth logins with the default auth_source of system. Unfortunately that's the only option available with racoon as supplied in Fedora 11, as support for pam/ldap/radius isn't built in.
The rest is all caused by my having a phase1_up/down script in /etc/ racoon/scripts (the directory and the script are both system_u:object_r:bin_t:s0).
allow racoon_t setkey_exec_t:file { read execute open execute_no_trans }; allow racoon_t fs_t:filesystem getattr; allow racoon_t tmp_t:dir { write remove_name getattr search add_name }; allow racoon_t tmp_t:file { write getattr read create unlink open };
Calling /sbin/setkey to add and remove SPDs is the primary reason to have an up/down script. The fs_t and tmp_t accesses are less clear why they are necessary. It's a /bin/sh script which isn't doing anything other than calling / sbin/setkey.
type=AVC msg=audit(1250495868.674:27320): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27321): avc: denied { write } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27322): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" name="/" dev=dm-0 ino=2 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=AVC msg=audit(1250495868.674:27323): avc: denied { search } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { add_name } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { create } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.674:27323): avc: denied { write open } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.675:27324): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp/sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27325): avc: denied { read } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27326): avc: denied { remove_name } for pid=5436 comm="l2tp_up_down" name="sh- thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.676:27326): avc: denied { unlink } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { read open } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute_no_trans } for pid=5436 comm="l2tp_up_down" path="/sbin/ setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { read open } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute_no_trans } for pid=5533 comm="l2tp_up_down" path="/sbin/ setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.293:27359): avc: denied { read } for pid=5533 comm="setkey" path=2F746D702F73682D7468642D31323530353139323239202864656C6574656429 dev=dm-0 ino=30914 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
On Mon, Aug 17, 2009 at 10:59:59AM +0200, Daniel Fazekas wrote:
selinux-policy-3.6.12-72.fc11.noarch selinux-policy-targeted-3.6.12-72.fc11.noarch ipsec-tools-0.7.2-1.fc11.x86_64
I'm getting a handful of racoon denials with what I believe is a pretty common setup — is there anything I could be doing differently?
allow racoon_t shadow_t:file { read getattr open };
Well i can give you some direction into how to allow this stuff but i am not confident as to wheter its the right this to do and i also have not tested any of it.
but in theory:
echo "policy_module(myracoon, 0.0.1)" > myracoon.te; echo "require { type racoon_t; }" >> myracoon.te; echo "auth_read_shadow(racoon_t)" >> myracoon.te;
This is needed for racoon to do XAuth logins with the default auth_source of system. Unfortunately that's the only option available with racoon as supplied in Fedora 11, as support for pam/ldap/radius isn't built in.
The rest is all caused by my having a phase1_up/down script in /etc/ racoon/scripts (the directory and the script are both system_u:object_r:bin_t:s0).
allow racoon_t setkey_exec_t:file { read execute open execute_no_trans }; allow racoon_t fs_t:filesystem getattr; allow racoon_t tmp_t:dir { write remove_name getattr search add_name }; allow racoon_t tmp_t:file { write getattr read create unlink open };
echo "setkey_domtrans(racoon_t)" >> myracoon.te; echo "fs_dontaudit_getattr_xattr_fs(racoon_t)" >> myracoon.te; echo "type racoon_tmp_t;" >> myracoon.te; echo "files_tmp_file(racoon_tmp_t)" >> myracoon.te; echo "manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)" >> myracoon.te; echo "manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)" >> myracoon.te; echo "files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })" >> myracoon.te;
make -f /usr/share/selinux/devel/Makefile myracoon.pp sudo semodule -i myracoon.pp
This is just the rules translated into policy. I am not positive whether racoon or setkey creates the object in tmp, read shadow, and get attributes of fs_t:filesystem.
This policy assumes racoon_t does all that.
Calling /sbin/setkey to add and remove SPDs is the primary reason to have an up/down script. The fs_t and tmp_t accesses are less clear why they are necessary. It's a /bin/sh script which isn't doing anything other than calling / sbin/setkey.
type=AVC msg=audit(1250495868.674:27320): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27321): avc: denied { write } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27322): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" name="/" dev=dm-0 ino=2 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=AVC msg=audit(1250495868.674:27323): avc: denied { search } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { add_name } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { create } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.674:27323): avc: denied { write open } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.675:27324): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp/sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27325): avc: denied { read } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27326): avc: denied { remove_name } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.676:27326): avc: denied { unlink } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { read open } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute_no_trans } for pid=5436 comm="l2tp_up_down" path="/sbin/setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { read open } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute_no_trans } for pid=5533 comm="l2tp_up_down" path="/sbin/setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.293:27359): avc: denied { read } for pid=5533 comm="setkey" path=2F746D702F73682D7468642D31323530353139323239202864656C6574656429 dev=dm-0 ino=30914 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
On Aug 17, 2009, at 16:10, Dominick Grift wrote:
echo "setkey_domtrans(racoon_t)" >> myracoon.te;
This line results in the follow error: myracoon.te":6:ERROR 'syntax error' at token 'setkey_domtrans' on line 3308: setkey_domtrans(racoon_t)
And the avcs which cause audit2allow to suggest this remains: allow racoon_t setkey_exec_t:file { read execute open execute_no_trans };
But it seems to have cleared up all the rest, thanks!
This is just the rules translated into policy. I am not positive whether racoon or setkey creates the object in tmp, read shadow, and get attributes of fs_t:filesystem.
racoon itself reads shadow. The rest is all caused by racoon executing a bash shell script, which in turn executes setkey.
I believe now that the tmp file accesses are likely caused by that script's use of here-document << syntax to specify the input for setkey.
eg.:
/sbin/setkey -c << EOT spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require; spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}/32[any] any -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require; EOT
On Mon, Aug 17, 2009 at 05:37:42PM +0200, Daniel Fazekas wrote:
On Aug 17, 2009, at 16:10, Dominick Grift wrote:
echo "setkey_domtrans(racoon_t)" >> myracoon.te;
This line results in the follow error: myracoon.te":6:ERROR 'syntax error' at token 'setkey_domtrans' on line 3308: setkey_domtrans(racoon_t)
So that means there is no such shared policy. we can can work around that by adding the following to the myracoon.te:
echo "require { type setkey_exec_t, setkey_t; }" >> myracoon.te; echo "domtrans_pattern(racoon_t, setkey_exec_t, setkey_t)" >> myracoon.te;
make -f /usr/share/selinux/devel/Makefile myracoon.pp sudo semodule -i myracoon.pp
assuming setkey_t is the domain type
And the avcs which cause audit2allow to suggest this remains: allow racoon_t setkey_exec_t:file { read execute open execute_no_trans };
But it seems to have cleared up all the rest, thanks!
This is just the rules translated into policy. I am not positive whether racoon or setkey creates the object in tmp, read shadow, and get attributes of fs_t:filesystem.
racoon itself reads shadow. The rest is all caused by racoon executing a bash shell script, which in turn executes setkey.
I believe now that the tmp file accesses are likely caused by that script's use of here-document << syntax to specify the input for setkey.
eg.:
/sbin/setkey -c << EOT spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require; spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}/32[any] any -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require; EOT
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
On Aug 17, 2009, at 18:09, Dominick Grift wrote:
So that means there is no such shared policy. we can can work around that by adding the following to the myracoon.te: echo "require { type setkey_exec_t, setkey_t; }" >> myracoon.te; echo "domtrans_pattern(racoon_t, setkey_exec_t, setkey_t)" >> myracoon.te;
assuming setkey_t is the domain type
That did compile, but now there's a whole new set of setkey_t denials.
allow setkey_t racoon_t:key_socket { read write }; allow setkey_t racoon_t:netlink_route_socket { read write }; allow setkey_t racoon_t:udp_socket { read write }; allow setkey_t racoon_t:unix_stream_socket { read write }; allow setkey_t racoon_tmp_t:file { read getattr };
I now had to make setkey_t permissive. Previously it only required doing that for racoon_t.
On Mon, Aug 17, 2009 at 10:46:16PM +0200, Daniel Fazekas wrote:
On Aug 17, 2009, at 18:09, Dominick Grift wrote:
So that means there is no such shared policy. we can can work around that by adding the following to the myracoon.te: echo "require { type setkey_exec_t, setkey_t; }" >> myracoon.te; echo "domtrans_pattern(racoon_t, setkey_exec_t, setkey_t)" >> myracoon.te;
assuming setkey_t is the domain type
That did compile, but now there's a whole new set of setkey_t denials.
allow setkey_t racoon_t:key_socket { read write }; allow setkey_t racoon_t:netlink_route_socket { read write }; allow setkey_t racoon_t:udp_socket { read write }; allow setkey_t racoon_t:unix_stream_socket { read write }; allow setkey_t racoon_tmp_t:file { read getattr };
I was kind of expecting that.
The issue is that most of these rules look really ugly.
Maybe there is a 'good' reason why setkey_domtrans is not available.
Maybe we should not let racoon_t domain transition to setkey_t.
try this rule instead of the domtrans_pattern():
can_exec(racoon_t, setkey_exec_t)
(maybe theres a setkey_exec() available for you to call)
This will cause racoon_t to run setkey in the racoon_t domain instead.
I now had to make setkey_t permissive. Previously it only required doing that for racoon_t.
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
On Aug 18, 2009, at 11:17, Dominick Grift wrote:
try this rule instead of the domtrans_pattern(): can_exec(racoon_t, setkey_exec_t)
Thanks, that did the trick. Everything seems to be fine now with enforcing turned fully back on.
Here's for reference the myracoon.te we ended up with, in case it helps somebody else too:
policy_module(myracoon, 0.0.4) require { type racoon_t, setkey_exec_t; }
auth_read_shadow(racoon_t)
can_exec(racoon_t, setkey_exec_t)
fs_dontaudit_getattr_xattr_fs(racoon_t)
type racoon_tmp_t; files_tmp_file(racoon_tmp_t) manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
On 08/18/2009 05:36 AM, Daniel Fazekas wrote:
On Aug 18, 2009, at 11:17, Dominick Grift wrote:
try this rule instead of the domtrans_pattern(): can_exec(racoon_t, setkey_exec_t)
Thanks, that did the trick. Everything seems to be fine now with enforcing turned fully back on.
Here's for reference the myracoon.te we ended up with, in case it helps somebody else too:
policy_module(myracoon, 0.0.4) require { type racoon_t, setkey_exec_t; }
auth_read_shadow(racoon_t)
can_exec(racoon_t, setkey_exec_t)
fs_dontaudit_getattr_xattr_fs(racoon_t)
type racoon_tmp_t; files_tmp_file(racoon_tmp_t) manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Ok better then the domtrans, although most of what you showed before were probably leaked file descriptors.
I would really prefer not to use /tmp.
On Aug 18, 2009, at 19:43, Daniel J Walsh wrote:
type racoon_tmp_t; files_tmp_file(racoon_tmp_t) manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
Ok better then the domtrans, although most of what you showed before were probably leaked file descriptors. I would really prefer not to use /tmp.
I still think – though haven't actually tested it – that all those tmp file accesses are caused by bash's here-doc syntax to provide input for setkey. (The temp files are all named sh-thd-#UNIX_TIMESTAMP#)
Just like the example script in ipsec-tools, /etc/racoon/scripts/ p1_up_down does it:
setkey -c << EOT spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require; spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require; EOT
The only other alternative seems to be to put the rules into a dynamically created temp file, which I could then place anywhere, then use setkey -f to load it from there.
"setkey takes a series of operations from standard input (if invoked with -c) or the file named filename (if invoked with -f filename)."
On 08/18/2009 01:53 PM, Daniel Fazekas wrote:
On Aug 18, 2009, at 19:43, Daniel J Walsh wrote:
type racoon_tmp_t; files_tmp_file(racoon_tmp_t) manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
Ok better then the domtrans, although most of what you showed before were probably leaked file descriptors. I would really prefer not to use /tmp.
I still think – though haven't actually tested it – that all those tmp file accesses are caused by bash's here-doc syntax to provide input for setkey. (The temp files are all named sh-thd-#UNIX_TIMESTAMP#)
Just like the example script in ipsec-tools, /etc/racoon/scripts/p1_up_down does it:
setkey -c << EOT spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require; spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require; EOT
The only other alternative seems to be to put the rules into a dynamically created temp file, which I could then place anywhere, then use setkey -f to load it from there.
"setkey takes a series of operations from standard input (if invoked with -c) or the file named filename (if invoked with -f filename)."
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Yes that looks correct. So I will add the rules to rawhide.
Miroslav can you grab the ipsec,te from rawhide and put it in F11.
On 08/20/2009 01:42 AM, Daniel J Walsh wrote:
On 08/18/2009 01:53 PM, Daniel Fazekas wrote:
On Aug 18, 2009, at 19:43, Daniel J Walsh wrote:
type racoon_tmp_t; files_tmp_file(racoon_tmp_t) manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
Ok better then the domtrans, although most of what you showed before were probably leaked file descriptors. I would really prefer not to use /tmp.
I still think – though haven't actually tested it – that all those tmp file accesses are caused by bash's here-doc syntax to provide input for setkey. (The temp files are all named sh-thd-#UNIX_TIMESTAMP#)
Just like the example script in ipsec-tools, /etc/racoon/scripts/p1_up_down does it:
setkey -c<< EOT spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require; spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require; EOT
The only other alternative seems to be to put the rules into a dynamically created temp file, which I could then place anywhere, then use setkey -f to load it from there.
"setkey takes a series of operations from standard input (if invoked with -c) or the file named filename (if invoked with -f filename)."
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Yes that looks correct. So I will add the rules to rawhide.
Miroslav can you grab the ipsec,te from rawhide and put it in F11.
Added to selinux-policy-3.6.12-79.fc11
On 08/17/2009 04:59 AM, Daniel Fazekas wrote:
selinux-policy-3.6.12-72.fc11.noarch selinux-policy-targeted-3.6.12-72.fc11.noarch ipsec-tools-0.7.2-1.fc11.x86_64
I'm getting a handful of racoon denials with what I believe is a pretty common setup — is there anything I could be doing differently?
allow racoon_t shadow_t:file { read getattr open };
This is needed for racoon to do XAuth logins with the default auth_source of system. Unfortunately that's the only option available with racoon as supplied in Fedora 11, as support for pam/ldap/radius isn't built in.
The rest is all caused by my having a phase1_up/down script in /etc/racoon/scripts (the directory and the script are both system_u:object_r:bin_t:s0).
allow racoon_t setkey_exec_t:file { read execute open execute_no_trans }; allow racoon_t fs_t:filesystem getattr; allow racoon_t tmp_t:dir { write remove_name getattr search add_name }; allow racoon_t tmp_t:file { write getattr read create unlink open };
Calling /sbin/setkey to add and remove SPDs is the primary reason to have an up/down script. The fs_t and tmp_t accesses are less clear why they are necessary. It's a /bin/sh script which isn't doing anything other than calling /sbin/setkey.
type=AVC msg=audit(1250495868.674:27320): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27321): avc: denied { write } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27322): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" name="/" dev=dm-0 ino=2 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=AVC msg=audit(1250495868.674:27323): avc: denied { search } for pid=5436 comm="l2tp_up_down" name="tmp" dev=dm-0 ino=26 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { add_name } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.674:27323): avc: denied { create } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.674:27323): avc: denied { write open } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.675:27324): avc: denied { getattr } for pid=5436 comm="l2tp_up_down" path="/tmp/sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27325): avc: denied { read } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27326): avc: denied { remove_name } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1250495868.676:27326): avc: denied { unlink } for pid=5436 comm="l2tp_up_down" name="sh-thd-1250518043" dev=dm-0 ino=218 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { read open } for pid=5436 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250495868.676:27327): avc: denied { execute_no_trans } for pid=5436 comm="l2tp_up_down" path="/sbin/setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { read open } for pid=5533 comm="l2tp_up_down" name="setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.280:27354): avc: denied { execute_no_trans } for pid=5533 comm="l2tp_up_down" path="/sbin/setkey" dev=dm-0 ino=10974 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:setkey_exec_t:s0 tclass=file type=AVC msg=audit(1250496231.293:27359): avc: denied { read } for pid=5533 comm="setkey" path=2F746D702F73682D7468642D31323530353139323239202864656C6574656429 dev=dm-0 ino=30914 scontext=system_u:system_r:racoon_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
I can add a tunable to allow racoon to read shadow, although I would like to see it use pam if a port is available.
I will also add the ability to transition from racoon to setkey_t, but I would prefer if you put your temporary files in /var/racoon or /var/run/pluto or /var/run/racoon.
System Services should NEVER use /tmp for creation of interaction with files. Users live there and users is evil :^)
On Aug 18, 2009, at 19:30, Daniel J Walsh wrote:
I can add a tunable to allow racoon to read shadow, although I would like to see it use pam if a port is available.
I too would prefer PAM, unfortunately Fedora 11's copy of racoon is built without --with-libpam. There already a BZ about it from November 2008: https://bugzilla.redhat.com/show_bug.cgi?id=470793
I will also add the ability to transition from racoon to setkey_t, but I would prefer if you put your temporary files in /var/racoon or /var/run/pluto or /var/run/racoon. System Services should NEVER use /tmp for creation of interaction with files. Users live there and users is evil :^)
Turns out that was simple enough.
I just added TMPDIR="/var/racoon" to the start of the bash shell script, and now bash doesn't try putting its stuff into /tmp. What's even better is that this already seems to be allowed by the current policy.
So the whole extra myracoon module could be simplified as:
--------- policy_module(myracoon, 0.0.5) require { type racoon_t, setkey_exec_t; }
auth_read_shadow(racoon_t) can_exec(racoon_t, setkey_exec_t) fs_dontaudit_getattr_xattr_fs(racoon_t) ---------
Are these reasonable to add to the official policy one day?
On Wed, 2009-08-19 at 13:01 +0200, Daniel Fazekas wrote:
On Aug 18, 2009, at 19:30, Daniel J Walsh wrote:
I can add a tunable to allow racoon to read shadow, although I would like to see it use pam if a port is available.
I too would prefer PAM, unfortunately Fedora 11's copy of racoon is built without --with-libpam. There already a BZ about it from November 2008: https://bugzilla.redhat.com/show_bug.cgi?id=470793
I will also add the ability to transition from racoon to setkey_t, but I would prefer if you put your temporary files in /var/racoon or /var/run/pluto or /var/run/racoon. System Services should NEVER use /tmp for creation of interaction with files. Users live there and users is evil :^)
Turns out that was simple enough.
I just added TMPDIR="/var/racoon" to the start of the bash shell script, and now bash doesn't try putting its stuff into /tmp. What's even better is that this already seems to be allowed by the current policy.
I've added the TMPDIR setting to the ipsec-tools-0.7.3-2.fc12 package - you can get it from koji or from rawhide mirrors later.
So the whole extra myracoon module could be simplified as:
policy_module(myracoon, 0.0.5) require { type racoon_t, setkey_exec_t; }
auth_read_shadow(racoon_t) can_exec(racoon_t, setkey_exec_t) fs_dontaudit_getattr_xattr_fs(racoon_t)
Are these reasonable to add to the official policy one day?
I've also added --with-libpam to the build and added some initial racoon PAM configuration. Can you please test xauth against pam instead of shadow? I still suppose some selinux-policy adjustments will be necessary.
On 08/19/2009 07:01 AM, Daniel Fazekas wrote:
On Aug 18, 2009, at 19:30, Daniel J Walsh wrote:
I can add a tunable to allow racoon to read shadow, although I would like to see it use pam if a port is available.
I too would prefer PAM, unfortunately Fedora 11's copy of racoon is built without --with-libpam. There already a BZ about it from November 2008: https://bugzilla.redhat.com/show_bug.cgi?id=470793
I will also add the ability to transition from racoon to setkey_t, but I would prefer if you put your temporary files in /var/racoon or /var/run/pluto or /var/run/racoon. System Services should NEVER use /tmp for creation of interaction with files. Users live there and users is evil :^)
Turns out that was simple enough.
I just added TMPDIR="/var/racoon" to the start of the bash shell script, and now bash doesn't try putting its stuff into /tmp. What's even better is that this already seems to be allowed by the current policy.
So the whole extra myracoon module could be simplified as:
policy_module(myracoon, 0.0.5) require { type racoon_t, setkey_exec_t; }
auth_read_shadow(racoon_t) can_exec(racoon_t, setkey_exec_t) fs_dontaudit_getattr_xattr_fs(racoon_t)
Are these reasonable to add to the official policy one day?
Yes
selinux@lists.fedoraproject.org