Re: SELinux with IPSec - something going on ?

[petre rodan <kaiowas@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 760 bytes --]


Hi,

here is a fresh ipsec-tools [1] policy made for gentoo.
works flawlessly with my setup [2] (the doc is work in progress).

[1] http://ipsec-tools.sourceforge.net/
[2] http://dev.gentoo.org/~kaiowas/doc/wifi_ipsec-howto.html

is this usable for any of you?

bye,
peter

Park Lee wrote:
> On 2003-11-17 at 14:37 Stephen Smalley wrote:
>  
>  >We have not done any work on integrating SELinux with IPSEC yet;
>  >at this point, such work would presumably be done based on the new
>  >Linux 2.6 IPSEC implementation.
>  
> Now, 11 months have passed, has any work been made to integrate IPSec 
> with SELinux?
> I also want to see if there is something I can do with it.
>  
> Thanks.
> 

--
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux

[-- Attachment #1.2: racoon.fc --]
[-- Type: text/plain, Size: 458 bytes --]


/etc/ipsec\.conf	--	system_u:object_r:setkey_conf_file_t
/etc/racoon(/.*)?		system_u:object_r:racoon_conf_file_t
/etc/racoon/certs(/.*)?		system_u:object_r:racoon_key_file_t
/etc/racoon/psk\.txt	--	system_u:object_r:racoon_key_file_t

/usr/sbin/racoon	--	system_u:object_r:racoon_exec_t
/usr/sbin/setkey	--	system_u:object_r:setkey_exec_t

/var/run/pluto\.ctl	-s	system_u:object_r:racoon_var_run_t
/var/run/racoon\.pid	--	system_u:object_r:racoon_var_run_t

[-- Attachment #1.3: racoon.te --]
[-- Type: text/plain, Size: 1168 bytes --]

#DESC ipsec-tools
#
# Author: petre rodan <kaiowas@gentoo.org>


daemon_base_domain(racoon, `, privlog')

type racoon_conf_file_t, file_type, sysadmfile;
type racoon_key_file_t, file_type, sysadmfile;

var_run_domain(racoon)
read_locale(racoon_t)
can_network(racoon_t)

allow racoon_t self:capability { net_admin net_bind_service };

r_dir_file(racoon_t, racoon_conf_file_t)
r_dir_file(racoon_t, racoon_key_file_t)


daemon_domain(setkey)

type setkey_conf_file_t, file_type, sysadmfile;


define(`setkey_domain', `

uses_shlib($1_t)
read_locale($1_t)

allow $1_t self:capability { net_admin };
allow $1_t setkey_conf_file_t:file r_file_perms;

') dnl end setkey_domain


define(`setkey_userdomain', `

# derived domain based on the calling user domain
type $1_setkey_t, domain;

domain_auto_trans($1_t, setkey_exec_t, $1_setkey_t)
role $1_r types $1_setkey_t;

setkey_domain($1_setkey)

# this is why there is a setkey_userdomain :)
allow $1_setkey_t { $1_tty_device_t $1_devpts_t }:chr_file { getattr read write };
allow $1_setkey_t privfd:fd use;
') dnl end setkey_userdomain


# one for initrc
setkey_domain(setkey)

# and one for sysadm
setkey_userdomain(sysadm)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]