Bug 1472838 - policy contains allow rules which collide with neverallow rules
policy contains allow rules which collide with neverallow rules
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.4
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
:
Depends On:
Blocks: 1477664 1565079
  Show dependency treegraph
 
Reported: 2017-07-19 09:48 EDT by Milos Malik
Modified: 2018-04-09 06:55 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1565079 (view as bug list)
Environment:
Last Closed: 2018-04-09 06:54:37 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Milos Malik 2017-07-19 09:48:00 EDT
Description of problem:
* the fact that expand-check is disabled by default in /etc/selinux/semanage.conf hides a problem that policy allows actions which should not be allowed
* are these collisions tolerated / expected?

Version-Release number of selected component (if applicable):
selinux-policy-devel-3.13.1-166.el7.noarch
selinux-policy-targeted-3.13.1-166.el7.noarch
selinux-policy-3.13.1-166.el7.noarch

How reproducible:
* always

Steps to Reproduce:
# grep expand-check= /etc/selinux/semanage.conf 
expand-check=1
# semodule -B
neverallow check failed at /etc/selinux/targeted/tmp/modules/100/selinuxutil/cil:245
  (neverallow selinuxutil_typeattr_1 semanage_store_t (file (relabelto)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/selinuxutil/cil:676
      (allow restorecond_t non_auth_file_type (file (getattr relabelfrom relabelto)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/systemd/cil:1128
      (allow systemd_tmpfiles_t non_auth_file_type (file (getattr relabelfrom relabelto)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13163
  (neverallow base_typeattr_18 scsi_generic_device_t (blk_file (read)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/munin/cil:581
      (allow disk_munin_plugin_t device_node (blk_file (ioctl read getattr lock open)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13161
  (neverallow base_typeattr_17 fixed_disk_device_t (blk_file (write append)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/cmirrord/cil:105
      (allow cmirrord_t fixed_disk_device_t (blk_file (read write)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:219
      (allow system_dbusd_t fixed_disk_device_t (blk_file (read write)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/oracleasm/cil:132
      (allow oracleasm_t fixed_disk_device_t (blk_file (read write)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13160
  (neverallow base_typeattr_17 fixed_disk_device_t (chr_file (write append)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/cmirrord/cil:104
      (allow cmirrord_t fixed_disk_device_t (chr_file (read write)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:218
      (allow system_dbusd_t fixed_disk_device_t (chr_file (read write)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/oracleasm/cil:131
      (allow oracleasm_t fixed_disk_device_t (chr_file (read write)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13159
  (neverallow base_typeattr_16 fixed_disk_device_t (blk_file (read)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:219
      (allow system_dbusd_t fixed_disk_device_t (blk_file (read write)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13158
  (neverallow base_typeattr_16 fixed_disk_device_t (chr_file (read)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:218
      (allow system_dbusd_t fixed_disk_device_t (chr_file (read write)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8901
  (neverallow base_typeattr_11 proc_kcore_t (file (ioctl read write create setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/abrt/cil:296
      (allow abrt_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/collectd/cil:207
      (allow collectd_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/snmp/cil:190
      (allow snmpd_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/sysadm/cil:1266
      (allow sysadm_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:1933
      (allow svirt_sandbox_domain proc_type (file (ioctl read getattr lock open)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8900
  (neverallow base_typeattr_10 proc_kmsg_t (file (ioctl read write create setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/abrt/cil:296
      (allow abrt_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/collectd/cil:207
      (allow collectd_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/snmp/cil:190
      (allow snmpd_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/sysadm/cil:1266
      (allow sysadm_t proc_type (file (ioctl read getattr lock open)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:1933
      (allow svirt_sandbox_domain proc_type (file (ioctl read getattr lock open)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8897
  (neverallow base_typeattr_9 self (capability (sys_module)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/openvswitch/cil:107
      (allow openvswitch_t self (capability (chown setgid setuid setpcap net_admin ipc_lock sys_module sys_rawio sys_nice sys_resource)))
    <root>
    booleanif at /etc/selinux/targeted/tmp/modules/100/virt/cil:2727
    true at /etc/selinux/targeted/tmp/modules/100/virt/cil:2728
    allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:2730
      (allow svirt_lxc_net_t self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:4512
  (neverallow base_typeattr_5 self (process (setcurrent)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/seunshare/cil:34
      (allow seunshare_domain self (process (fork signal setsched getcap setcap setexec setcurrent)))

neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:4496
  (neverallow base_typeattr_1 memory_device_t (blk_file (read)))
    <root>
    allow at /etc/selinux/targeted/tmp/modules/100/munin/cil:581
      (allow disk_munin_plugin_t device_node (blk_file (ioctl read getattr lock open)))

Failed to generate binary
semodule:  Failed!
#

Expected results:
* no collisions when expand-check is enabled

Additional information:
* the same problem appears on RHEL-7.3

Note You need to log in before you can comment on or make changes to this bug.