Re: support for fireflight reading /proc/NNN/fd and /proc/NNN/exe

[Thomas Bleher <bleher@informatik.uni-muenchen.de>]

[-- Attachment #1: Type: text/plain, Size: 2363 bytes --]

* Luke Kenneth Casson Leighton <lkcl@lkcl.net> [2004-06-08 00:50]:
> i picked fireflight because it does on-demand popup firewalling,
> which i think is great.
<snip>
> so what it does is look in /proc/NNN/exe and /proc/NNN/fds and
> looks up the executable...
<snip> 
> .. but it also needs to be able to track the files themselves,
> getattr, and stuff.
> 
> this is what i'm seeing:
> 
> 	allow fireflier_t ptmx_t:chr_file { getattr };
> 	allow fireflier_t sound_device_t:chr_file { getattr };
> 	allow fireflier_t sysadm_ssh_t:tcp_socket { getattr };
> 	allow fireflier_t sysadm_tty_device_t:chr_file { getattr };
> 	allow fireflier_t user_devpts_t:chr_file { getattr };
> 	allow fireflier_t user_home_t:file { getattr };
> 	allow fireflier_t user_tmp_t:file { getattr };
> 	allow fireflier_t user_t:fifo_file { getattr };
> 	allow fireflier_t user_t:tcp_socket { getattr };
> 	allow fireflier_t user_t:unix_stream_socket { getattr };
> 	allow fireflier_t xdm_t:fifo_file { getattr };
> 
> 
> should i be looking to modify the can_ps macro?

Not the macro directly, otherwise all domains which use can_ps() will be
affected. If you really need that much access, you should probably add a
rule like
        allow fireflier_t file_type:file_class_set getattr;
        allow fireflier_t domain:{ socket_class_set fifo_file } getattr;
But this seems just too broad (see below).

> i mean, basically, everything in /proc/NNN/fds, fireflier is
> going to try to stat it.
> 
<snip>

> and why, if i have can_ps(fireflier_t, domain), am i still seeing
> denied getattr on user_home_t?

user_home_t doesn't have the "domain"-attribute.

> .. alternatively, has anyone got any better ideas on how fireflier
> should be checking for executable program's names?

How about /proc/<pid>/exe ?
 
> p.s. if i _don't_ allow it to look up these program names, i can
> expect fireflier to thoroughly lock up the machine as it can't
> tell me what to do with a packet, so it gets blocked.

I still don't get why it needs to look at all fds and stat all the
files. Could you tell us why it needs to stat all open filehandles to
find the program name?

A little bit confused,
Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]