Hi,=

In this mail, i'll describe with wich steps i resolved my problem with = Network Interface Labeling.

&nbs= p;

- = ; Problem: We need to block a specific domain (application, users or other) to use = a specific network interface.

- Question: How can i do? With NetLabel? SECMARK?= I need to develop a new policy? Is there a refpolicy like a template? Is n= ot possible?

After some read on many blogs/books/SELinux site, i di= d a merge of these informations, and i found a solution for my problem.

- = Environment Example: we have an envir= onment where there are two network interface, the first for public network,= the second for internal network. And we don=E2=80=99t want a user called = =E2=80=9Cmyuser=E2=80=9D (sysadm_r) after login from public interface, can = jump trough internal network interface.

- &n= bsp; Solution step-by-step:

1. &nbs= p; We need to create two new types, the= first for internal interface, and another for packet_internal_interface.

=C2=A7 My policy= is this:

policy_module(telecom,1.0)

#I declare my types

type telecom_netif_mgmt_t;=C2= =A0=C2=A0=C2=A0 #type for internal network interface

<= p class=3DMsoPlainText style=3D'margin-left:108.0pt'>type telecom_netif_mgm= t_packet_t; #type for packet of internal network interface
2.    = ;   After compile and install this policy= , you have a new two types that you can check with seinfo =E2=80=93t |grep = <yourtype>
<= span style=3D'mso-list:Ignore'>3. <= /span>=C2=A0yum =E2=80=93y install netlabel_tools= =C2=A0=C2=A0 #is needed for manage Network Labeling
4.=      = Now you need to label your network internal = interface with semanage command:
=C2=A7 semanage interface -a -t telecom_netif_mgmt_t eth0= #with this we label the interface
=C2=A7&nb= sp; semanage interface =E2=80=93l #with t= his we check it
= =C2=A7 = =C2=A0=C2=A0we should see something like this
<= p class=3DMsoPlainText style=3D'margin-left:72.0pt;text-indent:-18.0pt;mso-= list:l0 level2 lfo1'>5= =2E    &nb= sp; Is moment to link this with Network Label= ing trough netlabelctl command:
=C2=A7= netlabelctl unlbl add interface:eth0 = address:10.23.130.131 label:system_u:object_r:telecom_netif_mgmt_packet_t:s= 0=C2=A0 #we are setting all unlabeled packets flow for eth0 are labeled = with telecom_netif_mgmt_packet_t
<= ![if !supportLists]>=C2=B7  =        N.B.= : address: 10.23.130.131 must be the static ip address of internal network = interface
=C2=A7 netlabelctl unlbl list #for check
=C2=B7&n= bsp;        you should must see this output: accept:on interface:eth0,address= :10.23.130.131/32,label:"system_u:object_r:telecom_netif_mgmt_packet_t= :s0"
<= span style=3D'mso-list:Ignore'>6. We need to modify our simple policy below with this delta:<= /o:p>
policy_modul= e(telecom,1.0)

#I declare my types
type telecom_netif_mgmt_t;=C2=A0=C2=A0=C2=A0 #type for internal network interface
type telecom_netif_mgmt_packet_t; #ty= pe for packet of internal network interface

=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 allow unconfined_t telecom_netif_mgmt_t : netif { tcp_recv = tcp_send udp_recv udp_send ingress egress } ; #This allow unconfined_t (= root user for example) to use internal network interface (egress, so the OU= T traffic) =E2=80=93 for comodity i allow all permissions
a= llow unlabeled_t telecom_netif_mgmt_t : netif { tcp_recv tcp_send udp_recv = udp_send ingress egress};=C2=A0=C2=A0=C2=A0 # This allow =C2=A0unlabeled= _t (all response from =E2=80=93 to) to pass troughe=C2=A0 internal network = interface (ingress, so the IN traffic) =E2=80=93 for comodity i allow all p= ermissions
7.       So, now uncon= fined_t is allowed, but myuser_t (our myuser user)is not allowed, so we nee= d only to try and see what happen:
=C2=A7 While i launch a ping trough myuser (root res= tricted shell):
=C2= =B7    &nb= sp;
=C2=B7&= nbsp;        We see also audit.log:
=C2=B7  &n= bsp;
=
=C2=B7         We can see that = our specific domaind (telecom_sysadm_t) can=E2=80=99t use and jump in the i= nternal network interface (eth0)

Pro= blem SOLVED!

I hope that this mini guide, can help someone.
If there are any improvement, that someone = can give me, i=E2=80=99m here ready to improve.

Sorry in advance, i= f this guide is not write with an optimal english.

Thanks,

Maurizio Pagani (LordFire in #SELinux)

    &n= bsp;

-----Messaggio originale-----
Da: Paul M= oore [mailto:paul@paul-moore.com]
Inviato: venerd=C3=AC 12 giugno 2015 = 22:48
A: Maurizio Pagani
Cc: Stephen Smalley; James Morris; Daniel J = Walsh; Dominick Grift; Sven Vermeulen; Eric Paris
Oggetto: Re: R: SELinu= x: Interface Labeling Problem
=
On Fri, Jun 12, 2015 at 4:34 PM, Maurizio= Pagani <pag.maurizio@gmail.com> wrot= e:
> Sure!!! That help!! However i= solved yet my problem, but i though
> "maybe i should must write a small guide/solution to list for sh= are my problem."
> =
> Right?

I'm glad to hear that= you've resolved your problem, and I think a short description of your prob= lem as well as how you solved it would be very welcome on the list.

--
paul moore
www.paul-moore.com