[gentoo-hardened] Troubles with policies (errors?) (2006.1)

[Jens Neuhalfen]

Hello everyone,

I am trying to get my xen-domU (/etc/make.profile ->
/usr/portage/profiles/selinux/x86/2006.1) to work with SeLinux. After
some experiments using the strict policy I thought that the targeted
policy might hold less Access-Denials (just to have something to build
on. After all, this is a server and I want it to run under 'strict').

Using targeted, I get the following from audit2allow -d (booting in
enforcing mode):

allow httpd_t var_run_t:sock_file unlink;

DHCP did not work, though. So, "seteforce 0", "dhcpcd -n eth0" and - it
works.

Output from audit2allow:

# audit2allow -d
allow dhcpc_t self:netlink_route_socket nlmsg_write;
allow httpd_t var_run_t:sock_file unlink;


My results of 'upgrading' the dhcp-policy to unstable follow below.


Still using the stable policy:

Another vexing thing is that "seinfo" fails:
# seinfo
Could not open policy /etc/selinux/targeted/policy/policy.21!

Although a policy.20 file exists. To get around that I
switched from  policy-version = 20 to
policy-version = 21
in semanage.conf and called semodule -B, semodule -R to build and load
the policy.21 file. seinfo now gives no error, but no output too.

# seinfo /etc/selinux/targeted/policy/policy.21
#

compared to

# seinfo /etc/selinux/targeted/policy/policy.20

Statistics for policy file: /etc/selinux/targeted/policy/policy.20
Policy Version & Type: v.20 (binary, non-MLS)
...





Booting and calling audit2allow -d gives me a much longer list:
allow dhcpc_t self:netlink_route_socket nlmsg_write;
allow getty_t urandom_device_t:chr_file read;
allow gssd_t etc_t:file write;
allow hostname_t urandom_device_t:chr_file read;
allow iptables_t urandom_device_t:chr_file read;
allow mount_t urandom_device_t:chr_file read;
allow mysqld_t urandom_device_t:chr_file read;
allow nfsd_t selinux_config_t:dir getattr;
allow portmap_t urandom_device_t:chr_file read;
allow restorecon_t urandom_device_t:chr_file read;
allow syslogd_t urandom_device_t:chr_file read;

I checked, if the modules are loaded:
# semodule -l
apache  1.4.1
dhcp    1.2.0
ftp     1.3.0
logrotate       1.3.1
mysql   1.3.0
portmap 1.3.0
rpc     1.3.1
screen  1.1.0

seems ok to me.


That was the point where I tried to switch to unstable (after all it is
not a productive system):



I then switched to the unstable policies ("~x86") but they gave me even
stranger errors (see below).  I did not find any bug in bugzilla
(dccp_recv) so I thought posting it on the list might be more appropriate.

(add all sec-policy/* to /etc/portage/package.keywords)

 emerge sec-policy/selinux-base-policy -1 -pv

Will emerge sec-policy/selinux-base-policy-20070329 which will fail at
installation time with

...
 * Inserting base module into targeted module store.
libsepol.print_missing_requirements: apache's global requirements were
not met: bool httpd_enable_ftp_server
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!
>>> sec-policy/selinux-base-policy-20070329 merged.


Trying to emerge the apache-policy (sec-policy/selinux-apache-20070329)
 gets me an error
 * Inserting the following modules into the targeted module store: apache
libsepol.permission_copy_callback: Module apache depends on permission
dccp_recv in class node, not satisfied
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!
>>> sec-policy/selinux-apache-20070329 merged.

Emerging the DHCP-policy is just the same as the apache policy.

Googeling for the "dccp_recv" permission I found that Chris committed
this new permission into the Tresys Reference Policy. I checked out the
latest version of the ref-policy, compiled and installed it but got more
Access-vector denials than before (I reverted that change too).

I am more than willing to experiment (SeLinux seems 'right') and
understand but now I need some 'external insights' :-)


Btw: I am using a custom build (fedora-sources) Kernel 2.6.19.


Jens
-- 
gentoo-hardened@g.o mailing list