[gentoo-hardened] Re: Sysadmin clues needed for SELinux

[Andy Dustman]

I did some more Googling and found this post:

http://article.gmane.org/gmane.linux.gentoo.hardened/490

which is a (January) followup from Chris PeBenito to me. It makes more
sense now, at least.

I've managed to do a couple of things now with policies, so that I've
at least gotten to the point where I think I know what I'm doing --
enough to admin the box -- but far from being an expert. Here's what I
managed to come up with:

I wrote a security policy for a third-party proprietary CGI shopping
cart application (PDG Cart), which I hope is about 90% there; I should
find out tomorrow if it can actually post payments...

I had to tweak the apache2 policy a little bit so that SSL would work
properl. The stock policy has:

/var/cache/ssl.*\.sem   --      system_u:object_r:httpd_cache_t

I had to add:

/var/cache/apache2              system_u:object_r:httpd_cache_t
/var/cache/apache2/ssl.*\.sem   system_u:object_r:httpd_cache_t

since this seems to have moved in current versions of apache-2.

I relocated my PORTDIR and DISTDIR.

/var/lib/ntp/ntp.drift wasn't being labelled correctly; I looks like
this is fixed in the testing policy. I expect apache is probably fixed
that way too.

I took root out of users. It was a bit of a scary moment when I did:

$ su -
Password:
Unable to cd to "/root"

Of course, /root is not relabeled for root being a normal user. But
then, if you do relabel it, it's has a context of
system_u:object_r:default_t, which is not right either. su without the
- works fine. However I suspect there is some more locking down to do
to keep root from doing bad things like various denial-of-service
attacks. Just as a example:

# dd if=/dev/zero of=/tmp/foo

This actually seems to lock up the machine in a bad way: An oops and a
kernel panic: Fatal Exception in Interrupt Handler, starring Sharon
Stone. I have a separate XFS /tmp filesystem, running
hardened-dev-sources. I could probably reproduce this, but won't...

Then there is the lovely don't-try-this-ever fork bomb:

: () { : |  : & } ; : # don't run this unless you have set ulimit or
like rebooting

Resource limits are another issue, of course. You can also compile
stuff (using the /tmp directory). If you have it mounted with the
noexec option, you should be pretty safe, though, but you can still
waste resources.

Maybe there should be a guest_r role (or punk_r) for users we really
don't want to do anything?
-- 
Computer interfaces should never be made of meat.

Using GMail? Setting Reply-to address to <> disables this annoying feature.

--
gentoo-hardened@g.o mailing list