Re: [gentoo-hardened] SELinux - network streams

[Chris PeBenito]

On Thu, 2007-08-02 at 16:25 +0200, julien.thomas@×××××××××××××.fr wrote:
> Chris PeBenito <pebenito@g.o> a écrit :
>
> > On Thu, 2007-08-02 at 11:59 +0200, julien.thomas@×××××××××××××.fr wrote:
> >> With a deeper search in the documentation,
> >> I started to watch the uncorrect labelled daemons (initrc_t type)
> >> And here is a few response :
> >>
> >> In the existing /etc/security/selinux/file_contexts file, I found
> >> uncorrect labelling definitions for the courier-imap package.
> >>
> >> So, I put here a few suggestion about this ... as I do not know
> >> weither I should tell this here or on bugzilla (is it really a bug ? )
> >
> > Yes, it is a bug.  I guess some courier files have moved.
> >
> >> ## new entry
> >> /usr/lib(64)?/courier/courier-authlib/*
> >> system_u:object_r:courier_authdaemon_exec_t
> >> # chcon -t courier_authdaemon_exec_t /usr/lib/courier/courier-authlib/*
> >>
> >> ## new entry
> >> /usr/lib/courier-imap/*  system_u:object_r:courier_exec_t
> >> # chcon -t courier_exec_t /usr/lib/courier-imap/*
> >>
> >>
> >> (/usr/bin/imapd  --      system_u:object_r:courier_pop_exec_t)
> >> ## newentry
> >> /usr/sbin/courier-imapd system_u:object_r:courier_pop_exec_t
> >> /usr/sbin/courier-pop3d system_u:object_r:courier_pop_exec_t
> >> # chcon -t courier_pop_exec_t /usr/sbin/courier-imapd
> >> # chcon -t courier_pop_exec_t /usr/sbin/courier-pop3d
> >>
> >> (/usr/lib(64)?/courier/courier/imaplogin --
> >> system_u:object_r:courier_pop_exec_t)
> >> ## new entry
> >> /usr/sbin/imaplogin system_u:object_r:courier_pop_exec_t
> >> # chcon -t courier_pop_exec_t /usr/sbin/imaplogin
> >>
> >> ## new entry
> >> /usr/sbin/couriertcpd   --      system_u:object_r:courier_tcpd_exec_t
> >> # chcon -t courier_tcpd_exec_t couriertcpd
> >>
> >> ## new entry
> >> /usr/sbin/courierlogger --      system_u:object_r:courier_exec_t
> >> # chcon -t courier_exec_t /usr/sbin/courierlogger
> >>
> >> For the following information of the file_contexts file, I did not
> >> find anything in courier-imap
> >> -----
> >> /usr/lib(64)?/courier/courier/courierpop.*      --
> >> system_u:object_r:courier_pop_exec_t
> >> /usr/lib(64)?/courier/imapd     --      system_u:object_r:courier_pop_exec_t
> >> /usr/lib(64)?/courier/pop3d     --      system_u:object_r:courier_pop_exec_t
> >>
> >>
> >> ---
> >> At the end, here is the result I got.
> >> Most of the daemon are correctly labelled, though courierlogger is
> >> still angry (why? initrc_t and also why courier_tcpd_t though I
> >> indicated courier_exec_t !) :D
> >>
> >> ps -eZ | grep cour
> >>
> >> system_u:system_r:initrc_t       4551 ?        00:00:00 courierlogger
> > [...]
> >> system_u:system_r:courier_tcpd_t 4627 ?        00:00:00 courierlogger
> >
> > There already is a courierlogger in a courier domain; perhaps the top
> > one is a stale courierlogger that wasn't killed when you restarted
> > courier?
> >
> In fact, I have restarted the server several times as it was required
> and I still have this problem.
>
> when the courier-imap process is started, everything is working (and
> thus here are the courierlogger processes in the good domain)
>
> but when courier-authlib is  started, another courierlogger is
> launched in the initrc domain, as written in th rc file
>
> start() {
>          checkconfig || return 1
>          setauth
>          ebegin "Starting courier-authlib: ${AUTHDAEMOND}"
>          start-stop-daemon --quiet --start --pidfile "${pidfile}" --exec \
>                  /usr/bin/env ${logger} -- ${LOGGEROPTS}
> -pid="${pidfile}" -start "${AUTHLIB}/${AUTHDAEMOND}"
>          eend $?
> }
>
> so, why is courierlogger launched in the initrc domain while
> authdaemon, launched in the same script, are in the correct domain ?
> For courrier-imap, the scripts command are rather different so no
> comparison are possible ...

Unfortunately I'm not really familiar with courier, so I don't know
exactly whats happening.  From analyzing the policy, there is no way for
the courier domains to transition back to initrc_t, so if there are
multiple courierloggers, when one being in initrc_t, then its probably
because of the init script.  What I can't explain is why one is in the
correct domain but another isn't.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243