squid and apache

squid and apache

[Russell Coker]

apache_content_template(squid)

squid.te has the above in an optional section.

/usr/lib/squid/cachemgr\.cgi -- 
gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)

squid.fc has the above, but there is no facility for optional sections in fc 
files.

How should we solve this?

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 264 bytes --]

On 03/03/2010 12:07 AM, Russell Coker wrote:
<snip>
> How should we solve this?
> 

I Wrote a blog with my view on this issue here:

http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html

I am also interested in other views on this.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]

Re: squid and apache

[Daniel J Walsh]

On 03/03/2010 05:20 AM, Dominick Grift wrote:
> On 03/03/2010 12:07 AM, Russell Coker wrote:
> <snip>
>    
>> How should we solve this?
>>
>>      
> I Wrote a blog with my view on this issue here:
>
> http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
>
> I am also interested in other views on this.
>
>    
Dominic your example would not work since it would not have rules to 
handle apache content is not present.  What happens to you executable.

I am not sure this would work.
optional_policy(`
apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
',`
     gen_require(`
             type bin_t;
     ')
     typealias bin_t alias backuppc_admin_exec_t;
')


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Daniel J Walsh]

On 03/03/2010 10:08 AM, Daniel J Walsh wrote:
> On 03/03/2010 05:20 AM, Dominick Grift wrote:
>> On 03/03/2010 12:07 AM, Russell Coker wrote:
>> <snip>
>>> How should we solve this?
>>>
>> I Wrote a blog with my view on this issue here:
>>
>> http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
>>
>> I am also interested in other views on this.
>>
> Dominic your example would not work since it would not have rules to 
> handle apache content is not present.  What happens to you executable.
>
> I am not sure this would work.
> optional_policy(`
> apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
> ',`
>     gen_require(`
>             type bin_t;
>     ')
>     typealias bin_t alias backuppc_admin_exec_t;
> ')
>
>
> -- 
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
I do like the idea of the blog though.  But it is a little harder then 
just what you suggest.

Since you will loose httpd_backuppc_content_*t definitions.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Christopher J. PeBenito]

On Wed, 2010-03-03 at 10:08 -0500, Daniel J Walsh wrote:
> On 03/03/2010 05:20 AM, Dominick Grift wrote:
> > On 03/03/2010 12:07 AM, Russell Coker wrote:
> > <snip>
> >    
> >> How should we solve this?
> >>
> >>      
> > I Wrote a blog with my view on this issue here:
> >
> > http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
> >
> > I am also interested in other views on this.
> >
> >    
> Dominic your example would not work since it would not have rules to 
> handle apache content is not present.  What happens to you executable.
> 
> I am not sure this would work.
> optional_policy(`
> apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
> ',`
>      gen_require(`
>              type bin_t;
>      ')
>      typealias bin_t alias backuppc_admin_exec_t;
> ')

That won't work because you can't put require blocks in the else block
of an optional.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Daniel J Walsh]

On 03/03/2010 11:01 AM, Christopher J. PeBenito wrote:
> On Wed, 2010-03-03 at 10:08 -0500, Daniel J Walsh wrote:
>    
>> On 03/03/2010 05:20 AM, Dominick Grift wrote:
>>      
>>> On 03/03/2010 12:07 AM, Russell Coker wrote:
>>> <snip>
>>>
>>>        
>>>> How should we solve this?
>>>>
>>>>
>>>>          
>>> I Wrote a blog with my view on this issue here:
>>>
>>> http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
>>>
>>> I am also interested in other views on this.
>>>
>>>
>>>        
>> Dominic your example would not work since it would not have rules to
>> handle apache content is not present.  What happens to you executable.
>>
>> I am not sure this would work.
>> optional_policy(`
>> apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
>> ',`
>>       gen_require(`
>>               type bin_t;
>>       ')
>>       typealias bin_t alias backuppc_admin_exec_t;
>> ')
>>      
> That won't work because you can't put require blocks in the else block
> of an optional.
>
>    
Could you fool the compiler by putting an interface with a gen_require

corecmd_bin_alias(backuppc_admin_exec_t)

Probably not.




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Caleb Case]

On Wed, Mar 3, 2010 at 11:01 AM, Christopher J. PeBenito
<cpebenito@tresys.com> wrote:
>
> On Wed, 2010-03-03 at 10:08 -0500, Daniel J Walsh wrote:
> > On 03/03/2010 05:20 AM, Dominick Grift wrote:
> > > On 03/03/2010 12:07 AM, Russell Coker wrote:
> > > <snip>
> > >
> > >> How should we solve this?
> > >>
> > >>
> > > I Wrote a blog with my view on this issue here:
> > >
> > > http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
> > >
> > > I am also interested in other views on this.
> > >
> > >
> > Dominic your example would not work since it would not have rules to
> > handle apache content is not present.  What happens to you executable.
> >
> > I am not sure this would work.
> > optional_policy(`
> > apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
> > ',`
> >      gen_require(`
> >              type bin_t;
> >      ')
> >      typealias bin_t alias backuppc_admin_exec_t;
> > ')
>
> That won't work because you can't put require blocks in the else block
> of an optional.
>

Thought I'd mention that the proposed CIL would alleviate this problem
since it allows you to put FC statements in the policy (and in
conditional statements). For example:

# if the squid block exists (i.e., the squid module is in the policy)
IF (? /(BLOCK squid)) {
  # call the apache block with the squid type
  CALL /(BLOCK apache_content_template) (TYPE squid)

  # label the squid cache manager
  LABEL (PATH:FILE (PATH:REGEX "/usr/lib/squid/cachemgr\.cgi")
(PATH:FILETYPE "--")) {
     USER system
     ROLE object
     TYPE squid_script_exec
     RANGE (LEVEL s0)
  }
}

The syntax is probably going to be changed at some point, but this
does illustrate the general concept that labeling is part of the
policy language proper and can be used in conditionals.

Caleb


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Daniel J Walsh]

On 03/03/2010 11:24 AM, Caleb Case wrote:
> On Wed, Mar 3, 2010 at 11:01 AM, Christopher J. PeBenito
> <cpebenito@tresys.com>  wrote:
>    
>> On Wed, 2010-03-03 at 10:08 -0500, Daniel J Walsh wrote:
>>      
>>> On 03/03/2010 05:20 AM, Dominick Grift wrote:
>>>        
>>>> On 03/03/2010 12:07 AM, Russell Coker wrote:
>>>> <snip>
>>>>
>>>>          
>>>>> How should we solve this?
>>>>>
>>>>>
>>>>>            
>>>> I Wrote a blog with my view on this issue here:
>>>>
>>>> http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
>>>>
>>>> I am also interested in other views on this.
>>>>
>>>>
>>>>          
>>> Dominic your example would not work since it would not have rules to
>>> handle apache content is not present.  What happens to you executable.
>>>
>>> I am not sure this would work.
>>> optional_policy(`
>>> apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)
>>> ',`
>>>       gen_require(`
>>>               type bin_t;
>>>       ')
>>>       typealias bin_t alias backuppc_admin_exec_t;
>>> ')
>>>        
>> That won't work because you can't put require blocks in the else block
>> of an optional.
>>
>>      
> Thought I'd mention that the proposed CIL would alleviate this problem
> since it allows you to put FC statements in the policy (and in
> conditional statements). For example:
>
> # if the squid block exists (i.e., the squid module is in the policy)
> IF (? /(BLOCK squid)) {
>    # call the apache block with the squid type
>    CALL /(BLOCK apache_content_template) (TYPE squid)
>
>    # label the squid cache manager
>    LABEL (PATH:FILE (PATH:REGEX "/usr/lib/squid/cachemgr\.cgi")
> (PATH:FILETYPE "--")) {
>       USER system
>       ROLE object
>       TYPE squid_script_exec
>       RANGE (LEVEL s0)
>    }
> }
>
> The syntax is probably going to be changed at some point, but this
> does illustrate the general concept that labeling is part of the
> policy language proper and can be used in conditionals.
>
> Caleb
>    
Well since you brought it up,   I believe there should be an alias in here.

So if this policy is installed you have squid_script_exec_t otherwise 
alias all files to bin_t.  So the system can work if the policy is 
enabled or disabled.


All file types defined in policy  should have an alias for enabled and 
disabled policy.

Even if they default to default_t.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: squid and apache

[Russell Coker]

[-- Attachment #1: Type: text/plain, Size: 510 bytes --]

On Wed, 3 Mar 2010, Dominick Grift <domg472@gmail.com> wrote:
> On 03/03/2010 12:07 AM, Russell Coker wrote:
> <snip>
>
> > How should we solve this?
>
> I Wrote a blog with my view on this issue here:
>
> http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html
>
> I am also interested in other views on this.

I've attached the patch I'm using for Debian/Squeeze.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog

[-- Attachment #2: diff.gz --]
[-- Type: application/x-gzip, Size: 1251 bytes --]