[gentoo-hardened] heavy problems installing SELinux on new system

[Torsten Krah]

Hello.

I want to setup a new test server using gentoo's hardened project
including SELinux, trying it the first time so i am a n00b ;) at this
topic, hope u can help me.

I read the basics about and tried out the installing hotwo at:

http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml

In favour of stability i am using the selinux-2.4.26-r2 sources instead
of 2.6.x Kernels, using policy version 15.
I configured kernel and it compiles fine. XFS Support including security
lables are working.

I installed the base system up to the end, chroot_relabled all and
rebootet.

Now the first error happened - it boots, but many avc errors appeared
and i doesnt get a login after last service has startet ... without
login, no chance to do anything.

Luckily i can boot from network, so i configured system to start sshd
daemon.

So i relabeld system again like guide said and rebootet second time, all
errors still exists - however policy making/loading and relabeling
executes fine without erors.

Login via ssh works fine - dmesg output shows some errors - its still
basic installation, nothing changed and so i thought it should work
without any modifications for user root ... still it doesnt and i dont
know what to look for or whats wrong.

Well, theres another Problem. 

The command "ls -Z" dumps very often with "segmantation fault",
espacially if i am doing it in "/selinux" or at "/dev" or in "/" for
example, perhaps also at other positions - suggestions?

dmesg output shows this after reboot ( only relevant infos ) :

#############################################################################################

security:  3 users, 5 roles, 378 types
security:  31 classes, 23076 rules
SELinux:  Completing initialization.
SELinux:  Setting up existing superblocks.
SELinux: initialized (dev 03:01, type xfs), uses xattr
SELinux: initialized (dev 00:07, type selinuxfs), uses genfs_contexts
SELinux: initialized (dev 00:06, type devpts), uses transition SIDs
SELinux: initialized (dev 00:05, type pipefs), uses task SIDs
SELinux: initialized (dev 00:04, type tmpfs), uses transition SIDs
SELinux: initialized (dev 00:03, type sockfs), uses task SIDs
SELinux: initialized (dev 00:02, type proc), uses genfs_contexts
SELinux: initialized (dev 00:01, type bdev), uses genfs_contexts
SELinux: initialized (dev 00:00, type rootfs), uses genfs_contexts

avc:  denied  { search } for  pid=280 exe=/bin/bash name=run dev=03:01
ino=639641 scontext=system_u:system_r:update_modules_t
tcontext=system_u:object_r:var_run_t tclass=dir
eth0: no IPv6 routers present

avc:  denied  { search } for  pid=280 exe=/bin/bash name=src dev=03:01
ino=1888663 scontext=system_u:system_r:update_modules_t
tcontext=system_u:object_r:src_t tclass=dir

avc:  denied  { read } for  pid=280 exe=/bin/bash name=linux dev=03:01
ino=1888665 scontext=system_u:system_r:update_modules_t
tcontext=system_u:object_r:src_t tclass=lnk_file
SELinux: initialized (dev 00:08, type tmpfs), uses transition SIDs

avc:  denied  { read } for  pid=711 exe=/sbin/hwclock name=ld.so.cache
dev=03:01 ino=1156263 scontext=system_u:system_r:hwclock_t
tcontext=root:object_r:etc_t tclass=file

avc:  denied  { getattr } for  pid=711 exe=/sbin/hwclock
name=ld.so.cache dev=03:01 ino=1156263
scontext=system_u:system_r:hwclock_t tcontext=root:object_r:etc_t
tclass=file
Real Time Clock Driver v1.10f

avc:  denied  { name_bind } for  pid=2951 exe=/sbin/portmap port=1007
scontext=system_u:system_r:portmap_t tcontext=system_u:object_r:port_t
tclass=udp_socket

avc:  denied  { name_bind } for  pid=2951 exe=/sbin/portmap port=1008
scontext=system_u:system_r:portmap_t tcontext=system_u:object_r:port_t
tclass=tcp_socket

avc:  denied  { create } for  pid=2951 exe=/sbin/portmap
scontext=system_u:system_r:portmap_t
tcontext=system_u:system_r:portmap_t tclass=unix_stream_socket

avc:  denied  { connect } for  pid=2951 exe=/sbin/portmap
scontext=system_u:system_r:portmap_t
tcontext=system_u:system_r:portmap_t tclass=unix_stream_socket

avc:  denied  { name_bind } for  pid=3159 exe=/sbin/rpc.statd port=791
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:port_t
tclass=udp_socket

avc:  denied  { read write } for  pid=3159 exe=/sbin/rpc.statd
name=state dev=03:01 ino=668844 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=file

avc:  denied  { read } for  pid=3159 exe=/sbin/rpc.statd name=sm
dev=03:01 ino=668842 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=dir

avc:  denied  { create } for  pid=3159 exe=/sbin/rpc.statd
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t
tclass=tcp_socket
avc:  denied  { setopt } for  pid=3159 exe=/sbin/rpc.statd
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t
tclass=tcp_socket
avc:  denied  { bind } for  pid=3159 exe=/sbin/rpc.statd
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t
tclass=tcp_socket

avc:  denied  { name_bind } for  pid=3159 exe=/sbin/rpc.statd port=797
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:port_t
tclass=tcp_socket

avc:  denied  { listen } for  pid=3159 exe=/sbin/rpc.statd lport=32768
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t
tclass=tcp_socket

avc:  denied  { lock } for  pid=3302 exe=/usr/sbin/rpc.mountd
path=/var/lib/nfs/etab dev=03:01 ino=668840
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=file

avc:  denied  { write } for  pid=3302 exe=/usr/sbin/rpc.mountd name=nfs
dev=03:01 ino=668838 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=dir
avc:  denied  { add_name } for  pid=3302 exe=/usr/sbin/rpc.mountd
name=xtab.tmp scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=dir

avc:  denied  { create } for  pid=3302 exe=/usr/sbin/rpc.mountd
name=xtab.tmp scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=file

avc:  denied  { remove_name } for  pid=3302 exe=/usr/sbin/rpc.mountd
name=xtab.tmp dev=03:01 ino=668851 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=dir

avc:  denied  { unlink } for  pid=3302 exe=/usr/sbin/rpc.mountd
name=xtab.tmp dev=03:01 ino=668851 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:var_lib_nfs_t tclass=file

avc:  denied  { append } for  pid=3578 exe=/usr/sbin/syslog-ng
name=tty12 dev=03:01 ino=1058672 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

avc:  denied  { setattr } for  pid=3578 exe=/usr/sbin/syslog-ng
name=tty12 dev=03:01 ino=1058672 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

avc:  denied  { append } for  pid=3578 exe=/usr/sbin/syslog-ng
path=/dev/tty12 dev=03:01 ino=1058672
scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

avc:  denied  { read } for  pid=3817 exe=/sbin/agetty name=resolv.conf
dev=03:01 ino=1059627 scontext=system_u:system_r:getty_t
tcontext=system_u:object_r:net_conf_t tclass=file

avc:  denied  { getattr } for  pid=3817 exe=/sbin/agetty
name=resolv.conf dev=03:01 ino=1059627
scontext=system_u:system_r:getty_t tcontext=system_u:object_r:net_conf_t
tclass=file

avc:  denied  { write } for  pid=3830 exe=/bin/bash name=root dev=03:01
ino=1311495 scontext=root:staff_r:staff_t
tcontext=root:object_r:sysadm_home_dir_t tclass=dir

avc:  denied  { add_name } for  pid=3830 exe=/bin/bash name=dmesg.out
scontext=root:staff_r:staff_t tcontext=root:object_r:sysadm_home_dir_t
tclass=dir

avc:  denied  { create } for  pid=3830 exe=/bin/bash name=dmesg.out
scontext=root:staff_r:staff_t tcontext=root:object_r:sysadm_home_dir_t
tclass=file

avc:  denied  { getattr } for  pid=3830 exe=/bin/dmesg name=dmesg.out
dev=03:01 ino=1398031 scontext=root:staff_r:staff_t
tcontext=root:object_r:sysadm_home_dir_t tclass=file

avc:  denied  { write } for  pid=3830 exe=/bin/dmesg
path=/root/dmesg.out dev=03:01 ino=1398031 scontext=root:staff_r:staff_t
tcontext=root:object_r:sysadm_home_dir_t tclass=file


#############################################################################################

syslog-ng, portmap polycies are installed. i dont have any idea why it
doesnt work like exspected, i cant do a local login, bad for searching
errors because network boot / ssh is not avaiable all the time, i am
going to read more stuff about it - but i hope u can help me and can me
give some hints or advices where to look for mistakes.


best regards


Torsten Krah


--
gentoo-hardened@g.o mailing list