Re: [gentoo-hardened] SELinux policy rules concerning access to /etc/shadow

[Bill McCarty]

Hi Chris,

Thanks for your helpful reply. Please see responses, below. I'll experiment 
and define the problem more precisely. But, to do so, I must have keyboard 
access. Breaking SSH is inconvenient when you're working remotely <g>.

Cheers,

--On Thursday, April 01, 2004 7:52 PM -0600 Chris PeBenito 
<pebenito@g.o> wrote:

> On Tue, 2004-03-30 at 17:10, Bill McCarty wrote:
>>
>> neverallow ~{ auth auth_write } shadow_t:file ~getattr;
>
> This forces shadow access to only be through PAM, with few exceptions.
>
>> To log in via SSH and become the system administrator, I find that I
>> must  add the following permissions, which contradict the constraint:
>>
>> allow sshd_t shadow_t:file { getattr read };
>> allow sysadm_su_t shadow_t:file { getattr read };
>
> I've not seen this.  It seems like you don't have >=pam-0.77 installed,
> since it affects sshd and su.

Good hypothesis, but it doesn't seem to be the case, unless I should have 
pam-0.77-r1 rather than merely pam-0.77:

     emerge -pv pam pam-login

     These are the packages that I would merge, in order:

     Calculating dependencies ...done!
     [ebuild   R   ] sys-libs/pam-0.77  +berkdb -pwdb +selinux  0 kB
     [ebuild   R   ] sys-apps/pam-login-3.14  -nls +selinux  0 kB

     Total size of downloads: 0 kB

I tried eliminating the policy:

     allow sysadm_su_t shadow_t:file { getattr read };

When I do so, the su command works normally. But, when I try to log in via 
SSH, I fail to get a command prompt. Instead, I get the message:

     Server refused to allocate pty

This system was originally a non-SELinux system running devfs. Could I have 
screwed up by compiling something while devfs was still active, or 
otherwise have failed to perform some conversion step? I wonder....


>> I tried to investigate the auth type, but can't find where it's defined.
>
> It is an attribute, see attrib.te.

Doh! Yes, I subsequently found this <g>.

---------------------------------------------------
Bill McCarty, Ph.D.
Professor of Information Technology
Azusa Pacific University



--
gentoo-hardened@g.o mailing list