[gentoo-hardened] SELinux Targeted strangeness

[Ronan Mullally]

I've just converted a new 2007.0 amd64 hardened install to SELinux and
selected the targeted policy.  I had some fun and games that required
downgrading portage to 2.1.2.2, but everything seems to have gone
relatively smoothly.

However...

The system is still running in permissive mode and I'm seeing lots of avc
log traffic for stuff I shouldn't be.  A simple 'df' as root gives:

 denied  { getattr } for  pid=22043 comm="df" name="/" dev=selinuxfs ino=473 scontext=user_u:system_r:system_chkpwd_t tcontext=system_u:object_r:security_t tclass=filesystem
 denied  { getattr } for  pid=22043 comm="df" name="/" dev=sysfs ino=1 scontext=user_u:system_r:system_chkpwd_t tcontext=system_u:object_r:sysfs_t tclass=filesystem
 denied  { getattr } for  pid=22043 comm="df" name="/" dev=sysfs ino=1 scontext=user_u:system_r:system_chkpwd_t tcontext=system_u:object_r:sysfs_t tclass=dir
 ...

It looks like pretty much everything I do is getting logged.

As far as I can tell everything is set up as it should be.  The only thing
I can find that looks unusual is:

 # ps -axZf

 system_u:system_r:sshd_t        24605 ?        Ss     0:00  \_ sshd: ronan [priv]
 system_u:system_r:sshd_t        24610 ?        S      0:00  |   \_ sshd: ronan@pts/1
 user_u:system_r:system_chkpwd_t 24611 pts/1    Ss     0:00  |       \_ -bash
 user_u:system_r:system_chkpwd_t 24616 pts/1    S      0:00  |           \_ su -
 user_u:system_r:system_chkpwd_t 24617 pts/1    S+     0:00  |               \_ -su

 system_u:system_r:local_login_t  6015 ttyS1    Ss     0:00 /bin/login --
 root:system_r:unconfined_t       6029 ttyS1    S+     0:00  \_ -bash

My SSH login and it's child shells are running in system_chkpwd_t, rather
than unconfined_t (which my console login runs as).  This seems to be the
cause of the avc denials above.

I've re-emerged openssh (with portage 2.1.2.2) but it's made no
difference.  The only modules I've got loaded is:

 # semodule -l
 portmap 1.3.1

Am I missing something obvious, or is there something broken somewhere?


-Ronan
-- 
gentoo-hardened@g.o mailing list