* Busted by constraints. @ 2005-05-12 14:32 Daniel J Walsh 2005-05-12 14:30 ` Stephen Smalley 0 siblings, 1 reply; 18+ messages in thread From: Daniel J Walsh @ 2005-05-12 14:32 UTC (permalink / raw) To: Stephen Smalley, SE Linux Auditing of constraint failures sucks. We are putting out incorrect error messages. Or at least not informative enough to help the user/policy writer to figure out what is wrong. Yesterday, Another engineer and I spent a lot of time trying to figure out why setfscreatecon was failing. The only indication was the the application was not allowed to created a directory. Of course the allow rule was present in the policy. Eventually we figured out we needed the privowner priv to get by a constraint. Shouldn't the kernel be reporting a constraint failure. Isn't this going to become a lot more important with MLS? Dan -- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-12 14:32 Busted by constraints Daniel J Walsh @ 2005-05-12 14:30 ` Stephen Smalley 2005-05-12 14:46 ` Daniel J Walsh 2005-05-13 15:35 ` Stephen Smalley 0 siblings, 2 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-12 14:30 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Thu, 2005-05-12 at 10:32 -0400, Daniel J Walsh wrote: > Auditing of constraint failures sucks. We are putting out incorrect > error messages. Or at least not informative enough to help the > user/policy writer to figure out what is wrong. > > Yesterday, Another engineer and I spent a lot of time trying to figure > out why setfscreatecon was failing. The only indication was the the > application was not allowed to created a directory. Of course the allow > rule was present in the policy. Eventually we figured out we needed > the privowner priv to get by a constraint. Shouldn't the kernel be > reporting a constraint failure. Isn't this going to become a lot more > important with MLS? The AVC just sees that a given permission was denied, not what component of the policy engine denied it. See "Flask architecture", "policy- flexibility", ... But nothing prevents you from creating a simple tool linked against libsepol that takes an avc denial and determines which part of the policy caused it. I'd expect that to be part of an audit analysis tool like seaudit, not a change to the kernel. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-12 14:30 ` Stephen Smalley @ 2005-05-12 14:46 ` Daniel J Walsh 2005-05-13 15:00 ` Stephen Smalley 2005-05-13 15:35 ` Stephen Smalley 1 sibling, 1 reply; 18+ messages in thread From: Daniel J Walsh @ 2005-05-12 14:46 UTC (permalink / raw) To: Stephen Smalley; +Cc: SE Linux, Karl MacMillan Stephen Smalley wrote: >On Thu, 2005-05-12 at 10:32 -0400, Daniel J Walsh wrote: > > >>Auditing of constraint failures sucks. We are putting out incorrect >>error messages. Or at least not informative enough to help the >>user/policy writer to figure out what is wrong. >> >>Yesterday, Another engineer and I spent a lot of time trying to figure >>out why setfscreatecon was failing. The only indication was the the >>application was not allowed to created a directory. Of course the allow >>rule was present in the policy. Eventually we figured out we needed >>the privowner priv to get by a constraint. Shouldn't the kernel be >>reporting a constraint failure. Isn't this going to become a lot more >>important with MLS? >> >> > >The AVC just sees that a given permission was denied, not what component >of the policy engine denied it. See "Flask architecture", "policy- >flexibility", ... > >But nothing prevents you from creating a simple tool linked against >libsepol that takes an avc denial and determines which part of the >policy caused it. I'd expect that to be part of an audit analysis tool >like seaudit, not a change to the kernel. > > > Well I would have no idea how to do it, but it is going to be increasingly needed as constraints grow. Something to tell me the failure is caused by a missing role or constraint would be great. audit2why :^) Dan -- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-12 14:46 ` Daniel J Walsh @ 2005-05-13 15:00 ` Stephen Smalley 2005-05-13 19:30 ` Stephen Smalley 2005-05-16 18:44 ` Stephen Smalley 0 siblings, 2 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 15:00 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan [-- Attachment #1: Type: text/plain, Size: 1169 bytes --] On Thu, 2005-05-12 at 10:46 -0400, Daniel J Walsh wrote: > Well I would have no idea how to do it, but it is going to be > increasingly needed > as constraints grow. > > Something to tell me the failure is caused by a missing role or > constraint would be great. > audit2why :^) Ok, just committed the two attached patches for libsepol and policycoreutils to introduce an audit2why utility. A sample of the output of audit2why is below from running: $ /usr/sbin/audit2why < /var/log/audit/audit.log type=KERNEL msg=audit(1115316525.803:399552): avc: denied { getattr } for path=/home/sds dev=hda5 ino=1175041 scontext=root:secadm_r:secadm_t:s0-s9:c0.c127 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir Was caused by: Missing TE allow rule for the type pair (use audit2allow). type=KERNEL msg=audit(1115320071.648:606858): avc: denied { append } for name=.bash_history dev=hda5 ino=1175047 scontext=user_u:user_r:user_t:s1-s9:c0.c127 tcontext=user_u:object_r:user_home_t:s0 tclass=file Was caused by: Constraint violation (add type attribute to domain to satisfy constraints or alter constraint). -- Stephen Smalley National Security Agency [-- Attachment #2: Type: text/x-patch, Size: 5583 bytes --] Index: selinux-usr/libsepol/ChangeLog diff -u selinux-usr/libsepol/ChangeLog:1.27 selinux-usr/libsepol/ChangeLog:1.28 --- selinux-usr/libsepol/ChangeLog:1.27 Mon Apr 25 15:55:29 2005 +++ selinux-usr/libsepol/ChangeLog Fri May 13 10:40:56 2005 @@ -1,3 +1,6 @@ +1.5.7 2005-05-13 + * Added sepol_compute_av_reason() for audit2why. + 1.5.6 2005-04-25 * Fixed bug in role hierarchy checker. Index: selinux-usr/libsepol/VERSION diff -u selinux-usr/libsepol/VERSION:1.22 selinux-usr/libsepol/VERSION:1.23 --- selinux-usr/libsepol/VERSION:1.22 Mon Apr 25 15:55:29 2005 +++ selinux-usr/libsepol/VERSION Fri May 13 10:40:56 2005 @@ -1 +1 @@ -1.5.6 +1.5.7 Index: selinux-usr/libsepol/libsepol.spec diff -u selinux-usr/libsepol/libsepol.spec:1.24 selinux-usr/libsepol/libsepol.spec:1.25 --- selinux-usr/libsepol/libsepol.spec:1.24 Mon Apr 25 15:55:29 2005 +++ selinux-usr/libsepol/libsepol.spec Fri May 13 10:40:56 2005 @@ -1,6 +1,6 @@ Summary: SELinux binary policy manipulation library Name: libsepol -Version: 1.5.6 +Version: 1.5.7 Release: 1 License: GPL Group: System Environment/Libraries Index: selinux-usr/libsepol/include/sepol/services.h diff -u selinux-usr/libsepol/include/sepol/services.h:1.3 selinux-usr/libsepol/include/sepol/services.h:1.4 --- selinux-usr/libsepol/include/sepol/services.h:1.3 Wed Aug 11 09:34:16 2004 +++ selinux-usr/libsepol/include/sepol/services.h Fri May 13 10:40:57 2005 @@ -40,6 +40,18 @@ access_vector_t requested, /* IN */ struct av_decision *avd); /* OUT */ +/* Same as above, but also return the reason(s) for any + denials of the requested permissions. */ +#define SEPOL_COMPUTEAV_TE 1 +#define SEPOL_COMPUTEAV_CONS 2 +#define SEPOL_COMPUTEAV_RBAC 4 +int sepol_compute_av_reason(security_id_t ssid, + security_id_t tsid, + security_class_t tclass, + access_vector_t requested, + struct av_decision *avd, + unsigned int *reason); + /* * Compute a SID to use for labeling a new object in the * class `tclass' based on a SID pair. Index: selinux-usr/libsepol/src/services.c diff -u selinux-usr/libsepol/src/services.c:1.10 selinux-usr/libsepol/src/services.c:1.11 --- selinux-usr/libsepol/src/services.c:1.10 Thu Feb 17 09:59:27 2005 +++ selinux-usr/libsepol/src/services.c Fri May 13 10:40:59 2005 @@ -73,7 +73,7 @@ return -1; } policydb = &mypolicydb; - return 0; + return sepol_sidtab_init(sidtab); } @@ -278,8 +278,9 @@ static int context_struct_compute_av(context_struct_t *scontext, context_struct_t *tcontext, security_class_t tclass, - access_vector_t requested __attribute__ ((unused)), - struct av_decision *avd) + access_vector_t requested, + struct av_decision *avd, + unsigned int *reason) { constraint_node_t *constraint; struct role_allow *ra; @@ -302,6 +303,7 @@ avd->auditallow = 0; avd->auditdeny = 0xffffffff; avd->seqno = latest_granting; + *reason = 0; /* * If a specific type enforcement rule was defined for @@ -319,10 +321,15 @@ if (avdatum->specified & AVTAB_AUDITALLOW) avd->auditallow = avtab_auditallow(avdatum); } - + /* Check conditional av table for additional permissions */ cond_compute_av(&policydb->te_cond_avtab, &avkey, avd); + if (requested & ~avd->allowed) { + *reason |= SEPOL_COMPUTEAV_TE; + requested &= avd->allowed; + } + /* * Remove any permissions prohibited by a constraint (this includes * the MLS policy). @@ -337,6 +344,11 @@ constraint = constraint->next; } + if (requested & ~avd->allowed) { + *reason |= SEPOL_COMPUTEAV_CONS; + requested &= avd->allowed; + } + /* * If checking process transition permission and the * role is changing, then check the (current_role, new_role) @@ -353,7 +365,12 @@ if (!ra) avd->allowed = (avd->allowed) & ~(PROCESS__TRANSITION | PROCESS__DYNTRANSITION); - } + } + + if (requested & ~avd->allowed) { + *reason |= SEPOL_COMPUTEAV_RBAC; + requested &= avd->allowed; + } return 0; } @@ -407,11 +424,12 @@ return 0; } -int sepol_compute_av(security_id_t ssid, - security_id_t tsid, - security_class_t tclass, - access_vector_t requested, - struct av_decision *avd) +int sepol_compute_av_reason(security_id_t ssid, + security_id_t tsid, + security_class_t tclass, + access_vector_t requested, + struct av_decision *avd, + unsigned int *reason) { context_struct_t *scontext = 0, *tcontext = 0; int rc = 0; @@ -430,11 +448,20 @@ } rc = context_struct_compute_av(scontext, tcontext, tclass, - requested, avd); + requested, avd, reason); out: return rc; } +int sepol_compute_av(security_id_t ssid, + security_id_t tsid, + security_class_t tclass, + access_vector_t requested, + struct av_decision *avd) +{ + unsigned int reason = 0; + return sepol_compute_av_reason(ssid, tsid, tclass, requested, avd, &reason); +} /* * Write the security context string representation of @@ -1302,7 +1329,7 @@ role_datum_t *role; struct av_decision avd; int rc = 0; - unsigned int i, j; + unsigned int i, j, reason; fromcon = sepol_sidtab_search(sidtab, fromsid); if (!fromcon) { @@ -1343,7 +1370,7 @@ rc = context_struct_compute_av(fromcon, &usercon, SECCLASS_PROCESS, PROCESS__TRANSITION, - &avd); + &avd, &reason); if (rc || !(avd.allowed & PROCESS__TRANSITION)) continue; rc = sepol_sidtab_context_to_sid(sidtab, &usercon, &sid); [-- Attachment #3: policycoreutils-audit2why.patch --] [-- Type: text/x-patch, Size: 9868 bytes --] Index: selinux-usr/policycoreutils/ChangeLog diff -u selinux-usr/policycoreutils/ChangeLog:1.112 selinux-usr/policycoreutils/ChangeLog:1.113 --- selinux-usr/policycoreutils/ChangeLog:1.112 Fri Apr 29 11:26:54 2005 +++ selinux-usr/policycoreutils/ChangeLog Fri May 13 10:42:19 2005 @@ -1,3 +1,6 @@ +1.23.8 2005-05-13 + * Added audit2why utility. + 1.23.7 2005-04-29 * Merged patch for fixfiles from Dan Walsh. Allow passing -F to force reset of customizable contexts. Index: selinux-usr/policycoreutils/Makefile diff -u selinux-usr/policycoreutils/Makefile:1.6 selinux-usr/policycoreutils/Makefile:1.7 --- selinux-usr/policycoreutils/Makefile:1.6 Wed Mar 31 16:07:41 2004 +++ selinux-usr/policycoreutils/Makefile Fri May 13 10:42:19 2005 @@ -1,4 +1,4 @@ -SUBDIRS=setfiles load_policy newrole run_init restorecon audit2allow scripts po sestatus +SUBDIRS=setfiles load_policy newrole run_init restorecon audit2allow audit2why scripts po sestatus all install relabel clean: @for subdir in $(SUBDIRS); do \ Index: selinux-usr/policycoreutils/VERSION diff -u selinux-usr/policycoreutils/VERSION:1.51 selinux-usr/policycoreutils/VERSION:1.52 --- selinux-usr/policycoreutils/VERSION:1.51 Fri Apr 29 11:26:54 2005 +++ selinux-usr/policycoreutils/VERSION Fri May 13 10:42:19 2005 @@ -1 +1 @@ -1.23.7 +1.23.8 Index: selinux-usr/policycoreutils/policycoreutils.spec diff -u selinux-usr/policycoreutils/policycoreutils.spec:1.74 selinux-usr/policycoreutils/policycoreutils.spec:1.75 --- selinux-usr/policycoreutils/policycoreutils.spec:1.74 Fri Apr 29 11:26:54 2005 +++ selinux-usr/policycoreutils/policycoreutils.spec Fri May 13 10:42:19 2005 @@ -1,6 +1,6 @@ Summary: SELinux policy core utilities. Name: policycoreutils -Version: 1.23.7 +Version: 1.23.8 Release: 1 License: GPL Group: System Environment/Base @@ -68,6 +68,7 @@ %{_sbindir}/load_policy %{_bindir}/newrole %{_bindir}/audit2allow +%{_sbindir}/audit2why %{_mandir}/man1/newrole.1.gz %{_mandir}/man1/audit2allow.1.gz %config %{_sysconfdir}/pam.d/newrole Index: selinux-usr/policycoreutils/audit2why/Makefile diff -u /dev/null selinux-usr/policycoreutils/audit2why/Makefile:1.1 --- /dev/null Fri May 13 10:52:35 2005 +++ selinux-usr/policycoreutils/audit2why/Makefile Fri May 13 10:42:21 2005 @@ -0,0 +1,24 @@ +# Installation directories. +PREFIX ?= ${DESTDIR}/usr +BINDIR ?= $(PREFIX)/sbin +LIBDIR ?= ${PREFIX}/lib +MANDIR ?= $(PREFIX)/share/man +LOCALEDIR ?= /usr/share/locale + + +CFLAGS = -Werror +override CFLAGS += -Wall -W +LDLIBS += ${LIBDIR}/libsepol.a -lselinux + +TARGETS=audit2why + +all: $(TARGETS) + +install: all + -mkdir -p $(BINDIR) + install -m 755 $(TARGETS) $(SBINDIR) + +clean: + rm -f $(TARGETS) *.o + +relabel: Index: selinux-usr/policycoreutils/audit2why/audit2why.c diff -u /dev/null selinux-usr/policycoreutils/audit2why/audit2why.c:1.1 --- /dev/null Fri May 13 10:52:35 2005 +++ selinux-usr/policycoreutils/audit2why/audit2why.c Fri May 13 10:42:21 2005 @@ -0,0 +1,239 @@ +#define _GNU_SOURCE +#include <unistd.h> +#include <stdio.h> +#include <stdlib.h> +#include <ctype.h> +#include <errno.h> +#include <getopt.h> +#include <limits.h> +#include <sepol/sepol.h> +#include <sepol/services.h> + +#define AVCPREFIX "avc: denied { " +#define SCONTEXT "scontext=" +#define TCONTEXT "tcontext=" +#define TCLASS "tclass=" + +/* Copied from selinux/selinux.h. + Should be replaced with #include <selinux/selinux.h>, + but first requires elimination of namespace collisions + between libselinux and libsepol. */ +extern const char *selinux_binary_policy_path(void); +extern security_class_t string_to_security_class(const char *name); +extern access_vector_t string_to_av_perm(security_class_t tclass, const char *name); +extern int security_policyvers(void); +extern int is_selinux_enabled(void); + +void usage(char *progname, int rc) +{ + fprintf(stderr, "usage: %s [-p policy] < /var/log/audit/audit.log\n", progname); + exit(rc); +} + +int main(int argc, char **argv) +{ + char path[PATH_MAX]; + char *buffer = NULL, *bufcopy = NULL; + unsigned int lineno = 0; + size_t len = 0, bufcopy_len = 0; + FILE *fp; + int opt, rc, set_path = 0; + char *p, *scon, *tcon, *tclassstr, *permstr; + security_id_t ssid, tsid; + security_class_t tclass; + access_vector_t perm, av; + struct av_decision avd; + unsigned int reason; + int vers = 0; + + while ((opt = getopt(argc, argv, "p:?h")) > 0) { + switch (opt) { + case 'p': + set_path = 1; + strncpy(path, optarg, PATH_MAX); + fp = fopen(path, "r"); + if (!fp) { + fprintf(stderr, "%s: unable to open %s: %s\n", + argv[0], path, strerror(errno)); + exit(1); + } + break; + default: + usage(argv[0], 0); + } + } + + if (argc - optind) + usage(argv[0], 1); + + if (!set_path) { + if (!is_selinux_enabled()) { + fprintf(stderr, "%s: Must specify -p policy on non-SELinux systems\n", argv[0]); + exit(1); + } + vers = security_policyvers(); + snprintf(path, PATH_MAX, "%s.%d", + selinux_binary_policy_path(), vers); + fp = fopen(path, "r"); + while (!fp && errno == ENOENT && --vers) { + snprintf(path, PATH_MAX, "%s.%d", + selinux_binary_policy_path(), vers); + fp = fopen(path, "r"); + } + if (!fp) { + snprintf(path, PATH_MAX, "%s.%d", + selinux_binary_policy_path(), security_policyvers()); + fprintf(stderr, "%s: unable to open %s: %s\n", + argv[0], path, strerror(errno)); + exit(1); + } + } + + rc = sepol_set_policydb_from_file(fp); + if (rc < 0) { + fprintf(stderr, "%s: unable to load policy from %s: %s\n", + argv[0], path, strerror(errno)); + exit(1); + } + fclose(fp); + + while (getline(&buffer, &len, stdin) > 0) { + size_t len2 = strlen(buffer); + + if (buffer[len2-1] == '\n') + buffer[len2-1] = 0; + lineno++; + + p = buffer; + while (*p && strncmp(p, AVCPREFIX, sizeof(AVCPREFIX) - 1)) + p++; + if (!(*p)) + continue; /* not an avc denial */ + + p += sizeof(AVCPREFIX) - 1; + + /* Save a copy of the original unmodified buffer. */ + if (!bufcopy) { + /* Initial allocation */ + bufcopy_len = len; + bufcopy = malloc(len); + } else if (bufcopy_len < len) { + /* Grow */ + bufcopy_len = len; + bufcopy = realloc(bufcopy, len); + } + if (!bufcopy) { + fprintf(stderr, "%s: OOM on buffer copy\n", argv[0]); + exit(2); + } + memcpy(bufcopy, buffer, len); + + /* Remember where the permission list begins, + and terminate the list. */ + permstr = p; + while (*p && *p != '}') + p++; + if (!(*p)) { + fprintf(stderr, "Missing closing bracket on line %u, skipping...\n", lineno); + continue; + } + *p++ = 0; + + /* Get scontext and convert to SID. */ + while (*p && strncmp(p, SCONTEXT, sizeof(SCONTEXT)-1)) + p++; + if (!(*p)) { + fprintf(stderr, "Missing %s on line %u, skipping...\n", SCONTEXT, lineno); + continue; + } + p += sizeof(SCONTEXT) - 1; + scon = p; + while (*p && !isspace(*p)) + p++; + if (*p) + *p++ = 0; + rc = sepol_context_to_sid(scon, strlen(scon)+1, &ssid); + if (rc < 0) { + fprintf(stderr, "Invalid %s%s on line %u, skipping...\n", SCONTEXT, scon, lineno); + continue; + } + + /* Get tcontext and convert to SID. */ + while (*p && strncmp(p, TCONTEXT, sizeof(TCONTEXT)-1)) + p++; + if (!(*p)) { + fprintf(stderr, "Missing %s on line %u, skipping...\n", TCONTEXT, lineno); + continue; + } + p += sizeof(TCONTEXT) - 1; + tcon = p; + while (*p && !isspace(*p)) + p++; + if (*p) + *p++ = 0; + rc = sepol_context_to_sid(tcon, strlen(tcon)+1, &tsid); + if (rc < 0) { + fprintf(stderr, "Invalid %s%s on line %u, skipping...\n", TCONTEXT, tcon, lineno); + continue; + } + + /* Get tclass= and convert to value. */ + while (*p && strncmp(p, TCLASS, sizeof(TCLASS) - 1)) + p++; + if (!(*p)) { + fprintf(stderr, "Missing %s on line %u, skipping...\n", TCLASS, lineno); + continue; + } + p += sizeof(TCLASS) - 1; + tclassstr = p; + while (*p && !isspace(*p)) + p++; + if (*p) + *p = 0; + tclass = string_to_security_class(tclassstr); + if (!tclass) { + fprintf(stderr, "Invalid %s%s on line %u, skipping...\n", TCLASS, tclassstr, lineno); + continue; + } + + /* Convert the permission list to an AV. */ + p = permstr; + av = 0; + while (*p) { + while (*p && !isspace(*p)) + p++; + if (*p) + *p++ = 0; + perm = string_to_av_perm(tclass, permstr); + if (!perm) { + fprintf(stderr, "Invalid permission %s on line %u, skipping...\n", permstr, lineno); + continue; + } + av |= perm; + permstr = p; + } + + /* Reproduce the computation. */ + rc = sepol_compute_av_reason(ssid, tsid, tclass, av, &avd, + &reason); + if (rc < 0) { + fprintf(stderr, "Error during access vector computation on line %u, skipping...\n", lineno); + continue; + } + + if (!reason) + continue; /* Denial would not occur under specified policy. */ + + printf("%s\n\tWas caused by:\n", bufcopy); + if (reason & SEPOL_COMPUTEAV_TE) + printf("\t\tMissing TE allow rule for the type pair (use audit2allow).\n"); + if (reason & SEPOL_COMPUTEAV_CONS) + printf("\t\tConstraint violation (add type attribute to domain to satisfy constraints or alter constraint).\n"); + if (reason & SEPOL_COMPUTEAV_RBAC) + printf("\t\tMissing role allow rule for the role pair (add role allow rule).\n"); + printf("\n"); + } + free(buffer); + free(bufcopy); + exit(0); +} Index: selinux-usr/policycoreutils/load_policy/Makefile diff -u selinux-usr/policycoreutils/load_policy/Makefile:1.13 selinux-usr/policycoreutils/load_policy/Makefile:1.14 --- selinux-usr/policycoreutils/load_policy/Makefile:1.13 Tue Feb 22 11:07:51 2005 +++ selinux-usr/policycoreutils/load_policy/Makefile Fri May 13 10:42:23 2005 @@ -2,6 +2,7 @@ PREFIX ?= ${DESTDIR}/usr SBINDIR ?= $(PREFIX)/sbin MANDIR ?= $(PREFIX)/share/man +LIBDIR ?= ${PREFIX}/lib LOCALEDIR ?= /usr/share/locale CFLAGS = -Werror ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-13 15:00 ` Stephen Smalley @ 2005-05-13 19:30 ` Stephen Smalley 2005-05-13 20:00 ` Stephen Smalley 2005-05-16 18:44 ` Stephen Smalley 1 sibling, 1 reply; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 19:30 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan [-- Attachment #1: Type: text/plain, Size: 1281 bytes --] On Fri, 2005-05-13 at 11:00 -0400, Stephen Smalley wrote: > Ok, just committed the two attached patches for libsepol and > policycoreutils to introduce an audit2why utility. In creating audit2why, I ran into the known namespace collision between libsepol and libselinux; they both define the base set of Flask types, with the one set of definitions for security-aware applications running on SELinux and the other set of definitions for the binary policy and the userspace security server code (the latter is only exported by the static libsepol, not the shared library). I worked around the collision temporarily in audit2why.c by not including selinux.h and manually defining function prototypes for the functions from libselinux, but I think we should eliminate the collision by applying the attached script to all *.[chy] files in libsepol and checkpolicy and then applying the attached patch to audit2why. I don't think we want to actually fold the types together, as the libsepol definitions need to stay consistent with the binary policy format whereas the libselinux ones don't need to be fixed size (and in the case of security_id_t we cannot fold them since one is an integer and the other is a struct). Seem reasonable? -- Stephen Smalley National Security Agency [-- Attachment #2: fixnamespace --] [-- Type: application/x-shellscript, Size: 439 bytes --] [-- Attachment #3: audit2why-namespace.patch --] [-- Type: text/x-patch, Size: 1668 bytes --] Index: policycoreutils/audit2why/audit2why.c =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/audit2why/audit2why.c,v retrieving revision 1.1 diff -u -p -r1.1 audit2why.c --- policycoreutils/audit2why/audit2why.c 13 May 2005 14:42:21 -0000 1.1 +++ policycoreutils/audit2why/audit2why.c 13 May 2005 19:14:22 -0000 @@ -8,22 +8,13 @@ #include <limits.h> #include <sepol/sepol.h> #include <sepol/services.h> +#include <selinux/selinux.h> #define AVCPREFIX "avc: denied { " #define SCONTEXT "scontext=" #define TCONTEXT "tcontext=" #define TCLASS "tclass=" -/* Copied from selinux/selinux.h. - Should be replaced with #include <selinux/selinux.h>, - but first requires elimination of namespace collisions - between libselinux and libsepol. */ -extern const char *selinux_binary_policy_path(void); -extern security_class_t string_to_security_class(const char *name); -extern access_vector_t string_to_av_perm(security_class_t tclass, const char *name); -extern int security_policyvers(void); -extern int is_selinux_enabled(void); - void usage(char *progname, int rc) { fprintf(stderr, "usage: %s [-p policy] < /var/log/audit/audit.log\n", progname); @@ -39,10 +30,10 @@ int main(int argc, char **argv) FILE *fp; int opt, rc, set_path = 0; char *p, *scon, *tcon, *tclassstr, *permstr; - security_id_t ssid, tsid; - security_class_t tclass; - access_vector_t perm, av; - struct av_decision avd; + sepol_security_id_t ssid, tsid; + sepol_security_class_t tclass; + sepol_access_vector_t perm, av; + struct sepol_av_decision avd; unsigned int reason; int vers = 0; ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-13 19:30 ` Stephen Smalley @ 2005-05-13 20:00 ` Stephen Smalley 0 siblings, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 20:00 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Fri, 2005-05-13 at 15:30 -0400, Stephen Smalley wrote: > In creating audit2why, I ran into the known namespace collision between > libsepol and libselinux; they both define the base set of Flask types, > with the one set of definitions for security-aware applications running > on SELinux and the other set of definitions for the binary policy and > the userspace security server code (the latter is only exported by the > static libsepol, not the shared library). I worked around the collision > temporarily in audit2why.c by not including selinux.h and manually > defining function prototypes for the functions from libselinux, but I > think we should eliminate the collision by applying the attached script > to all *.[chy] files in libsepol and checkpolicy and then applying the > attached patch to audit2why. I don't think we want to actually fold the > types together, as the libsepol definitions need to stay consistent with > the binary policy format whereas the libselinux ones don't need to be > fixed size (and in the case of security_id_t we cannot fold them since > one is an integer and the other is a struct). Seem reasonable? Ah, there was one duplicated expression in the sed script, but otherwise it yielded the expected result, and the resulting libsepol, checkpolicy, and audit2why all build as expected. Committed to sourceforge CVS. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-13 15:00 ` Stephen Smalley 2005-05-13 19:30 ` Stephen Smalley @ 2005-05-16 18:44 ` Stephen Smalley 2005-05-16 22:00 ` Daniel J Walsh 1 sibling, 1 reply; 18+ messages in thread From: Stephen Smalley @ 2005-05-16 18:44 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan [-- Attachment #1: Type: text/plain, Size: 1094 bytes --] On Fri, 2005-05-13 at 11:00 -0400, Stephen Smalley wrote: > Ok, just committed the two attached patches for libsepol and > policycoreutils to introduce an audit2why utility. A sample of the > output of audit2why is below from running: > $ /usr/sbin/audit2why < /var/log/audit/audit.log > > type=KERNEL msg=audit(1115316525.803:399552): avc: denied { getattr } for path=/home/sds dev=hda5 ino=1175041 scontext=root:secadm_r:secadm_t:s0-s9:c0.c127 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir > Was caused by: > Missing TE allow rule for the type pair (use audit2allow). > > type=KERNEL msg=audit(1115320071.648:606858): avc: denied { append } for name=.bash_history dev=hda5 ino=1175047 scontext=user_u:user_r:user_t:s1-s9:c0.c127 tcontext=user_u:object_r:user_home_t:s0 tclass=file > Was caused by: > Constraint violation (add type attribute to domain to satisfy constraints or alter constraint). Further patches to libsepol and audit2why so that audit2why can handle boolean settings and local user definitions properly. -- Stephen Smalley National Security Agency [-- Attachment #2: libsepol.patch --] [-- Type: text/x-patch, Size: 6812 bytes --] Index: libsepol/ChangeLog =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/ChangeLog,v retrieving revision 1.29 diff -u -p -r1.29 ChangeLog --- libsepol/ChangeLog 13 May 2005 19:38:06 -0000 1.29 +++ libsepol/ChangeLog 16 May 2005 18:21:50 -0000 @@ -1,3 +1,7 @@ +1.5.9 2005-05-16 + * Added sepol_genbools_policydb and sepol_genusers_policydb for + audit2why. + 1.5.8 2005-05-13 * Added sepol_ prefix to Flask types to avoid namespace collision with libselinux. Index: libsepol/VERSION =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/VERSION,v retrieving revision 1.24 diff -u -p -r1.24 VERSION --- libsepol/VERSION 13 May 2005 19:38:06 -0000 1.24 +++ libsepol/VERSION 16 May 2005 18:21:00 -0000 @@ -1 +1 @@ -1.5.8 +1.5.9 Index: libsepol/libsepol.spec =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/libsepol.spec,v retrieving revision 1.26 diff -u -p -r1.26 libsepol.spec --- libsepol/libsepol.spec 13 May 2005 19:38:06 -0000 1.26 +++ libsepol/libsepol.spec 16 May 2005 18:21:03 -0000 @@ -1,6 +1,6 @@ Summary: SELinux binary policy manipulation library Name: libsepol -Version: 1.5.8 +Version: 1.5.9 Release: 1 License: GPL Group: System Environment/Libraries Index: libsepol/include/sepol/policydb.h =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/include/sepol/policydb.h,v retrieving revision 1.8 diff -u -p -r1.8 policydb.h --- libsepol/include/sepol/policydb.h 13 May 2005 19:38:13 -0000 1.8 +++ libsepol/include/sepol/policydb.h 16 May 2005 17:33:49 -0000 @@ -263,6 +263,8 @@ extern int policydb_index_bools(policydb extern int policydb_index_others(policydb_t * p, unsigned int verbose); +extern int policydb_reindex_users(policydb_t * p); + extern int constraint_expr_destroy(constraint_expr_t * expr); extern void policydb_destroy(policydb_t * p); Index: libsepol/include/sepol/services.h =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/include/sepol/services.h,v retrieving revision 1.5 diff -u -p -r1.5 services.h --- libsepol/include/sepol/services.h 13 May 2005 19:38:13 -0000 1.5 +++ libsepol/include/sepol/services.h 16 May 2005 17:33:49 -0000 @@ -25,6 +25,13 @@ extern int sepol_set_policydb(policydb_t *p); extern int sepol_set_sidtab(sidtab_t *s); +/* Modify a policydb for boolean settings. */ +int sepol_genbools_policydb(policydb_t *policydb, const char *booleans); + +/* Modify a policydb for user settings. */ +int sepol_genusers_policydb(policydb_t *policydb, + const char *usersdir); + /* Load the security policy. This initializes the policydb and sidtab based on the provided binary policy. */ int sepol_load_policy(void * data, size_t len); Index: libsepol/src/genbools.c =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/genbools.c,v retrieving revision 1.13 diff -u -p -r1.13 genbools.c --- libsepol/src/genbools.c 25 Apr 2005 19:55:30 -0000 1.13 +++ libsepol/src/genbools.c 16 May 2005 17:33:49 -0000 @@ -52,7 +52,7 @@ static int process_boolean(char *buffer, return 1; } -static int load_booleans(struct policydb *policydb, char *path) { +static int load_booleans(struct policydb *policydb, const char *path) { FILE *boolf; char *buffer=NULL; size_t size=0; @@ -64,7 +64,7 @@ static int load_booleans(struct policydb boolf = fopen(path,"r"); if (boolf == NULL) - return -1; + goto localbool; while (getline(&buffer, &size, boolf) > 0) { int ret=process_boolean(buffer, name, sizeof(name), &val); @@ -81,6 +81,7 @@ static int load_booleans(struct policydb } } fclose(boolf); +localbool: snprintf(localbools,sizeof(localbools), "%s.local", path); boolf = fopen(localbools,"r"); if (boolf != NULL) { @@ -157,6 +158,18 @@ int sepol_genbools(void *data, size_t le return -1; } +int sepol_genbools_policydb(policydb_t *policydb, const char *booleans) +{ + int rc; + + rc = load_booleans(policydb, booleans); + if (!rc) + rc = evaluate_conds(policydb); + if (rc) + errno = EINVAL; + return rc; +} + int sepol_genbools_array(void *data, size_t len, char **names, int *values, int nel) { struct policydb policydb; Index: libsepol/src/genusers.c =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/genusers.c,v retrieving revision 1.11 diff -u -p -r1.11 genusers.c --- libsepol/src/genusers.c 13 Apr 2005 14:30:18 -0000 1.11 +++ libsepol/src/genusers.c 16 May 2005 17:34:14 -0000 @@ -444,3 +444,34 @@ err: policydb_destroy(&policydb); return -1; } + +int sepol_genusers_policydb(policydb_t *policydb, + const char *usersdir) +{ + char path[PATH_MAX]; + + /* Load base set of system users from the policy package. */ + snprintf(path, sizeof path, "%s/system.users", usersdir); + if (load_users(policydb, path) < 0) { + __sepol_debug_printf("%s: Can't load system.users: %s\n", + __FUNCTION__, strerror(errno)); + return -1; + } + + /* Load locally defined users. */ + snprintf(path, sizeof path, "%s/local.users", usersdir); + if (load_users(policydb, path) < 0) { + __sepol_debug_printf("%s: Can't load local.users: %s\n", + __FUNCTION__, strerror(errno)); + return -1; + } + + if (policydb_reindex_users(policydb) < 0) { + __sepol_debug_printf("%s: Can't reindex users: %s\n", + __FUNCTION__, strerror(errno)); + return -1; + + } + + return 0; +} Index: libsepol/src/policydb.c =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/policydb.c,v retrieving revision 1.8 diff -u -p -r1.8 policydb.c --- libsepol/src/policydb.c 17 Feb 2005 14:59:27 -0000 1.8 +++ libsepol/src/policydb.c 16 May 2005 17:38:29 -0000 @@ -440,7 +440,6 @@ int policydb_index_others(policydb_t * p return 0; } - /* * The following *_destroy functions are used to * free any memory allocated for each kind of @@ -1733,5 +1732,30 @@ bad: return -1; } +int policydb_reindex_users(policydb_t * p) +{ + unsigned int i = SYM_USERS; + + if (p->user_val_to_struct) + free(p->user_val_to_struct); + if (p->sym_val_to_name[i]) + free(p->sym_val_to_name[i]); + + p->user_val_to_struct = (user_datum_t **) + malloc(p->p_users.nprim * sizeof(user_datum_t *)); + if (!p->user_val_to_struct) + return -1; + + p->sym_val_to_name[i] = (char **) + malloc(p->symtab[i].nprim * sizeof(char *)); + if (!p->sym_val_to_name[i]) + return -1; + + if (hashtab_map(p->symtab[i].table, index_f[i], p)) + return -1; + + return 0; +} + [-- Attachment #3: policycoreutils.patch --] [-- Type: text/x-patch, Size: 5838 bytes --] Index: policycoreutils/ChangeLog =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/ChangeLog,v retrieving revision 1.114 diff -u -p -r1.114 ChangeLog --- policycoreutils/ChangeLog 13 May 2005 19:41:30 -0000 1.114 +++ policycoreutils/ChangeLog 16 May 2005 18:23:47 -0000 @@ -1,3 +1,7 @@ +1.23.10 2005-05-16 + * Extended audit2why to incorporate booleans and local user + settings when analyzing audit messages. + 1.23.9 2005-05-13 * Updated audit2why for sepol_ prefixes on Flask types to avoid namespace collision with libselinux, and to Index: policycoreutils/VERSION =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/VERSION,v retrieving revision 1.53 diff -u -p -r1.53 VERSION --- policycoreutils/VERSION 13 May 2005 19:41:30 -0000 1.53 +++ policycoreutils/VERSION 16 May 2005 18:23:04 -0000 @@ -1 +1 @@ -1.23.9 +1.23.10 Index: policycoreutils/policycoreutils.spec =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/policycoreutils.spec,v retrieving revision 1.76 diff -u -p -r1.76 policycoreutils.spec --- policycoreutils/policycoreutils.spec 13 May 2005 19:41:30 -0000 1.76 +++ policycoreutils/policycoreutils.spec 16 May 2005 18:23:02 -0000 @@ -1,6 +1,6 @@ Summary: SELinux policy core utilities. Name: policycoreutils -Version: 1.23.9 +Version: 1.23.10 Release: 1 License: GPL Group: System Environment/Base Index: policycoreutils/audit2why/audit2why.c =================================================================== RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/audit2why/audit2why.c,v retrieving revision 1.2 diff -u -p -r1.2 audit2why.c --- policycoreutils/audit2why/audit2why.c 13 May 2005 19:41:37 -0000 1.2 +++ policycoreutils/audit2why/audit2why.c 16 May 2005 18:25:16 -0000 @@ -36,6 +36,9 @@ int main(int argc, char **argv) struct sepol_av_decision avd; unsigned int reason; int vers = 0; + sidtab_t sidtab; + policydb_t policydb; + struct policy_file pf; while ((opt = getopt(argc, argv, "p:?h")) > 0) { switch (opt) { @@ -63,6 +66,10 @@ int main(int argc, char **argv) exit(1); } vers = security_policyvers(); + if (vers < 0) { + fprintf(stderr, "%s: Could not get policy version: %s\n", argv[0], strerror(errno)); + exit(1); + } snprintf(path, PATH_MAX, "%s.%d", selinux_binary_policy_path(), vers); fp = fopen(path, "r"); @@ -80,14 +87,44 @@ int main(int argc, char **argv) } } - rc = sepol_set_policydb_from_file(fp); - if (rc < 0) { - fprintf(stderr, "%s: unable to load policy from %s: %s\n", - argv[0], path, strerror(errno)); + /* Set up a policydb directly so that we can mutate it later + for booleans and user settings. Otherwise we would just use + sepol_set_policydb_from_file() here. */ + pf.fp = fp; + pf.type = PF_USE_STDIO; + if (policydb_read(&policydb, &pf, 0)) { + fprintf(stderr, "%s: invalid binary policy %s\n", + argv[0], path); exit(1); } fclose(fp); - + sepol_set_policydb(&policydb); + + if (!set_path) { + /* If they didn't specify a full path of a binary policy file, + then also try loading any boolean settings and user + definitions from the active locations. Otherwise, + they can use genpolbools and genpolusers to build a + binary policy file that includes any desired settings + and then apply audit2why -p to the resulting file. + Errors are non-fatal as such settings are optional. */ + sepol_debug(0); + (void)sepol_genbools_policydb(&policydb, selinux_booleans_path()); + (void)sepol_genusers_policydb(&policydb, selinux_users_path()); + } + + + /* Initialize the sidtab for subsequent use by sepol_context_to_sid + and sepol_compute_av_reason. */ + rc = sepol_sidtab_init(&sidtab); + if (rc < 0) { + fprintf(stderr, "%s: unable to init sidtab\n", + argv[0]); + exit(1); + } + sepol_set_sidtab(&sidtab); + + /* Process the audit messages. */ while (getline(&buffer, &len, stdin) > 0) { size_t len2 = strlen(buffer); @@ -212,16 +249,31 @@ int main(int argc, char **argv) continue; } - if (!reason) - continue; /* Denial would not occur under specified policy. */ - printf("%s\n\tWas caused by:\n", bufcopy); - if (reason & SEPOL_COMPUTEAV_TE) - printf("\t\tMissing TE allow rule for the type pair (use audit2allow).\n"); - if (reason & SEPOL_COMPUTEAV_CONS) - printf("\t\tConstraint violation (add type attribute to domain to satisfy constraints or alter constraint).\n"); - if (reason & SEPOL_COMPUTEAV_RBAC) - printf("\t\tMissing role allow rule for the role pair (add role allow rule).\n"); + + if (!reason) { + printf("\t\tUnknown - would be allowed by %s policy\n", set_path ? "specified" : "active"); + printf("\t\tPossible mismatch between this policy and the one under which the audit message was generated.\n"); + printf("\t\tPossible mismatch between current in-memory boolean settings vs. permanent ones.\n"); + } + + if (reason & SEPOL_COMPUTEAV_TE) { + printf("\t\tMissing or disabled TE allow rule.\n"); + printf("\t\tAllow rules may exist but be disabled by boolean settings; check boolean settings.\n"); + printf("\t\tYou can see the necessary allow rules by running audit2allow with this audit message as input.\n"); + } + + if (reason & SEPOL_COMPUTEAV_CONS) { + printf("\t\tConstraint violation.\n"); + printf("\t\tCheck policy/constraints.\n"); + printf("\t\tTypically, you just need to add a type attribute to the domain to satisfy the constraint.\n"); + } + + if (reason & SEPOL_COMPUTEAV_RBAC) { + printf("\t\tMissing role allow rule.\n"); + printf("\t\tAdd allow rule for the role pair.\n"); + } + printf("\n"); } free(buffer); ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-16 18:44 ` Stephen Smalley @ 2005-05-16 22:00 ` Daniel J Walsh 2005-05-17 11:39 ` Stephen Smalley 2005-05-17 12:05 ` Stephen Smalley 0 siblings, 2 replies; 18+ messages in thread From: Daniel J Walsh @ 2005-05-16 22:00 UTC (permalink / raw) To: Stephen Smalley; +Cc: SE Linux, Karl MacMillan [-- Attachment #1: Type: text/plain, Size: 192 bytes --] I think, this patch is needed to export symbols of newly added libsepol functions. Also policycoreutils-rhat.patch needed to build on 64 bit platforms, plus some other stuff. Dan -- [-- Attachment #2: libsepol-rhat.patch --] [-- Type: text/x-patch, Size: 578 bytes --] diff --exclude-from=exclude -N -u -r nsalibsepol/src/libsepol.map libsepol-1.5.8/src/libsepol.map --- nsalibsepol/src/libsepol.map 2005-04-14 07:22:14.000000000 -0400 +++ libsepol-1.5.8/src/libsepol.map 2005-05-16 17:43:48.000000000 -0400 @@ -1,4 +1,4 @@ { - global: sepol_genbools*; sepol_set_policydb_from_file; sepol_check_context; sepol_genusers; sepol_debug; sepol_set_delusers; + global: sepol_genbools*; sepol_set_policydb_from_file; sepol_check_context; sepol_genusers; sepol_debug; sepol_set_delusers; sepol_context_to_sid; sepol_compute_av_reason; local: *; }; [-- Attachment #3: policycoreutils-rhat.patch --] [-- Type: text/x-patch, Size: 4031 bytes --] diff --exclude-from=exclude -N -u -r nsapolicycoreutils/audit2why/audit2why.1 policycoreutils-1.23.9/audit2why/audit2why.1 --- nsapolicycoreutils/audit2why/audit2why.1 1969-12-31 19:00:00.000000000 -0500 +++ policycoreutils-1.23.9/audit2why/audit2why.1 2005-05-16 17:24:58.000000000 -0400 @@ -0,0 +1,62 @@ +.\" Hey, Emacs! This is an -*- nroff -*- source file. +.\" Copyright (c) 2005 Dan Walsh <dwalsh@redhat.com> +.\" +.\" This is free documentation; you can redistribute it and/or +.\" modify it under the terms of the GNU General Public License as +.\" published by the Free Software Foundation; either version 2 of +.\" the License, or (at your option) any later version. +.\" +.\" The GNU General Public License's references to "object code" +.\" and "executables" are to be interpreted as the output of any +.\" document formatting or typesetting system, including +.\" intermediate and printed output. +.\" +.\" This manual is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public +.\" License along with this manual; if not, write to the Free +.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, +.\" USA. +.\" +.\" +.TH AUDIT2ALLOW "1" "May 2005" "Security Enhanced Linux" NSA +.SH NAME +audit2why \- Translates auditmessages into a description of why the access was denied +.SH SYNOPSIS +.B audit2why +.RI [ options "] " +.SH OPTIONS +.TP + +.B "\-\-help" +Print a short usage message +.TP +.B "\-p <policyfile>" +Specify an alternate policy file. +.SH DESCRIPTION +.PP +This utility scans stdin (logfiles) for messages logged when the +system denied permission for operations, and generates a reason why the +access was denied +.PP +.SH EXAMPLE +$ /usr/sbin/audit2why < /var/log/audit/audit.log + +type=KERNEL msg=audit(1115316525.803:399552): avc: denied { getattr } for path=/home/sds dev=hda5 ino=1175041 scontext=root:secadm_r:secadm_t:s0-s9:c0.c127 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir + Was caused by: + Missing TE allow rule for the type pair (use audit2allow). + +type=KERNEL msg=audit(1115320071.648:606858): avc: denied { append } for name=.bash_history dev=hda5 ino=1175047 scontext=user_u:user_r:user_t:s1-s9:c0.c127 tcontext=user_u:object_r:user_home_t:s0 tclass=file + Was caused by: + Constraint violation (add type attribute to domain to satisfy constraints or alter constraint). + + +.PP +.SH AUTHOR +This manual page was written by +.I Dan Walsh <dwalsh@redhat.com>, +.B audit2why +utility was written by Stephen Smalley <sds@tycho.nsa.gov>. diff --exclude-from=exclude -N -u -r nsapolicycoreutils/audit2why/Makefile policycoreutils-1.23.9/audit2why/Makefile --- nsapolicycoreutils/audit2why/Makefile 2005-05-16 15:40:11.000000000 -0400 +++ policycoreutils-1.23.9/audit2why/Makefile 2005-05-16 17:26:05.000000000 -0400 @@ -1,6 +1,6 @@ # Installation directories. PREFIX ?= ${DESTDIR}/usr -BINDIR ?= $(PREFIX)/sbin +BINDIR ?= $(PREFIX)/bin LIBDIR ?= ${PREFIX}/lib MANDIR ?= $(PREFIX)/share/man LOCALEDIR ?= /usr/share/locale @@ -8,7 +8,7 @@ CFLAGS = -Werror override CFLAGS += -Wall -W -LDLIBS += ${LIBDIR}/libsepol.a -lselinux +LDLIBS += -lsepol -lselinux TARGETS=audit2why @@ -17,6 +17,8 @@ install: all -mkdir -p $(BINDIR) install -m 755 $(TARGETS) $(BINDIR) + -mkdir -p $(MANDIR)/man1 + install -m 644 audit2why.1 $(MANDIR)/man1/ clean: rm -f $(TARGETS) *.o diff --exclude-from=exclude -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-1.23.9/scripts/fixfiles --- nsapolicycoreutils/scripts/fixfiles 2005-04-29 14:11:23.000000000 -0400 +++ policycoreutils-1.23.9/scripts/fixfiles 2005-05-16 17:24:58.000000000 -0400 @@ -164,7 +164,7 @@ fi # See how we were called. -while getopts "C:Fo:R:l:" i; do +while getopts "C:Ffo:R:l:" i; do case "$i" in f) fullFlag=1 ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-16 22:00 ` Daniel J Walsh @ 2005-05-17 11:39 ` Stephen Smalley 2005-05-17 11:50 ` Stephen Smalley 2005-05-17 12:41 ` Daniel J Walsh 2005-05-17 12:05 ` Stephen Smalley 1 sibling, 2 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-17 11:39 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Mon, 2005-05-16 at 18:00 -0400, Daniel J Walsh wrote: > I think, this patch is needed to export symbols of newly added libsepol > functions. No. These particular functions are _only_ for the static library and programs that link with it, as they expose too much of the internals of libsepol. Note that audit2why is linked with libsepol.a, not the shared library (prior to your policycoreutils patch). We will not _export_ these symbols via the shared library. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-17 11:39 ` Stephen Smalley @ 2005-05-17 11:50 ` Stephen Smalley 2005-05-17 12:41 ` Daniel J Walsh 1 sibling, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-17 11:50 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Tue, 2005-05-17 at 07:39 -0400, Stephen Smalley wrote: > On Mon, 2005-05-16 at 18:00 -0400, Daniel J Walsh wrote: > > I think, this patch is needed to export symbols of newly added libsepol > > functions. > > No. These particular functions are _only_ for the static library and > programs that link with it, as they expose too much of the internals of > libsepol. Note that audit2why is linked with libsepol.a, not the shared > library (prior to your policycoreutils patch). We will not _export_ > these symbols via the shared library. Note btw that this is no different than checkpolicy, which also links with the static libsepol. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-17 11:39 ` Stephen Smalley 2005-05-17 11:50 ` Stephen Smalley @ 2005-05-17 12:41 ` Daniel J Walsh 1 sibling, 0 replies; 18+ messages in thread From: Daniel J Walsh @ 2005-05-17 12:41 UTC (permalink / raw) To: Stephen Smalley; +Cc: SE Linux, Karl MacMillan Stephen Smalley wrote: >On Mon, 2005-05-16 at 18:00 -0400, Daniel J Walsh wrote: > > >>I think, this patch is needed to export symbols of newly added libsepol >>functions. >> >> > >No. These particular functions are _only_ for the static library and >programs that link with it, as they expose too much of the internals of >libsepol. Note that audit2why is linked with libsepol.a, not the shared >library (prior to your policycoreutils patch). We will not _export_ >these symbols via the shared library. > > > Ok libdir needs to be passed in via spec file. Dan -- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-16 22:00 ` Daniel J Walsh 2005-05-17 11:39 ` Stephen Smalley @ 2005-05-17 12:05 ` Stephen Smalley 1 sibling, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-17 12:05 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Mon, 2005-05-16 at 18:00 -0400, Daniel J Walsh wrote: > I think, this patch is needed to export symbols of newly added libsepol > functions. > > Also policycoreutils-rhat.patch needed to build on 64 bit platforms, > plus some other stuff. Also, I specifically put it into sbin rather than bin because you need to be able to read the policy and the audit log in order to use it effectively, so it didn't seem overly useful to put it into bin. Note that the output has changed somewhat with my last patch from the sample messages I posted earlier (that you included into the man page). -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-12 14:30 ` Stephen Smalley 2005-05-12 14:46 ` Daniel J Walsh @ 2005-05-13 15:35 ` Stephen Smalley 1 sibling, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 15:35 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan On Thu, 2005-05-12 at 10:30 -0400, Stephen Smalley wrote: > The AVC just sees that a given permission was denied, not what component > of the policy engine denied it. See "Flask architecture", "policy- > flexibility", ... BTW, to elaborate on this point, when a permission check is first made for a given (subject security context, object security context, object security class) triple, the AVC gets a complete access vector (all permission decisions) for that triple from the security server, so the security server does the complete policy computation at that time and never sees subsequent permission checks on the same triple as long as the cache entry isn't evicted. Hence, even if we modified the kernel security server to log a message about the cause when it receives a request for a computation and one of the requested permissions is denied, we'd still never see the causes for denials that are handled entirely by the AVC using the cached access vector. To support that in the kernel (vs. creating a utility like audit2why), we'd have to have the kernel security server return a vector of _reasons_ for each denied permission in the access vector to the AVC and have the AVC interpret that vector when generating the audit message. In addition to being rather painful, that also tends to break the desired encapsulation of policy logic within the security server in the kernel (vs. having some policy-aware applications like audit2why). -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints.
@ 2005-05-12 20:37 Casey Schaufler
2005-05-13 11:16 ` Stephen Smalley
0 siblings, 1 reply; 18+ messages in thread
From: Casey Schaufler @ 2005-05-12 20:37 UTC (permalink / raw)
To: SE Linux
--- Stephen Smalley <sds@tycho.nsa.gov> wrote:
> But nothing prevents you from creating a simple tool
> linked against
> libsepol that takes an avc denial and determines
> which part of the
> policy caused it.
I seriously doubt this would be a "simple" tool.
Two months after the event are you absolutely sure
you are going to have all the information you need
to reconstruct the policy and file system context
that was in force at the time of a particular
access attempt?
One of the first MLS systems (System V/MLS)
did reconstructive audit. The experience of
that system lead all of the Unix vendors after
to use schemes that created individual records
that include all interesting information.
I disagree with your assessment that it's easier
to do this is user space after the fact than in
the kernel as the action happens.
Casey Schaufler
casey@schaufler-ca.com
Yahoo! Mail
Stay connected, organized, and protected. Take the tour:
http://tour.mail.yahoo.com/mailtour.html
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: Busted by constraints. 2005-05-12 20:37 Casey Schaufler @ 2005-05-13 11:16 ` Stephen Smalley 0 siblings, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 11:16 UTC (permalink / raw) To: Casey Schaufler; +Cc: SE Linux On Thu, 2005-05-12 at 13:37 -0700, Casey Schaufler wrote: > I seriously doubt this would be a "simple" tool. > Two months after the event are you absolutely sure > you are going to have all the information you need > to reconstruct the policy and file system context > that was in force at the time of a particular > access attempt? Everything we need to reproduce the denial is included in the audit message (i.e. the relevant security contexts and object information) except for the policy itself. So all you need is the audit log and the policy that was in effect at the time, and you can reproduce the computation. I'll make a simple patch to libsepol and a trivial utility that does this. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. @ 2005-05-13 15:10 Casey Schaufler 2005-05-13 15:20 ` Stephen Smalley 0 siblings, 1 reply; 18+ messages in thread From: Casey Schaufler @ 2005-05-13 15:10 UTC (permalink / raw) To: SE Linux --- Stephen Smalley <sds@tycho.nsa.gov> wrote: > On Thu, 2005-05-12 at 13:37 -0700, Casey Schaufler > wrote: > Everything we need to reproduce the denial is > included in the audit > message (i.e. the relevant security contexts and > object information) > except for the policy itself. Yup. > So all you need is > the audit log and the > policy that was in effect at the time, and you can > reproduce the > computation. So where is the policy-in-effect stored? Certainly you're not going to suggest using the policy source file that happens to be there at the time of analysis. That policy file (actually, that set of policy files soon) may bear little resemblence to the policy that was in force at the time the event occured. Even if you're talking about the policy file at the time of collection there is real risk that the content of the policy file does not match what the kernel is enforcing. > I'll make a simple patch to libsepol > and a trivial utility > that does this. Enjoy. It's pretty pointless. Casey Schaufler casey@schaufler-ca.com Discover Yahoo! Stay in touch with email, IM, photo sharing and more. Check it out! http://discover.yahoo.com/stayintouch.html -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. 2005-05-13 15:10 Casey Schaufler @ 2005-05-13 15:20 ` Stephen Smalley 0 siblings, 0 replies; 18+ messages in thread From: Stephen Smalley @ 2005-05-13 15:20 UTC (permalink / raw) To: Casey Schaufler; +Cc: SE Linux On Fri, 2005-05-13 at 08:10 -0700, Casey Schaufler wrote: > So where is the policy-in-effect stored? > Certainly you're not going to suggest using > the policy source file that happens to be there > at the time of analysis. That policy file > (actually, that set of policy files soon) > may bear little resemblence to the policy > that was in force at the time the event > occured. Even if you're talking about the > policy file at the time of collection > there is real risk that the content of the > policy file does not match what the kernel > is enforcing. audit2why/libsepol actually acts on the binary policy file, and libsepol has the same policy engine code as the kernel, but I understand your concern about matching up with the policy that was in effect at the time of the denial. However, keep in mind that: a) keeping a versioned repository of your policies is a good idea independent of this issue, b) we are only trying to identify what component of the policy caused a denial (e.g. Type Enforcement, RBAC, or constraint), and this is not likely to be highly variable across policy changes/upgrades for a given denial. It might be useful if the kernel audit messages included some kind of policy identifier / hash that could be used in correlating against a versioned repository of policies. That wouldn't be difficult. > Enjoy. It's pretty pointless. To the contrary, it specifically addresses Dan's problem (i.e. being able to quickly determine which part of the policy caused a given denial for application and policy debugging), where he knows what policy he is using at the time of the denial. And it should provide a basis for future work on audit analysis tools, even if we have to make further enhancements to support that functionality fully. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: Busted by constraints. @ 2005-05-13 15:56 Casey Schaufler 0 siblings, 0 replies; 18+ messages in thread From: Casey Schaufler @ 2005-05-13 15:56 UTC (permalink / raw) To: Stephen Smalley, Casey Schaufler; +Cc: SE Linux --- Stephen Smalley <sds@tycho.nsa.gov> wrote: > audit2why/libsepol actually acts on the binary > policy file, and libsepol > has the same policy engine code as the kernel, but I > understand your > concern about matching up with the policy that was > in effect at the time > of the denial. Since the policy is a variable in the security lattice it needs to be included in the audit information. > However, keep in mind that: > a) keeping a versioned repository of your policies > is a good idea > independent of this issue, Sure, just as versioned repositories of your users and system installation is a good idea. > b) we are only trying to identify what component of > the policy caused a > denial (e.g. Type Enforcement, RBAC, or constraint), > and this is not > likely to be highly variable across policy > changes/upgrades for a given > denial. The likelyhood of change does not discount the threat of change. > It might be useful if the kernel audit messages > included some kind of > policy identifier / hash that could be used in > correlating against a > versioned repository of policies. That wouldn't be > difficult. Your audit message should explicitly identify what policy resulted in any failure. > > Enjoy. It's pretty pointless. > > To the contrary, it specifically addresses Dan's > problem OKay, it's a valuable debug tool until such time as you repair the audit records. Casey Schaufler casey@schaufler-ca.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2005-05-17 12:41 UTC | newest] Thread overview: 18+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2005-05-12 14:32 Busted by constraints Daniel J Walsh 2005-05-12 14:30 ` Stephen Smalley 2005-05-12 14:46 ` Daniel J Walsh 2005-05-13 15:00 ` Stephen Smalley 2005-05-13 19:30 ` Stephen Smalley 2005-05-13 20:00 ` Stephen Smalley 2005-05-16 18:44 ` Stephen Smalley 2005-05-16 22:00 ` Daniel J Walsh 2005-05-17 11:39 ` Stephen Smalley 2005-05-17 11:50 ` Stephen Smalley 2005-05-17 12:41 ` Daniel J Walsh 2005-05-17 12:05 ` Stephen Smalley 2005-05-13 15:35 ` Stephen Smalley -- strict thread matches above, loose matches on Subject: below -- 2005-05-12 20:37 Casey Schaufler 2005-05-13 11:16 ` Stephen Smalley 2005-05-13 15:10 Casey Schaufler 2005-05-13 15:20 ` Stephen Smalley 2005-05-13 15:56 Casey Schaufler
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.