Re: [gentoo-hardened] Re: Sysadmin clues needed for SELinux

[Andy Dustman]

On Tue, 16 Nov 2004 08:38:34 +0200, petre rodan <kaiowas@g.o> wrote:
> Andy Dustman wrote:

> > Of course, /root is not relabeled for root being a normal user. But
> > then, if you do relabel it, it's has a context of
> > system_u:object_r:default_t, which is not right either. su without the
> > - works fine.
>
> /root(/.*)? should end up root:object_r:sysadm_home_t, not default_t.
>
> you should have in your users file a line like:
> user root roles { sysadm_r staff_r };

What you missed was, I removed root from users, which Chris had
suggested back in January.

>  > However I suspect there is some more locking down to do
> > to keep root from doing bad things like various denial-of-service
> > attacks. Just as a example:
> >
> > # dd if=/dev/zero of=/tmp/foo
>
> other then filling up the /tmp fs, I don't see what else it can do.
>
> > This actually seems to lock up the machine in a bad way: An oops and a
> > kernel panic: Fatal Exception in Interrupt Handler, starring Sharon
> > Stone.
>
> I can't reproduce this on my ext3 fs

That doesn't surprise me, since you are using a different filesystem.
I would guess this is either an XFS bug or IDE bug. However, since
hardened-dev-sources is 2 releases behind the current
development-sources three, it's entirely possible that the bug is
already fixed.

>  > I have a separate XFS /tmp filesystem, running
> > hardened-dev-sources. I could probably reproduce this, but won't...
>
> > Maybe there should be a guest_r role (or punk_r) for users we really
> > don't want to do anything?
>
> if they are not permitted to do anything, they shouldn't have received an account in the first place. :)

That is true, but we can't get rid of root entirely.

Here's another issue: Gentoo includes by default the bin user. Usually
(in other UNIX and Linux distributions, but not all) this is used as
the owner (sometimes group) of most binaries, but Gentoo makes most
binaries root-owned. (Obviously setuid binaries are another matter.)
So is there any particular reason to use root over bin for ownership
of binaries? Might it make a difference for SELinux if root only has
normal user rights, or even less rights than normal?
-- 
Computer interfaces should never be made of meat.

Using GMail? Setting Reply-to address to <> disables this annoying feature.

--
gentoo-hardened@g.o mailing list