* dbus reading /proc/X/cmdline
@ 2009-03-04 12:09 Russell Coker
2009-03-04 14:00 ` Stephen Smalley
0 siblings, 1 reply; 5+ messages in thread
From: Russell Coker @ 2009-03-04 12:09 UTC (permalink / raw)
To: SE-Linux
Why does the dbus-daemon want to read the cmdline of every process that it
talks to? Is it something to allow or dontaudit? It appears to work without
allowing it.
type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
comm="dbus-daemon" name="2874" dev=proc ino=12535
scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
comm="dbus-daemon" name="cmdline" dev=proc ino=12536
scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
exe="/usr/bin/dbus-daemon"
subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
--
russell@coker.com.au
http://etbe.coker.com.au/ My Main Blog
http://doc.coker.com.au/ My Documents Blog
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: dbus reading /proc/X/cmdline
2009-03-04 12:09 dbus reading /proc/X/cmdline Russell Coker
@ 2009-03-04 14:00 ` Stephen Smalley
2009-03-04 15:45 ` Daniel J Walsh
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Smalley @ 2009-03-04 14:00 UTC (permalink / raw)
To: russell; +Cc: SE-Linux
On Wed, 2009-03-04 at 23:09 +1100, Russell Coker wrote:
> Why does the dbus-daemon want to read the cmdline of every process that it
> talks to? Is it something to allow or dontaudit? It appears to work without
> allowing it.
>
> type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
> comm="dbus-daemon" name="2874" dev=proc ino=12535
> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
> type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
> comm="dbus-daemon" name="cmdline" dev=proc ino=12536
> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
> type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
> exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
> auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
> fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
> exe="/usr/bin/dbus-daemon"
> subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
It appears to fetch that information for logging purposes (comm= field).
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: dbus reading /proc/X/cmdline
2009-03-04 14:00 ` Stephen Smalley
@ 2009-03-04 15:45 ` Daniel J Walsh
2009-03-04 16:25 ` Stephen Smalley
0 siblings, 1 reply; 5+ messages in thread
From: Daniel J Walsh @ 2009-03-04 15:45 UTC (permalink / raw)
To: Stephen Smalley; +Cc: russell, SE-Linux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Stephen Smalley wrote:
> On Wed, 2009-03-04 at 23:09 +1100, Russell Coker wrote:
>> Why does the dbus-daemon want to read the cmdline of every process that it
>> talks to? Is it something to allow or dontaudit? It appears to work without
>> allowing it.
>>
>> type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
>> comm="dbus-daemon" name="2874" dev=proc ino=12535
>> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
>> type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
>> comm="dbus-daemon" name="cmdline" dev=proc ino=12536
>> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
>> type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
>> exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
>> auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
>> fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
>> exe="/usr/bin/dbus-daemon"
>> subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
>
> It appears to fetch that information for logging purposes (comm= field).
>
dbus also has the ability to state that an executable is the only one
that is able to communicate over it. Not very secure. But it is there.
I can put in the config that only /usr/libexec/nm-applet is able to
communicate with network-manager.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkmuoiQACgkQrlYvE4MpobM/JgCgzin1pYFSKS4ka2sdpbstaMxf
plcAoOLQSrfWgeoOHjwDtc+CFm4Btzfa
=xCKi
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: dbus reading /proc/X/cmdline
2009-03-04 15:45 ` Daniel J Walsh
@ 2009-03-04 16:25 ` Stephen Smalley
2009-03-04 16:52 ` Daniel J Walsh
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Smalley @ 2009-03-04 16:25 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: russell, SE-Linux
On Wed, 2009-03-04 at 10:45 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Stephen Smalley wrote:
> > On Wed, 2009-03-04 at 23:09 +1100, Russell Coker wrote:
> >> Why does the dbus-daemon want to read the cmdline of every process that it
> >> talks to? Is it something to allow or dontaudit? It appears to work without
> >> allowing it.
> >>
> >> type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
> >> comm="dbus-daemon" name="2874" dev=proc ino=12535
> >> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
> >> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
> >> type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
> >> comm="dbus-daemon" name="cmdline" dev=proc ino=12536
> >> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
> >> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
> >> type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
> >> exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
> >> auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
> >> fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
> >> exe="/usr/bin/dbus-daemon"
> >> subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
> >
> > It appears to fetch that information for logging purposes (comm= field).
> >
> dbus also has the ability to state that an executable is the only one
> that is able to communicate over it. Not very secure. But it is there.
>
> I can put in the config that only /usr/libexec/nm-applet is able to
> communicate with network-manager.
That sort of restriction should be implemented based on SELinux domains
rather than program name. Just a matter of defining policy for the
client programs and configuring the dbus policy appropriately.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: dbus reading /proc/X/cmdline
2009-03-04 16:25 ` Stephen Smalley
@ 2009-03-04 16:52 ` Daniel J Walsh
0 siblings, 0 replies; 5+ messages in thread
From: Daniel J Walsh @ 2009-03-04 16:52 UTC (permalink / raw)
To: Stephen Smalley; +Cc: russell, SE-Linux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Stephen Smalley wrote:
> On Wed, 2009-03-04 at 10:45 -0500, Daniel J Walsh wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Stephen Smalley wrote:
>>> On Wed, 2009-03-04 at 23:09 +1100, Russell Coker wrote:
>>>> Why does the dbus-daemon want to read the cmdline of every process that it
>>>> talks to? Is it something to allow or dontaudit? It appears to work without
>>>> allowing it.
>>>>
>>>> type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
>>>> comm="dbus-daemon" name="2874" dev=proc ino=12535
>>>> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
>>>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
>>>> type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
>>>> comm="dbus-daemon" name="cmdline" dev=proc ino=12536
>>>> scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
>>>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
>>>> type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
>>>> exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
>>>> auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
>>>> fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
>>>> exe="/usr/bin/dbus-daemon"
>>>> subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
>>> It appears to fetch that information for logging purposes (comm= field).
>>>
>> dbus also has the ability to state that an executable is the only one
>> that is able to communicate over it. Not very secure. But it is there.
>>
>> I can put in the config that only /usr/libexec/nm-applet is able to
>> communicate with network-manager.
>
> That sort of restriction should be implemented based on SELinux domains
> rather than program name. Just a matter of defining policy for the
> client programs and configuring the dbus policy appropriately.
>
Yes it has that ability also.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkmuscgACgkQrlYvE4MpobN8PwCg1Zasmiulh2hKqPPSm86ggZq0
k0wAoNvJZyCrTIs+etf9ZLbHGdMjbHiP
=2HM4
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-03-04 16:52 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-03-04 12:09 dbus reading /proc/X/cmdline Russell Coker
2009-03-04 14:00 ` Stephen Smalley
2009-03-04 15:45 ` Daniel J Walsh
2009-03-04 16:25 ` Stephen Smalley
2009-03-04 16:52 ` Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.