Re: [gentoo-hardened] Confused about winbindd and SELinux

[Chris PeBenito]

On Wed, 2008-03-19 at 11:21 -0400, Mike Edenfield wrote:
> I'm trying to track down a bunch of AVC denials related to winbindd on
> one of our file servers, and I'm confused as to how winbindd is supposed
> to work with SELinux.  Specifically, it looks like the UNIX pipe used to
> talk to winbindd is in a different place on my system than SELinux
> expects to find it.
>
> I have a pipe in /tmp/.winbindd/pipe which was labelled winbind_tmp_t.
> However, when I check the file_contexts file, and the .fc files from the
> reference policy, I don't see any mention of /tmp/.winbindd.  So my
> first question is, how is this file getting a label that doesn't seem to
> exist in the policy?

The type definitely exists, its just not in the file contexts.
type_transition statements in the policy are mechanisms for changing the
default context on objects.  Its what makes it possible for 99% of the
apps to be SELinux-ignorant.

> More importantly, the interface file for samba includes an interface
> macro to grant access to winbind's communication pipe, but it looks like
> this:
>
> interface(`samba_stream_connect_winbind',`
>          gen_require(`
>                  type samba_var_t, winbind_t, winbind_var_run_t;
>          ')
>
>          files_search_pids($1)
>          allow $1 samba_var_t:dir search_dir_perms;
>
> stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t)
> ')
>
> I don't see any mention of winbind_tmp_t there, but I do see
> winbind_var_run_t.  I've also seen other posts to this list that seem to
> indicate winbind creates it's UNIX pipe in /var/run/winbindd, which *is*
> listed in file_contexts but isn't anywhere on my system.  The
> documentation for samba also makes no mention of /var/run/winbindd, but
> does specifically mention /tmp/.winbindd.

The above interface is for connecting to winbind over a unix domain
socket.  If you have a list of apps that want to communicate with
windbind over that pipe, I can fix up the policy.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243