Re: [gentoo-hardened] SELinux Targeted strangeness

[Chris PeBenito]

On Tue, 2007-07-31 at 14:19 +0100, Ronan Mullally wrote:
> I've just converted a new 2007.0 amd64 hardened install to SELinux and
> selected the targeted policy.  I had some fun and games that required
> downgrading portage to 2.1.2.2, but everything seems to have gone
> relatively smoothly.
>
> However...
[...]
>  system_u:system_r:sshd_t        24605 ?        Ss     0:00  \_ sshd: ronan [priv]
>  system_u:system_r:sshd_t        24610 ?        S      0:00  |   \_ sshd: ronan@pts/1
>  user_u:system_r:system_chkpwd_t 24611 pts/1    Ss     0:00  |       \_ -bash
>  user_u:system_r:system_chkpwd_t 24616 pts/1    S      0:00  |           \_ su -
>  user_u:system_r:system_chkpwd_t 24617 pts/1    S+     0:00  |               \_ -su
>
>  system_u:system_r:local_login_t  6015 ttyS1    Ss     0:00 /bin/login --
>  root:system_r:unconfined_t       6029 ttyS1    S+     0:00  \_ -bash

This is a policy bug in base-policy.  You can hotfix your policy by
making a local policy module [1] that has:


require {
	type sshd_t;
}
unconfined_shell_domtrans(sshd_t)



[1] http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=3&chap=5

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243