[PATCH] MLS Policy

[PATCH] MLS Policy

[Jonathan Kim]

[-- Attachment #1.1: Type: text/plain, Size: 689 bytes --]

The attached patch corrects an apparent typo in the base_can_network macro. 
With the patch applied, it will be possible to do "ssh or ping localhost",
for example.
 
Also, the NSA policy already contains the correct comments for all of the
MLS attributes in the file attrib.te, but the 'policy-20051021.patch' is
patching over these comments with older comments. 
The fix is to not patch that portion of the attrib.te file
 
Thank you

----------------------------------- 
Jonghoon Jonathan 
Secure Systems Engineer 

Trusted Computer Solutions 
121 W Goose Alley 
Urbana, IL  61801 

http://www.TrustedCS.com <http://www.trustedcs.com/>  

V:  217.384.0028  ext.16 
F:  217.384.0288 

 

[-- Attachment #1.2: Type: text/html, Size: 1792 bytes --]

[-- Attachment #2: policy-mls-1.27.2.patch.netif --]
[-- Type: application/octet-stream, Size: 674 bytes --]

diff -Nur policy-1.27.2.orig/macros/network_macros.te policy-1.27.2/macros/network_macros.te
--- policy-1.27.2.orig/macros/network_macros.te	2005-11-08 15:07:10.000000000 -0600
+++ policy-1.27.2/macros/network_macros.te	2005-11-08 15:33:23.000000000 -0600
@@ -16,7 +16,7 @@
 # Allow the domain to send or receive using any network interface.
 # netif_type is a type attribute for all network interface types.
 #
-allow $1 netif_t:netif { $2_recv $2_send rawip_send rawip_recv };
+allow $1 netif_type:netif { $2_recv $2_send rawip_send rawip_recv };
 #
 # Allow the domain to send to or receive from any node.
 # node_type is a type attribute for all node types.

Re: [PATCH] MLS Policy

[Daniel J Walsh]

Jonathan Kim wrote:
> The attached patch corrects an apparent typo in the base_can_network 
> macro.
> With the patch applied, it will be possible to do "ssh or ping 
> localhost", for example.
No this is not a bug in the patch.  the idea was to only force all 
policies to specify a non standard device type.
So that you can start to specify, apache can listen on eth0 but not eth1.

Adding the following is probably what MLS needs
+allow $1 netif_lo_t:netif { $2_recv $2_send rawip_send rawip_recv };

>  
> Also, the NSA policy already contains the correct comments for all of 
> the MLS attributes in the file attrib.te, but the 
> 'policy-20051021.patch' is patching over these comments with older 
> comments.
> The fix is to not patch that portion of the attrib.te file
>  
> Thank you
>
> -----------------------------------
> *Jonghoon Jonathan*
> Secure Systems Engineer
>
> *Trusted Computer Solutions*
> 121 W Goose Alley
> Urbana, IL  61801
>
> http://www.TrustedCS.com <http://www.trustedcs.com/>
>
> *V:*  217.384.0028  ext.16
> *F: * 217.384.0288
>
>  


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: [PATCH] MLS Policy

[Chad Hanson]

I concur....

> -----Original Message-----
> From: Daniel J Walsh [mailto:dwalsh@redhat.com]
> Sent: Wednesday, November 09, 2005 10:20 AM
> To: Jonathan Kim
> Cc: SELinux@tycho.nsa.gov; Chad Hanson
> Subject: Re: [PATCH] MLS Policy
> 
> 
> Jonathan Kim wrote:
> > The attached patch corrects an apparent typo in the 
> base_can_network 
> > macro.
> > With the patch applied, it will be possible to do "ssh or ping 
> > localhost", for example.
> No this is not a bug in the patch.  the idea was to only force all 
> policies to specify a non standard device type.
> So that you can start to specify, apache can listen on eth0 
> but not eth1.
> 
> Adding the following is probably what MLS needs
> +allow $1 netif_lo_t:netif { $2_recv $2_send rawip_send rawip_recv };
> 
> >  
> > Also, the NSA policy already contains the correct comments 
> for all of 
> > the MLS attributes in the file attrib.te, but the 
> > 'policy-20051021.patch' is patching over these comments with older 
> > comments.
> > The fix is to not patch that portion of the attrib.te file
> >  
> > Thank you
> >
> > -----------------------------------
> > *Jonghoon Jonathan*
> > Secure Systems Engineer
> >
> > *Trusted Computer Solutions*
> > 121 W Goose Alley
> > Urbana, IL  61801
> >
> > http://www.TrustedCS.com <http://www.trustedcs.com/>
> >
> > *V:*  217.384.0028  ext.16
> > *F: * 217.384.0288
> >
> >  
> 
> 
> -- 
> 
> 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[PATCH] MLS policy

[Jonathan Kim]

[-- Attachment #1: Type: text/plain, Size: 526 bytes --]

This patch sets the file context for the seusers file to be
SystemHigh (because the seusers file contains MLS labels and
these must be protected).  It also fixes some login-related
issues on MLS (allow login on a tty which is not at SystemLow,
and also allow reading of the seusers file).


 <<mls-login.patch>> 

-----------------------------------
Jonghoon Jonathan
Secure Systems Engineer

Trusted Computer Solutions
121 W Goose Alley
Urbana, IL  61801

http://www.TrustedCS.com

V:  217.384.0028  ext.16
F:  217.384.0288


[-- Attachment #2: mls-login.patch --]
[-- Type: application/octet-stream, Size: 1977 bytes --]

diff -Nur policy-1.27.2.orig/domains/program/getty.te policy-1.27.2/domains/program/getty.te
--- policy-1.27.2.orig/domains/program/getty.te	2005-10-21 15:56:50.000000000 +0000
+++ policy-1.27.2/domains/program/getty.te	2005-11-04 00:12:30.498842863 +0000
@@ -8,7 +8,7 @@
 #
 # Rules for the getty_t domain.
 #
-init_service_domain(getty, `, privfd')
+init_service_domain(getty, `, privfd, mlsfileread, mlsfilewrite')
 
 etcdir_domain(getty)
 
diff -Nur policy-1.27.2.orig/domains/program/login.te policy-1.27.2/domains/program/login.te
--- policy-1.27.2.orig/domains/program/login.te	2005-10-21 15:56:50.000000000 +0000
+++ policy-1.27.2/domains/program/login.te	2005-11-04 00:11:29.743583172 +0000
@@ -13,7 +13,7 @@
 
 # $1 is the name of the domain (local or remote)
 define(`login_domain', `
-type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
+type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfileread, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
 role system_r types $1_login_t;
 
 dontaudit $1_login_t shadow_t:file { getattr read };
diff -Nur policy-1.27.2.orig/file_contexts/types.fc policy-1.27.2/file_contexts/types.fc
--- policy-1.27.2.orig/file_contexts/types.fc	2005-11-04 00:07:02.691790026 +0000
+++ policy-1.27.2/file_contexts/types.fc	2005-11-04 00:10:55.206530855 +0000
@@ -306,6 +306,7 @@
 /etc/resolv\.conf.*	--	system_u:object_r:net_conf_t:s0
 
 /etc/selinux(/.*)?		system_u:object_r:selinux_config_t:s0
+/etc/selinux/([^/]*/)?seusers	--	system_u:object_r:selinux_config_t:s15:c0.c255
 /etc/selinux/([^/]*/)?users(/.*)?	system_u:object_r:selinux_config_t:s15:c0.c255
 /etc/selinux/([^/]*/)?policy(/.*)?	system_u:object_r:policy_config_t:s15:c0.c255
 /etc/selinux/([^/]*/)?src(/.*)?	system_u:object_r:policy_src_t:s15:c0.c255

Re: [PATCH] MLS policy

[Daniel J Walsh]

Jonathan Kim wrote:
> This patch sets the file context for the seusers file to be
> SystemHigh (because the seusers file contains MLS labels and
> these must be protected).  It also fixes some login-related
> issues on MLS (allow login on a tty which is not at SystemLow,
> and also allow reading of the seusers file).
>   
Added to rev selinux-policy-targeted-1.27.2-15

>
>  <<mls-login.patch>> 
>
> -----------------------------------
> Jonghoon Jonathan
> Secure Systems Engineer
>
> Trusted Computer Solutions
> 121 W Goose Alley
> Urbana, IL  61801
>
> http://www.TrustedCS.com
>
> V:  217.384.0028  ext.16
> F:  217.384.0288
>
>   


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.