Allowing MLS->non-MLS and vice versa upon policy reload

Allowing MLS->non-MLS and vice versa upon policy reload

[Guido Trentalancia]

Stephen,

I am writing again to include a few more notes about the patch that I just posted.

You might want to check a few duplicate function declarations in ss/services.h and include/security.h (I did not know the best place for them, but when trying to build, selinuxfs.c was complaining about not finding declarations for functions in services.c, so I decided to update and include services.h, not knowing that the global security.h was already including some declarations).

But I can well move the declarations to security.h if it is better...

Regards,

Guido Trentalancia 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Allowing MLS->non-MLS and vice versa upon policy reload

[Guido Trentalancia]

Hello !

When switching at runtime from the standard reference policy and the MLS/MCS reference policy (2.20091117), the ssh server on a Debian Lenny system does not accept new connections until it is restarted.

The following denials are generated:

type=1400 audit(1265028026.079:19): avc:  denied  { transition } for  pid=8973 comm="sshd" path="/bin/bash" dev=dm-1 ino=146597 scontext=system_u:system_r:sshd_t:s0 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=process

Unfortunately, simply adding a custom module such as the following:

require {
        type staff_t;
        type sshd_t;
        class process transition;
}

#============= sshd_t ==============
allow sshd_t staff_t:process transition;

does not help.

I believe the problem arises as soon as the ssh server opens a shell for the user as I get "/bin/bash: Permission denied" after the initial /etc/motd banner (and the connection is dropped at that point).

Does anybody have an idea on how to sort out this issue ?

I believe the server is OpenSSH version 5.1p1, while bash is version 3.2.39(1). I have not had time to test other distributions.

Kind regards,

Guido Trentalancia 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Allowing MLS->non-MLS and vice versa upon policy reload

[Stephen Smalley]

On Mon, 2010-02-01 at 14:03 +0100, Guido Trentalancia wrote:
> Hello !
> 
> When switching at runtime from the standard reference policy and the MLS/MCS reference policy (2.20091117), the ssh server on a Debian Lenny system does not accept new connections until it is restarted.
> 
> The following denials are generated:
> 
> type=1400 audit(1265028026.079:19): avc:  denied  { transition } for  pid=8973 comm="sshd" path="/bin/bash" dev=dm-1 ino=146597 scontext=system_u:system_r:sshd_t:s0 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023 tclass=process
> 
> Unfortunately, simply adding a custom module such as the following:
> 
> require {
>         type staff_t;
>         type sshd_t;
>         class process transition;
> }
> 
> #============= sshd_t ==============
> allow sshd_t staff_t:process transition;
> 
> does not help.
> 
> I believe the problem arises as soon as the ssh server opens a shell for the user as I get "/bin/bash: Permission denied" after the initial /etc/motd banner (and the connection is dropped at that point).
> 
> Does anybody have an idea on how to sort out this issue ?
> 
> I believe the server is OpenSSH version 5.1p1, while bash is version 3.2.39(1). I have not had time to test other distributions.

Normally under MCS policy, ssh is started as a ranged daemon (see
ssh.te) so that it can then create ranged user sessions.  So if you
start it under standard policy and then switch to MCS, and you then try
to login to a user who is authorized for something more than just s0,
then it will fail due to violation of a MCS/MLS constraint in the
policy.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Allowing MLS->non-MLS and vice versa upon policy reload

[Guido Trentalancia]

Stephen,

the openssh server issue is specific to Debian or at least specific to
version 5.1p1. The current version is 5.3p1 and it does not suffer that
problem, therefore the issue should not be considered any further.

Should I submit both patches to the kernel mailing list or what ?

Kind regards,

Guido Trentalancia


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Allowing MLS->non-MLS and vice versa upon policy reload

[Stephen Smalley]

On Wed, 2010-02-03 at 20:47 +0100, Guido Trentalancia wrote:
> Stephen,
> 
> the openssh server issue is specific to Debian or at least specific to
> version 5.1p1. The current version is 5.3p1 and it does not suffer that
> problem, therefore the issue should not be considered any further.
> 
> Should I submit both patches to the kernel mailing list or what ?

Not necessary; they should get taken into security-testing-2.6 in due
time, given that they were acked unless someone objects to them.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.