Re: Defining SELinux users, "Unable to get valid context...". Help!

[Dominick Grift <dominick.grift@defensec.nl>]

Peter Whittaker <peterwhittaker@sphyrnasecurity.com> writes:

> Good afternoon,
>
>     BLUF: Logging in via SSH or directly at the console results
>     in "Unable to get valid context...". Help! Much info included.
>
> I'm working on a software diode implementing a linear assured pipeline
> which is secured with SELinux. As part of this, I am defining a number
> of SELinux users, with the goal being that Linux users belonging to a
> specific Linux group will, at login, be assigned to the applicable
> SELinux user, then role, then type, etc.
>
> However. When I log in as my test user, icmc01, via the console or via
> SSH, I get the message "Unable to get valid context for icmc01". A
> check with "id -Z" shows that my test user has the following context:
>
>     system_u:system_r:unconfined_t:s0-s0:c0.c1023
>
> I really want them to have the context:
>
>     CDTml_high2local_u:CDTml_high2local_r:xferHigh2Local_t:s0-s0:c0.c1023
>
> (In fact, I don't care about the MLS/MCS portion, I am more than happy
> to accept system defaults; I'm really only going for the MAC.)
>
> What follows is everything I could think to include, from their passwd
> entry and the group file to semanage settings, from the contexts and
> content of various SELinux configuration files to the relevant snips
> of the TE file itself.

A few things that I could find but that are needed for computing
contexts are:

the login programs need to be allowed to manual transition to the user
type. So for example if you want to login with sshd_t:
allow sshd_t xferHigh2Local_t:process transition;

The user type needs to be a bin and shell entry type:
allow xferHigh2Local_t { bin_t shell_exec_t }:file entrypoint;

There is probably more that i am overlooking but these, i think, are
important part for computation of contexts

See where those get you.

>
> NOTE: This is all under permissive mode, targeted policy.
>
> Any insight or direction will be much appreciated, I am tearing out
> my hair. Thank you!
>
>     % grep icmc01 /etc/passwd
>     icmc01:x:2105:2105::/home/icmc01:/bin/bash
>
>     % grep 2105 /etc/group
>     CDTml_high2local:x:2105:
>
>     % semanage login -l |grep CDTml_high2local_u
>     %CDTml_high2local    CDTml_high2local_u   s0-s0:c0.c1023       *
>
>     % semanage user -l |grep CDTml_high2local_u
>     CDTml_high2local_u user       s0         s0-s0:c0.c1023
>      CDTml_high2local_r
>
>     % ls -lZ /etc/selinux/targeted/contexts/users/CDTml_high2local_u
>     -rw-r--r--. root root system_u:object_r:default_context_t:s0
> /etc/selinux/targeted/contexts/users/CDTml_high2local_u
>
>     % cat /etc/selinux/targeted/contexts/users/CDTml_high2local_u
>     system_r:crond_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:initrc_su_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:local_login_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:remote_login_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:sshd_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     CDTml_high2local_r:xferHigh2Local_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>
>     % ls -lZ /etc/selinux/targeted/contexts/default_*
>     -rw-r--r--. root root system_u:object_r:default_context_t:s0
> /etc/selinux/targeted/contexts/default_contexts
>     -rw-r--r--. root root system_u:object_r:default_context_t:s0
> /etc/selinux/targeted/contexts/default_type
>
>     % cat /etc/selinux/targeted/contexts/default_contexts
>     system_r:crond_t:s0 system_r:system_cronjob_t:s0
>     system_r:local_login_t:s0 user_r:user_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:remote_login_t:s0 user_r:user_t:s0
> CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:sshd_t:s0 user_r:user_t:s0 CDTml_high2local_r:xferHigh2Local_t:s0
>     system_r:sulogin_t:s0 sysadm_r:sysadm_t:s0
>     system_r:xdm_t:s0 user_r:user_t:s0
>
>     % uname -a
>     Linux localhost.localdomain 3.10.0-1160.6.1.el7.x86_64 #1 SMP Wed
> Oct 21 13:44:38 EDT 2020 x86_64 x86_64 x86_64 GNU/Linux
>
>     % more /etc/redhat-release
>     Red Hat Enterprise Linux Server release 7.9 (Maipo)
>
>     % yum info installed \*selinux\*|grep -A3 '^Name'
>     Name        : libselinux
>     Arch        : x86_64
>     Version     : 2.5
>     Release     : 15.el7
>     --
>     Name        : libselinux-python
>     Arch        : x86_64
>     Version     : 2.5
>     Release     : 15.el7
>     --
>     Name        : libselinux-utils
>     Arch        : x86_64
>     Version     : 2.5
>     Release     : 15.el7
>     --
>     Name        : selinux-policy
>     Arch        : noarch
>     Version     : 3.13.1
>     Release     : 268.el7_9.2
>     --
>     Name        : selinux-policy-devel
>     Arch        : noarch
>     Version     : 3.13.1
>     Release     : 268.el7_9.2
>     --
>     Name        : selinux-policy-targeted
>     Arch        : noarch
>     Version     : 3.13.1
>     Release     : 268.el7_9.2
>
>     % grep -C3 CDTml_high2local_r CDTml.te
>     # and grant them access to our types
>     role CDTml_low2local_r;
>     role CDTml_local2high_r;
>     role CDTml_high2local_r;
>     role CDTml_local2low_r;
>     role CDTml_auditor_r;
>
>     allow system_r {
>         CDTml_low2local_r
>         CDTml_local2high_r
>         CDTml_high2local_r
>         CDTml_local2low_r
>         CDTml_auditor_r
>     };
>     allow unconfined_r {
>         CDTml_low2local_r
>         CDTml_local2high_r
>         CDTml_high2local_r
>         CDTml_local2low_r
>         CDTml_auditor_r
>     };
>     --
>         xferLocal2High_t
>         xferLocal2High_exec_t
>     };
>     role CDTml_high2local_r types {
>         xferHigh2Local_t
>         xferHigh2Local_exec_t
>     };
>
>     % tail -f /var/log/secure
>     Feb 11 14:57:44 localhost login: pam_selinux(login:session): Open Session
>     Feb 11 14:57:44 localhost login: pam_selinux(login:session): Open Session
>     Feb 11 14:57:44 localhost login: pam_selinux(login:session):
> Username= icmc01 SELinux User= CDTml_high2local_u Level=
> s0-s0:c0.c1023
>     Feb 11 14:57:44 localhost login: pam_selinux(login:session):
> Unable to get valid context for icmc01
>     Feb 11 14:57:44 localhost login: pam_unix(login:session): session
> opened for user icmc01 by LOGIN(uid=0)
>     Feb 11 14:57:44 localhost login: LOGIN ON tty2 BY icmc01
>
>
> Peter Whittaker
> Director, Business Development
> www.SphyrnaSecurity.com
> +1 613 864 5337

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift