Re: systemd and rebooting

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> Currently there are no SE Linux access controls for reboot/halt/suspend/etc 
> running in a typical systemd configuration.  So any process that can talk to 
> the dbus system bus can reboot without SE Linux access controls.
>
> The problem is that reboot/halt type operations can be initiated through dbus 
> connections to either init or systemd-logind and the latter has no SE Linux 
> code.
>
> https://github.com/systemd/systemd/issues/34878
>
> The above URL has a systemd bug report.
>
> allow sysadm_t systemd_logind_t:system { halt reboot };
>
> The attached patch addresses this.  It's not a candidate for inclusion in 
> systemd upstream as it has duplicated code for SE Linux access checks but it 
> works and would be a starting point for someone who knows systemd better than 
> SE Linux.  The attached patch needs policy like the above.
>
> It would be possible to write a patch that checks access against the context 
> of pid 1 but I went for the most direct solution to the problem for at least 
> the first draft.
>
> https://github.com/systemd/systemd/issues?q=is%3Aissue+state%3Aopen+selinux
>
> As an aside there's more than a few SE Linux related bugs reported against 
> systemd if someone has experience with systemd hacking and interest in SE 
> Linux.  I would be happy to help with the SE Linux side of testing such 
> things.


I am not sure about this but I wanted to note:

https://github.com/systemd/systemd/pulls?q=is%3Apr+state%3Aopen+label%3Aselinux

There are various entries there that are stuck. Two notable ones:

https://github.com/systemd/systemd/pull/20387
https://github.com/systemd/systemd/pull/10023

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl