Re: [gentoo-hardened] Troubles with policies (errors?) (2006.1)

[Chris PeBenito]

On Sun, 2007-04-29 at 14:07 +0200, Jens Neuhalfen wrote:
> Hello everyone,

Theres a lot of details in here, hopefully I can digest and answer all
of these :)

> Using targeted, I get the following from audit2allow -d (booting in
> enforcing mode):
>
> allow httpd_t var_run_t:sock_file unlink;

Now that httpd is running in the right domain, it should be creating new
sockets with the right type, so this was probably just an old one.
Should be ok to be left denied, and you shouldn't see it anymore anyway.

> DHCP did not work, though. So, "seteforce 0", "dhcpcd -n eth0" and - it
> works.
[...]

which version of dhcpcd?  It works fine for me from the regular init
scripts.

> My results of 'upgrading' the dhcp-policy to unstable follow below.
>
>
> Still using the stable policy:
>
> Another vexing thing is that "seinfo" fails:
> # seinfo
> Could not open policy /etc/selinux/targeted/policy/policy.21!
>
> Although a policy.20 file exists. To get around that I
> switched from  policy-version = 20 to
> policy-version = 21
> in semanage.conf and called semodule -B, semodule -R to build and load
> the policy.21 file. seinfo now gives no error, but no output too.

You should leave this option commented out.  The semanage/semodule
should now be building the newest policy version that the compiler
supports.  If the kernel is older, it will downgrade the policy.  2.6.19
should be a v21 policy, so I'm not sure what the problem is.  What
version does `sestatus` say?

> # seinfo /etc/selinux/targeted/policy/policy.21
> #
>
> compared to
>
> # seinfo /etc/selinux/targeted/policy/policy.20
>
> Statistics for policy file: /etc/selinux/targeted/policy/policy.20
> Policy Version & Type: v.20 (binary, non-MLS)



> Booting and calling audit2allow -d gives me a much longer list:
> allow dhcpc_t self:netlink_route_socket nlmsg_write;

I'll have to do some looking on that one, its not in the upstream policy
at the moment.

> allow gssd_t etc_t:file write;

The actual denial message would be helpful in this case.

> allow getty_t urandom_device_t:chr_file read;
> allow hostname_t urandom_device_t:chr_file read;
> allow iptables_t urandom_device_t:chr_file read;
> allow mount_t urandom_device_t:chr_file read;
> allow mysqld_t urandom_device_t:chr_file read;
> allow nfsd_t selinux_config_t:dir getattr;
> allow portmap_t urandom_device_t:chr_file read;
> allow restorecon_t urandom_device_t:chr_file read;
> allow syslogd_t urandom_device_t:chr_file read;

Normally I would say these are from the hardened gcc __guard (or
whatever it is named lately), but I thought that wasn't available with
gcc 4.1+/glibc 2.4+.  I suspect that I should dontaudit this anyway.

>  emerge sec-policy/selinux-base-policy -1 -pv
>
> Will emerge sec-policy/selinux-base-policy-20070329 which will fail at
> installation time with
>
> ...
>  * Inserting base module into targeted module store.
> libsepol.print_missing_requirements: apache's global requirements were
> not met: bool httpd_enable_ftp_server
> libsemanage.semanage_link_sandbox: Link packages failed
> semodule:  Failed!
[more similar errors]

Make sure you have all the 20070329 policies merged (ignore the above
error message), and then use the script in this [1] to reinstall all the
policies in one shot.

[1] http://marc.info/?l=gentoo-hardened&m=117573233110226&w=2

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243