Fedora Account System
Red Hat Associate
Red Hat Customer
Created attachment 423031 [details] Output of ausearch that shows the corresponding AVCs Description of problem: In order to have an IPv6 connectivity using a Sixxs tunnel, I want to trigger the services aiccu and radvd from NetworkManager dispatcher. I have the following script: $ cat /etc/NetworkManager/dispatcher.d/20-aiccu #!/bin/sh if [ "$2" = "up" ] ; then /sbin/service aiccu start && /sbin/service radvd start || : fi if [ "$2" = "down" ] ; then /sbin/service radvd stop || : /sbin/service aiccu stop || : fi It works if SELinux is in permissive move, but gives AVCs (in enforcing mode, aiccu does not behave correctly). With audit2allow, I have created the following local.te module: ================================================================== module local 1.1; require { type insmod_exec_t; type modules_conf_t; type urandom_device_t; type syslogd_t; type ifconfig_exec_t; type sysfs_t; type port_t; type modules_dep_t; type shell_exec_t; type bin_t; type devlog_t; type proc_t; type random_device_t; type console_device_t; type modules_object_t; type aiccu_t; class tun_socket create; class chr_file { read open }; class capability { net_admin sys_module sys_tty_config }; class tcp_socket { write name_connect connect shutdown read create }; class file { execute read execute_no_trans getattr open }; class sock_file write; class netlink_route_socket { setopt nlmsg_write read bind create nlmsg_read write getattr }; class lnk_file read; class unix_dgram_socket { write create connect sendto }; class udp_socket { write read create connect }; class dir read; } #============= aiccu_t ============== allow aiccu_t bin_t:lnk_file read; allow aiccu_t devlog_t:sock_file write; allow aiccu_t ifconfig_exec_t:file { read getattr open execute execute_no_trans }; allow aiccu_t insmod_exec_t:file { read getattr open execute execute_no_trans }; allow aiccu_t modules_conf_t:dir read; allow aiccu_t modules_conf_t:file { read getattr open }; allow aiccu_t modules_dep_t:file { read getattr open }; allow aiccu_t modules_object_t:file { read open }; allow aiccu_t port_t:tcp_socket name_connect; allow aiccu_t proc_t:file { read getattr open }; allow aiccu_t random_device_t:chr_file read; allow aiccu_t self:capability net_admin; allow aiccu_t self:netlink_route_socket { setopt nlmsg_write read bind create nlmsg_read write getattr }; allow aiccu_t self:tcp_socket { read write create connect shutdown }; allow aiccu_t self:tun_socket create; allow aiccu_t self:udp_socket { write read create connect }; allow aiccu_t self:unix_dgram_socket { write create connect }; allow aiccu_t shell_exec_t:file { read execute open getattr execute_no_trans }; allow aiccu_t sysfs_t:file { read getattr open }; allow aiccu_t syslogd_t:unix_dgram_socket sendto; #!!!! This avc can be allowed using the boolean 'global_ssp' allow aiccu_t urandom_device_t:chr_file { read open }; allow aiccu_t console_device_t:chr_file open; allow aiccu_t modules_object_t:file getattr; allow aiccu_t self:capability { sys_module sys_tty_config }; ================================================================== With that local.te module compiled and loaded, I can toggle the network off and on with NetworkManager and I get the correct IPv6 connectivity. With the help of Dominick Grift <domg472> on selinux.org, my local module has been shrunk to: sysnet_domtrans_ifconfig(aiccu_t) modutils_domtrans_insmod(aiccu_t) corecmd_exec_shell(aiccu_t) kernel_read_system_state(aiccu_t) Version-Release number of selected component (if applicable): selinux-policy-3.7.19-23.fc13.noarch selinux-policy-targeted-3.7.19-23.fc13.noarch How reproducible: reproductible Steps to Reproduce: 0. Have a Sixxs account, and aiccu configured. 1. Create /etc/NetworkManager/dispatcher.d/20-aiccu (see above). 2. cnetworkmanager -o off; cnetworkmanager -o on 3. check the AVCs Actual results: - With "sudo service aiccu restart", aiccu launched from the unconfined root user, it works. - Without local.pp loaded, aiccu does not work in enforcing mode (and lots of AVCs in permissive mode). - With the local.pp described above, all is right. Expected results: - aiccu should be able to run in its confined domain. Additional info: I have attached the full AVC logs. I got them in permissive mode, without any local module, using a shell one-liner like that one: cnetworkmanager -o off; DATE=`date '+%H:%M'`; cnetworkmanager -o on; sleep 10; sudo /sbin/ausearch -ts $DATE -m avc
I have grepped in the source code of aiccu-2007.01.15-7.fc13, and I have verified that the four lines Dominick Grift are needed: corecmd_exec_shell(aiccu_t) -> because aiccu uses system(3). sysnet_domtrans_ifconfig(aiccu_t) -> because aiccu calls "ip" several times. kernel_read_system_state(aiccu_t) -> because aiccu checks /proc/net/if_inet6 modutils_domtrans_insmod(aiccu_t) -> because aiccu tries to "modprobe ipv6" if /proc/net/if_inet6 is missing.
Additionally, as /etc/aiccu.conf can contain passwords, would it be possible that this file is labeled system_u:object_r:aiccu_conf_t so that confined domains with files_read_etc_files(foobar_t) cannot read it and only the domain aiccu_t can read it?
(In reply to comment #2) > Additionally, as /etc/aiccu.conf can contain passwords, would it be possible > that this file is labeled system_u:object_r:aiccu_conf_t so that confined > domains with files_read_etc_files(foobar_t) cannot read it and only the domain > aiccu_t can read it? Great bug report. Thanks. Labeling configuration files is not only a good idea because of any sensitive information it may contain, but it is also required for confined administration (RBAC): aiccu_admin
(In reply to comment #1) > I have grepped in the source code of aiccu-2007.01.15-7.fc13, and I have > verified that the four lines Dominick Grift are needed: > > corecmd_exec_shell(aiccu_t) > -> because aiccu uses system(3). > sysnet_domtrans_ifconfig(aiccu_t) > -> because aiccu calls "ip" several times. > kernel_read_system_state(aiccu_t) > -> because aiccu checks /proc/net/if_inet6 > modutils_domtrans_insmod(aiccu_t) > -> because aiccu tries to "modprobe ipv6" if /proc/net/if_inet6 is missing. Thanks for that. I am fine with it. But I am looking into raw audit and I am seeing some suspect AVC messages. At least allow aiccu_t self:capability net_admin; allow aiccu_t port_t:tcp_socket name_connect; allow aiccu_t syslogd_t:unix_dgram_socket sendto; allow aiccu_t devlog_t:sock_file write; ... ... Could you try # service aiccu restart # ausearch -m avc -ts recent Thanks for testing.
Created attachment 423164 [details] Aiccu redone Enclosed is "Aiccu redone" Note: I have removed files_read_etc_files() and domain_use_interactive_fds(). Aiccu may need this access after all but i would like confirmation of that.
(In reply to comment #4) > (In reply to comment #1) > > I have grepped in the source code of aiccu-2007.01.15-7.fc13, and I have > > verified that the four lines Dominick Grift are needed: > > > > corecmd_exec_shell(aiccu_t) > > -> because aiccu uses system(3). > > sysnet_domtrans_ifconfig(aiccu_t) > > -> because aiccu calls "ip" several times. > > kernel_read_system_state(aiccu_t) > > -> because aiccu checks /proc/net/if_inet6 > > modutils_domtrans_insmod(aiccu_t) > > -> because aiccu tries to "modprobe ipv6" if /proc/net/if_inet6 is missing. > > Thanks for that. I am fine with it. > > But I am looking into raw audit and I am seeing some suspect AVC messages. At > least > > allow aiccu_t self:capability net_admin; That is "ip" but i also see it for comm="aiccu" so we may indeed need it. > allow aiccu_t port_t:tcp_socket name_connect; This port should be labelled: (tcp/udp:3874) sixxsconfig http://www.pc-library.com/ports/tcp-udp-port/3874/ And then i guess aiccu_t need to name_connect tp sixxsconfig_port_t tcp ports > allow aiccu_t syslogd_t:unix_dgram_socket sendto; > allow aiccu_t devlog_t:sock_file write; Looks like this is indeed for comm="aiccu" so i guess we should also add: logging_send_syslog_msg(aiccu_t)
(In reply to comment #6) > (In reply to comment #4) > > (In reply to comment #1) > > > I have grepped in the source code of aiccu-2007.01.15-7.fc13, and I have > > > verified that the four lines Dominick Grift are needed: > > > > > > corecmd_exec_shell(aiccu_t) > > > -> because aiccu uses system(3). > > > sysnet_domtrans_ifconfig(aiccu_t) > > > -> because aiccu calls "ip" several times. > > > kernel_read_system_state(aiccu_t) > > > -> because aiccu checks /proc/net/if_inet6 > > > modutils_domtrans_insmod(aiccu_t) > > > -> because aiccu tries to "modprobe ipv6" if /proc/net/if_inet6 is missing. > > > > Thanks for that. I am fine with it. > > > > But I am looking into raw audit and I am seeing some suspect AVC messages. At > > least > > > > allow aiccu_t self:capability net_admin; > > That is "ip" but i also see it for comm="aiccu" so we may indeed need it. > > > allow aiccu_t port_t:tcp_socket name_connect; > > This port should be labelled: (tcp/udp:3874) > > sixxsconfig > > http://www.pc-library.com/ports/tcp-udp-port/3874/ > > And then i guess aiccu_t need to name_connect tp sixxsconfig_port_t tcp ports > > > allow aiccu_t syslogd_t:unix_dgram_socket sendto; > > allow aiccu_t devlog_t:sock_file write; > > Looks like this is indeed for comm="aiccu" so i guess we should also add: > > logging_send_syslog_msg(aiccu_t) Yes :).
Yet looking from that perspective there should be even more. I will submit a patch with what i suspect may also be needed.
Created attachment 423188 [details] aiccu re This might look more like it.
Thanks Dominick. It looks better. Only allow aiccu_t self:unix_dgram_socket create_stream_socket_perms; can be removed. It is a part of logging_send_syslog_msg().
Created attachment 423242 [details] Output of "ausearch -m avc -ts recent" after "service aiccu restart" (selinux is permissive, and all local modules are disabled)
(In reply to comment #4) > # service aiccu restart > # ausearch -m avc -ts recent > > Thanks for testing. Hi, thank you for spending time on this bug. I have attached what you asked. It might be redundant with the first attachment of this bug (attachment #423031 [details]).
Fixed in selinux-policy-3.7.19-28.fc13
selinux-policy-3.7.19-28.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-28.fc13
selinux-policy-3.7.19-28.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-28.fc13
After the upgrade to selinux-policy-3.7.19-28.fc13: sudo semodule -r myaiccu sudo service aiccu restart and no AVC. Same after NetworkManager toggled to OFF then ON (remember my aiccu service is launched by NM-dispatcher). As far as I am concerned, the bug is fixed. Thank you all.
selinux-policy-3.7.19-28.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.