MLS over loopback interface

MLS over loopback interface

[Langland, Blake]

[-- Attachment #1: Type: text/plain, Size: 523 bytes --]

All,

I have two web servers running on an SELinux machine, one running at s2 and one at s3. Both webservers have two webapps each that are attempting to communicate over the loopback interface. The communication is strictly s2 <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of the loopback interface. If I have it set below s3, the s3 webapps cannot send over the interface; If I have it set higher than s2, the s2 webapps cannot receive over the interface. Any suggestions?

Thanks,
Blake


[-- Attachment #2: Type: text/html, Size: 2343 bytes --]

Re: MLS over loopback interface

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/10/2013 01:12 PM, Langland, Blake wrote:
> All,
> 
> 
> 
> I have two web servers running on an SELinux machine, one running at s2 and
> one at s3. Both webservers have two webapps each that are attempting to
> communicate over the loopback interface. The communication is strictly s2
> <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of
> the loopback interface. If I have it set below s3, the s3 webapps cannot
> send over the interface; If I have it set higher than s2, the s2 webapps
> cannot receive over the interface. Any suggestions?
> 
> 
> 
> Thanks,
> 
> Blake
> 
> 
> 
Can you use different IPs?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlJW4iYACgkQrlYvE4MpobMc1QCaAijG8RkFSSZwQWA8wRRFCDQp
yA0AoI2G1wnsqXvFfpQWZHs9rN+HQmnC
=QCOC
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: MLS over loopback interface

[William Roberts]

[-- Attachment #1: Type: text/plain, Size: 794 bytes --]

set it as:  s2,s3 (if you can even do that not sure if it works like cats)


On Thu, Oct 10, 2013 at 1:12 PM, Langland, Blake <
blangland@integrity-apps.com> wrote:

>  All,****
>
> ** **
>
> I have two web servers running on an SELinux machine, one running at s2
> and one at s3. Both webservers have two webapps each that are attempting to
> communicate over the loopback interface. The communication is strictly s2
> <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of
> the loopback interface. If I have it set below s3, the s3 webapps cannot
> send over the interface; If I have it set higher than s2, the s2 webapps
> cannot receive over the interface. Any suggestions?****
>
> ** **
>
> Thanks,****
>
> Blake****
>
> ** **
>



-- 
Respectfully,

William C Roberts

[-- Attachment #2: Type: text/html, Size: 1451 bytes --]

Re: MLS over loopback interface

[Stephen Smalley]

On 10/10/2013 01:31 PM, William Roberts wrote:
> set it as:  s2,s3 (if you can even do that not sure if it works like cats)

No, can't do that with sensitivities.

> 
> 
> On Thu, Oct 10, 2013 at 1:12 PM, Langland, Blake <
> blangland@integrity-apps.com> wrote:
> 
>>  All,****
>>
>> ** **
>>
>> I have two web servers running on an SELinux machine, one running at s2
>> and one at s3. Both webservers have two webapps each that are attempting to
>> communicate over the loopback interface. The communication is strictly s2
>> <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of
>> the loopback interface. If I have it set below s3, the s3 webapps cannot
>> send over the interface; If I have it set higher than s2, the s2 webapps
>> cannot receive over the interface. Any suggestions?****
>>
>> ** **
>>
>> Thanks,****
>>
>> Blake****
>>
>> ** **
>>
> 
> 
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: MLS over loopback interface

[Stephen Smalley]

On 10/10/2013 01:12 PM, Langland, Blake wrote:
> All,
> 
> I have two web servers running on an SELinux machine, one running at s2 and one at s3. Both webservers have two webapps each that are attempting to communicate over the loopback interface. The communication is strictly s2 <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of the loopback interface. If I have it set below s3, the s3 webapps cannot send over the interface; If I have it set higher than s2, the s2 webapps cannot receive over the interface. Any suggestions?

Can you clarify exactly what avc denials you are getting?
Kernel version?
network_peer_controls enabled or disabled?

I don't see a mlstrustedobject-like exemption in the netif constraints
in refpolicy/policy/mls, so you can't just make the loopback netif type
a mlstrustedobject to exempt it.

I do however see that if you apply mls_net_write_within_range() to the
web server domains and if you put a range on the interface that covers
both levels, then it should pass the mls constraint in policy/mls.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: MLS over loopback interface

[Langland, Blake]

Thanks for the replies. Here is an example of the AVC:

avc: denied { egress } for pid=2472 comm="java" saddr=192.168.25.102 src=60447 daddr=192.168.25.102 dest=8443 netif=lo scontext=user_s:user_r:user_java_t:s3 tcontext=system_u:object_r:lo_netif_t:s2 tclass=netif

(The opposite would be an ingress with user_java_t:s2 and lo_netif_t:s3)
Network peer labeling is netlabel.
Kernel Version: 2.6.32-279.el6.x86_64

I will try the suggestion of mls_net_write_within_range(), I'm still getting a hang of what uses the ranges have vs a single sensitivity.

Thanks again!
Blake




-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov] 
Sent: Thursday, October 10, 2013 12:03 PM
To: Langland, Blake
Cc: selinux@tycho.nsa.gov
Subject: Re: MLS over loopback interface

On 10/10/2013 01:12 PM, Langland, Blake wrote:
> All,
> 
> I have two web servers running on an SELinux machine, one running at s2 and one at s3. Both webservers have two webapps each that are attempting to communicate over the loopback interface. The communication is strictly s2 <-> s2 and s3 <-> s3. The problem I am having is setting the MLS level of the loopback interface. If I have it set below s3, the s3 webapps cannot send over the interface; If I have it set higher than s2, the s2 webapps cannot receive over the interface. Any suggestions?

Can you clarify exactly what avc denials you are getting?
Kernel version?
network_peer_controls enabled or disabled?

I don't see a mlstrustedobject-like exemption in the netif constraints in refpolicy/policy/mls, so you can't just make the loopback netif type a mlstrustedobject to exempt it.

I do however see that if you apply mls_net_write_within_range() to the web server domains and if you put a range on the interface that covers both levels, then it should pass the mls constraint in policy/mls.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: MLS over loopback interface

[Stephen Smalley]

On 10/10/2013 04:34 PM, Langland, Blake wrote:
> Thanks for the replies. Here is an example of the AVC:
> 
> avc: denied { egress } for pid=2472 comm="java" saddr=192.168.25.102 src=60447 daddr=192.168.25.102 dest=8443 netif=lo scontext=user_s:user_r:user_java_t:s3 tcontext=system_u:object_r:lo_netif_t:s2 tclass=netif
> 
> (The opposite would be an ingress with user_java_t:s2 and lo_netif_t:s3)
> Network peer labeling is netlabel.
> Kernel Version: 2.6.32-279.el6.x86_64
> 
> I will try the suggestion of mls_net_write_within_range(), I'm still getting a hang of what uses the ranges have vs a single sensitivity.

So, then you also need to make the interface ranged rather than
single-level, e.g. s2-s3 or s0-s15:c0.c1024 if you want it to cover
everything.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.