Re: named SELinux policy

Re: named SELinux policy

[Daniel J Walsh]

Jason Vas Dias wrote:
> Hi Dan -
>
> Ivan raised a good point about the named SELinux policy:
> On Saturday 04 March 2006 14:49, Ivan Gyurdiev <ivg2@cornell.edu> wrote:
>   
>>  files_read_etc_files(named_t) allows named to read all files marked 
>>  etc_t. Those are usually configuration files, shouldn't be any secrets 
>>  there.... What if it turns out there is a secret file mislabeled by 
>>  mistake? Why is named interested in configuration of other programs anyway?
>>     
> On Saturday 04 March 2006 15:14, Jason Vas Dias <jvdias@redhat.com> wrote:
>   
>>  This is because named.conf can 'include "...";' other files, which are in $ROOTDIR/etc
>>  and not labelled as named_conf_t by default - unless in the chroot, where 
>>  /var/named/chroot/etc/* is labelled as named_conf_t. I think probably this should be
>>  changed to label  /etc/named.* or /etc/bind/* as named_conf_t and disallow named etc_t 
>>  read privilege. But this is mitigated by the fact that named runs as the 'named:named' user, 
>>  and most /etc/* files should be -rw------- .
>>     
>
> The named process does not read any /etc/ files that are not named_conf_t . 
> The initscript, which has context initrc_exec_t, may need to read /etc/ files 
> or invoke other programs which do so. 
> The rndc process should ONLY need to read $ROOTDIR/etc/rndc.* files, which
> should all have context named_conf_t . (Currently, $ROOTDIR/etc/rndc.* only
> gets labelled as named_conf_t if $ROOTDIR is /var/named - this seems odd).
>
> Please can we remove these lines from the bind.te devel policy:
>
> files_read_etc_files(named_t)
> files_read_etc_runtime_files(named_t)
> files_read_etc_files(ndc_t)
>
> And replace this line in bind.fc :
> /etc/named\.conf  -- gen_context(system_u:object_r:named_conf_t,s0)
> with
> /etc/{named,rndc}.*      gen_context(system_u:object_r:named_conf_t,s0)
>
> With the next version of bind, I'm going to be replacing the named.conf
> Provide-d by caching-nameserver with :
>  $ROOTDIR/etc/named.caching-nameserver.conf , which will include:
>  $ROOTDIR/etc/named.rfc1912.zones.conf
>
> And I think we need a better way of labelling named configuration files
> as named_conf_t rather than just letting named read etc_t* .
>
> Please let me know your opinion on the above and whether these changes
> can go in to FC-5.
>
> Thanks & Regards,
> Jason
>   
I am not a big fan of labeling files in /etc as something other than 
etc_t.  If these files get created by another tool (sed, emacs, ed, cp, 
system-config-bind ...) that does not maintain security context all of a 
sudden named will mysteriously stop working.  Named starts blowing up, 
User blames SELinux, turns SELinux off.

File context that differs from parent directory is especially hard to 
maintain and can give the impression that SELinux is difficult.  We can 
not predict which tools a user will use to maintain the named.conf file 
so leaving it etc_t is better in my opinion.  If you want to prevent 
secret data then you should not store a file in /etc with default 
context (etc_t, etc_runtime_t).  (You probably should not store the file 
there in the  first place.)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: named SELinux policy

[Ivan Gyurdiev]

> File context that differs from parent directory is especially hard to 
> maintain and can give the impression that SELinux is difficult.  We 
> can not predict which tools a user will use to maintain the named.conf 
> file so leaving it etc_t is better in my opinion.  If you want to 
> prevent secret data then you should not store a file in /etc with 
> default context (etc_t, etc_runtime_t).  (You probably should not 
> store the file there in the  first place.)
I see this as one of the fundamental problems of SELinux to solve before 
it becomes mainstream...

Should automatic type transitions be treated as a hack, placed there 
until the app starts using setfscreatecon? Should they instead be 
treated as the way to do things, with applications being modified to 
better organize their files into folders, and the folders pre-created as 
appropriate.

Automated transitions have already proved difficult when mixing files of 
different types in the same folder, and also with shared libraries 
creating files.

It seems like the app has much more knowledge about the file than the 
kernel's (src_context, target_class) pair. However, should we be 
incorporating selinux contexts into applications [ as is already done in 
consolehelper ]? How reliable are those context? The rwx of chmod() are 
pretty much set in stone. Policy changes all the time. Is it better to 
keep selinux logic out of applications instead?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: named SELinux policy

[Erich Schubert]

Hello Daniel,
> > The named process does not read any /etc/ files that are not named_conf_t . 
[...]

> > With the next version of bind, I'm going to be replacing the named.conf
> > Provide-d by caching-nameserver with :
> >  $ROOTDIR/etc/named.caching-nameserver.conf , which will include:
> >  $ROOTDIR/etc/named.rfc1912.zones.conf

I consider that seriously broken, btw...

> > And I think we need a better way of labelling named configuration files
> > as named_conf_t rather than just letting named read etc_t* .

We have had a better way for years already...

> I am not a big fan of labeling files in /etc as something other than 
> etc_t.  If these files get created by another tool (sed, emacs, ed, cp, 

I agree for /etc itself. But not for subdirectories.
Use /etc/bind/ please. Like any sane distribution. And then you can
label all the files in that directory the same way.

> File context that differs from parent directory is especially hard to 
> maintain and can give the impression that SELinux is difficult.  We can 

That is why we should make use of directories.

Jason: debian has had /etc/bind/zones.rfc1918 for a long time, why don't
you use this name, too?

best regards,
Erich Schubert
-- 
     erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C     (o_
 A man doesn't know what he knows until he knows what he doesn't know. //\
         Wenn Leute nicht glauben, dass Mathematik einfach ist,        V_/_
              dann nur deshalb, weil sie nicht begreifen,
          wie kompliziert das Leben ist. --- John von Neumann


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.