Re: [gentoo-hardened] Problem with SELinux policy

[Chris PeBenito]

On Thu, 2008-03-13 at 15:26 +0100, Björn Fahller wrote:
> I can just chime in with a me-too. I've installed an x86 2007.0, though.
>
> A lot of issues could be resolved by manually relabeling following the
> discussions in:
>
> http://www.mail-archive.com/gentoo-hardened%40lists.gentoo.org/msg01610.html
>
> However, the below ones remain, and I don't know what to do about them.
>
> For what it's worth, I have indeed rebuilt udev. In fact, I rebeilt every
> single package (ouch!)
>    _
> /Bjorn
>
>
>  audit(1205311345.096:2): policy loaded auid=4294967295
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  audit(1205311345.562:3): avc:  denied  { write } for  pid=946 comm="bash"
> name="null" dev=tmpfs ino=1313 scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:device_t tclass=chr_file
>  audit(1205311345.624:4): avc:  denied  { read } for  pid=955
> comm="write_root_link" name="console" dev=tmpfs ino=1307
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t
> tclass=chr_file

These two will require some investigation to see why there are
mislabeled device nodes at this point (i.e. after udev started).

>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev securityfs, type securityfs), not configured for
> labeling
>  audit(1205311352.640:5): avc:  denied  { mount } for  pid=1756 comm="mount"
> name="/" dev=securityfs ino=1 scontext=system_u:system_r:mount_t
> tcontext=system_u:object_r:unlabeled_t tclass=filesystem

I added this to the upstream policy.

>  Adding 977216k swap on /dev/hda1.  Priority:-1 extents:1 across:977216k
>  audit(1205311359.150:6): avc:  denied  { write } for  pid=2470
> comm="runscript.sh" name="resolv.conf" dev=hda2 ino=46223216
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:net_conf_t
> tclass=file
>  audit(1205311359.154:7): avc:  denied  { setattr } for  pid=2525 comm="chmod"
> name="resolv.conf" dev=hda2 ino=46223216 scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:net_conf_t tclass=file

Do you use net-dns/resolvconf-gentoo?

>  audit(1205311362.834:8): avc:  denied  { search } for  pid=3168
> comm="syslog-ng" name="lib" dev=hda2 ino=33576422
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=dir
>  audit(1205311362.834:9): avc:  denied  { read } for  pid=3168
> comm="syslog-ng" name="syslog-ng.persist" dev=hda2 ino=33576402
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=file
>  audit(1205311362.834:10): avc:  denied  { getattr } for  pid=3168
> comm="syslog-ng" path="/var/lib/syslog-ng.persist" dev=hda2 ino=33576402
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=file

I'll have to add support for this file to the policy.  Is this
created/modified by syslog-ng too?

>  eth0: link up, 100Mbps, full-duplex
>  audit(1205311366.898:11): avc:  denied  { nlmsg_write } for  pid=3576
> comm="dhcpcd" scontext=system_u:system_r:dhcpc_t

I'll have to do some investigation on this one.

> tcontext=system_u:system_r:dhcpc_t tclass=netlink_route_socket
>  audit(1205307770.810:12): avc:  denied  { create } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:13): avc:  denied  { bind } for  pid=3889 comm="agetty"
> scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t
> tclass=netlink_route_socket
>  audit(1205307770.810:14): avc:  denied  { getattr } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:15): avc:  denied  { write } for  pid=3889 comm="agetty"
> scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t
> tclass=netlink_route_socket
>  audit(1205307770.810:16): avc:  denied  { nlmsg_read } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:17): avc:  denied  { read } for  pid=3889 comm="agetty"
> scontext=system_u:system_r:getty_t tcontext=system_u:system_r:getty_t
> tclass=netlink_route_socket

Fixed this upstream too.  Its nonfatal, probably just makes the hostname
not resolve in your login banner.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243