booting in enforcing mode

booting in enforcing mode

[Rogelio Serrano]

I can boot in enforcing mode now but there seem to be too many 
denials in my log. Which denials can be considered harmless? i 
can see a lot of ioctl, sys_tty_config and getattr.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Russell Coker]

On Sat, 10 Apr 2004 17:10, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> I can boot in enforcing mode now but there seem to be too many
> denials in my log. Which denials can be considered harmless? i
> can see a lot of ioctl, sys_tty_config and getattr.

Show us a sample of the messages.

When determining whether the denials are harmless it's usually a matter of the 
scontext and tcontext.

As for sys_tty_config, in the transition to kernel 2.6.x the handling of this 
changed and lots of applications need it.  I've considered having the 
daemon_base_domain() macro allow or dontaudit it.  Most applications that 
request it don't seem to really need it (they work fine without it).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

On 2004-04-10 22:22:59 +0800 Russell Coker 
<russell@coker.com.au> wrote:

> On Sat, 10 Apr 2004 17:10, Rogelio Serrano 
> <rogelio@smsglobal.net> wrote:
>> I can boot in enforcing mode now but there seem to be too many
>> denials in my log. Which denials can be considered harmless? i
>> can see a lot of ioctl, sys_tty_config and getattr.
> 
> Show us a sample of the messages.
> 
> When determining whether the denials are harmless it's usually 
> a matter of 
> the scontext and tcontext.
> 
> As for sys_tty_config, in the transition to kernel 2.6.x the 
> handling of this 
> changed and lots of applications need it.  I've considered 
> having the 
> daemon_base_domain() macro allow or dontaudit it.  Most 
> applications that 
> request it don't seem to really need it (they work fine 
> without it).
> 

I see. I think i have to remove some of those that i added. the 
hotplug scripts are the noisiest. i will fix /bin/login first. 
its the login fom util-linux 2.12 and im not using PAM. i need 
to label the tty properly. i can login but not into 
/User/Admin. login drops me into / then i can just "cd" and im 
in sysadm_home_dir. all home directories are in /Users and 
admins home dir is /Users/Admin alongside the other users. The 
context for /Users is system_u:object_r:file_t. Is that ok? 
Shouldnt it be root_t? Or should i create a totally new type.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

On 2004-04-10 22:53:17 +0800 Rogelio Serrano 
<rogelio@smsglobal.net> wrote:

> On 2004-04-10 22:22:59 +0800 Russell Coker 
> <russell@coker.com.au> wrote:
> 
>> On Sat, 10 Apr 2004 17:10, Rogelio Serrano 
>> <rogelio@smsglobal.net> wrote:
>>> I can boot in enforcing mode now but there seem to be too 
>>> many
>>> denials in my log. Which denials can be considered harmless? 
>>> i
>>> can see a lot of ioctl, sys_tty_config and getattr.
>> 
>> Show us a sample of the messages.
>> 
>> When determining whether the denials are harmless it's 
>> usually a matter of 
>> the scontext and tcontext.
>> 
>> As for sys_tty_config, in the transition to kernel 2.6.x the 
>> handling of 
>> this changed and lots of applications need it.  I've 
>> considered having the 
>> daemon_base_domain() macro allow or dontaudit it.  Most 
>> applications that 
>> request it don't seem to really need it (they work fine 
>> without it).
>> 
> 
> I see. I think i have to remove some of those that i added. 
> the hotplug 
> scripts are the noisiest. i will fix /bin/login first. its the 
> login fom 
> util-linux 2.12 and im not using PAM. i need to label the tty 
> properly. i can 
> login but not into /User/Admin. login drops me into / then i 
> can just "cd" 
> and im in sysadm_home_dir. all home directories are in /Users 
> and admins home 
> dir is /Users/Admin alongside the other users. The context for 
> /Users is 
> system_u:object_r:file_t. Is that ok? Shouldnt it be root_t? 
> Or should i 
> create a totally new type.
> 
> 
> 
> --
> This message was distributed to subscribers of the selinux 
> mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 

^[The problem was fixed by setting /Users to 
system_u:object_r:home_root_t.
The denials are all harmless. Im rebuilding the system from 
scratch in enforcing mode now. This will be a good test of the 
policy. I rewrote mount, syslogd, and klogd to have the bare 
minimum priviledges. Im going to rewrite init next. im looking 
for a bash replacement its incredibly noisy. maybe its time to 
stop using boot scripts.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Russell Coker]

On Sun, 11 Apr 2004 00:53, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> I see. I think i have to remove some of those that i added. the
> hotplug scripts are the noisiest. i will fix /bin/login first.
> its the login fom util-linux 2.12 and im not using PAM. i need

Not using PAM is a problem.  I have written policy to prevent /bin/login from 
accessing /etc/shadow directly.  When using PAM the helper program 
unix_chkpwd is granted read access to /etc/shadow and /bin/login will spawn 
unic_chkpwd to check the password.

When not using PAM you would have to put the following in login.te:
allow $1_login_t shadow_t:file { getattr read };

Then in the domain declaration change auth_chkpwd to auth.

> to label the tty properly. i can login but not into

That's another thing, if you use a non-PAM login program then you have to 
patch it to relabel the tty.

I think that an option to consider is using pam-login.  It's source code is 
apparently very clean, partly because it's only designed to use PAM and has 
no options for doing other things.

> /User/Admin. login drops me into / then i can just "cd" and im
> in sysadm_home_dir. all home directories are in /Users and
> admins home dir is /Users/Admin alongside the other users. The
> context for /Users is system_u:object_r:file_t. Is that ok?
> Shouldnt it be root_t? Or should i create a totally new type.

Best thing to do would be sed -e s/^\/home\//\/Users\// on the file_contexts 
file.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Russell Coker]

On Sun, 11 Apr 2004 03:28, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> I rewrote mount, syslogd, and klogd to have the bare
> minimum priviledges.

What did you change?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

On 2004-04-11 18:23:36 +0800 Russell Coker 
<russell@coker.com.au> wrote:

> On Sun, 11 Apr 2004 03:28, Rogelio Serrano 
> <rogelio@smsglobal.net> wrote:
>> I rewrote mount, syslogd, and klogd to have the bare
>> minimum priviledges.
> 
> What did you change?
> 

Im using an lfs derived distro. it uses uClibc.

These are all my own versions of those utilities. useful only 
from boot scripts. mount is just a wrapper around the mount 
syscall. and unmount also a wrapper around the unmount syscall. 
they dont need fstab or /proc/mounts. the original versions are 
causing too much noise in the logs. i was having lot of 
difficulty customizing the policy. i was reading the source 
code to find out which permissions were needed and which were 
not. i found the original programs to be too complicated for me 
to read so I rewrote the easy to rewrite programs so i can 
focus on init, login and agetty.

im using busybox for most of the network stuff and logging. in 
enforcing mode i was having a lot of difficulty to run syslogd 
in the proper context. i was having difficulty with the busybox 
code so i ripped out the relevant parts and built my own 
syslogd from that. same for klogd. i then tested these programs 
and took out some code that caused problems.

Im developing a non standard system. so i can not use the 
setools. my only option is to use very simple programs that are 
easy to audit  and match to the policy which is a stripped down 
version of the default policy.

One area im having a lot irritation with is the hotplug 
scripts. everytime they run bash opens /proc/kmem /dev/random 
/dev/pts /dev/ptmx and countless other devices and files that 
is not even mentioned anywhere in the relevant sources. now i 
dont know which to allow and which to deny. so now im going to 
write small prgrams to replace the scripts.

over all my strategy is to replace or customise programs to 
conform to an extermely stringent policy.  seems fater that 
way.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

On 2004-04-11 18:23:07 +0800 Russell Coker 
<russell@coker.com.au> wrote:

> On Sun, 11 Apr 2004 00:53, Rogelio Serrano 
> <rogelio@smsglobal.net> wrote:
>> I see. I think i have to remove some of those that i added. 
>> the
>> hotplug scripts are the noisiest. i will fix /bin/login first.
>> its the login fom util-linux 2.12 and im not using PAM. i need
> 
> Not using PAM is a problem.  I have written policy to prevent 
> /bin/login from 
> accessing /etc/shadow directly.  When using PAM the helper 
> program 
> unix_chkpwd is granted read access to /etc/shadow and 
> /bin/login will spawn 
> unic_chkpwd to check the password.
> 
> When not using PAM you would have to put the following in 
> login.te:
> allow $1_login_t shadow_t:file { getattr read };
> 
> Then in the domain declaration change auth_chkpwd to auth.
> 
>> to label the tty properly. i can login but not into
> 
> That's another thing, if you use a non-PAM login program then 
> you have to 
> patch it to relabel the tty.
> 
> I think that an option to consider is using pam-login.  It's 
> source code is 
> apparently very clean, partly because it's only designed to 
> use PAM and has 
> no options for doing other things.
> 
>> /User/Admin. login drops me into / then i can just "cd" and im
>> in sysadm_home_dir. all home directories are in /Users and
>> admins home dir is /Users/Admin alongside the other users. The
>> context for /Users is system_u:object_r:file_t. Is that ok?
>> Shouldnt it be root_t? Or should i create a totally new type.
> 
> Best thing to do would be sed -e s/^\/home\//\/Users\// on the 
> file_contexts 
> file.
> 

Im not using shadow too. i fixed up the login though. it 
behaves like pam login now.
just to clarify im not using a standard distro. im using an lfs 
knock off.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

> I think that an option to consider is using pam-login.  It's 
> source code is 
> apparently very clean, partly because it's only designed to 
> use PAM and has 
> no options for doing other things.
> 

I checked it out. I might use PAM after all. Thanks.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Russell Coker]

On Sun, 11 Apr 2004 23:35, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> >> I rewrote mount, syslogd, and klogd to have the bare
> >> minimum priviledges.
> >
> > What did you change?
>
> Im using an lfs derived distro. it uses uClibc.
>
> These are all my own versions of those utilities. useful only
> from boot scripts. mount is just a wrapper around the mount
> syscall. and unmount also a wrapper around the unmount syscall.
> they dont need fstab or /proc/mounts. the original versions are
> causing too much noise in the logs. i was having lot of

Reading a file of type etc_t is not going to do any great harm.  Almost 
everything has read access to such files (think of all the things that break 
if /etc/passwd is not readable).

If I made it a tunable for whether /proc/mounts and /etc/mtab are accessible 
would that satisfy your needs?  I really want to keep everyone on the same 
policy tree as much as possible.  That will allow you to upgrade to newer 
releases of SE Linux with less effort and also allow me to incorporate any 
improvements you make without any difficulty.

> im using busybox for most of the network stuff and logging. in
> enforcing mode i was having a lot of difficulty to run syslogd
> in the proper context.

You might want to read my previous messages on this topic to this list, and 
the paper I presented at OLS 2003 on running SE Linux on an iPaQ.

> i was having difficulty with the busybox 
> code so i ripped out the relevant parts and built my own
> syslogd from that. same for klogd. i then tested these programs
> and took out some code that caused problems.

My conclusion was that doing such things was best.  I think that having 
syslogd and klogd running in different domains provides minimal benefit and 
for a small machine you might want to combine them (the policy supports this 
if you remove klogd.te).

> One area im having a lot irritation with is the hotplug
> scripts. everytime they run bash opens /proc/kmem /dev/random
> /dev/pts /dev/ptmx and countless other devices and files that
> is not even mentioned anywhere in the relevant sources. now i
> dont know which to allow and which to deny. so now im going to
> write small prgrams to replace the scripts.

Shell scripts always require access to more things than they should.  One 
thing you might investigate is using a smaller shell than bash.  Shells with 
less features request less access to the system...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Rogelio Serrano]

On 2004-04-12 14:37:57 +0800 Russell Coker 
<russell@coker.com.au> wrote:

> On Sun, 11 Apr 2004 23:35, Rogelio Serrano 
> <rogelio@smsglobal.net> wrote:
>>>> I rewrote mount, syslogd, and klogd to have the bare
>>>> minimum priviledges.
>>> 
>>> What did you change?
>> 
>> Im using an lfs derived distro. it uses uClibc.
>> 
>> These are all my own versions of those utilities. useful only
>> from boot scripts. mount is just a wrapper around the mount
>> syscall. and unmount also a wrapper around the unmount 
>> syscall.
>> they dont need fstab or /proc/mounts. the original versions 
>> are
>> causing too much noise in the logs. i was having lot of
> 
> Reading a file of type etc_t is not going to do any great 
> harm.  Almost 
> everything has read access to such files (think of all the 
> things that break 
> if /etc/passwd is not readable).
> 

i see. im considering a config file for remount. thats what i 
call the mount replacement now. im very happy with the 
replacements actually.

> If I made it a tunable for whether /proc/mounts and /etc/mtab 
> are accessible 
> would that satisfy your needs?  I really want to keep everyone 
> on the same 
> policy tree as much as possible.  That will allow you to 
> upgrade to newer 
> releases of SE Linux with less effort and also allow me to 
> incorporate any 
> improvements you make without any difficulty.
> 

I think thats a good idea.
I understand.
Im going to download the policy snapshot from your website. I 
think its better than the default policy from selinux-usr.

>> im using busybox for most of the network stuff and logging. in
>> enforcing mode i was having a lot of difficulty to run syslogd
>> in the proper context.
> 
> You might want to read my previous messages on this topic to 
> this list, and 
> the paper I presented at OLS 2003 on running SE Linux on an 
> iPaQ.
> 
>> i was having difficulty with the busybox code so i ripped out 
>> the relevant 
>> parts and built my own
>> syslogd from that. same for klogd. i then tested these 
>> programs
>> and took out some code that caused problems.
> 
> My conclusion was that doing such things was best.  I think 
> that having 
> syslogd and klogd running in different domains provides 
> minimal benefit and 
> for a small machine you might want to combine them (the policy 
> supports this 
> if you remove klogd.te).
> 

Well klogd is reading from /proc kmsg and syslogd from 
/dev/log. I will need to keep them separate. The system is 
going to be used on both big and small "machines".

This is in flux right now because i am studying runit, minit, 
quickinit and upstart. I want to combine the best features of 
these init implementations. The logging subsystem is going to 
be closely integrated with init. i particularly like quickinit 
and the supervision and logging concept of runit...

>> One area im having a lot irritation with is the hotplug
>> scripts. everytime they run bash opens /proc/kmem /dev/random
>> /dev/pts /dev/ptmx and countless other devices and files that
>> is not even mentioned anywhere in the relevant sources. now i
>> dont know which to allow and which to deny. so now im going to
>> write small prgrams to replace the scripts.
> 
> Shell scripts always require access to more things than they 
> should.  One 
> thing you might investigate is using a smaller shell than 
> bash.  Shells with 
> less features request less access to the system...
> 

im going to do that. im going to try minix shell, ash and pdksh.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: booting in enforcing mode

[Russell Coker]

On Mon, 12 Apr 2004 17:10, Rogelio Serrano <rogelio@smsglobal.net> wrote:
> I think thats a good idea.
> I understand.
> Im going to download the policy snapshot from your website. I
> think its better than the default policy from selinux-usr.

The policy snapshot on my site is out of date, I haven't updated it for a 
while and lots of new things have gone into the latest NSA release.  I don't 
recommend my snapshot at the moment.

> Well klogd is reading from /proc kmsg and syslogd from
> /dev/log. I will need to keep them separate. The system is
> going to be used on both big and small "machines".

For big machines it's best to keep them separate.  For small machines you can 
save some disk space and RAM by using the same executable for both.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.