[gentoo-hardened] Unsolved AVCs on a hardened/linux/amd64/selinux

[Vincent Brillault]

Hi all,

I've installed my first SELinux enhanced Gentoo Hardened a few days 
ago.
A lot of avc appears in the logs and I fear that those would crash the 
server if I try to boot in enforcing mode.

Basic configuration details :
Kernel:  3.2.2-hardened-r1
Profile: hardened/linux/amd64/selinux
sec-policy: based on the hardened-dev overlay:
   - sec-policy/selinux-base-policy: 2.20120215-r4
   - sec-policy/selinux-base: 2.20120215-r4
Policy: strict
Mode: permissive

First of all, I think that the current policy lakes a context rules for 
ip6tables, I fixed it by adding the following rule (The context used 
here comes from /var/lib/iptables):
/var/lib/ip6tables(/.*)?    gen_context(system_u:object_r:initrc_tmp_t)

Then, another rule seems to be missing from nginx. I think it's caused 
by a the following line in my configuration: “include 
/etc/nginx/vhosts.d/*.conf;” that result in :
Mar  2 11:10:47 ***** kernel: [  968.008780] type=1400 
audit(1330683047.439:55): avc:  denied  { read } for  pid=2257 
comm="nginx" name="vhosts.d" dev="sda1" ino=393764 
scontext=system_u:system_r:nginx_t 
tcontext=system_u:object_r:nginx_conf_t tclass=dir

I added the following rule to resolve this avc:
allow nginx_t nginx_conf_t:dir read;

I don't have enough experience to understand the following avcs that 
come after every boot (after I log in) :

Mar  2 10:54:51 ***** kernel: [    3.669361] type=1400 
audit(1330682082.668:3): avc:  denied  { getattr } for  pid=736 
comm="mount" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:mount_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:54:51 ***** kernel: [    3.803100] type=1400 
audit(1330682082.802:4): avc:  denied  { getattr } for  pid=751 
comm="restorecon" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:setfiles_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:54:51 ***** kernel: [    6.859414] type=1400 
audit(1330682086.290:5): avc:  denied  { getattr } for  pid=968 
comm="pvscan" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:lvm_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:54:51 ***** kernel: [    7.767982] type=1400 
audit(1330682087.198:6): avc:  denied  { setsched } for  pid=1010 
comm="mount" scontext=system_u:system_r:mount_t 
tcontext=system_u:system_r:kernel_t tclass=process
Mar  2 10:54:51 ***** kernel: [    8.354336] type=1400 
audit(1330682087.785:7): avc:  denied  { write } for  pid=1062 comm="rm" 
name="console" dev="sda1" ino=423795 scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:lib_t tclass=dir
Mar  2 10:54:51 ***** kernel: [    8.354358] type=1400 
audit(1330682087.785:8): avc:  denied  { remove_name } for  pid=1062 
comm="rm" name="keymap" dev="sda1" ino=393305 
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:lib_t 
tclass=dir
Mar  2 10:54:51 ***** kernel: [    8.354373] type=1400 
audit(1330682087.785:9): avc:  denied  { unlink } for  pid=1062 
comm="rm" name="keymap" dev="sda1" ino=393305 
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:lib_t 
tclass=file
Mar  2 10:54:51 ***** kernel: [    8.365926] type=1400 
audit(1330682087.796:10): avc:  denied  { create } for  pid=1063 
comm="mkdir" name=".test.1056" scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:var_run_t tclass=dir
Mar  2 10:54:51 ***** kernel: [    8.719682] type=1400 
audit(1330682088.150:11): avc:  denied  { getattr } for  pid=1175 
comm="fuser" path="socket:[1859]" dev="sockfs" ino=1859 
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:udev_t 
tclass=unix_stream_socket
Mar  2 10:54:51 ***** kernel: [    8.720802] type=1400 
audit(1330682088.151:12): avc:  denied  { getattr } for  pid=1176 
comm="fuser" path="socket:[1860]" dev="sockfs" ino=1860 
scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:udev_t 
tclass=netlink_kobject_uevent_socket
Mar  2 10:54:51 ***** kernel: [    8.849343] type=1400 
audit(1330682088.280:13): avc:  denied  { setattr } for  pid=1271 
comm="chmod" name="/" dev="tmpfs" ino=3021 
scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:tmp_t 
tclass=dir
Mar  2 10:54:51 ***** kernel: [    9.151457] type=1400 
audit(1330682088.582:14): avc:  denied  { add_name } for  pid=1299 
comm="runscript.sh" name="unicode" scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:lib_t tclass=dir
Mar  2 10:54:54 ***** kernel: [   15.470860] type=1400 
audit(1330682094.901:22): avc:  denied  { getattr } for  pid=1735 
comm="openvpn" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:openvpn_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:54:56 ***** kernel: [   16.646182] type=1400 
audit(1330682096.077:23): avc:  denied  { add_name } for  pid=1804 
comm="runscript.sh" name="wrapper_loop.pid" 
scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:asterisk_var_run_t tclass=dir
Mar  2 10:54:56 ***** kernel: [   16.646272] type=1400 
audit(1330682096.077:24): avc:  denied  { create } for  pid=1804 
comm="runscript.sh" name="wrapper_loop.pid" 
scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:asterisk_var_run_t tclass=file
Mar  2 10:54:56 ***** kernel: [   16.646389] type=1400 
audit(1330682096.077:25): avc:  denied  { write } for  pid=1804 
comm="runscript.sh" name="wrapper_loop.pid" dev="sda1" ino=524346 
scontext=system_u:system_r:initrc_t 
tcontext=system_u:object_r:asterisk_var_run_t tclass=file
Mar  2 10:54:56 ***** kernel: [   16.903405] type=1400 
audit(1330682096.334:26): avc:  denied  { setattr } for  pid=1805 
comm="asterisk" name="asterisk" dev="sda1" ino=568583 
scontext=system_u:system_r:asterisk_t 
tcontext=system_u:object_r:asterisk_var_run_t tclass=dir
Mar  2 10:54:58 ***** kernel: [   19.082552] type=1400 
audit(1330682098.513:27): avc:  denied  { getattr } for  pid=1838 
comm="mount" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:mount_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:54:58 ***** kernel: [   19.340996] type=1400 
audit(1330682098.772:28): avc:  denied  { dac_override } for  pid=1865 
comm="nginx" capability=1  scontext=system_u:system_r:nginx_t 
tcontext=system_u:system_r:nginx_t tclass=capability
Mar  2 10:54:59 ***** kernel: [   20.095608] type=1400 
audit(1330682099.526:29): avc:  denied  { getattr } for  pid=1895 
comm="sed" name="/" dev="sysfs" ino=1 
scontext=system_u:system_r:postfix_master_t 
tcontext=system_u:object_r:sysfs_t tclass=filesystem
Mar  2 10:55:12 ***** kernel: [   33.256625] type=1400 
audit(1330682112.687:30): avc:  denied  { search } for  pid=2033 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=system_u:system_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=dir
Mar  2 10:55:12 ***** kernel: [   33.256688] type=1400 
audit(1330682112.687:31): avc:  denied  { getattr } for  pid=2033 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=system_u:system_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:55:14 ***** kernel: [   35.354952] type=1400 
audit(1330682114.785:32): avc:  denied  { search } for  pid=2042 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=staff_u:staff_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=dir
Mar  2 10:55:14 ***** kernel: [   35.355060] type=1400 
audit(1330682114.786:33): avc:  denied  { getattr } for  pid=2042 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=staff_u:staff_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem
Mar  2 10:55:19 ***** kernel: [   39.687063] type=1400 
audit(1330682119.117:34): avc:  denied  { transition } for  pid=2045 
comm="newrole" path="/bin/zsh" dev="sda1" ino=563099 
ipaddr=***.***.***.*** scontext=staff_u:staff_r:newrole_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=process
Mar  2 10:55:19 ***** kernel: [   39.687937] type=1400 
audit(1330682119.118:35): avc:  denied  { rlimitinh } for  pid=2045 
comm="zsh" ipaddr=***.***.***.*** scontext=staff_u:staff_r:newrole_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=process
Mar  2 10:55:19 ***** kernel: [   39.687958] type=1400 
audit(1330682119.118:36): avc:  denied  { siginh } for  pid=2045 
comm="zsh" ipaddr=***.***.***.*** scontext=staff_u:staff_r:newrole_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=process
Mar  2 10:55:19 ***** kernel: [   39.689198] type=1400 
audit(1330682119.120:37): avc:  denied  { noatsecure } for  pid=2045 
comm="zsh" ipaddr=***.***.***.*** scontext=staff_u:staff_r:newrole_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=process
Mar  2 10:55:19 ***** kernel: [   39.714856] type=1400 
audit(1330682119.145:38): avc:  denied  { getattr } for  pid=2045 
comm="sudo" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=staff_u:sysadm_r:sysadm_sudo_t 
tcontext=system_u:object_r:sysfs_t tclass=filesystem
Mar  2 10:55:19 ***** kernel: [   39.812201] type=1400 
audit(1330682119.243:39): avc:  denied  { search } for  pid=2046 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=staff_u:sysadm_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=dir
Mar  2 10:55:19 ***** kernel: [   39.812263] type=1400 
audit(1330682119.243:40): avc:  denied  { getattr } for  pid=2046 
comm="unix_chkpwd" name="/" dev="sysfs" ino=1 ipaddr=***.***.***.*** 
scontext=staff_u:sysadm_r:chkpwd_t tcontext=system_u:object_r:sysfs_t 
tclass=filesystem


More information concerning my configuration:
#semodule -l
apache  2.3.0
application     1.2.0
asterisk        1.10.0
authlogin       2.3.0
bind    1.11.0
bootloader      1.13.0
clock   1.6.0
consoletype     1.10.0
cron    2.4.0
crontabr2e      1.0.0
dmesg   1.3.0
fixes   1.0.0 (ip6table fix)
fstools 1.15.0
getty   1.9.0
hostname        1.7.0
hotplug 1.15.0
init    1.18.0
iptables        1.13.0
libraries       2.8.0
locallogin      1.11.0
logging 1.18.0
logrotate       1.14.0
lvm     1.13.0
miscfiles       1.9.0
modutils        1.12.0
mount   1.14.0
mta     2.4.0
netutils        1.11.0
nginx   1.0.10
nginxfix        1.0.10
nscd    1.10.0
openvpn 1.11.0
portage 1.12.0
postfix 1.13.0
raid    1.11.0
rsync   1.11.0
screen  2.5.0
selinuxutil     1.16.0
ssh     2.3.0
staff   2.3.0
storage 1.10.0
su      1.12.0
sudo    1.9.0
sysadm  2.4.0
sysnetwork      1.13.0
udev    1.14.0
unprivuser      2.3.0
userdomain      4.7.0
usermanage      1.17.0
xdg     1.0.0


#getsebool -a
allow_execheap --> off
allow_execmem --> off
allow_execmod --> off
allow_execstack --> off
allow_httpd_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_sys_script_anon_write --> off
allow_httpd_user_script_anon_write --> off
allow_mount_anyfile --> off
allow_polyinstantiation --> off
allow_ptrace --> off
allow_rsync_anon_write --> off
allow_ssh_keysign --> off
allow_user_mysql_connect --> off
allow_user_postgresql_connect --> off
allow_ypbind --> off
console_login --> off
cron_can_relabel --> off
fcron_crond --> off
gentoo_nginx_can_network_connect --> off
gentoo_nginx_can_network_connect_http --> on
gentoo_nginx_enable_http_server --> on
gentoo_nginx_enable_imap_server --> off
gentoo_nginx_enable_pop3_server --> off
gentoo_nginx_enable_smtp_server --> off
gentoo_try_dontaudit --> on
gentoo_wait_requests --> off
global_ssp --> on
httpd_builtin_scripting --> off
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_enable_cgi --> off
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_ssi_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
init_upstart --> off
mail_read_content --> off
mmap_low_allowed --> off
named_write_master_zones --> off
nfs_export_all_ro --> off
nfs_export_all_rw --> off
openvpn_enable_homedirs --> off
portage_use_nfs --> off
rsync_export_all_ro --> on
secure_mode --> on
secure_mode_insmod --> off
secure_mode_policyload --> off
ssh_sysadm_login --> off
use_nfs_home_dirs --> off
use_samba_home_dirs --> off
user_direct_mouse --> off
user_dmesg --> off
user_ping --> off
user_rw_noexattrfile --> off
user_tcp_server --> off
user_ttyfile_stat --> off

#fstab :
/dev/sda1               /               ext4            noatime         
                                                                         
0 1
/dev/sda3               none            swap            sw              
                                                                         
0 0
proc                    /proc           proc            defaults        
                                                                         
0 0
tmpfs                   /tmp            tmpfs           
defaults,noexec,nosuid,rootcontext=system_u:object_r:tmp_t               
                0 0
udev                    /dev            tmpfs           
rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10m,mode=755 
     0 0
none                    /selinux        selinuxfs       noauto          
                                                                         
0 0

#mounts :
rootfs on / type rootfs (rw)
/dev/root on / type ext4 
(rw,seclabel,noatime,user_xattr,barrier=1,data=ordered)
selinuxfs on /selinux type selinuxfs (rw,relatime)
proc on /proc type proc (rw,relatime)
rc-svcdir on /lib64/rc/init.d type tmpfs 
(rw,rootcontext=system_u:object_r:initrc_state_t,seclabel,nosuid,nodev,noexec,relatime,size=1024k,mode=755)
sysfs on /sys type sysfs (rw,seclabel,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs 
(rw,nosuid,nodev,noexec,relatime)
udev on /dev type tmpfs 
(rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10240k,mode=755)
devpts on /dev/pts type devpts 
(rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620)
shm on /dev/shm type tmpfs 
(rw,rootcontext=system_u:object_r:tmpfs_t,seclabel,nosuid,nodev,noexec,relatime)
tmpfs on /tmp type tmpfs 
(rw,noexec,nosuid,rootcontext="system_u:object_r:tmp_t")
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc 
(rw,noexec,nosuid,nodev)

I think something about /sys mount point is missing in my fstab but I'm 
unable to find anything about that in the web.

Thanks,
Vincent Brillault