[gentoo-hardened] Portage-related AVCs

[Robert Sharp]

Hi,

just done my weekly update and I noticed the following AVCs occurred 
that suggest something missing in the portage policy?

type=PROCTITLE msg=audit(1479900756.052:3548): 
proctitle=6370002D61002D2D7265666C696E6B3D6175746F002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F5F707974686F6E322E372F2E002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F2F
type=PATH msg=audit(1479900756.052:3548): item=0 
name="/var/tmp/portage/dev-python/pypax-0.9.2/image/." inode=1182893 
dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 
obj=staff_u:object_r:portage_tmp_t nametype=NORMAL
type=CWD msg=audit(1479900756.052:3548): 
cwd="/var/tmp/portage/dev-python/pypax-0.9.2/work/elfix-0.9.2/scripts"
type=SYSCALL msg=audit(1479900756.052:3548): arch=c000003e syscall=189 
success=yes exit=0 a0=44b69d9c40 a1=36fe2f5a763 a2=44b69d9df0 a3=1f 
items=1 ppid=21441 pid=21661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 
fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="cp" 
exe="/bin/cp" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
type=AVC msg=audit(1479900756.052:3548): avc:  denied  { relabelto } 
for  pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893 
scontext=staff_u:sysadm_r:portage_sandbox_t 
tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1
type=AVC msg=audit(1479900756.052:3548): avc:  denied  { relabelfrom } 
for  pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893 
scontext=staff_u:sysadm_r:portage_sandbox_t 
tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1

I checked the policy for source=portage_sandbox_t and 
target=portage_tmp_t and it is:

# sesearch -s portage_sandbox_t -t portage_tmp_t -Ad
Found 5 semantic av rules:
    allow portage_sandbox_t portage_tmp_t : lnk_file { ioctl read write 
create getattr setattr lock unlink link rename } ;
    allow portage_sandbox_t portage_tmp_t : dir { ioctl read write 
create getattr setattr lock unlink link rename add_name remove_name 
reparent search rmdir open } ;
    allow portage_sandbox_t portage_tmp_t : fifo_file { ioctl read write 
create getattr setattr lock append unlink link rename open } ;
    allow portage_sandbox_t portage_tmp_t : file { ioctl read write 
create getattr setattr lock relabelfrom relabelto append unlink link 
rename execute execute_no_trans open } ;
    allow portage_sandbox_t portage_tmp_t : sock_file { ioctl read write 
create getattr setattr lock append unlink link rename open } ;

It looks to me like portage was trying to relabelto/from a directory but 
these ops are only allowed for files?

I also spotted AVCs involving directory access to portage_tmpfs_t (and 
sandbox as the source), such as:

type=PROCTITLE msg=audit(1479900586.938:3542): 
proctitle=707974686F6E322E37002F7573722F6C696236342F707974686F6E322E372F736974652D7061636B616765732F696E636C7564655F7365727665722F696E636C7564655F7365727665722E7079002D2D706F7274002F746D702F6469737463632D70756D702E656B6A3330372F736F636B6574002D2D7069645F66696C65002F
type=PATH msg=audit(1479900586.938:3542): item=1 
name="/dev/shm/tmpgk84Lo.include_server-16244-1" inode=1246573 dev=00:13 
mode=040700 ouid=250 ogid=250 rdev=00:00 
obj=staff_u:object_r:portage_tmpfs_t nametype=DELETE
type=PATH msg=audit(1479900586.938:3542): item=0 name="/dev/shm/" 
inode=8351 dev=00:13 mode=041777 ouid=0 ogid=0 rdev=00:00 
obj=system_u:object_r:tmpfs_t nametype=PARENT
type=CWD msg=audit(1479900586.938:3542): 
cwd="/var/tmp/portage/dev-python/cffi-1.5.2/work/cffi-1.5.2"
type=SYSCALL msg=audit(1479900586.938:3542): arch=c000003e syscall=84 
success=yes exit=0 a0=3a6d7c7770 a1=0 a2=0 a3=36b items=2 ppid=1 
pid=16244 auid=4294967295 uid=250 gid=250 euid=250 suid=250 fsuid=250 
egid=250 sgid=250 fsgid=250 tty=pts0 ses=4294967295 comm="python2.7" 
exe="/usr/bin/python2.7" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
type=AVC msg=audit(1479900586.938:3542): avc:  denied  { rmdir } for  
pid=16244 comm="python2.7" name="tmpgk84Lo.include_server-16244-1" 
dev="tmpfs" ino=1246573 scontext=staff_u:sysadm_r:portage_sandbox_t 
tcontext=staff_u:object_r:portage_tmpfs_t tclass=dir permissive=1

And a similar AVC for creating the same directory.

Is this likely to be a policy gap or have I done something wrong or 
failed to do something I should have. I cannot provide more details 
about what was happening at the time, other than in the audit snippets 
above - it was the middle of a lengthy update process.

Thanks,

Robert Sharp