Re: [gentoo-hardened] Problem with SELinux policy

[Florian Tischler]

Am Donnerstag, 13. März 2008 schrieb Björn Fahller:
> On Thursday 13 March 2008 15.20.21 Chris PeBenito wrote:
> > On Fri, 2008-02-29 at 22:12 +0700, Michael Metsger wrote:
> > > I'm trying to use "selinux/2007.0/hardened/amd64" to make
> > > gentoo-hardened with selinux. I started from
> > > stage3-amd64-hardened-multilib-2007.0. After update, switch to new
> > > profile and agin update, booting selinux kernel and relabeling I got
> > > worked system with many "avc:  denied" messages. Some of them I
> > > solved.
> > > At this time I don't know how to solve this "avc:  denied" correct:
> >
> > Did you remerge udev?  Most of this is device nodes in udev /dev are
> > mislabeled.
>
> I can just chime in with a me-too. I've installed an x86 2007.0, though.
>
> A lot of issues could be resolved by manually relabeling following the
> discussions in:
>
> http://www.mail-archive.com/gentoo-hardened%40lists.gentoo.org/msg01610.htm
>l
>
> However, the below ones remain, and I don't know what to do about them.
>
> For what it's worth, I have indeed rebuilt udev. In fact, I rebeilt every
> single package (ouch!)

Hi,

I am trying to use SElinux in a Xen DomU. Profile is also 
selinux/2007.0/hardened/amd64. I am using ~amd64 as accept_keywords, don´t 
know if this is a good idea when using selinux.

I get exactly the same error messages like your error messages below + a few 
additional one. (some of them are probably related to xen)

I would be very happy if someone could help me fixing this issues.

Thanks,
Florian

The additional error messages i get:

audit(1205421548.959:24): avc:  denied  { getattr } for  pid=1561 comm="bash" 
name="xen" dev=proc ino=4026532902 scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:proc_xen_t tclass=dir

audit(1205421548.959:25): avc:  denied  { search } for  pid=1561 comm="bash" 
name="xen" dev=proc ino=4026532902 scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:proc_xen_t tclass=dir

audit(1205421548.959:26): avc:  denied  { read } for  pid=1561 comm="bash" 
name="capabilities" dev=proc ino=4026532943 
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:proc_xen_t 
tclass=file

audit(1205421548.963:27): avc:  denied  { getattr } for  pid=1567 comm="grep" 
name="capabilities" dev=proc ino=4026532943 
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:proc_xen_t 
tclass=file

audit(1205421669.862:40): avc:  denied  { create } for  pid=2815 comm="login" 
scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

audit(1205421669.862:41): avc:  denied  { bind } for  pid=2815 comm="login" 
scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

audit(1205421669.862:42): avc:  denied  { getattr } for  pid=2815 comm="login" 
scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

audit(1205421669.862:43): avc:  denied  { write } for  pid=2815 comm="login" 
scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

audit(1205421669.862:44): avc:  denied  { nlmsg_read } for  pid=2815 
comm="login" scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

audit(1205421669.862:45): avc:  denied  { read } for  pid=2815 comm="login" 
scontext=system_u:system_r:local_login_t 
tcontext=system_u:system_r:local_login_t tclass=netlink_route_socket

>    _
> /Bjorn
>
>
>  audit(1205311345.096:2): policy loaded auid=4294967295
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  audit(1205311345.562:3): avc:  denied  { write } for  pid=946 comm="bash"
> name="null" dev=tmpfs ino=1313 scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:device_t tclass=chr_file
>  audit(1205311345.624:4): avc:  denied  { read } for  pid=955
> comm="write_root_link" name="console" dev=tmpfs ino=1307
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t
> tclass=chr_file
>  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
>  SELinux: initialized (dev securityfs, type securityfs), not configured for
> labeling
>  audit(1205311352.640:5): avc:  denied  { mount } for  pid=1756
> comm="mount" name="/" dev=securityfs ino=1
> scontext=system_u:system_r:mount_t
> tcontext=system_u:object_r:unlabeled_t tclass=filesystem
>  Adding 977216k swap on /dev/hda1.  Priority:-1 extents:1 across:977216k
>  audit(1205311359.150:6): avc:  denied  { write } for  pid=2470
> comm="runscript.sh" name="resolv.conf" dev=hda2 ino=46223216
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:net_conf_t
> tclass=file
>  audit(1205311359.154:7): avc:  denied  { setattr } for  pid=2525
> comm="chmod" name="resolv.conf" dev=hda2 ino=46223216
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:net_conf_t
> tclass=file
>  audit(1205311362.834:8): avc:  denied  { search } for  pid=3168
> comm="syslog-ng" name="lib" dev=hda2 ino=33576422
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=dir
>  audit(1205311362.834:9): avc:  denied  { read } for  pid=3168
> comm="syslog-ng" name="syslog-ng.persist" dev=hda2 ino=33576402
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=file
>  audit(1205311362.834:10): avc:  denied  { getattr } for  pid=3168
> comm="syslog-ng" path="/var/lib/syslog-ng.persist" dev=hda2 ino=33576402
> scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_lib_t
> tclass=file
>  eth0: link up, 100Mbps, full-duplex
>  audit(1205311366.898:11): avc:  denied  { nlmsg_write } for  pid=3576
> comm="dhcpcd" scontext=system_u:system_r:dhcpc_t
> tcontext=system_u:system_r:dhcpc_t tclass=netlink_route_socket
>  audit(1205307770.810:12): avc:  denied  { create } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:13): avc:  denied  { bind } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:14): avc:  denied  { getattr } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:15): avc:  denied  { write } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:16): avc:  denied  { nlmsg_read } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket
>  audit(1205307770.810:17): avc:  denied  { read } for  pid=3889
> comm="agetty" scontext=system_u:system_r:getty_t
> tcontext=system_u:system_r:getty_t tclass=netlink_route_socket


-- 
Florian Tischler
mailto:flo_list2007@×××××.at
icq#11754147
-- 
gentoo-hardened@l.g.o mailing list