Re: [gentoo-hardened] Re: "Out of the box" SELinux policy questions...

[Chris PeBenito]

On Wed, 2007-03-21 at 13:38 -0400, Mike Edenfield wrote:
> Chris PeBenito wrote:
>
> > It would be nice to find out more specifically what is going on with the
> > other two denials, but I suspect that it will be ok to allow.  I use
> > dhcpcd on my server, but don't see this problem.
>
> Thanks for all your help so far.  Over this weekend I upgraded to the
> new, modular SELinux policy and applied the strict policy to my system.
>   This seems to have removed the majority of my audit messages, so I'm
> guessing the 2005.1 policy files were just out of date.
>
> I do have a few questions about the new policy setup.
>
> 1. How can I see what policy rules are defined in a compiled policy
> module?  I need to add some rules to handle interactions between
> multiple services but I want to make sure the labels are correct first,
> and use the correct domain types.  But without the policy sources I
> haven't figured out how to see what rules are available.

You can use app-admin/setools-3.1 's apol tool to open up a module
(*.pp), but you must also have a base module (base.pp).  Or you could
use it to open of policy.21.  If this still isn't sufficient, you'll
still have to look the policy sources.

However part of the reference policy is now the concept of interfaces
which provide access to a module's access, for example,
apache_read_log(foo_t) would give the domain foo_t the rules for reading
the apache log.  You can see a reference of interfaces from
http://oss.tresys.com/docs/refpolicy/api/.  Then you won't need to
figure out what type the apache logs are, and what allow rules are
needed to get the access.

> 2. This one is specific to sudo.  I added a couple of rules relating to
> sudo:
>
> allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
> allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };
>
> but I remember from looking through the older policy sources that sudo
> actually defines more than one $1_sudo_t type that all get the same
> rules.  Is there a way in my local.te file to look up and apply my two
> transition rules to every defined *_sudo_t type, or will I need to
> specify each one individually?

If your policy customizations module is called "local" you would want
this:

template(`local_per_role_template',`
        require { type $1_sudo_t, pam_var_run_t; }
        allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms;
        allow $1_sudo_t pam_var_run_t:dir { getattr search write };
')

[modulename]_per_role_template is automatically invoked for each of the
user roles (user,staff,sysadm), with the parameters: prefix,
user_domain, role

So for sysadm_r, the prefix is sysadm and the user_domain is sysadm_t.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243