Re: [gentoo-hardened] SELinux_startup_errors

[Chris PeBenito]

On Fri, 2004-01-30 at 13:27, Andy Dustman wrote:
> I had my own problems with the recent LiveCD. It would get a good way
> through the bootstrap and then it would lock up. Unfortunately, it
> always seemed to do this when I wasn't watching, and by the time I
> noticed, the screen would be blanked and pressing keys wouldn't revive
> it. The solution was to use scripts/bootstrap-2.6.sh: That worked the
> first time. I had intended to install gentoo-dev-sources anyway.

I'll have to look into this bootstrap-2.6.sh, I'm not familar with it. 
Then I'll fix up the install guide.

> Additionally, I cannot find any of the stages on the Live CD. It seems
> like they should be there, since it's 100 MB, but I have the CD mounted

The loopback isn't compressed, so thats why its 100MB.  I decided not to
put any stages on the livecd, since the livecd and the stages are still
experimental.

> I still don't really have a good grip on SELinux, though. For example,
> once I'm in enforcing mode, it seems that I can't run emerge, even if
> I'm using the sysadm_r role. The reason for this seemed to be that
> /usr/bin/emerge was a symlink to ../lib/portage/bin/emerge. I added
> /usr/bin/emerge into the profile, and relabeled, and then it worked.

Hmm, this sounds odd.  But as is, the policy is to have a separate
portage_r role that can use portage, so there can be a separation of
sysadm_r and portage.  Then, optionally, there is an auto-transition for
sysadm_t that can be uncommented.  However, it doesn't seem that anyone
wants to use the portage_r, so I'm strongly considering removing the
role, and just using the more natural auto-transition.  Are there any
comments on this?

> Another related problem is with portage itself. Emerge won't let you
> merge packages unless you are actually root. With SELinux, it's not a
> matter of being root, but being in the sysadm_r role. So it prevents a
> normal user with the right role from merging packages, even though they
> have the correct privileges from a filesystem perspective; and it allows

If the user is not in the portage_t domain, then they don't have the
correct privileges from a fs perspective.

> (Well, mostly. A user in the portage
> group ought to at least be able to build binary packages, I think.)

The policy doesn't support this, and probably never will.  Access to
portage is tightly controlled, since it allows modification of all files
on the system.

> On the systems I have now, I give someone else sudo access so they can
> update package. I don't know if sudo is really compatible with SELinux

The requirements for running portage are root/su/sudo/uid 0, and either
portage_r or a auto transition from sysadm_t to portage_t.

> or not. But presently to do updates, you'd have to su, which requires
> giving out the root password, and then newrole -r sysadm_t.

Generally whats done is to newrole, then su/sudo.  Even if you gave out
the root password to certain privileged users, you can still remove root
from the users file, and then root will be limited to user_r, as is done
on the demo machine.  Then if someone logs in as root, they can't really
do anything beyond a regular user.  But if you log in from another
account that can newrole to sysadm_r, they can su/sudo and administrate
the machine normally (which is what we do on the demo machine).  The key
is that SELinux maintains a user identity which is separate from the
uid.  The uid can change, but the identity doesn't.  See the policy
overview for more info.

http://www.gentoo.org/proj/en/hardened/selinux/selinux-policy.xml

There has been talk of trying to merge newrole and sudo, but nothing has
materialized afaik.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243