1 |
On Tue, 2007-03-06 at 15:33 -0500, Mike Edenfield wrote: |
2 |
> I've recently installed a few proof-of-concept hardened Gentoo servers |
3 |
> at work, with the hardened toolchain + SELinux as security measures. |
4 |
> I'll probably end to "training" the admins and other devs on how to |
5 |
> write and configure security policy, so I'm trying to understand it |
6 |
> better myself :) The documentation from the hardened project has been |
7 |
> helpful, but there's one element that I seem to be missing. |
8 |
> |
9 |
> I have a good grasp on how the policy rules work, and how to write a |
10 |
> policy rule, but I'm still confused on exactly *why* I should be writing |
11 |
> a policy rule. My confusion stems from the fact that there are what I |
12 |
> believe to be an excessive number of avc denial messages being logged |
13 |
> right out of the box, just to boot the system. I obviously could run |
14 |
> audit2allow and figure out what TE rules to add, and silence the log |
15 |
> messages. But some of the rules it recommends just look wrong to me. |
16 |
> Things like this: |
17 |
> |
18 |
> allow consoletype_t file_t:chr_file { getattr ioctl read write }; |
19 |
> allow consoletype_t file_t:dir search; |
20 |
> allow dmesg_t file_t:chr_file { read write }; |
21 |
> |
22 |
> I was under the impression that nothing should ever be permitted to |
23 |
> transition to file_t, and that errors referencing the file_t domain mean |
24 |
> there's something mis-labelled. In this case, it looks like |
25 |
> /dev/console is the biggest culprit, but I've also 20 or so errors from |
26 |
> initrc, a few from ifconfig, a half-dozen from udev. If I install, say, |
27 |
> sshd or sudo, I get more, even after merging and reloading their policy |
28 |
> files. |
29 |
> |
30 |
> Is this normal or expected? |
31 |
|
32 |
Sorry for the slow response. These messages are likely due to the |
33 |
static device nodes under a udev /dev. There isn't a good way to |
34 |
automatically relabel these device nodes. The best way would be to |
35 |
reboot with udev temporarily disabled, then do `restorecon -R /dev`, |
36 |
then boot up with udev reenabled. I believe gentoo=noudev on the kernel |
37 |
command line will still disable udev during booting. Alternatively you |
38 |
can use the RC_DEVICES setting in /etc/conf.d/rc to enable or disable |
39 |
udev on boot. |
40 |
|
41 |
-- |
42 |
Chris PeBenito |
43 |
<pebenito@g.o> |
44 |
Developer, |
45 |
Hardened Gentoo Linux |
46 |
|
47 |
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 |
48 |
Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243 |