Re: policy patches

[Russell Coker <russell@coker.com.au>]

[-- Attachment #1: Type: text/plain, Size: 2652 bytes --]

On Sat, 2 Oct 2004 02:42, James Carter <jwcart2@epoch.ncsc.mil> wrote:
> Mostly merged with the corrections.
>
> These two lines caused things to break, so I held off merging these for
> now.
> +/sbin/kmodule  --      system_u:object_r:kudzu_exec_t
> +/sbin/start_udev --    system_u:object_r:udev_exec_t
>
> These are the denials I am seeing:
> avc:  denied  { unlink } for  pid=705 exe=/bin/rm name=.udev.tdb dev=tmpfs
> ino=927 scontext=system_u:system_r:udev_t

Version 7.85-1 of the initscripts package fixes the restorecon command to use 
the -R option to label all of /dev.  If you upgrade to the latest rawhide 
then the start_udev labelling should work.  NB  I sent the patch to you 
before rawhide was fixed, this was intentional as neither patch worked well 
without the other so there was no benefit in delaying.

> avc:  denied  { search } for  pid=856 exe=/sbin/kmodule
> name=usr dev=hda2 ino=162881 scontext=system_u:system_r:kudzu_t
> tcontext=user_u:object_r:file_t tclass=dir

Looks like either mis-labelling or you have /usr on a different file system.  
I guess we have to add a dontaudit rule for that for when /usr (or /var or 
whatever else it may access that isn't on the root fs).

> avc:  denied  { getattr } for  
> pid=856 exe=/sbin/kmodule path=/lib/modules/2.6.8-1.541/kernel dev=hda2
> ino=930725 scontext=system_u:system_r:kudzu_t
> tcontext=system_u:object_r:modules_object_t tclass=dir

I've attached kudzu.diff to deal with this issue and the above.  Please try 
including those file contexts changes, with kudzu.diff and the latest 
initscripts it should be fine.

> avc:  denied  { 
> setattr } for  pid=2402 exe=/usr/X11R6/bin/Xorg name=dri dev=tmpfs ino=7757
> scontext=system_u:system_r:xdm_xserver_t
> tcontext=system_u:object_r:device_t tclass=dir

I think that Dan's latest patch allowed that one.

> The xdm_xserver_t device_t:dir setattr denial is not due to this patch.
> It is the only denial that I have been seeing lately; I just haven't had
> an opportunity to look into it more.  It doesn't appear to cause any
> problems though.

Long term udev has to deal with that too.  The X server should not be creating 
device nodes.  Quite a bit of work has recently gone into reducing /dev/mem 
access but allowing arbitrary device node creation wastes that.  It'll be 
fixed eventually (but at the moment we are already busy enough with udev 
issues).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: kudzu.diff --]
[-- Type: text/x-diff, Size: 879 bytes --]

--- /usr/src/se/policy/domains/program/unused/kudzu.te	2004-10-02 03:36:11.000000000 +1000
+++ domains/program/unused/kudzu.te	2004-10-02 03:40:37.000000000 +1000
@@ -15,7 +15,7 @@
 allow kudzu_t etc_t:file { getattr read };
 allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config };
 allow kudzu_t modules_conf_t:file { getattr read };
-allow kudzu_t modules_object_t:dir { search };
+allow kudzu_t modules_object_t:dir { getattr search };
 allow kudzu_t modules_dep_t:file { getattr read };
 allow kudzu_t mouse_device_t:chr_file { read write };
 allow kudzu_t proc_t:file { getattr read };
@@ -81,3 +81,6 @@
 file_type_auto_trans(kudzu_t, etc_t, etc_runtime_t, file)
 allow kudzu_t tape_device_t:chr_file r_file_perms;
 allow kudzu_t tmp_t:dir { search };
+
+# for file systems that are not yet mounted
+dontaudit kudzu_t file_t:dir search;