Context transition error

Context transition error

[Vince Le Port]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear all,

I am working on a mean to change the nfs server context depending on the
user who wants to access his files. I have planned to use MCS to do that.

Here is the approach for NFS:

Let us say, we have two users : client1 in s0:c1 and client2 in s0:c2
If client1 wants to access his home directory mounted with NFS, then the
NFS daemon will change his MCS category corresponding to the client MCS
category
That will limit the risk that client2 could access client1's files

Thus, for example my test program is launched in that context :
sysadm_u:sysadm_r:sysadm_t:s0:c1.c2

Then that program makes a setcon in order to move into
sysadm_u:sysadm_r:sysadm_t:s0:c1 and the following step is to move the
program in that context sysadm_u:sysadm_r:sysadm_t:s0:c2

I have written the following semodule :

module localadmin 1.0;

require {
        type sysadm_t;
        class process setcurrent;
        class process dyntransition;
}

allow sysadm_t self:process { setcurrent dyntransition };

The problem is that this setcon does not work. Audit launches a
dyntransition permission denied :

type=AVC msg=audit(1224660818.891:422): avc: denied { dyntransition }
for pid=18334 comm="prog" scontext=sysadm_u:sysadm_r:sysadm_t:s0:c2
tcontext=sysadm_u:sysadm_r:sysadm_t:s0:c1 tclass=process

It also seems impossible to return back to the original context s0:c1.c2
, once s0:c1 is reached

Is it possible to allow this transition?

Thanks you for helping a SElinux newbie

Regards,

Vince
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJJwn1CkDrToteDh0RAgtMAKC4N4YG9+VIB2u0NtEwYbpSXgvqzACdFc8u
1YhQzdQDTLNfq8hT1Kh0NZY=
=zYx5
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Context transition error

[Stephen Smalley]

On Fri, 2008-11-21 at 20:20 +0100, Vince Le Port wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Dear all,
> 
> I am working on a mean to change the nfs server context depending on the
> user who wants to access his files. I have planned to use MCS to do that.
> 
> Here is the approach for NFS:
> 
> Let us say, we have two users : client1 in s0:c1 and client2 in s0:c2
> If client1 wants to access his home directory mounted with NFS, then the
> NFS daemon will change his MCS category corresponding to the client MCS
> category
> That will limit the risk that client2 could access client1's files
> 
> Thus, for example my test program is launched in that context :
> sysadm_u:sysadm_r:sysadm_t:s0:c1.c2
> 
> Then that program makes a setcon in order to move into
> sysadm_u:sysadm_r:sysadm_t:s0:c1 and the following step is to move the
> program in that context sysadm_u:sysadm_r:sysadm_t:s0:c2
> 
> I have written the following semodule :
> 
> module localadmin 1.0;
> 
> require {
>         type sysadm_t;
>         class process setcurrent;
>         class process dyntransition;
> }
> 
> allow sysadm_t self:process { setcurrent dyntransition };
> 
> The problem is that this setcon does not work. Audit launches a
> dyntransition permission denied :
> 
> type=AVC msg=audit(1224660818.891:422): avc: denied { dyntransition }
> for pid=18334 comm="prog" scontext=sysadm_u:sysadm_r:sysadm_t:s0:c2
> tcontext=sysadm_u:sysadm_r:sysadm_t:s0:c1 tclass=process
> 
> It also seems impossible to return back to the original context s0:c1.c2
> , once s0:c1 is reached
> 
> Is it possible to allow this transition?
> 
> Thanks you for helping a SElinux newbie

The domain needs the mcssetcats attribute in order to pass the MCS
policy constraints.

You can use the mcs_process_set_categories() refpolicy interface if
building using the refpolicy infrastructure (i.e. yum install
selinux-policy-devel, make -f /usr/share/selinux/devel/Makefile
localadmin.pp).

I'm not sure what you are really planning to do though, as:
- obviously your program should not run in sysadm_t,
- The real processing for nfsd is handled by kernel threads, not a
userland process, and thus can change its credentials without going
through permission checks,
- you still need a mechanism of binding the client process security
context to the NFS request and conveying that to the server.

You may wish to have a look at the ongoing labeled NFS work:
http://selinuxproject.org/page/Labeled_NFS

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Context transition error

[Vince Le Port]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
> On Fri, 2008-11-21 at 20:20 +0100, Vince Le Port wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Dear all,
>>
>> I am working on a mean to change the nfs server context depending on the
>> user who wants to access his files. I have planned to use MCS to do that.
>>
>> Here is the approach for NFS:
>>
>> Let us say, we have two users : client1 in s0:c1 and client2 in s0:c2
>> If client1 wants to access his home directory mounted with NFS, then the
>> NFS daemon will change his MCS category corresponding to the client MCS
>> category
>> That will limit the risk that client2 could access client1's files
>>
>> Thus, for example my test program is launched in that context :
>> sysadm_u:sysadm_r:sysadm_t:s0:c1.c2
>>
>> Then that program makes a setcon in order to move into
>> sysadm_u:sysadm_r:sysadm_t:s0:c1 and the following step is to move the
>> program in that context sysadm_u:sysadm_r:sysadm_t:s0:c2
>>
>> I have written the following semodule :
>>
>> module localadmin 1.0;
>>
>> require {
>>         type sysadm_t;
>>         class process setcurrent;
>>         class process dyntransition;
>> }
>>
>> allow sysadm_t self:process { setcurrent dyntransition };
>>
>> The problem is that this setcon does not work. Audit launches a
>> dyntransition permission denied :
>>
>> type=AVC msg=audit(1224660818.891:422): avc: denied { dyntransition }
>> for pid=18334 comm="prog" scontext=sysadm_u:sysadm_r:sysadm_t:s0:c2
>> tcontext=sysadm_u:sysadm_r:sysadm_t:s0:c1 tclass=process
>>
>> It also seems impossible to return back to the original context s0:c1.c2
>> , once s0:c1 is reached
>>
>> Is it possible to allow this transition?
>>
>> Thanks you for helping a SElinux newbie
>
> The domain needs the mcssetcats attribute in order to pass the MCS
> policy constraints.
>
> You can use the mcs_process_set_categories() refpolicy interface if
> building using the refpolicy infrastructure (i.e. yum install
> selinux-policy-devel, make -f /usr/share/selinux/devel/Makefile
> localadmin.pp).
>
> I'm not sure what you are really planning to do though, as:
> - obviously your program should not run in sysadm_t,
> - The real processing for nfsd is handled by kernel threads, not a
> userland process, and thus can change its credentials without going
> through permission checks,
> - you still need a mechanism of binding the client process security
> context to the NFS request and conveying that to the server.
>
> You may wish to have a look at the ongoing labeled NFS work:
> http://selinuxproject.org/page/Labeled_NFS
>
Following your advice, I have created a dedicated domain for my app
which now transitions from myapp_exec_t to myapp_t when I execute it. It
seems more relevant than my previous idea.
The use of the interface mcs_process_set_categories() lets the
application change its categories perfectly.

My next step is to work on the mean to convey the user's context to the
server

Thank you for your anwser!
Regards,
Vince
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
 
iD8DBQFJKJgXCkDrToteDh0RAmiPAKCwC+t5Ii++HOgTZ2nHRBICEDpTywCeLxPE
xlGpLu8iS4UimkGmLkZyK94=
=bAvT
-----END PGP SIGNATURE-----


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Context transition error

[Vince Le Port]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 

> On Fri, 2008-11-21 at 20:20 +0100, Vince Le Port wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Dear all,
>>
>> I am working on a mean to change the nfs server context depending on the
>> user who wants to access his files. I have planned to use MCS to do that.
>>
>> Here is the approach for NFS:
>>
>> Let us say, we have two users : client1 in s0:c1 and client2 in s0:c2
>> If client1 wants to access his home directory mounted with NFS, then the
>> NFS daemon will change his MCS category corresponding to the client MCS
>> category
>> That will limit the risk that client2 could access client1's files
>>
>> Thus, for example my test program is launched in that context :
>> sysadm_u:sysadm_r:sysadm_t:s0:c1.c2
>>
>> Then that program makes a setcon in order to move into
>> sysadm_u:sysadm_r:sysadm_t:s0:c1 and the following step is to move the
>> program in that context sysadm_u:sysadm_r:sysadm_t:s0:c2
>>
>> I have written the following semodule :
>>
>> module localadmin 1.0;
>>
>> require {
>>         type sysadm_t;
>>         class process setcurrent;
>>         class process dyntransition;
>> }
>>
>> allow sysadm_t self:process { setcurrent dyntransition };
>>
>> The problem is that this setcon does not work. Audit launches a
>> dyntransition permission denied :
>>
>> type=AVC msg=audit(1224660818.891:422): avc: denied { dyntransition }
>> for pid=18334 comm="prog" scontext=sysadm_u:sysadm_r:sysadm_t:s0:c2
>> tcontext=sysadm_u:sysadm_r:sysadm_t:s0:c1 tclass=process
>>
>> It also seems impossible to return back to the original context s0:c1.c2
>> , once s0:c1 is reached
>>
>> Is it possible to allow this transition?
>>
>> Thanks you for helping a SElinux newbie
>
> The domain needs the mcssetcats attribute in order to pass the MCS
> policy constraints.
>
> You can use the mcs_process_set_categories() refpolicy interface if
> building using the refpolicy infrastructure (i.e. yum install
> selinux-policy-devel, make -f /usr/share/selinux/devel/Makefile
> localadmin.pp).
>
> I'm not sure what you are really planning to do though, as:
> - obviously your program should not run in sysadm_t,
> - The real processing for nfsd is handled by kernel threads, not a
> userland process, and thus can change its credentials without going
> through permission checks,
> - you still need a mechanism of binding the client process security
> context to the NFS request and conveying that to the server.
>
> You may wish to have a look at the ongoing labeled NFS work:
> http://selinuxproject.org/page/Labeled_NFS
>
Hi list,

Your answer helped me so much. I have succeeded in making my test
program running properly.

I am now working on the NFS server side modification.

I have made some searches around the use of setcon , and it seems that
this function is only available in the user space, not into the kernel.
Am I wrong saying that?

Does anybody know the equivalent of setcon in kernel mode?
Moreover I did not find the source code of the setcon function... where
could I find it ?

Regards,

Vince

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
 
iD8DBQFJNUk5CkDrToteDh0RAhMiAJ93nCGnsz9M/TK5XI91o+x9/v7TRgCgjARV
w4lfWN+fJbxHZM39foeOync=
=Ehls
-----END PGP SIGNATURE-----


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Context transition error

[Stephen Smalley]

On Tue, 2008-12-02 at 15:42 +0100, Vince Le Port wrote:
> Hi list,
> 
> Your answer helped me so much. I have succeeded in making my test
> program running properly.
> 
> I am now working on the NFS server side modification.
> 
> I have made some searches around the use of setcon , and it seems that
> this function is only available in the user space, not into the kernel.
> Am I wrong saying that?
> 
> Does anybody know the equivalent of setcon in kernel mode?
> Moreover I did not find the source code of the setcon function... where
> could I find it ?

setcon() is a library function provided by libselinux.
The equivalent of setcon() in the kernel is security_setprocattr() whose
prototype is defined in include/linux/security.h.

If you look at an earlier version of the labeled NFS patch set, you can
see an example of using security_setprocattr() to set the nfsd context
from the remote label:
http://marc.info/?l=selinux&m=122270951204108&w=2

As before, I'd encourage you to follow the ongoing labeled NFS work.  A
newer version of the patch set was just posted, although this omits the
process label transport mechanism since that is being redesigned.
http://marc.info/?l=selinux&m=122814925716620&w=2

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.