Re: list of permissions created by allow2audit: what do i do now?

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, May 18, 2004 at 01:18:26PM -0400, Stephen Smalley wrote:
> >  do i end up with _only_ getattr permissions or do i end up
> >  with both read _and_ getattr?
> 
> checkpolicy takes the union of all such allow rules, so you end up with
> both read and getattr.  You can check at runtime via compute_av.  So you
> shouldn't still get denials, unless you aren't truly loading the new
> policy into the kernel or another factor (e.g. policy/constraints) is
> coming into play.  One common mistake is if your kernel isn't up-to-date
> and doesn't accept the latest policy version, you may be loading an
> older policy version, not the one you just compiled with your new
> checkpolicy.

 ah ha!

	tv:/etc/selinux# compute_av system_u:system_r:xdm_xserver_t
	system_u:system_r:initrc_t shm
	allowed= { getattr read write associate unix_read unix_write }

 ha ha!

 okay, one lot disappeared, have another lot to deal with.

 so i think i might be on track, now.

 okay, this is what i get from audit2allow when the selinux programs
 (latest cvs, head tag) are compiled on the same kernel as wot i install
 on:


	allow crond_t lib_t:file { execute };
		#PATH=/lib/libselinux.so.1   :  execute

	allow hotplug_t dbusd_t:unix_stream_socket { connectto };
		#EXE=/usr/lib/hal/hal.hotplug  PATH=/var/run/dbus/system_bus_socket   :  connectto

	allow hotplug_t sysctl_net_t:file { getattr write };
		#EXE=/bin/bash  PATH=/proc/sys/net/ipv4/conf/all/rp_filter   :  getattr
		#EXE=/bin/bash  NAME=rp_filter   :  write

	allow hotplug_t unlabeled_t:file { getattr };
		#EXE=/bin/bash  PATH=/usr/sbin/usbmodules   :  getattr

	allow inetd_t smtp_port_t:tcp_socket { name_bind };
		#EXE=/usr/sbin/inetd   :  name_bind

	allow initrc_t dbusd_t:unix_stream_socket { connectto };
		#EXE=/usr/sbin/hald  PATH=/var/run/dbus/system_bus_socket   :  connectto

	allow initrc_t fonts_t:dir { read };
		#EXE=/usr/bin/gdmlogin  NAME=TrueType   :  read

	allow initrc_t fonts_t:file { read };
		#EXE=/usr/X11R6/bin/xfs-xtt  NAME=fonts.dir   :  read

	allow initrc_t initrc_t:tcp_socket { bind create listen setopt };
		#EXE=/usr/sbin/famd   :  create
		#EXE=/usr/sbin/famd   :  bind
		#EXE=/usr/sbin/famd  LADDR=127.0.0.1  LPORT=834   :  listen
		#EXE=/usr/bin/perl   :  setopt

	allow initrc_t initrc_t:udp_socket { listen };
		#EXE=/usr/bin/perl  LPORT=10000   :  listen

	allow initrc_t netif_lo_t:netif { udp_recv udp_send };
		#EXE=/usr/sbin/famd  SADDR=127.0.0.1  SRC=835  DADDR=127.0.0.1  DEST=111   :  udp_send
		#EXE=/sbin/portmap  SADDR=127.0.0.1  SRC=111  DADDR=127.0.0.1  DEST=835   :  udp_recv

	allow initrc_t node_inaddr_any_t:tcp_socket { node_bind };
		#EXE=/usr/bin/perl  SRC=10000   :  node_bind

	allow initrc_t node_inaddr_any_t:udp_socket { node_bind };
		#EXE=/usr/sbin/famd  SRC=835   :  node_bind
		#EXE=/usr/sbin/famd  SRC=836   :  node_bind

	allow initrc_t node_lo_t:node { udp_recv udp_send };
		#EXE=/usr/sbin/famd  SADDR=127.0.0.1  SRC=835  DADDR=127.0.0.1  DEST=111  NETIF=lo   :  udp_send
		#EXE=/sbin/portmap  SADDR=127.0.0.1  SRC=111  DADDR=127.0.0.1  DEST=835  NETIF=lo   :  udp_recv

	allow initrc_t node_lo_t:tcp_socket { node_bind };
		#EXE=/usr/sbin/famd  SADDR=127.0.0.1  SRC=834   :  node_bind

	allow initrc_t port_t:tcp_socket { name_bind };
		#EXE=/usr/sbin/famd   :  name_bind
		#EXE=/usr/bin/perl   :  name_bind

	allow initrc_t port_t:udp_socket { name_bind };
		#EXE=/usr/sbin/famd   :  name_bind
		#EXE=/usr/bin/perl   :  name_bind

	allow initrc_t portmap_port_t:udp_socket { recv_msg send_msg };
		#EXE=/usr/sbin/famd  SADDR=127.0.0.1  SRC=835  DADDR=127.0.0.1  DEST=111  NETIF=lo   :  send_msg
		#EXE=/sbin/portmap  SADDR=127.0.0.1  SRC=111  DADDR=127.0.0.1  DEST=835  NETIF=lo   :  recv_msg

	allow initrc_t readable_t:file { read };
		#EXE=/usr/bin/gdmlogin  NAME=fonts.conf   :  read

	allow initrc_t readable_t:lnk_file { read };
		#EXE=/usr/bin/gdmlogin  NAME=Bitstream-Vera-Sans.ttf   :  read

	allow initrc_t unlabeled_t:file { execute execute_no_trans ioctl read };
		#EXE=/bin/bash  NAME=makedev   :  execute
		#EXE=/bin/bash  PATH=/etc/init.d/makedev   :  execute_no_trans
		#EXE=/bin/bash  PATH=/etc/init.d/makedev   :  read
		#EXE=/bin/bash  PATH=/etc/init.d/makedev   :  ioctl

	allow initrc_t var_lib_t:dir { setattr };
		#EXE=/usr/bin/gdm  NAME=gdm   :  setattr

	allow initrc_t var_lib_t:fifo_file { create read setattr write };
		#EXE=/usr/bin/gdm  NAME=.gdmfifo   :  create
		#EXE=/usr/bin/gdm  NAME=.gdmfifo   :  read write
		#EXE=/usr/bin/gdm  NAME=.gdmfifo   :  setattr

	allow initrc_t var_log_t:dir { remove_name };
		#EXE=/usr/bin/gdm  NAME=:0.log   :  remove_name

	allow initrc_t var_log_t:file { link unlink };
		#EXE=/usr/bin/gdm  NAME=:0.log   :  link
		#EXE=/usr/bin/gdm  NAME=:0.log   :  unlink

	allow initrc_t var_spool_t:dir { read };
		#EXE=/usr/sbin/atd  NAME=atjobs   :  read

	allow initrc_t xdm_xserver_tmp_t:dir { setattr };
		#EXE=/usr/bin/gdm  NAME=.ICE-unix   :  setattr

	allow initrc_t xdm_xserver_t:unix_stream_socket { connectto };
		#EXE=/usr/bin/gdm  PATH=/tmp/.X11-unix/X0   :  connectto

	allow klogd_t boot_t:file { getattr read };
		#EXE=/sbin/klogd  NAME=System.map-2.6.6-selinux1   :  read
		#EXE=/sbin/klogd  PATH=/boot/System.map-2.6.6-selinux1   :  getattr

	allow local_login_t lib_t:file { execute };
		#PATH=/lib/libselinux.so.1   :  execute
		#PATH=/lib/libselinux.so.1   :  execute

	allow mount_t security_t:dir { mounton };
		#EXE=/bin/mount  PATH=/selinux   :  mounton

	allow syslogd_t unlabeled_t:dir { search };
		#EXE=/sbin/syslogd  NAME=news   :  search

	allow syslogd_t unlabeled_t:file { append ioctl };
		#EXE=/sbin/syslogd  NAME=news.crit   :  append
		#EXE=/sbin/syslogd  PATH=/var/log/news/news.crit   :  ioctl

	allow system_chkpwd_t lib_t:file { execute };
		#PATH=/lib/libselinux.so.1   :  execute

	allow system_chkpwd_t var_run_t:dir { search };
		#EXE=/sbin/unix_verify  NAME=run   :  search

	allow user_t staff_home_t:file { getattr read };
		#EXE=/bin/bash  NAME=.bash_profile   :  read
		#EXE=/bin/bash  PATH=/home/lkcl/.bash_profile   :  getattr

	allow xdm_xserver_t tmpfs_t:file { read write };
		#PATH=/SYSV00000000   :  read write


wheeee :)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.