| Message ID | 20190220123354.1589-1-dominick.grift@defensec.nl (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | scripts/selinux: modernize mdp | expand |
On Wed, Feb 20, 2019 at 01:33:54PM +0100, Dominick Grift wrote: > The MDP example no longer works on modern systems. > > Add support for devtmpfs. This is required by login programs to relabel terminals. > Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. > Add default seusers mapping and failsafe context for the SELinux PAM module. There are a couple more possible improvements that i have identified: Fail gracefully if checkpolicy does not exist Run setfiles with -F. There *might* be one scenario where this might be a good idea. Where the filesystem is labeled with invalid contexts but where SELinux is disabled. In that case setfiles will reset, but only types (I suppose) > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > --- > scripts/selinux/install_policy.sh | 6 +++++- > scripts/selinux/mdp/mdp.c | 1 + > 2 files changed, 6 insertions(+), 1 deletion(-) > > diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh > index 0b86c47baf7d..334fcf8903d5 100755 > --- a/scripts/selinux/install_policy.sh > +++ b/scripts/selinux/install_policy.sh > @@ -20,14 +20,18 @@ CP=`which checkpolicy` > VERS=`$CP -V | awk '{print $1}'` > > ./mdp policy.conf file_contexts > -$CP -o policy.$VERS policy.conf > +$CP -U allow -o policy.$VERS policy.conf > > mkdir -p /etc/selinux/dummy/policy > mkdir -p /etc/selinux/dummy/contexts/files > > +echo "__default__:user_u" > /etc/selinux/dummy/seusers > +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context > + > cp file_contexts /etc/selinux/dummy/contexts/files > cp dbus_contexts /etc/selinux/dummy/contexts > cp policy.$VERS /etc/selinux/dummy/policy > + > FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts > > if [ ! -d /etc/selinux ]; then > diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c > index 073fe7537f6c..cf06d5694cbc 100644 > --- a/scripts/selinux/mdp/mdp.c > +++ b/scripts/selinux/mdp/mdp.c > @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) > > fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); > fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); > + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); > fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); > fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); > fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); > -- > 2.21.0.rc1 >
On Wed, Feb 20, 2019 at 03:09:22PM +0100, Dominick Grift wrote: > On Wed, Feb 20, 2019 at 01:33:54PM +0100, Dominick Grift wrote: > > The MDP example no longer works on modern systems. > > > > Add support for devtmpfs. This is required by login programs to relabel terminals. > > Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. > > Add default seusers mapping and failsafe context for the SELinux PAM module. > > There are a couple more possible improvements that i have identified: > > Fail gracefully if checkpolicy does not exist > Run setfiles with -F. There *might* be one scenario where this might be a good idea. Where the filesystem is labeled with invalid contexts but where SELinux is disabled. > In that case setfiles will reset, but only types (I suppose) This also does not make sense to me: if [ -f /sbin/setfiles ]; then SF="/usr/setfiles" I think "-f /usr/setfiles" was meant here? I suppose `which setfiles` only searches "PATH", and so it wouldnt find /usr/setfiles. But then, who uses /usr/setfiles? > > > > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > > --- > > scripts/selinux/install_policy.sh | 6 +++++- > > scripts/selinux/mdp/mdp.c | 1 + > > 2 files changed, 6 insertions(+), 1 deletion(-) > > > > diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh > > index 0b86c47baf7d..334fcf8903d5 100755 > > --- a/scripts/selinux/install_policy.sh > > +++ b/scripts/selinux/install_policy.sh > > @@ -20,14 +20,18 @@ CP=`which checkpolicy` > > VERS=`$CP -V | awk '{print $1}'` > > > > ./mdp policy.conf file_contexts > > -$CP -o policy.$VERS policy.conf > > +$CP -U allow -o policy.$VERS policy.conf > > > > mkdir -p /etc/selinux/dummy/policy > > mkdir -p /etc/selinux/dummy/contexts/files > > > > +echo "__default__:user_u" > /etc/selinux/dummy/seusers > > +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context > > + > > cp file_contexts /etc/selinux/dummy/contexts/files > > cp dbus_contexts /etc/selinux/dummy/contexts > > cp policy.$VERS /etc/selinux/dummy/policy > > + > > FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts > > > > if [ ! -d /etc/selinux ]; then > > diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c > > index 073fe7537f6c..cf06d5694cbc 100644 > > --- a/scripts/selinux/mdp/mdp.c > > +++ b/scripts/selinux/mdp/mdp.c > > @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) > > > > fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); > > fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); > > + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); > > fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); > > fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); > > fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); > > -- > > 2.21.0.rc1 > > > > -- > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > Dominick Grift
On Wed, Feb 20, 2019 at 9:48 AM Dominick Grift <dominick.grift@defensec.nl> wrote: > > On Wed, Feb 20, 2019 at 03:09:22PM +0100, Dominick Grift wrote: > > On Wed, Feb 20, 2019 at 01:33:54PM +0100, Dominick Grift wrote: > > > The MDP example no longer works on modern systems. > > > > > > Add support for devtmpfs. This is required by login programs to relabel terminals. > > > Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. > > > Add default seusers mapping and failsafe context for the SELinux PAM module. > > > > There are a couple more possible improvements that i have identified: > > > > Fail gracefully if checkpolicy does not exist > > Run setfiles with -F. There *might* be one scenario where this might be a good idea. Where the filesystem is labeled with invalid contexts but where SELinux is disabled. > > In that case setfiles will reset, but only types (I suppose) > > This also does not make sense to me: > > if [ -f /sbin/setfiles ]; then > SF="/usr/setfiles" > > I think "-f /usr/setfiles" was meant here? I suppose `which setfiles` only searches "PATH", and so it wouldnt find /usr/setfiles. > But then, who uses /usr/setfiles? No one AFAIK. So I agree that this does not make sense. Might have been a broken attempt to support either /sbin/setfiles or /usr/sbin/setfiles as the install location of setfiles, since that did change at some point. > > > > > > > > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > > > --- > > > scripts/selinux/install_policy.sh | 6 +++++- > > > scripts/selinux/mdp/mdp.c | 1 + > > > 2 files changed, 6 insertions(+), 1 deletion(-) > > > > > > diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh > > > index 0b86c47baf7d..334fcf8903d5 100755 > > > --- a/scripts/selinux/install_policy.sh > > > +++ b/scripts/selinux/install_policy.sh > > > @@ -20,14 +20,18 @@ CP=`which checkpolicy` > > > VERS=`$CP -V | awk '{print $1}'` > > > > > > ./mdp policy.conf file_contexts > > > -$CP -o policy.$VERS policy.conf > > > +$CP -U allow -o policy.$VERS policy.conf > > > > > > mkdir -p /etc/selinux/dummy/policy > > > mkdir -p /etc/selinux/dummy/contexts/files > > > > > > +echo "__default__:user_u" > /etc/selinux/dummy/seusers > > > +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context > > > + > > > cp file_contexts /etc/selinux/dummy/contexts/files > > > cp dbus_contexts /etc/selinux/dummy/contexts > > > cp policy.$VERS /etc/selinux/dummy/policy > > > + > > > FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts > > > > > > if [ ! -d /etc/selinux ]; then > > > diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c > > > index 073fe7537f6c..cf06d5694cbc 100644 > > > --- a/scripts/selinux/mdp/mdp.c > > > +++ b/scripts/selinux/mdp/mdp.c > > > @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) > > > > > > fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); > > > fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); > > > + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); > > > fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); > > > fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); > > > fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); > > > -- > > > 2.21.0.rc1 > > > > > > > -- > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > Dominick Grift > > -- > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > Dominick Grift
On Wed, Feb 20, 2019 at 2:21 PM Stephen Smalley <stephen.smalley@gmail.com> wrote: > > On Wed, Feb 20, 2019 at 9:48 AM Dominick Grift > <dominick.grift@defensec.nl> wrote: > > > > On Wed, Feb 20, 2019 at 03:09:22PM +0100, Dominick Grift wrote: > > > On Wed, Feb 20, 2019 at 01:33:54PM +0100, Dominick Grift wrote: > > > > The MDP example no longer works on modern systems. > > > > > > > > Add support for devtmpfs. This is required by login programs to relabel terminals. > > > > Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. > > > > Add default seusers mapping and failsafe context for the SELinux PAM module. > > > > > > There are a couple more possible improvements that i have identified: > > > > > > Fail gracefully if checkpolicy does not exist > > > Run setfiles with -F. There *might* be one scenario where this might be a good idea. Where the filesystem is labeled with invalid contexts but where SELinux is disabled. > > > In that case setfiles will reset, but only types (I suppose) > > > > This also does not make sense to me: > > > > if [ -f /sbin/setfiles ]; then > > SF="/usr/setfiles" > > > > I think "-f /usr/setfiles" was meant here? I suppose `which setfiles` only searches "PATH", and so it wouldnt find /usr/setfiles. > > But then, who uses /usr/setfiles? > > No one AFAIK. So I agree that this does not make sense. Might have > been a broken attempt to support either /sbin/setfiles or > /usr/sbin/setfiles as the install location of setfiles, since that did > change at some point. Or if as you say it was just an attempt to deal with a PATH that omits /sbin, then maybe they should both be /sbin/setfiles. > > > > > > > > > > > > > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > > > > --- > > > > scripts/selinux/install_policy.sh | 6 +++++- > > > > scripts/selinux/mdp/mdp.c | 1 + > > > > 2 files changed, 6 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh > > > > index 0b86c47baf7d..334fcf8903d5 100755 > > > > --- a/scripts/selinux/install_policy.sh > > > > +++ b/scripts/selinux/install_policy.sh > > > > @@ -20,14 +20,18 @@ CP=`which checkpolicy` > > > > VERS=`$CP -V | awk '{print $1}'` > > > > > > > > ./mdp policy.conf file_contexts > > > > -$CP -o policy.$VERS policy.conf > > > > +$CP -U allow -o policy.$VERS policy.conf > > > > > > > > mkdir -p /etc/selinux/dummy/policy > > > > mkdir -p /etc/selinux/dummy/contexts/files > > > > > > > > +echo "__default__:user_u" > /etc/selinux/dummy/seusers > > > > +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context > > > > + > > > > cp file_contexts /etc/selinux/dummy/contexts/files > > > > cp dbus_contexts /etc/selinux/dummy/contexts > > > > cp policy.$VERS /etc/selinux/dummy/policy > > > > + > > > > FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts > > > > > > > > if [ ! -d /etc/selinux ]; then > > > > diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c > > > > index 073fe7537f6c..cf06d5694cbc 100644 > > > > --- a/scripts/selinux/mdp/mdp.c > > > > +++ b/scripts/selinux/mdp/mdp.c > > > > @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) > > > > > > > > fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); > > > > fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); > > > > + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); > > > > fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); > > > > fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); > > > > fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); > > > > -- > > > > 2.21.0.rc1 > > > > > > > > > > -- > > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > > Dominick Grift > > > > -- > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > Dominick Grift
On Wed, Feb 20, 2019 at 02:25:16PM -0500, Stephen Smalley wrote: > On Wed, Feb 20, 2019 at 2:21 PM Stephen Smalley > <stephen.smalley@gmail.com> wrote: > > > > On Wed, Feb 20, 2019 at 9:48 AM Dominick Grift > > <dominick.grift@defensec.nl> wrote: > > > > > > On Wed, Feb 20, 2019 at 03:09:22PM +0100, Dominick Grift wrote: > > > > On Wed, Feb 20, 2019 at 01:33:54PM +0100, Dominick Grift wrote: > > > > > The MDP example no longer works on modern systems. > > > > > > > > > > Add support for devtmpfs. This is required by login programs to relabel terminals. > > > > > Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. > > > > > Add default seusers mapping and failsafe context for the SELinux PAM module. > > > > > > > > There are a couple more possible improvements that i have identified: > > > > > > > > Fail gracefully if checkpolicy does not exist > > > > Run setfiles with -F. There *might* be one scenario where this might be a good idea. Where the filesystem is labeled with invalid contexts but where SELinux is disabled. > > > > In that case setfiles will reset, but only types (I suppose) > > > > > > This also does not make sense to me: > > > > > > if [ -f /sbin/setfiles ]; then > > > SF="/usr/setfiles" > > > > > > I think "-f /usr/setfiles" was meant here? I suppose `which setfiles` only searches "PATH", and so it wouldnt find /usr/setfiles. > > > But then, who uses /usr/setfiles? > > > > No one AFAIK. So I agree that this does not make sense. Might have > > been a broken attempt to support either /sbin/setfiles or > > /usr/sbin/setfiles as the install location of setfiles, since that did > > change at some point. > > Or if as you say it was just an attempt to deal with a PATH that omits > /sbin, then maybe they should both be /sbin/setfiles. We should probably remove those particular file tests altogether? If which does not find it then you have a problem that I am not we want to support? Not to mention that we just dont know the reason for this and what is right or what is wrong? > > > > > > > > > > > > > > > > > > > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > > > > > --- > > > > > scripts/selinux/install_policy.sh | 6 +++++- > > > > > scripts/selinux/mdp/mdp.c | 1 + > > > > > 2 files changed, 6 insertions(+), 1 deletion(-) > > > > > > > > > > diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh > > > > > index 0b86c47baf7d..334fcf8903d5 100755 > > > > > --- a/scripts/selinux/install_policy.sh > > > > > +++ b/scripts/selinux/install_policy.sh > > > > > @@ -20,14 +20,18 @@ CP=`which checkpolicy` > > > > > VERS=`$CP -V | awk '{print $1}'` > > > > > > > > > > ./mdp policy.conf file_contexts > > > > > -$CP -o policy.$VERS policy.conf > > > > > +$CP -U allow -o policy.$VERS policy.conf > > > > > > > > > > mkdir -p /etc/selinux/dummy/policy > > > > > mkdir -p /etc/selinux/dummy/contexts/files > > > > > > > > > > +echo "__default__:user_u" > /etc/selinux/dummy/seusers > > > > > +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context > > > > > + > > > > > cp file_contexts /etc/selinux/dummy/contexts/files > > > > > cp dbus_contexts /etc/selinux/dummy/contexts > > > > > cp policy.$VERS /etc/selinux/dummy/policy > > > > > + > > > > > FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts > > > > > > > > > > if [ ! -d /etc/selinux ]; then > > > > > diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c > > > > > index 073fe7537f6c..cf06d5694cbc 100644 > > > > > --- a/scripts/selinux/mdp/mdp.c > > > > > +++ b/scripts/selinux/mdp/mdp.c > > > > > @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) > > > > > > > > > > fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); > > > > > fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); > > > > > + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); > > > > > fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); > > > > > fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); > > > > > fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); > > > > > -- > > > > > 2.21.0.rc1 > > > > > > > > > > > > > -- > > > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > > > Dominick Grift > > > > > > -- > > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 > > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 > > > Dominick Grift
diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh index 0b86c47baf7d..334fcf8903d5 100755 --- a/scripts/selinux/install_policy.sh +++ b/scripts/selinux/install_policy.sh @@ -20,14 +20,18 @@ CP=`which checkpolicy` VERS=`$CP -V | awk '{print $1}'` ./mdp policy.conf file_contexts -$CP -o policy.$VERS policy.conf +$CP -U allow -o policy.$VERS policy.conf mkdir -p /etc/selinux/dummy/policy mkdir -p /etc/selinux/dummy/contexts/files +echo "__default__:user_u" > /etc/selinux/dummy/seusers +echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context + cp file_contexts /etc/selinux/dummy/contexts/files cp dbus_contexts /etc/selinux/dummy/contexts cp policy.$VERS /etc/selinux/dummy/policy + FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts if [ ! -d /etc/selinux ]; then diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c index 073fe7537f6c..cf06d5694cbc 100644 --- a/scripts/selinux/mdp/mdp.c +++ b/scripts/selinux/mdp/mdp.c @@ -131,6 +131,7 @@ int main(int argc, char *argv[]) fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n"); fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n");
The MDP example no longer works on modern systems. Add support for devtmpfs. This is required by login programs to relabel terminals. Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd. Add default seusers mapping and failsafe context for the SELinux PAM module. Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> --- scripts/selinux/install_policy.sh | 6 +++++- scripts/selinux/mdp/mdp.c | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)