suggestion to help transition to selinux: dynamic loading of libselinux

suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton]

dear nsa et al,

love selinux principle.  it's _got_ to be made easier.

idea: make all the modifications to e.g. coreutils, login etc.
compile with the header files but not necessarily _need_
libselinux at run-time.

way to do that is the same way that libdvdcss is loaded by
libdvdread: dynamically [there are plenty of other programs
that use the same technique].

the suggestion is based on the premise that if you have a
non-selinux kernel, and no libselinux installed, the programs
(pam, coreutils, login etc.) will attempt to dynamically load
libselinux (with dlopen), find it missing, _won't care_
and will adapt and proceed knowing that there's no security
enhancements - i.e. as if they had never been patched to
deal with selinux in the first place;

whilst if they _do_ detect that libselinux is available, an
init function is called which returns a pointer to a vector
table of all the functions needed, which are then used;

and i presume that if such programs are compromised, and someone
attempts to _stop_ libselinux from being loaded, well then
those programs will not be capable of making domain transitions
etc. and they will be useless [am i right?]


the technique of having one function available from a dynamic
library, which returns a table of all functions available in
the library, and which is accessed via dlsym is very common,
i am sure you have heard of it:

/* change all functions listed in this vector table from
   extern to static: they are made accessible _only_ through
   the vector table, instead
 */

static libselinux_vector_table fns =
{
    is_selinux_enabled,
	freecon,
	freeconary,
	getcon,
	getpidcon,
	getprevcon,
	getexeccon,
	....
	....
	fsetfilecon
}


extern libselinux_vector_table *libselinux_init_fn(void);


then you do this, in every program that requires access to
libselinux functions:

void *handle = dlopen("/usr/lib/libselinux.so", blah);
void *(void) fn = dlsym(handle, "libselinux_init_fn");

libselinux_vector_table *sel = (libselinux_vector_table*)(*fn)();

then, for example, in the patch to coreutils,
http://selinux.lemuria.org/newselinux/coreutils/coreutils.diff

in coreutils-5.0.91/src/copy.c line 1444 approx, instead of
++#ifdef WITH_SELINUX
++	if (x->preserve_security_context) 
++	  setfscreatecon(NULL);
++#endif

you have:

if (sel != NULL && x->preserve_security_context)
	sel->setfscreatecon(NULL);


yes, correct: no #ifdef WITH_SELINUX :)


i.e. you must compile always with the header files, but you must NOT
require the library libselinux to be present in order for the program
to actually work.

this is a standard programming technique, i am sure that someone could
provide better examples of how it is deployed.

the advantage of deploying it is that at present there is
completely justifiable resistance upstream in accepting
patches to the core functionality of linux useability that
makes it impossible to use the core utilities for a non-selinux
environment (!), and this suggestion makes the reason for that
resistance go away.


i hope that you will consider adapting libselinux for use in this
manner, because the sooner the dual-maintenance of the "alternate"
versions of the core utils disappears, the better.

sincerely,

l.

p.s. please ask me for clarifications if needed or even for
patches rather than go "uhn?  weirdo, weird language, can't
even touch a shift key, don't talk to him".  i _want_ selinux
to be adapted mainstream by debian, quickly, so talk to me.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Sun, 16 May 2004 09:26, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> and i presume that if such programs are compromised, and someone
> attempts to _stop_ libselinux from being loaded, well then
> those programs will not be capable of making domain transitions
> etc. and they will be useless [am i right?]

The first candidate for such changes would be init.  We would have to 
hard-code a check for selinux=0 in the init source to avoid having init just 
not enable SE Linux if file system corruption causes libselinux.so to 
disappear.

I think that init is the program that needs such changes most, the current 
situation makes libselinux one of the most important packages in the system 
(can't boot without it).

> then, for example, in the patch to coreutils,
> http://selinux.lemuria.org/newselinux/coreutils/coreutils.diff
>
> in coreutils-5.0.91/src/copy.c line 1444 approx, instead of
> ++#ifdef WITH_SELINUX
> ++	if (x->preserve_security_context)
> ++	  setfscreatecon(NULL);
> ++#endif
>
> you have:
>
> if (sel != NULL && x->preserve_security_context)
> 	sel->setfscreatecon(NULL);
>
>
> yes, correct: no #ifdef WITH_SELINUX :)

In any case I think that we want #ifdef WITH_SELINUX.  People who don't want 
to use SE Linux should have the option to compile without any of that code 
for small memory systems.

> the advantage of deploying it is that at present there is
> completely justifiable resistance upstream in accepting
> patches to the core functionality of linux useability that
> makes it impossible to use the core utilities for a non-selinux
> environment (!), and this suggestion makes the reason for that
> resistance go away.

Of course we can do this on a per-application basis.  If there is some 
application for which we can't get the current patches included but for which 
changes such as you suggest would be accepted then we should definitely do it 
for that app.

Of course that doesn't require changing libselinux, we could just call dlsym() 
for every function we want to use.  Do any applications use so many functions 
that calling dlsym() repeatedly is excessive overhead?

> p.s. please ask me for clarifications if needed or even for
> patches rather than go "uhn?  weirdo, weird language, can't
> even touch a shift key, don't talk to him".  i _want_ selinux
> to be adapted mainstream by debian, quickly, so talk to me.

The main thing that is needed for better SE Linux support in Debian is to have 
more people working on it.  Doing this sort of thing properly requires that 
most than one person work on it.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton]

On Tue, May 18, 2004 at 05:10:40AM +1000, Russell Coker wrote:
> On Sun, 16 May 2004 09:26, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > and i presume that if such programs are compromised, and someone
> > attempts to _stop_ libselinux from being loaded, well then
> > those programs will not be capable of making domain transitions
> > etc. and they will be useless [am i right?]
> 
> The first candidate for such changes would be init.  We would have to 
> hard-code a check for selinux=0 in the init source to avoid having init just 
> not enable SE Linux if file system corruption causes libselinux.so to 
> disappear.
 
 oh.  eek!  of course :)  cause libselinux.so to be corrupted and you're
 in.

 hmmm.... physical security is assumed already (i.e. no boot from
 floppy)... 

 ... modification of initscripts "by corruption" an outside chance...
 
 ... replacement of initscripts (apt-get install sysvinit) _cannot_
 be ruled out...

 ... therefore the startup process must be secure (no dynamic loading)

 i don't know enough to be able to say it would be good, or bad, to
 make _some_ programs do dynamic loading of libselinux and some not
 do it.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Tue, 18 May 2004 07:56, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
>  ... replacement of initscripts (apt-get install sysvinit) _cannot_
>  be ruled out...

If you install a non-SE version of sysvinit then you will entirely turn off SE 
Linux.  There is no solution to this.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 641 bytes --]

On Mon, 17 May 2004 21:56:01 -0000, Luke Kenneth Casson Leighton said:

>  oh.  eek!  of course :)  cause libselinux.so to be corrupted and you're
>  in.

Equally important - the sequence has to be able to DTRT if the fsck of the root
filesystem fails. Remember - for dynamic linking to work, you need a *lot* more
uncorrupted inodes.  If the library you need is in /lost+found, you have some
issues to work out.. ;)

(Note - DTRT doesn't necessarily mean "recover" - although a statically linked
/sbin/fsck.ext3 helps a bunch there.  Being able to drop the system to a known
fail-safe state and then yell for help is probably sufficient).


[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton]

On Tue, May 18, 2004 at 05:10:40AM +1000, Russell Coker wrote:

> Of course we can do this on a per-application basis.  If there is some 
> application for which we can't get the current patches included but for which 
> changes such as you suggest would be accepted then we should definitely do it 
> for that app.
 

> Of course that doesn't require changing libselinux, we could just call dlsym() 
> for every function we want to use.  

ah, you then need to check every pointer to every function
for not being NULL.

it'd be aesthetically better to cut/paste sel-> in front of every
function used rather than have if (fn != NULL) ...

plus you have to check for the success of each dlsym() rather
than just the one.

you can just search for calls to is_selinux_enabled()  and
add the code to do one dlsym() at that point, in fact you
could probably get away with adding a small macro into
libselinux.h that'd do the hard work.


> > p.s. please ask me for clarifications if needed or even for
> > patches rather than go "uhn?  weirdo, weird language, can't
> > even touch a shift key, don't talk to him".  i _want_ selinux
> > to be adapted mainstream by debian, quickly, so talk to me.
> 
> The main thing that is needed for better SE Linux support in Debian is to have 
> more people working on it.  Doing this sort of thing properly requires that 
> most than one person work on it.
 
 count me as a wobbly "in" :)

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Tue, 18 May 2004 08:02, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > Of course that doesn't require changing libselinux, we could just call
> > dlsym() for every function we want to use.
>
> ah, you then need to check every pointer to every function
> for not being NULL.

That's easy to do.  Most of the programs that might be re-written in that way 
don't use many of the libselinux functions anyway.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Stephen Smalley]

On Mon, 2004-05-17 at 15:10, Russell Coker wrote:
> The first candidate for such changes would be init.  We would have to 
> hard-code a check for selinux=0 in the init source to avoid having init just 
> not enable SE Linux if file system corruption causes libselinux.so to 
> disappear.
> 
> I think that init is the program that needs such changes most, the current 
> situation makes libselinux one of the most important packages in the system 
> (can't boot without it).

I'm surprised that /sbin/init isn't statically linked in Fedora. 
Rationale?

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Tue, 18 May 2004 21:31, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Mon, 2004-05-17 at 15:10, Russell Coker wrote:
> > The first candidate for such changes would be init.  We would have to
> > hard-code a check for selinux=0 in the init source to avoid having init
> > just not enable SE Linux if file system corruption causes libselinux.so
> > to disappear.
> >
> > I think that init is the program that needs such changes most, the
> > current situation makes libselinux one of the most important packages in
> > the system (can't boot without it).
>
> I'm surprised that /sbin/init isn't statically linked in Fedora.
> Rationale?

When fsck, getty, login, /bin/sh, cat etc, and all the other programs that are 
necessary for booting and allowing a root login are dynamically linked it 
doesn't seem to provide much benefit to have init statically linked.

To have all those programs dynamically linked would significantly increase 
disk space for small systems, or require having two versions of each with the 
static version being optional.  So in ancient Linux history it was decided to 
use dynamically linked programs for all of those and almost everyone has 
followed.  Some people have built custom distributions at various times to 
have statically linked /sbin programs but have not apparently received a 
benefit to justify the effort.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Stephen Smalley]

On Sat, 2004-05-15 at 19:26, Luke Kenneth Casson Leighton wrote:
> idea: make all the modifications to e.g. coreutils, login etc.
> compile with the header files but not necessarily _need_
> libselinux at run-time.

Interestingly, this issue just came up on the userlinux mailing list;
someone noticed that upon doing an apt-get update, they pulled in
libselinux1.  After a bit of investigation, they found that this was due
to updating gdm, because the SELinux patch for gdm is already
upstreamed.

Note of caution:  Some people still build /sbin/init statically, I
think, and we don't want to prevent people from doing so just for
SELinux.  The current patches allow for that; if we rewrite them to use
dlopen, won't that be a problem?

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton]

On Tue, May 18, 2004 at 12:34:06PM -0400, Stephen Smalley wrote:
> On Sat, 2004-05-15 at 19:26, Luke Kenneth Casson Leighton wrote:
> > idea: make all the modifications to e.g. coreutils, login etc.
> > compile with the header files but not necessarily _need_
> > libselinux at run-time.
> 
> Interestingly, this issue just came up on the userlinux mailing list;
> someone noticed that upon doing an apt-get update, they pulled in
> libselinux1.  After a bit of investigation, they found that this was due
> to updating gdm, because the SELinux patch for gdm is already
> upstreamed.
 
  ah ha!  great!  so it's begun.
 
> Note of caution:  Some people still build /sbin/init statically, I
> think, and we don't want to prevent people from doing so just for
> SELinux.  The current patches allow for that; if we rewrite them to use
> dlopen, won't that be a problem?
 
 hm.

 yes.

 you'd need two packages with the same name - two compile-time
 #ifdef things - to solve that one.

 all in all, i'd say the pros and cons weigh against a rewrite.

 l.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Wed, 19 May 2004 02:34, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> Interestingly, this issue just came up on the userlinux mailing list;
> someone noticed that upon doing an apt-get update, they pulled in
> libselinux1.  After a bit of investigation, they found that this was due
> to updating gdm, because the SELinux patch for gdm is already
> upstreamed.

I don't think that is a problem.  If you have gdm installed then you have lots 
of other libraries dragged in by gdm itself and by all the other GNOME 
components.  libselinux should be lost in the noise.

Using dlopen for SE Linux alone is not worth-while for gdm (IMHO) unless we 
find a more generic use for the mechanism (IE supporting things other than SE 
Linux).

> Note of caution:  Some people still build /sbin/init statically, I
> think, and we don't want to prevent people from doing so just for
> SELinux.  The current patches allow for that; if we rewrite them to use
> dlopen, won't that be a problem?

To support that we would want to have #ifdef STATIC_BUILD or something 
similar.  That should not be hard to do.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Chris Babcock]

> idea: make all the modifications to e.g. coreutils, login etc.
> compile with the header files but not necessarily _need_
> libselinux at run-time.
>
...
> the suggestion is based on the premise that if you have a
> non-selinux kernel, and no libselinux installed, the programs
> (pam, coreutils, login etc.) will attempt to dynamically load
> libselinux (with dlopen), find it missing, _won't care_
> and will adapt and proceed knowing that there's no security
> enhancements - i.e. as if they had never been patched to
> deal with selinux in the first place;
>
> whilst if they _do_ detect that libselinux is available, an
> init function is called which returns a pointer to a vector
> table of all the functions needed, which are then used;
>
Does this sound dangerous to anybody else?

This seems pretty harmless on a working se system, but on a non-se system,
I suspect this dependency could be exploited.





--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Les Bell]

"Chris Babcock" <cbabcock@luthresearch.com> wrote:

>>
Does this sound dangerous to anybody else?
<<

Does the design of SELinux depend on the state machine theory of security,
i.e. if a system starts in a secure state, and all transitions are secure,
then the system will remain secure? This design would seem unable to
support that theory, i.e. until the selinux library is loaded, there are no
constraints on the state of the machine. Just a thought. . .

Best,

--- Les Bell, RHCE, CISSP
[http://www.lesbell.com.au]



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton]

On Tue, May 18, 2004 at 07:50:34PM +1000, Les Bell wrote:
> 
> "Chris Babcock" <cbabcock@luthresearch.com> wrote:
> 
> >>
> Does this sound dangerous to anybody else?
> <<
> 
> Does the design of SELinux depend on the state machine theory of security,
> i.e. if a system starts in a secure state, and all transitions are secure,
> then the system will remain secure? 

 personally: i assume so (nothing else makes sense) on the basis that
 if you cannot change domain (because either libselinux is unavaiable
 or the programs that _use_ libselinux are somehow corrupted and
 unavailable) then you can go nowhere and therefore do no damage.


> This design would seem unable to
> support that theory, i.e. until the selinux library is loaded, there are no
> constraints on the state of the machine. Just a thought. . .
 
 yes you are right: there are issues, mentioned by russell,
 from initialisation (sysvinit) where if /usr/lib/libselinux.so
 is unavaiable (corrupted and in /lost+found) then the initialisation
 scripts would need to be modified to halt boot-up if the system
 is booted with selinux=1.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Tue, 18 May 2004 19:50, "Les Bell" <lesbell@lesbell.com.au> wrote:
> "Chris Babcock" <cbabcock@luthresearch.com> wrote:
> > Does this sound dangerous to anybody else?

If you can replace /lib/libselinux.so then you can surely compromise the 
entire system in many other ways.

> Does the design of SELinux depend on the state machine theory of security,
> i.e. if a system starts in a secure state, and all transitions are secure,
> then the system will remain secure? This design would seem unable to
> support that theory, i.e. until the selinux library is loaded, there are no
> constraints on the state of the machine. Just a thought. . .

Until the policy is loaded there are no SE Linux constraints on the machine 
state.  However at that time only init is running so it shouldn't be a 
problem.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Chris Babcock]

> On Tue, 18 May 2004 19:50, "Les Bell" <lesbell@lesbell.com.au> wrote:
>> "Chris Babcock" <cbabcock@luthresearch.com> wrote:
>> > Does this sound dangerous to anybody else?
>
> If you can replace /lib/libselinux.so then you can surely compromise the
> entire system in many other ways.
>
>> Does the design of SELinux depend on the state machine theory of
>> security,
>> i.e. if a system starts in a secure state, and all transitions are
>> secure,
>> then the system will remain secure? This design would seem unable to
>> support that theory, i.e. until the selinux library is loaded, there are
>> no
>> constraints on the state of the machine. Just a thought. . .
>
> Until the policy is loaded there are no SE Linux constraints on the
> machine
> state.  However at that time only init is running so it shouldn't be a
> problem.
>

The danger involved with replacement of /lib/libselinux.so on an selinux
system is pretty obvious, however if the system is operating properly it
shouldn't be too much of an issue.

What I was thinking about was more along the lines of what happens on a
system where a vendor distributes selinux enabled utilities (using dlopen
as described) but doesn't install the library by default and leaves
selinux disabled in kernel.

In this case a bogus libselinux could be installed...  The vendor
utilities, core libraries (glib etc), and kernel wouldn't even have to be
modified, so they would still pass a signature check.

I was just thinking that this idea may be opening up an interesting attack
vector on some systems given the way some distros seem to be going.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker]

On Wed, 19 May 2004 00:19, "Chris Babcock" <cbabcock@luthresearch.com> wrote:
> > Until the policy is loaded there are no SE Linux constraints on the
> > machine
> > state.  However at that time only init is running so it shouldn't be a
> > problem.
>
> The danger involved with replacement of /lib/libselinux.so on an selinux
> system is pretty obvious, however if the system is operating properly it
> shouldn't be too much of an issue.
>
> What I was thinking about was more along the lines of what happens on a
> system where a vendor distributes selinux enabled utilities (using dlopen
> as described) but doesn't install the library by default and leaves
> selinux disabled in kernel.

If the vendor in question does not install libselinux then the are designing 
their system to be only protected by Unix permissions.  To create a file 
in /lib you have to have UID 0, so again anyone who can install libselinux 
has already taken over the system.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.