Re: [gentoo-hardened] selinux denials due to race conditions?

[Chris PeBenito]

On Tue, 2007-06-19 at 20:55 -0400, Bill Sharer wrote:
> I'm on the 2006.1 unstable profile for selinux and think I may have a
> race condition that results in avc denials before selinux has finished
> labeling things like /dev. For example, the first denial below appears
> to be where /etc/hotplug.d/default/default.hotplug is peeking and poking
> around with /dev/null. The denial has it as a system_u:object_r:file_t,
> but when I look at it from a running system I see it as a
> system_u:object_r:null_device_t. Should I be messing around in
> /etc/runlevels/boot to put dependencies in various scripts (although
> selinux isn't a script so how would I make it a dependency?)

This is indeed a race.  Hotplug events can happen at any time, and when
that happens it results in the kernel calling userland to do some
handling, and in your case its happening during SELinux initialization.
This type of problem has been reported in the past, but its so
infrequent that I can't remember nor find the workaround. :x  Its not a
boot runlevel fix as this is happening while init (the program, pid 1)
is starting, so the init scripts haven't started.

> snippet from a dmesg:
>
> security:  5 users, 5 roles, 1376 types, 81 bools
> security:  59 classes, 61906 rules
> security:  class dccp_socket not defined in policy
> security:  permission dccp_recv in class node not defined in policy
> security:  permission dccp_send in class node not defined in policy
> security:  permission dccp_recv in class netif not defined in policy
> security:  permission dccp_send in class netif not defined in policy
> SELinux:  Completing initialization.
> SELinux:  Setting up existing superblocks.
> SELinux: initialized (dev sda5, type ext3), uses xattr
> inode_doinit_with_dentry:  context_to_sid(unlabeled) returned 22 for
> dev=sda5 ino=1938273
> audit(1182137416.171:2): avc:  denied  { ioctl } for  pid=884
> comm="default.hotplug" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.203:3): avc:  denied  { read } for  pid=889 comm="env"
> name="urandom" dev=sda5 ino=732962 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137416.204:4): avc:  denied  { read } for  pid=884
> comm="default.hotplug" name="default.hotplug" dev=sda5 ino=1356280
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sbin_t
> tclass=file
> audit(1182137416.206:5): avc:  denied  { search } for  pid=884
> comm="default.hotplug" name="var" dev=sda5 ino=1254177
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:var_t
> tclass=dir
> audit(1182137416.221:6): avc:  denied  { search } for  pid=884
> comm="default.hotplug" name="log" dev=sda5 ino=1255669
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:var_log_t
> tclass=dir
> SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts
> SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts
> SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
> SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses genfs_contexts
> SELinux: initialized (dev devpts, type devpts), uses transition SIDs
> SELinux: initialized (dev eventpollfs, type eventpollfs), uses task SIDs
> SELinux: initialized (dev inotifyfs, type inotifyfs), uses genfs_contexts
> SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
> SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts
> SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
> SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
> SELinux: initialized (dev proc, type proc), uses genfs_contexts
> SELinux: initialized (dev bdev, type bdev), uses genfs_contexts
> SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts
> SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
> audit(1182137416.259:7): policy loaded auid=4294967295
> audit(1182137416.261:8): avc:  denied  { read write } for  pid=1
> comm="init" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.275:9): avc:  denied  { ioctl } for  pid=1 comm="init"
> name="tty0" dev=sda5 ino=735467 scontext=system_u:system_r:init_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137416.277:10): avc:  denied  { read } for  pid=891
> comm="hotplug" name="urandom" dev=sda5 ino=732962
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.279:11): avc:  denied  { write } for  pid=891
> comm="hotplug" name="tty" dev=sda5 ino=734192
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.296:12): avc:  denied  { ioctl } for  pid=893
> comm="default.hotplug" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.758:13): avc:  denied  { read write } for  pid=970
> comm="rc" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.033:14): avc:  denied  { read write } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.034:15): avc:  denied  { search } for  pid=994
> comm="consoletype" name="dev" dev=sda5 ino=732961
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=dir
> audit(1182137417.034:16): avc:  denied  { getattr } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.035:17): avc:  denied  { ioctl } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.082:18): avc:  denied  { ioctl } for  pid=997
> comm="stty" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.172:19): avc:  denied  { getattr } for  pid=970
> comm="bash" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.196:20): avc:  denied  { read write } for  pid=1001
> comm="dmesg" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:dmesg_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.220:21): avc:  denied  { read write } for  pid=1004
> comm="mount" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:mount_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
> audit(1182137417.478:22): avc:  denied  { read write } for  pid=1038
> comm="restorecon" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:restorecon_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.716:23): avc:  denied  { write } for  pid=1042
> comm="bash" name="null" dev=tmpfs ino=2106
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t
> tclass=chr_file
> audit(1182137417.875:24): avc:  denied  { read write } for  pid=1062
> comm="udevd" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137418.770:25): avc:  denied  { read } for  pid=1194
> comm="modprobe" name="console" dev=tmpfs ino=2100
> scontext=system_u:system_r:insmod_t tcontext=system_u:object_r:device_t
> tclass=chr_file
> audit(1182137424.374:26): avc:  denied  { getattr } for  pid=2059
> comm="modprobe.sh" name="modprobe.conf" dev=sda5 ino=1515100
> scontext=system_u:system_r:udev_t tcontext=root:object_r:modules_conf_t
> tclass=file
> audit(1182137424.376:27): avc:  denied  { read } for  pid=2112
> comm="grep" name="modprobe.conf" dev=sda5 ino=1515100
> scontext=system_u:system_r:udev_t tcontext=root:object_r:modules_conf_t
> tclass=file
-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243