Re: [gentoo-hardened] "Out of the box" SELinux policy questions...

[Chris PeBenito]

On Tue, 2007-03-13 at 16:38 -0400, Mike Edenfield wrote:
> Chris PeBenito wrote:
> > On Tue, 2007-03-06 at 15:33 -0500, Mike Edenfield wrote:
>
> > Sorry for the slow response.  These messages are likely due to the
> > static device nodes under a udev /dev.
[cut]
> Thanks for this, and also to the person who wrote the
> previous reply recommending a static /dev.  (I meant to
> reply sooner but have been on vacation).  This actually
> eliminated a big chunk of my problems.
>
> I'm still hoping someone can point me to a more general
> tutorial on troubleshooting these types of errors.  Now that
> I'm trying to get actual services running on the system, I'm
> obviously having more of them, and I don't want to waste
> this list's time trying to explain every one of them to me
> :x  Things like this (two of which I assume are being
> generated because I'm running dhcpcd on this machine at boot):
>
> Mar 13 06:39:09 [kernel] audit(1173782339.840:57): avc:
> denied  { write } for  pid=2775 comm="runscript.sh"
> name="resolv.conf" dev=hda3 ino=1556987
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:net_conf_t tclass=file
>
> Mar 13 06:39:09 [kernel] audit(1173782339.850:58): avc:
> denied  { setattr } for  pid=2989 comm="chmod"
> name="resolv.conf" dev=hda3 ino=1556987
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:net_conf_t tclass=file
>
> Mar 13 06:39:09 [kernel] audit(1173782348.950:59): avc:
> denied  { ptrace } for  pid=4000 comm="pidof"
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:system_r:init_t tclass=process
>
> Mar 13 06:39:09 [kernel] audit(1173782348.950:60): avc:
> denied  { ptrace } for  pid=4000 comm="pidof"
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:system_r:kernel_t tclass=process
>
> Obviously, I can get rid of these by adding rules like this:
>
> allow initrc_t init_t:process ptrace;
> allow initrc_t kernel_t:process ptrace;
> allow initrc_t net_conf_t:file { setattr write };
>
> My question is more theoretical, that is, is there a reason
> why those rules aren't *already* there?

I can't really make general statements about this.  It depends on many
factors.  Sometimes its a due to a new feature of a package that the
policy does not yet account for.  Sometimes checks are added/changed.
Sometimes its simply a feature or error path that hasn't been covered
yet.  The pidof ptrace denials are an example of a check being added.

> Is it normal to have to tweak the policy files right out of the box,
> or after installing a new ebuild, and I should feel "ok" with doing
> it?

The hope is that it should work out of the box.  Since its impossible
for us to anticipate all possible conditions or maybe non-standard file
locations, a couple may pop up.

> Or does it point to a bigger problem with my install that I messed up
> and need to fix?

If those are the only denials you are receiving, I'd say you're in
pretty good shape.

I suspect that the ptrace denials can be dontaudited, i.e.

dontaudit initrc_t init_t:process ptrace;
dontaudit initrc_t kernel_t:process ptrace;

It would be nice to find out more specifically what is going on with the
other two denials, but I suspect that it will be ok to allow.  I use
dhcpcd on my server, but don't see this problem.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243