Re: [gentoo-hardened] locked out of selinux

[Matt Harrison]

Mike Edenfield wrote:
> Markus Bartl wrote:
>
>> Sep 29 20:20:22 odin type=1400 audit(1222712401.300:3): avc:  denied
>> { read write } for  pid=1 comm="init" path="/dev/console" dev=sda3
>> ino=1485226 scontext=system_u:system_r:init_t
>> tcontext=system_u:object_r:file_t tclass=chr_file
>> Sep 29 20:20:22 odin type=1400 audit(1222712401.304:4): avc:  denied
>> { ioctl } for  pid=1 comm="init" path="/dev/tty0" dev=sda3 ino=1485112
>> scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
>> tclass=chr_file
>> Sep 29 20:20:22 odin type=1400 audit(1222712401.316:5): avc:  denied
>> { read write } for  pid=1081 comm="rc" name="console" dev=sda3
>> ino=1485226 scontext=system_u:system_r:initrc_t
>> tcontext=system_u:object_r:file_t tclass=chr_file
>> Sep 29 20:20:22 odin type=1400 audit(1222712401.364:6): avc:  denied
>> { read write } for  pid=1083 comm="consoletype" name="console"
>> dev=sda3 ino=1485226 scontext=system_u:system_r:consoletype_t
>> tcontext=system_u:object_r:file_t tclass=chr_file
>> Sep 29 20:20:22 odin type=1400 audit(1222712401.364:7): avc:  denied
>> { getattr } for  pid=1083 comm="consoletype" path="/dev/console"
>> dev=sda3 ino=1485226 scontext=system_u:system_r:consoletype_t
>> tcontext=system_u:object_r:file_t tclass=chr_file
>
> These are actually pretty harmless -- it just means your static /dev
> isn't labeled correctly.  This is because the stage3 tarballs don't have
> any SELinux information in them, so when you unpack it the /dev files
> are there with no labels, but by the time you get SELinux working enough
> to relabel your filesystems, udev has taken over /dev.
>
> If you want to get rid of these AVC's from your dmesg, you just need to
> relabel the static dev entries.  It's a bit tricky but you only need to
> do it once:
>
> # mkdir -p /mnt/realroot
> # mount -o bind / /mnt/realroot
> # setfiles -r /mnt/realroot \
>   /etc/selinux/strict/contexts/files/file_contexts \
>   /mnt/realroot/dev
> # umount /mnt/realroot

That works and I can now boot the machine in enforcing mode.

I'm still suffering some service problems. courier-imap and
courier-authlib still refuse to start in enforcing mode, they give
various errors:

type=1400 audit(1222791340.255:367): avc:  denied  { getattr } for
pid=6774 comm="courier-authlib" path="/etc/profile.env" dev=hda3
ino=62489 scontext=staff_u:sysadm_r:run_init_t
tcontext=system_u:object_r:etc_runtime_t tclass=file
type=1400 audit(1222791342.986:368): avc:  denied  { read } for
pid=6779 comm="consoletype" name="urandom" dev=tmpfs ino=3320
scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file
type=1400 audit(1222791343.676:369): avc:  denied  { read } for
pid=6811 comm="runscript.sh" name="authdaemonrc" dev=hda3 ino=62734
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:courier_etc_t tclass=file
type=1400 audit(1222791344.066:370): avc:  denied  { read } for
pid=6840 comm="runscript.sh" name="authdaemonrc" dev=hda3 ino=62734
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:courier_etc_t tclass=file

and

type=1400 audit(1222791363.237:372): avc:  denied  { getattr } for
pid=6851 comm="courier-imapd" path="/etc/profile.env" dev=hda3 ino=62489
scontext=staff_u:sysadm_r:run_init_t
tcontext=system_u:object_r:etc_runtime_t tclass=file
type=1400 audit(1222791364.978:373): avc:  denied  { read } for
pid=6856 comm="consoletype" name="urandom" dev=tmpfs ino=3320
scontext=system_u:system_r:consoletype_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file
type=1400 audit(1222791366.598:374): avc:  denied  { read } for
pid=6943 comm="runscript.sh" name="authdaemonrc" dev=hda3 ino=62734
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:courier_etc_t tclass=file
type=1400 audit(1222791366.648:375): avc:  denied  { execute } for
pid=6946 comm="env" name="courierlogger" dev=hda5 ino=49145
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:courier_exec_t tclass=file

And I'm unable to mount nfs shares, it gives me "can't get address
for....". But if I switch to permissive I can start both courier
services and nfs mounts work perfectly.

Also postfix won't start, it's permenantly stuck thinking its started
but it isn't. It failed to stop or start with messages like:

grsec: From 10.194.217.10: denied resource overstep by requesting
121724928 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:6593] uid/euid:0/0
gid/egid:0/0, parent /sbin/runscript.sh[runscript.sh:6592] uid/euid:0/0
gid/egid:0/

I tried to start it manually but I get

genesis ~ # postfix -c /etc/postfix/ start
-su: /usr/sbin/postfix: Permission denied

genesis ~ # ls -l /usr/sbin/postfix
-rwxr-xr-x+ 1 root root 71892 Sep 25 19:30 /usr/sbin/postfix

Any ideas?

Thanks

Matt