Re: [gentoo-hardened] Portage-related AVCs

[Jason Zaman]

On Wed, Nov 23, 2016 at 12:58:34PM +0000, Robert Sharp wrote:
> Hi,
>
> just done my weekly update and I noticed the following AVCs occurred
> that suggest something missing in the portage policy?
>
> type=PROCTITLE msg=audit(1479900756.052:3548):
> proctitle=6370002D61002D2D7265666C696E6B3D6175746F002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F5F707974686F6E322E372F2E002F7661722F746D702F706F72746167652F6465762D707974686F6E2F70797061782D302E392E322F696D6167652F2F
> type=PATH msg=audit(1479900756.052:3548): item=0
> name="/var/tmp/portage/dev-python/pypax-0.9.2/image/." inode=1182893
> dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00
> obj=staff_u:object_r:portage_tmp_t nametype=NORMAL
> type=CWD msg=audit(1479900756.052:3548):
> cwd="/var/tmp/portage/dev-python/pypax-0.9.2/work/elfix-0.9.2/scripts"
> type=SYSCALL msg=audit(1479900756.052:3548): arch=c000003e syscall=189
> success=yes exit=0 a0=44b69d9c40 a1=36fe2f5a763 a2=44b69d9df0 a3=1f
> items=1 ppid=21441 pid=21661 auid=4294967295 uid=0 gid=0 euid=0 suid=0
> fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="cp"
> exe="/bin/cp" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
> type=AVC msg=audit(1479900756.052:3548): avc:  denied  { relabelto }
> for  pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893
> scontext=staff_u:sysadm_r:portage_sandbox_t
> tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1
> type=AVC msg=audit(1479900756.052:3548): avc:  denied  { relabelfrom }
> for  pid=21661 comm="cp" name="image" dev="dm-0" ino=1182893
> scontext=staff_u:sysadm_r:portage_sandbox_t
> tcontext=staff_u:object_r:portage_tmp_t tclass=dir permissive=1
>
> I checked the policy for source=portage_sandbox_t and
> target=portage_tmp_t and it is:
>
> # sesearch -s portage_sandbox_t -t portage_tmp_t -Ad
> Found 5 semantic av rules:
>     allow portage_sandbox_t portage_tmp_t : lnk_file { ioctl read write
> create getattr setattr lock unlink link rename } ;
>     allow portage_sandbox_t portage_tmp_t : dir { ioctl read write
> create getattr setattr lock unlink link rename add_name remove_name
> reparent search rmdir open } ;
>     allow portage_sandbox_t portage_tmp_t : fifo_file { ioctl read write
> create getattr setattr lock append unlink link rename open } ;
>     allow portage_sandbox_t portage_tmp_t : file { ioctl read write
> create getattr setattr lock relabelfrom relabelto append unlink link
> rename execute execute_no_trans open } ;
>     allow portage_sandbox_t portage_tmp_t : sock_file { ioctl read write
> create getattr setattr lock append unlink link rename open } ;
>
> It looks to me like portage was trying to relabelto/from a directory but
> these ops are only allowed for files?

I've definitely got perms towards dirs too.
# sesearch -s portage_sandbox_t -t portage_tmp_t -A
allow portage_sandbox_t non_auth_file_type:dir { open search getattr read lock ioctl };
allow portage_sandbox_t non_auth_file_type:file { getattr read open lock ioctl };
allow portage_sandbox_t non_auth_file_type:lnk_file { read getattr };
allow portage_sandbox_t portage_tmp_t:dir { add_name link remove_name unlink write open relabelfrom search getattr rename read lock reparent create rmdir setattr relabelto ioctl };
allow portage_sandbox_t portage_tmp_t:fifo_file { link append unlink write open getattr rename read lock create setattr ioctl };
allow portage_sandbox_t portage_tmp_t:file { link append unlink write open relabelfrom getattr rename read lock execute_no_trans create execute setattr relabelto ioctl };
allow portage_sandbox_t portage_tmp_t:lnk_file { link unlink write getattr rename read lock create setattr ioctl };
allow portage_sandbox_t portage_tmp_t:sock_file { link append unlink write open getattr rename read lock create setattr ioctl };

Are you on ~arch or stable? did you just upgrade to the 2.6 userland?
What versions do you have installed of these:
sys-libs/libsepol
sys-libs/libselinux
sys-libs/libsemanage
sys-apps/checkpolicy
sys-apps/policycoreutils
dev-python/sepolgen
app-admin/setools

what does this return?
ls -al /etc/selinux/*/policy/policy.*

and in /etc/selinux/semanage.conf, do you have policy-version =  set to anything?

-- Jason

> I also spotted AVCs involving directory access to portage_tmpfs_t (and
> sandbox as the source), such as:
>
> type=PROCTITLE msg=audit(1479900586.938:3542):
> proctitle=707974686F6E322E37002F7573722F6C696236342F707974686F6E322E372F736974652D7061636B616765732F696E636C7564655F7365727665722F696E636C7564655F7365727665722E7079002D2D706F7274002F746D702F6469737463632D70756D702E656B6A3330372F736F636B6574002D2D7069645F66696C65002F
> type=PATH msg=audit(1479900586.938:3542): item=1
> name="/dev/shm/tmpgk84Lo.include_server-16244-1" inode=1246573 dev=00:13
> mode=040700 ouid=250 ogid=250 rdev=00:00
> obj=staff_u:object_r:portage_tmpfs_t nametype=DELETE
> type=PATH msg=audit(1479900586.938:3542): item=0 name="/dev/shm/"
> inode=8351 dev=00:13 mode=041777 ouid=0 ogid=0 rdev=00:00
> obj=system_u:object_r:tmpfs_t nametype=PARENT
> type=CWD msg=audit(1479900586.938:3542):
> cwd="/var/tmp/portage/dev-python/cffi-1.5.2/work/cffi-1.5.2"
> type=SYSCALL msg=audit(1479900586.938:3542): arch=c000003e syscall=84
> success=yes exit=0 a0=3a6d7c7770 a1=0 a2=0 a3=36b items=2 ppid=1
> pid=16244 auid=4294967295 uid=250 gid=250 euid=250 suid=250 fsuid=250
> egid=250 sgid=250 fsgid=250 tty=pts0 ses=4294967295 comm="python2.7"
> exe="/usr/bin/python2.7" subj=staff_u:sysadm_r:portage_sandbox_t key=(null)
> type=AVC msg=audit(1479900586.938:3542): avc:  denied  { rmdir } for
> pid=16244 comm="python2.7" name="tmpgk84Lo.include_server-16244-1"
> dev="tmpfs" ino=1246573 scontext=staff_u:sysadm_r:portage_sandbox_t
> tcontext=staff_u:object_r:portage_tmpfs_t tclass=dir permissive=1
>
> And a similar AVC for creating the same directory.
>
> Is this likely to be a policy gap or have I done something wrong or
> failed to do something I should have. I cannot provide more details
> about what was happening at the time, other than in the audit snippets
> above - it was the middle of a lengthy update process.
>
> Thanks,
>
> Robert Sharp
>