Re: [gentoo-hardened] selinux: rsync to remote selinux protected server..

[Petre Rodan]

Hi,

On Sun, Mar 25, 2007 at 10:58:05PM +0100, Justin Heesemann wrote:
> Petre Rodan wrote:
> > Hi,
> >
> > On Sun, Mar 25, 2007 at 05:17:39PM +0100, Justin Heesemann wrote:
> >> since the default role for root is staff_t, who's not allowed (almost)
> >> anything..
> >> i wonder how to manage to backup stuff to another server.
> >
> >
> > you only have to make sure that no wrongdoers can execute that special rsync binary of yours or you have a serious security problem.
>
> ok, this shouldn't be much of a problem.
>
> thanks for the fast reply!
>
> i've now written a small module but i have a problem installing it:
>
> # semodule -v -i backup.pp

:) my sample policy was for the older framework.
if you're using the new reference policy, you can try to tweak the backup module located here: 

http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/admin/

> Attempting to install module 'backup.pp':
> Ok: return value of 0.
> Committing changes:
> libsepol.print_missing_requirements: rsync_backup's global requirements were
> not met: type/attribute auth
> libsemanage.semanage_link_sandbox: Link packages failed
> semodule:  Failed!
>
>
>
> just to make sure: this is my rsync_backup.te:
>
> module rsync_backup 1.1;
> require {
>         class dir { getattr read search };
>         class file { execute getattr read };
>         class lnk_file { getattr read };
>         class sock_file { getattr };
>         class fifo_file { getattr };
>         class process {  noatsecure siginh rlimitinh transition };
>
>         type mnt_t;
>         type portage_fetch_tmp_t;
>         type proc_t;
>         type shadow_t;
>         type staff_t;
>         type sysfs_t;
>
>         attribute auth_chkpwd;
>         attribute auth;
>         attribute domain;
>         attribute file_type;
>         attribute privlog;
>         attribute sysadmfile;
>
> }
>
> type backup_t, domain, privlog, auth_chkpwd, auth;
> type backup_exec_t, file_type, sysadmfile;
> role staff_r types backup_t;
>
> domain_auto_trans(staff_t, backup_exec_t, backup_t);
>
> allow backup_t { file_type -shadow_t -portage_fetch_tmp_t -sysfs_t }:file {
> getattr read };
> allow backup_t { file_type }:lnk_file { getattr read };
> allow backup_t { file_type }:fifo_file getattr;
> allow backup_t { file_type }:sock_file getattr;
> allow backup_t { file_type -mnt_t -proc_t -sysfs_t }:dir { getattr read
> search };
>
>
>
>
> --
> Best Regards,
> Justin
> --
> gentoo-hardened@g.o mailing list
>

bye,
peter

-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux