New to SELinux -- any suggestions?

New to SELinux -- any suggestions?

[Michael Graffam]

Hello everyone,

I just installed Fedora Core 6 on my laptop. In the past I've chosen to
disable selinux because it interfered with running my chosen programming
environment: Common Lisp. 

Having been increasingly impressed with FC, and its tools to manage
SELinux, this time I decided to roll up my sleeves and figure out what I
could do to make my Lisp systems work without throwing out the baby with
the bathwater. I'm glad I did, because a simple 

chcon -t uncontained_execmem_exec_t /usr/bin/sbcl
(and /usr/local/bin/lisp)

fixed my troubles. It begs the question, which I will soon pose to the
SBCL and CMUCL lists as to why, exactly, CL implementations require an
executable stack -- but that's another story. 

After fixing my problem, I wanted to demonstrate the behavior to a
friend of mine, and found that I didn't have the foggiest idea of how to
actually use chcon :) .. I couldn't remove the indicated permission from
my bins. 

So, my first questions is: how do I do that? 'man chcon' and 'info
chcon' didn't prove helpful. 

This leads to my second question: is there a comprehensive set of
documentation for the SELinux-related command set?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Russell Coker]

On Sunday 29 October 2006 12:41, Michael Graffam <michael.graffam@gmail.com> 
wrote:
> chcon -t uncontained_execmem_exec_t /usr/bin/sbcl
> (and /usr/local/bin/lisp)

Incidentally why are you running it from /usr/local/bin?  Why don't you use an 
RPM package of it?  If there is no RPM available have you considered building 
your own and submitting it to Extras?

> After fixing my problem, I wanted to demonstrate the behavior to a
> friend of mine, and found that I didn't have the foggiest idea of how to
> actually use chcon :) .. I couldn't remove the indicated permission from
> my bins.

The problem here is your idea of "removing the permission".  Chcon does not 
add or remove permissions, it merely changes the labels of files.  What the 
label means is determined by the policy.

So if you want to change a file back to it's default context you can 
use "restorecon", in this case "restorecon -F -R -v /usr/local /usr/bin" 
should do what you want.

Another option is to know what the original context was (maybe by examining 
the file with "ls -Z" before changing it in the first place).  In this case I 
know that the bin directories have type bin_t, so the following would work:
chcon -t bin_t /usr/bin/sbcl /usr/local/bin/lisp

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Michael Graffam]

On Sun, 2006-10-29 at 13:31 +1000, Russell Coker wrote:
> On Sunday 29 October 2006 12:41, Michael Graffam <michael.graffam@gmail.com> 
> wrote:
> > chcon -t uncontained_execmem_exec_t /usr/bin/sbcl
> > (and /usr/local/bin/lisp)
> 
> Incidentally why are you running it from /usr/local/bin?  Why don't you use an 
> RPM package of it?  If there is no RPM available have you considered building 
> your own and submitting it to Extras?

As I suspected, a quick Google of 'fedora cmucl' indicates that there
is, indeed, an RPM of CMUCL. I myself run it from /usr/local/bin because
I built it from source, along with some modifications for my particular
application. I've carried this tree along with me for some time, and I'm
kind of sentimental about it now :)

> The problem here is your idea of "removing the permission".  Chcon does not 
> add or remove permissions, it merely changes the labels of files.  What the 
> label means is determined by the policy.
> 
> So if you want to change a file back to it's default context you can 
> use "restorecon", in this case "restorecon -F -R -v /usr/local /usr/bin" 
> should do what you want.

Thank you for the help. Can one AND/OR the contexts? Based on the above,
it would seem to me that if an executable violated two points of policy
it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
case, I'm wondering how I might apply multiple contexts. Or am I still
out in left field here?

> Another option is to know what the original context was (maybe by examining 
> the file with "ls -Z" before changing it in the first place).  In this case I 
> know that the bin directories have type bin_t, so the following would work:
> chcon -t bin_t /usr/bin/sbcl /usr/local/bin/lisp

Whooo.. new ls fields too! Man, I feel like a kid again! This is
great! :) Having been using GNU/Linux for so long, I almost forgot how
fun it is to learn new stuff about it!

-M


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Russell Coker]

On Sunday 29 October 2006 15:30, Michael Graffam <michael.graffam@gmail.com> 
wrote:
> > The problem here is your idea of "removing the permission".  Chcon does
> > not add or remove permissions, it merely changes the labels of files. 
> > What the label means is determined by the policy.
> >
> > So if you want to change a file back to it's default context you can
> > use "restorecon", in this case "restorecon -F -R -v /usr/local /usr/bin"
> > should do what you want.
>
> Thank you for the help. Can one AND/OR the contexts? Based on the above,
> it would seem to me that if an executable violated two points of policy
> it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
> case, I'm wondering how I might apply multiple contexts. Or am I still
> out in left field here?

I don't know what you mean by "bless" in this message.

SE Linux does not support multiple contexts on one object.  If multiple 
contexts are supported then it becomes almost impossible to analyse the 
policy.  For example if we want to make sure that domain user_t can not write 
to any file that allows a domain transition to a domain that can write to 
the /etc/shadow file (shadow_t) then we need to make sure that there is no 
file type which is an entry point for passwd_t that is also writable by 
user_t, this is a fairly simple analysis to perform.

If however a file could have multiple types then such analysis would be 
impossible unless you also had rules determining which pairs of contexts 
might be applied to one file (in which case every permitted pair of contexts 
could be mapped to a single context in the current SE Linux system for the 
same result).

> > Another option is to know what the original context was (maybe by
> > examining the file with "ls -Z" before changing it in the first place). 
> > In this case I know that the bin directories have type bin_t, so the
> > following would work: chcon -t bin_t /usr/bin/sbcl /usr/local/bin/lisp
>
> Whooo.. new ls fields too! Man, I feel like a kid again! This is
> great! :) Having been using GNU/Linux for so long, I almost forgot how
> fun it is to learn new stuff about it!

There is also "id -Z", "ps -Z" and "cp -Z".  There are also a few new 
commands, in addition to chcon there's runcon and newrole (which isn't being 
used so much nowadays) and there is semanage and getsebool/setsebool to 
manage it.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Michael Graffam]

On Sun, 2006-10-29 at 15:01 +1000, Russell Coker wrote:
> On Sunday 29 October 2006 15:30, Michael Graffam <michael.graffam@gmail.com> 
> wrote:
> > Thank you for the help. Can one AND/OR the contexts? Based on the above,
> > it would seem to me that if an executable violated two points of policy
> > it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
> > case, I'm wondering how I might apply multiple contexts. Or am I still
> > out in left field here?
> 
> I don't know what you mean by "bless" in this message.

By "bless" I meant "Allow it to run regardless." Or "Give it the
blessing to misbehave."


> If however a file could have multiple types then such analysis would be 
> impossible unless you also had rules determining which pairs of contexts 
> might be applied to one file (in which case every permitted pair of contexts 
> could be mapped to a single context in the current SE Linux system for the 
> same result).

OK, that makes perfect sense. I had figured that multiple contexts would
be allowed, to prevent the possible need of expanding the number of
required 'base' contexts. But, I can certainly see your point about the
difficulty of analyzing all possible combinations. 

> > Whooo.. new ls fields too! Man, I feel like a kid again! This is
> > great! :) Having been using GNU/Linux for so long, I almost forgot how
> > fun it is to learn new stuff about it!
> 
> There is also "id -Z", "ps -Z" and "cp -Z".  There are also a few new 
> commands, in addition to chcon there's runcon and newrole (which isn't being 
> used so much nowadays) and there is semanage and getsebool/setsebool to 
> manage it.

Thanks again for your help. Would you happen to know if there is a
document somewhere which gives a general overview of the structure of
the SELinux mechanisms, maybe with some details on the common contexts
and so forth?

-M


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Russell Coker]

On Sunday 29 October 2006 17:05, Michael Graffam <michael.graffam@gmail.com> 
wrote:
> > If however a file could have multiple types then such analysis would be
> > impossible unless you also had rules determining which pairs of contexts
> > might be applied to one file (in which case every permitted pair of
> > contexts could be mapped to a single context in the current SE Linux
> > system for the same result).
>
> OK, that makes perfect sense. I had figured that multiple contexts would
> be allowed, to prevent the possible need of expanding the number of
> required 'base' contexts. But, I can certainly see your point about the
> difficulty of analyzing all possible combinations.

There are many types used in SE Linux, the number you see in the targeted 
policy is a small part of what is in the strict policy.

Also recently (FC5 and above) the MLS features of SE Linux have been used.  
With separate mechanisms for protecting confidentiality and integrity a 
smaller number of types is needed (previously types were used for 
confidentiality as well).

> Thanks again for your help. Would you happen to know if there is a
> document somewhere which gives a general overview of the structure of
> the SELinux mechanisms, maybe with some details on the common contexts
> and so forth?

Some of this is documented in the Fedora wiki.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New to SELinux -- any suggestions?

[Joshua Brindle]

Michael Graffam wrote:
> On Sun, 2006-10-29 at 15:01 +1000, Russell Coker wrote:
>   
>> On Sunday 29 October 2006 15:30, Michael Graffam <michael.graffam@gmail.com> 
>> wrote:
>>     
>>> Thank you for the help. Can one AND/OR the contexts? Based on the above,
>>> it would seem to me that if an executable violated two points of policy
>>> it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
>>> case, I'm wondering how I might apply multiple contexts. Or am I still
>>> out in left field here?
>>>       
>> I don't know what you mean by "bless" in this message.
>>     
>
> By "bless" I meant "Allow it to run regardless." Or "Give it the
> blessing to misbehave."
>
>   
you can always write a very permissive policy for it but chances are you 
won't need to. What is the app doing that unconfined_execstack_t doesn't 
allow?

If you do end up having to write a policy its quite easy in FC6, just 
yum install selinux-policy-devel, /usr/share/selinux/devel/policygentool 
mylistapp /usr/local/bin/lisp and follow the instructions that 
policygentool has. This will allow you to give permissions only to your 
lisp app without granting them to the rest of the system.. You probably 
won't have to do this though, if unconfined_execstack_t can't do 
something its either a very broken app or a policy bug..

>> If however a file could have multiple types then such analysis would be 
>> impossible unless you also had rules determining which pairs of contexts 
>> might be applied to one file (in which case every permitted pair of contexts 
>> could be mapped to a single context in the current SE Linux system for the 
>> same result).
>>     
>
> OK, that makes perfect sense. I had figured that multiple contexts would
> be allowed, to prevent the possible need of expanding the number of
> required 'base' contexts. But, I can certainly see your point about the
> difficulty of analyzing all possible combinations. 
>
>   
>>> Whooo.. new ls fields too! Man, I feel like a kid again! This is
>>> great! :) Having been using GNU/Linux for so long, I almost forgot how
>>> fun it is to learn new stuff about it!
>>>       
>> There is also "id -Z", "ps -Z" and "cp -Z".  There are also a few new 
>> commands, in addition to chcon there's runcon and newrole (which isn't being 
>> used so much nowadays) and there is semanage and getsebool/setsebool to 
>> manage it.
>>     
>
> Thanks again for your help. Would you happen to know if there is a
> document somewhere which gives a general overview of the structure of
> the SELinux mechanisms, maybe with some details on the common contexts
> and so forth?
>
>   
There is quite a bit of documentation around in various places, most of 
which are linked to from the sourceforge project page 
(http://selinux.sourceforge.net/resources.php3). There is also a quite 
comprehensive book that was recently published if you are interested in 
that (http://www.phptr.com/bookstore/product.asp?isbn=0131963694&rl=1)

Alot of the new infrastructure isn't well documented, the fedora faq 
(http://fedora.redhat.com/docs/selinux-faq-fc5/en_US/) has a bit about 
them but it appears to be down at the moment.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.