Re: [gentoo-hardened] Vconfig on a selinux box

[Aleksander Kamil Modzelewski]

Chris PeBenito wrote:
>>I am trying to set up vlans (and several other things) on a hardened gentoo
>>box. I found out, that moving the vconfig to ifconfig_exec_t makes it almost
>>done, and I have seen that done with tc and ip, _but_ I'd like to just feel
>>sure that this is the right way.
> Here are a few questions to try to help you answer your question.
>
> 1. How conceptually similar is vconfig to ifconfig in terms of
> functionality?
I consider it logically grouped with it, and it appeared to me that the 
policy applied to other tools working "along" ifconfig (like tc or mii-tool, 
for example).

> 2. By running vconfig in ifconfig_t and adding permissions to ifconfig_t
> to make vconfig work, will this give ifconfig permissions that it
> doesn't need that could be exploited?  For example, giving ifconfig_t
> sys_admin capability or raw disk access, or reading shadow_t, or even
> something simple like writing to etc_t.
Well, it _does_ need read access to sysfs_t. But nothing more.


> If you answered "very similar" for #1 and "no" for #2, you've probably
> made the right decision.  If you say "very similar" for #1, and "yes"
> for #2, you should probably copy the ifconfig.te to vconfig.te and
> rename the types in vconfig.te (s/ifconfig/vconfig/g), and add your
> policy there.  If you say "not very similar" for #1, then .you probably
> made the wrong decision.
Well, strictly, it would be "no + rather no". Well, anyway, I have decided 
that giving the ifconfig additional permissions to make a tool from another 
package work is inelegant. So, I made  what You suggest, added 
r_dir_file(vconfig_t, sysfs_t) and removed some parts which seemed clearly 
unnecessary.

> I can't say for sure what the right course of action is until you show
> us the policy you've added. :)
I attach it now. Only file labeled as vconfig_exec_t is /sbin/vconfig.

Regards,
Aleksander Kamil Modzelewski