Re: [gentoo-hardened] selinux denials due to race conditions?

[Bill Sharer]

As a followup to my initial message (thanks to everyone for the replies)...

I realized that hotplug had been obsoleted by udev and unmerged both 
sys-apps/hotplug and sys-apps/hotplug-base.  That got rid of the 
default.hotplug denials, but I was still getting the denials on /dev 
nodes labeled as file_t.

Per Joern's comment I looked at the static /dev by doing the following

# mkdir /mnt/rawroot
# mount --bind / /mnt/rawroot
# cd /mnt/rawroot/dev

That showed me that indeed there were a mess of static nodes laying 
around in there with a file_t context.  I used setfilecon to manually 
relabel the crucial ones such as console, tty0 and null.  I'm still 
getting some denials on startup, but now they are real policy tweaks 
that need to happen.

Bill Sharer wrote:
>  I'm on the 2006.1 unstable profile for selinux and think I may have a
> race condition that results in avc denials before selinux has finished
> labeling things like /dev. For example, the first denial below appears
> to be where /etc/hotplug.d/default/default.hotplug is peeking and
> poking around with /dev/null. The denial has it as a
> system_u:object_r:file_t, but when I look at it from a running system
> I see it as a system_u:object_r:null_device_t. Should I be messing
> around in /etc/runlevels/boot to put dependencies in various scripts
> (although selinux isn't a script so how would I make it a dependency?)
>
> snippet from a dmesg:
>
> security:  5 users, 5 roles, 1376 types, 81 bools
> security:  59 classes, 61906 rules
> security:  class dccp_socket not defined in policy
> security:  permission dccp_recv in class node not defined in policy
> security:  permission dccp_send in class node not defined in policy
> security:  permission dccp_recv in class netif not defined in policy
> security:  permission dccp_send in class netif not defined in policy
> SELinux:  Completing initialization.
> SELinux:  Setting up existing superblocks.
> SELinux: initialized (dev sda5, type ext3), uses xattr
> inode_doinit_with_dentry:  context_to_sid(unlabeled) returned 22 for
> dev=sda5 ino=1938273
> audit(1182137416.171:2): avc:  denied  { ioctl } for  pid=884
> comm="default.hotplug" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.203:3): avc:  denied  { read } for  pid=889
> comm="env" name="urandom" dev=sda5 ino=732962
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.204:4): avc:  denied  { read } for  pid=884
> comm="default.hotplug" name="default.hotplug" dev=sda5 ino=1356280
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sbin_t
> tclass=file
> audit(1182137416.206:5): avc:  denied  { search } for  pid=884
> comm="default.hotplug" name="var" dev=sda5 ino=1254177
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:var_t
> tclass=dir
> audit(1182137416.221:6): avc:  denied  { search } for  pid=884
> comm="default.hotplug" name="log" dev=sda5 ino=1255669
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:var_log_t tclass=dir
> SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts
> SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts
> SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
> SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses genfs_contexts
> SELinux: initialized (dev devpts, type devpts), uses transition SIDs
> SELinux: initialized (dev eventpollfs, type eventpollfs), uses task SIDs
> SELinux: initialized (dev inotifyfs, type inotifyfs), uses genfs_contexts
> SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
> SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts
> SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
> SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
> SELinux: initialized (dev proc, type proc), uses genfs_contexts
> SELinux: initialized (dev bdev, type bdev), uses genfs_contexts
> SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts
> SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts
> audit(1182137416.259:7): policy loaded auid=4294967295
> audit(1182137416.261:8): avc:  denied  { read write } for  pid=1
> comm="init" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.275:9): avc:  denied  { ioctl } for  pid=1
> comm="init" name="tty0" dev=sda5 ino=735467
> scontext=system_u:system_r:init_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.277:10): avc:  denied  { read } for  pid=891
> comm="hotplug" name="urandom" dev=sda5 ino=732962
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.279:11): avc:  denied  { write } for  pid=891
> comm="hotplug" name="tty" dev=sda5 ino=734192
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.296:12): avc:  denied  { ioctl } for  pid=893
> comm="default.hotplug" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:hotplug_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137416.758:13): avc:  denied  { read write } for  pid=970
> comm="rc" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.033:14): avc:  denied  { read write } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.034:15): avc:  denied  { search } for  pid=994
> comm="consoletype" name="dev" dev=sda5 ino=732961
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=dir
> audit(1182137417.034:16): avc:  denied  { getattr } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.035:17): avc:  denied  { ioctl } for  pid=994
> comm="consoletype" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:consoletype_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.082:18): avc:  denied  { ioctl } for  pid=997
> comm="stty" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.172:19): avc:  denied  { getattr } for  pid=970
> comm="bash" name="null" dev=sda5 ino=733068
> scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.196:20): avc:  denied  { read write } for  pid=1001
> comm="dmesg" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:dmesg_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137417.220:21): avc:  denied  { read write } for  pid=1004
> comm="mount" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:mount_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
> audit(1182137417.478:22): avc:  denied  { read write } for  pid=1038
> comm="restorecon" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:restorecon_t
> tcontext=system_u:object_r:file_t tclass=chr_file
> audit(1182137417.716:23): avc:  denied  { write } for  pid=1042
> comm="bash" name="null" dev=tmpfs ino=2106
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:device_t tclass=chr_file
> audit(1182137417.875:24): avc:  denied  { read write } for  pid=1062
> comm="udevd" name="console" dev=sda5 ino=734292
> scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t
> tclass=chr_file
> audit(1182137418.770:25): avc:  denied  { read } for  pid=1194
> comm="modprobe" name="console" dev=tmpfs ino=2100
> scontext=system_u:system_r:insmod_t
> tcontext=system_u:object_r:device_t tclass=chr_file
> audit(1182137424.374:26): avc:  denied  { getattr } for  pid=2059
> comm="modprobe.sh" name="modprobe.conf" dev=sda5 ino=1515100
> scontext=system_u:system_r:udev_t
> tcontext=root:object_r:modules_conf_t tclass=file
> audit(1182137424.376:27): avc:  denied  { read } for  pid=2112
> comm="grep" name="modprobe.conf" dev=sda5 ino=1515100
> scontext=system_u:system_r:udev_t
> tcontext=root:object_r:modules_conf_t tclass=file

-- 
gentoo-hardened@g.o mailing list