[gentoo-hardened] "Out of the box" SELinux policy questions...

[Mike Edenfield]

I've recently installed a few proof-of-concept hardened Gentoo servers 
at work, with the hardened toolchain + SELinux as security measures. 
I'll probably end to "training" the admins and other devs on how to 
write and configure security policy, so I'm trying to understand it 
better myself :)  The documentation from the hardened project has been 
helpful, but there's one element that I seem to be missing.

I have a good grasp on how the policy rules work, and how to write a 
policy rule, but I'm still confused on exactly *why* I should be writing 
a policy rule.  My confusion stems from the fact that there are what I 
believe to be an excessive number of avc denial messages being logged 
right out of the box, just to boot the system.  I obviously could run 
audit2allow and figure out what TE rules to add, and silence the log 
messages.  But some of the rules it recommends just look wrong to me. 
Things like this:

allow consoletype_t file_t:chr_file { getattr ioctl read write };
allow consoletype_t file_t:dir search;
allow dmesg_t file_t:chr_file { read write };

I was under the impression that nothing should ever be permitted to 
transition to file_t, and that errors referencing the file_t domain mean 
there's something mis-labelled.  In this case, it looks like 
/dev/console is the biggest culprit, but I've also 20 or so errors from 
initrc, a few from ifconfig, a half-dozen from udev.  If I install, say, 
sshd or sudo, I get more, even after merging and reloading their policy 
files.

Is this normal or expected?  Should I just add all of these rules that 
audit2allow recommends, or did I miss some key step in the installation? 
   Are there any guidelines for tracking down the cause of these errors 
and fixing them "the right way" so as not to compromise the security of 
the system with over-broad rules?  Are there any kinds of best practices 
guidelines for SELinux that I can use to explain the "why" of policy 
writing, once I get past the "how"?

Thanks for any help you can give me,

--Mike


-- 
gentoo-hardened@g.o mailing list