SE Linux loading procedure.

SE Linux loading procedure.

[Oren Abe-P27525]

Hi there...

Do you (or anybody) have a flow chart(s)
describe the SE Linux loading sequence.

Something like step-by-step of the main
modules and procedures that loads into the
memory during the boot process ?

Thanks in advance.

Abe Oren
Principal Engineer
General Dynamics
Decision Systems
(480)675-2575

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Default policy under debian

[Ed Street]

Hello,

Just to let everyone know, using woody bf2.4 minimal install with
selinux we found remote root could execute /sbin/poweroff

Ed


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Default policy under debian

[Stephen Smalley]

On Fri, 21 Jun 2002, Ed Street wrote:

> Just to let everyone know, using woody bf2.4 minimal install with
> selinux we found remote root could execute /sbin/poweroff

Can you clarify what you mean by this statement?  "Remote root" is
ambiguous, as there is a difference between having the Linux root uid and
having the SELinux root user identity, and you also need to specify the
role and domain.  Notice that processes with the Linux root uid do
not necessarily have the SELinux root user identity, since the
identities are independent.  The SELinux user identity can only be
set by certain TE domains such as login and sshd, and the SELinux
root user identity is not assigned to system processes or setuid
root programs executed by ordinary user processes.  "Execute
/sbin/poweroff" is also ambiguous, as there is a difference between having
execute permission to /sbin/poweroff (relatively unimportant) and having
the necessary permissions to truly power off the system.

If you simply mean that a person who can authenticate as the root user can
power off the system, then that is no surprise.  The example policy
authorizes the SELinux root user identity for sysadm_r (see policy/users)
for direct logins as root:sysadm_r:sysadm_t, and the example policy
authorizes sshd_t to transition to sysadm_t for remote administration (see
the domain_trans rule in policy/domains/program/sshd.te).

You can certainly remove the corresponding domain_trans rule from sshd.te
if you do not wish to permit remote administrator shells, although you
would also need to do something about newrole if you want to completely
prevent the use of newrole by remote sessions (e.g. setting up a separate
user domain for remote shells that cannot transition to newrole_t).

You can also remove sysadm_r from the authorized roles for root in
policy/users if you are willing to always login under an ordinary user
account and use su (plus newrole, if you don't login directly as sysadm_r)
for administration.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com





--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Default policy under debian

[Russell Coker]

On Mon, 24 Jun 2002 07:50, Stephen Smalley wrote:
> On Fri, 21 Jun 2002, Ed Street wrote:
> > Just to let everyone know, using woody bf2.4 minimal install with
> > selinux we found remote root could execute /sbin/poweroff
>
> Can you clarify what you mean by this statement?  "Remote root" is
> ambiguous, as there is a difference between having the Linux root uid and
> having the SELinux root user identity, and you also need to specify the
> role and domain.  Notice that processes with the Linux root uid do

Here is the results of poweroff on Debian when uid=0 domain=user_t:

root@lyta:/# /sbin/poweroff
shutdown: warning: cannot open /var/run/shutdown.pid
init: /dev/initctl: Permission denied
root@lyta:/# id
uid=0(root) gid=0(root) groups=0(root) context=rjc:user_r:user_t sid=440
root@lyta:/#

If you ssh into a Debian machine as root in a typical setup it will log you 
in as root:sysadm_r:sysadm_t by default.  But that can easily be changed.  If 
you deny the "root" identity access to the sysadm_r role then they can't shut 
the machine down (as I recently proved).

> You can certainly remove the corresponding domain_trans rule from sshd.te
> if you do not wish to permit remote administrator shells, although you
> would also need to do something about newrole if you want to completely
> prevent the use of newrole by remote sessions (e.g. setting up a separate
> user domain for remote shells that cannot transition to newrole_t).

With all the bugs in ssh recently I have been thinking of doing this.  Make 
sshd go to user_t first (and prevent user_t having dac_override capability or 
suid/sgid capabilities) and then require newrole to change to sysadm_r.  It 
would still be possible to damage things, but it would be a lot harder and 
the damage would be a lot less.

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux loading procedure.

[Stephen Smalley]

On Fri, 21 Jun 2002, Oren Abe-P27525 wrote:

> Do you (or anybody) have a flow chart(s)
> describe the SE Linux loading sequence.
>
> Something like step-by-step of the main
> modules and procedures that loads into the
> memory during the boot process ?

I'm not aware of any such flow chart for SELinux.  But keep in mind that
the SELinux kernel is merely a modified form of the Linux kernel
(Linux+the LSM kernel patch+the SELinux kernel module).

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux loading procedure.

[Russell Coker]

On Mon, 24 Jun 2002 09:45, Stephen Smalley wrote:
> On Fri, 21 Jun 2002, Oren Abe-P27525 wrote:
> > Do you (or anybody) have a flow chart(s)
> > describe the SE Linux loading sequence.
> >
> > Something like step-by-step of the main
> > modules and procedures that loads into the
> > memory during the boot process ?
>
> I'm not aware of any such flow chart for SELinux.  But keep in mind that
> the SELinux kernel is merely a modified form of the Linux kernel
> (Linux+the LSM kernel patch+the SELinux kernel module).

I think that perhaps they want a list of the differences between SE Linux and 
a regular Linux kernel.

Basically as part of the proceedure of mounting the root file system or doing 
a pivot_root() operation the new policy file is loaded from 
/etc/security/selinux/ .

After that is loaded if it's the first load of a SE policy then it'll apply 
SIDs to kernel threads etc.

After that is done then the PSID mappings for the file system are 
re-evaluated to avoid the initrd problems (in the latest patches anyway).

Then when the kernel runs init it's subject to the regular 
domain_auto_trans() rules and things go in a normal fashion from there.

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

XDM with SE Linux

[Ryan Emge]

 SE linux users,

 Is there anyone here successfully running XDM with their SE Linux system? If you have both working together please contact me as I'm interested in how you went about it.

Best Regards,

 Ryan Emge


-- 

Ryan O. Emge

Information Assurance & Security
Norwich University - http://www.norwich.edu
158 Harmon Drive
Northfield, VT 05663

An NSA "Center of Academic Excellence in Information Assurance"

E: emger@norwich.edu

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: XDM with SE Linux

[Stephen Smalley]

On Mon, 15 Jul 2002, Ryan Emge wrote:

>  Is there anyone here successfully running XDM with their SE Linux
> system? If you have both working together please contact me as I'm
> interested in how you went about it.

To use an X Display Manager with SELinux, you need a patched [xgk]dm to
set the security context for the user session, as noted in selinux/README.
You can alternatively run X via startx after a normal login, which is what
I typically do.  We do not provide a patched [xgk]dm, but Mark Westerman
has a patched gdm available from the sourceforge selinux project site
(www.sf.net/projects/selinux), and Russell Coker has a patched kdm
available from his site (http://www.coker.com.au/selinux/kdm).

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.