Re: [gentoo-hardened] Confused about winbindd and SELinux

[Chris PeBenito]

On Thu, 2008-03-20 at 11:17 -0400, Mike Edenfield wrote:
> Chris PeBenito wrote:

> > The above interface is for connecting to winbind over a unix domain
> > socket.  If you have a list of apps that want to communicate with
> > windbind over that pipe, I can fix up the policy.
>
> Well, I have a list of apps that are trying to connect to winbind, but
> they're not using the domain from that interface.  That's kinda where my
> confusion is coming from.  The interface appears to grant access to the
> pipe from /var/cache/samba/winbindd_privileged (which is labeled
> winbind_var_run_t), but not the pipe from /tmp/.winbindd (which is
> labeled winbind_tmp_t).  My main concern was that something was wrong
> with my setup that's making winbind not cooperate with the SELinux policy.

Thats because, as I said in my previous response, the interface is for
connecting over a unix domain socket.  If we look at the macro
stream_connect_pattern(), it has:

	allow $1 $2:dir search_dir_perms;
	allow $1 $3:sock_file { getattr write };
	allow $1 $4:unix_stream_socket connectto;

no mention of pipes (fifo_files).  So to fix up the policy I have to
make a new interface for rw on winbind_tmp_t fifo_files, and then make
the appropriate domains call that interface.

> But to actually address your email :), so far I've gotten AVC's from
> these domains that I think have a legitimate reason to access winbind:
>
> crond_t, newrole_t, semanage_t (for genhomedircon), sshd_t, and the
> various *_sudo_t domains.
>
> I also got warnings from portage_t.sandbox, because it runs tar.  I can
> see allow rules already in place for portage_t.sandbox -> winbind_tmp_t
> for objects of type file, dir, and lnk_file, but I'm seeing messages for
> winbind_tmp_t:sock_file as well.
>
> There was one from run_init_t, which appears to be when it runs the
> samba startup script, and I'm not sure why it's accessing the winbind
> pipe before it transitions into the samba domains.

Are you using pam_winbind, pam_smbpass or nss_winbind on this system
too?

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243