From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1RF3uf-0008O0-U1 for garchives@archives.gentoo.org; Sat, 15 Oct 2011 13:04:30 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 20BB121C1FC; Sat, 15 Oct 2011 13:04:18 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id C23E921C1FC for ; Sat, 15 Oct 2011 13:04:17 +0000 (UTC) Received: from pelican.gentoo.org (unknown [66.219.59.40]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 260CA1B4021 for ; Sat, 15 Oct 2011 13:04:17 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by pelican.gentoo.org (Postfix) with ESMTP id 3EBFC80042 for ; Sat, 15 Oct 2011 13:04:16 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <772e60f6cd55d1189c4a1023fbf56cc036e510a7.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/ X-VCS-Repository: proj/hardened-docs X-VCS-Files: xml/selinux/hb-using-configuring.xml X-VCS-Directories: xml/selinux/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 772e60f6cd55d1189c4a1023fbf56cc036e510a7 Date: Sat, 15 Oct 2011 13:04:16 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: X-Archives-Hash: 6df0944b01daa9efc424a68c1a58ef90 commit: 772e60f6cd55d1189c4a1023fbf56cc036e510a7 Author: Sven Vermeulen siphos be> AuthorDate: Thu Oct 13 19:17:05 2011 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Thu Oct 13 19:17:05 2011 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=3Dproj/hardened-docs= .git;a=3Dcommit;h=3D772e60f6 Lots of updates on file label management, also introduce booleans --- xml/selinux/hb-using-configuring.xml | 374 ++++++++++++++++++++++++++++= +++++- 1 files changed, 372 insertions(+), 2 deletions(-) diff --git a/xml/selinux/hb-using-configuring.xml b/xml/selinux/hb-using-= configuring.xml index 78ace4f..1a3f536 100644 --- a/xml/selinux/hb-using-configuring.xml +++ b/xml/selinux/hb-using-configuring.xml @@ -287,8 +287,378 @@ Within SELinux, access privileges are based on the = label given on the originating part (called the domain) and its target resource. For instance, a process running in the passwd_t domain wants to read (=3D pr= ivilege) the file /etc/shadow which is labeled shadow_t (=3D the tar= get -resouce). It comes to no surprise then that the majority of SELinux -administration is (re)labeling the resources. +resource). It comes to no surprise then that the majority of SELinux +administration is (re)labeling the resources correctly (and ensuring the= ir label +stays correct). +

+ + + + +Getting File Label(s) + + +

+There are many ways to relabel commands, and none of them are equal to a= nother. +But before we explain this in more detail, let's first take a look at a = few file +labels (and how you can query them). +

+ +

+In SELinux, labels are given on a file level through the file systems' a= bility +to keep extended attributes. For SELinux, the attribute is called +security.selinux and can be obtained through getfattr: +

+ +
+$ getfattr -n security.selinux /etc/hosts
+# file: etc/hosts
+security.selinux=3D"system_u:object_r:net_conf_t"
+
+ +

+Of course, getting the file attribute this way is time consuming and not= that +flexible. For this purpose, most important applications (including +coreutils) are made SELinux-aware. These applications mostly use = the +-Z option to display the SELinux context information. In case of = files, +this means the extended attribute content: +

+ +
+$ ls -Z /etc/hosts
+system_u:object_r:net_conf_t   /etc/hosts
+
+ +

+Other commands exist that display the context as it should be, like +matchpathcon. However, their purpose is to query the SELinux poli= cy on +your system to find out what the policy ought to be, not what it is: +

+ +
+$ ls -Z /etc/make.conf
+staff_u:object_r:etc_t    /etc/make.conf
+$ matchpathcon /etc/make.conf
+/etc/make.conf            system_u:object_r:portage_conf_t
+
+ + + + +Setting File Label(s) + + +

+Now how can you manipulate file labels? Well, first of all: you will not= be +allowed to change the file labels of any possible file (not even if you = are the +owner of that file) unless the SELinux policy allows you to. These allow= rules +are made on two privilege types: which labels are you allowed to change +(relabelfrom) and to which labels are you allowed to change +(relabelto). You can query these rules through sesearch: +

+ +
+# From which label on files (-c) is user_t (-s) allowed (-A) to=
 relabel from (-p)?
+$ sesearch -s user_t -c file -p relabelfrom -A
+[...]
+allow user_t mozilla_home_t : file { ... relabelfrom =
relabelto } ;
+
+ +

+If you have the permission, then you can use chcon to chan= ge the +context of a file: +

+ +
+$ ls -Z strace.log
+staff_u:object_r:user_home_t  strace.log
+$ chcon -t mutt_home_t strace.log
+$ ls -Z strace.log
+staff_u:object_r:mutt_home_t  strace.log
+
+ +

+If you do not hold the right privileges, you will get a descriptive erro= r +message: +

+ +
+$ chcon -t shadow_t strace.log
+chcon: failed to change context of `strace.log' to `staff_u:object_r:sha=
dow_t': Permission denied
+
+ +

+Now, if you now think that chcon is all you need, you're wrong. T= he +chcon command does nothing more than what it sais - change contex= t. But +when the system relabels files, these changes are gone. Relabeling files= is +often done to ensure that the file labels are correct (as in: the labels= match +what the SELinux policy sais they ought to be). The SELinux policy conta= ins, for +each policy module, the list of files, directories, sockets, ... and the= ir +appropriate file context (label). +

+ +

+We will look at SELinux policy modules later, but below you'll find an e= xcerpt +from such a definition, for the mozilla module: +

+ +
+/usr/bin/firefox-bin                            -- gen_context(system_u:=
object_r:mozilla_exec_t,s0)
+/usr/bin/mozilla-[0-9].*                        -- gen_context(system_u:=
object_r:mozilla_exec_t,s0)
+/usr/bin/mozilla-bin-[0-9].*                    -- gen_context(system_u:=
object_r:mozilla_exec_t,s0)
+/usr/lib(64)?/galeon/galeon                     -- gen_context(system_u:=
object_r:mozilla_exec_t,s0)
+/usr/lib(64)?/netscape/.+/communicator/communicator-smotif\.real -- gen_=
context(system_u:object_r:mozilla_exec_t,s0)
+/usr/lib(64)?/netscape/base-4/wrapper           -- gen_context(system_u:=
object_r:mozilla_exec_t,s0)
+/usr/lib/[^/]*firefox[^/]*/plugin-container     -- gen_context(system_u:=
object_r:mozilla_plugin_exec_t,s0)
+/usr/lib64/[^/]*firefox[^/]*/plugin-container   -- gen_context(system_u:=
object_r:mozilla_plugin_exec_t,s0)
+
+ +

+To put the right label on a file, you can use the setfiles or +restorecon commands. Since they are both the same command (but wi= th a +slightly different way of using) we'll only talk about restorecon= for now +- more information on the setfiles command can be found in its ma= n page. +

+ +

+When you use restorecon, the application will query the SELinux p= olicy to +find out what the right label of the file should be. If it differs, it w= ill +change the label to the right setting. That means that you do not need t= o +provide the label for a file in order for the command to work. Also, +restorecon supports recursivity, so you do not need to relabel fi= les one +by one. +

+ +
+$ ls -Z /etc/make.conf
+staff_u:object_r:etc_t            /etc/make.conf
+$ restorecon /etc/make.conf
+$ ls -Z /etc/make.conf
+system_u:object_r:portage_conf_t  /etc/make.conf
+
+ +

+Finally, Gentoo also provides a useful application: rlpkg. This s= cript +relabels the files of a Gentoo package (rlpkg <packagename>= ) or, +given the right arguments, all files on the file system: +

+ +
+# Relabel the files of the firefox-bin package:
+# rlpkg firefox
+
+# Relabel all files on the file system:
+# rlpkg -a -r
+
+ + + + +Overriding the SELinux Policy File Labels + + +

+You might not always agree with the label that the SELinux policy enforc= es on +the files: you might have your files located elsewhere (a different loca= tion for +your Portage tree is a nice example) or you need to label them different= ly in +order for other applications to work. To not have to chcon these = files +over and over again, you can enhance the SELinux policy on your system w= ith +additional file context rules. These rules are used when you call +restorecon as well and override the rules provided by the SELinux= policy. +

+ +

+To add additional file context rules, you need to use the semanage +command. This command is used to manage, manipulate and update the local= SELinux +policy on your system. In this particular case, we will use the seman= age +fcontext command: +

+ +
+# Mark /mnt/gentoo/etc/make.conf as a portage_conf_t type
+# semanage fcontext -a -t portage_conf_t /mnt/gentoo/etc/make.conf
+
+# Mark /mnt/gentoo/usr/portage as portage_ebuild_t
+# semanage fcontext -a -t portage_ebuild_t "/mnt/gentoo/usr/portage(/=
.*)?"
+
+ +

+As you can see from the example, you can use wildcards. But beware about= using +wildcards: when a rule holds a wildcard, it has a lower priority than a = rule +without a wildcard. And the priority on rules with a wildcard is based o= n how +"down" the string the first occurance of a wildcard is. For more informa= tion, +please check out our FAQ o= n "How do +I know which file context rule is used for a particular file?." +

+ +

+If you want to delete a file context definition, you use semanage fco= ntext +-d: +

+ +
+# semanage fcontext -d -t portage_ebuild_t /mnt/gentoo/etc/make.conf<=
/i>
+
+ +

+Finally, to view all file context definitions (both user-set and SELinux= policy +provided), you can use semanage fcontext -l. To only see the loca= lly set, +add -C: +

+ +
+# semanage fcontext -C -l
+SELinux fcontext                          type             Context
+/opt/xxe/bin/.*\.jar                      all files        system_u:obje=
ct_r:lib_t
+/srv/virt/gentoo(/.*)?                    all files        system_u:obje=
ct_r:qemu_image_t
+
+ + + + +Customizable types + + +

+Labels on files are not that hard to understand, but you might come into= some +surprises if you do not know that there are also customizable types. +

+ +

+A customizable type is a specific type which is not touched by th= e +SELinux administration tools by default. If you want to relabel a file t= hat +currently holds a customizable type, you will need to force this through= the +commands (such as restorecon -F). +

+ +

+There are not that many customizable types by default. The list of types= that +SELinux considers as customizable are mentioned in the +customizable_types file within the +/etc/selinux/*/contexts location: +

+ +
+# cat /etc/selinux/strict/contexts/customizable_types
+mount_loopback_t
+public_content_rw_t
+public_content_t
+swapfile_t
+textrel_shlib_t
+
+ +

+Such types exist because these types are used for files whose location i= s known +not to be fixed (and as such, the SELinux policy cannot without a doubt = know if +the label on the files is correct or not). The public_content_t o= ne, +which is used for files that are readable by several services (like FTP,= web +server, ...), might give you a nice example for such a case. +

+ +

+If you look at the restorecon man page, it mentions both customiz= able +types as well as the user section. The latter is for rules that are iden= tified +in the SELinux policy as being files for an end user, like the following +definitions in the mozilla policy module: +

+ +
+HOME_DIR/\.mozilla(/.*)?      gen_context(system_u:object_r:mozilla_home=
_t,s0)
+HOME_DIR/\.netscape(/.*)?     gen_context(system_u:object_r:mozilla_home=
_t,s0)
+HOME_DIR/\.phoenix(/.*)?      gen_context(system_u:object_r:mozilla_home=
_t,s0)
+
+ +

+Although in the above example, forcing restorecon on the files is +probably correct, there are examples where you do not want this. For ins= tance, +the firefox policy by default only allows the application to write to +directories labeled mozilla_home_t. If you want to download somet= hing, +this isn't possible (unless you download it into ~/.mozilla= ). The +solution there is to label a directory (say ~/Downloads) as +mozilla_home_t.=20 +

+ + + + + +
+SELinux Policy and Booleans + +Introduction + + +

+We have dealt with users and labels now, but there is still a third aspe= ct that +we haven't touched: the SELinux policy itself. +

+ +

+The SELinux policy as offered by Gentoo Hardened is a carefully tuned SE= Linux +policy, based on the reference policy (a distribution-agnostic SELinux p= olicy) +with minor changes. Hopefully, you will not need to rewrite the policy t= o suit +it for your needs, but changes are very likely to occur here and there. +

+ + + + +Changing the SELinux Policy Behavior: Booleans + + +

+A common and user friendly way of tweaking the SELinux policy is through +booleans. A SELinux boolean, also known as a conditional, changes= how the +SELinux policy behaves based on the setting that the user provides. To m= ake this +a bit more clear, let's look at a few booleans available: +

+ +
+# getsebool -a | grep ^user
+user_direct_mouse --> off
+user_dmesg --> off
+user_ping --> on
+user_rw_noexattrfile --> off
+user_tcp_server --> off
+user_ttyfile_stat --> off
+
+ +

+Although they might not say much on first sight, these booleans alter ho= w the +SELinux policy enforces user activity (hence the booleans starting with +user_). For instance, user_ping is set to on,= so a +user is allowed to use ping. If it was set to off, the SEL= inux +policy would not allow a user to execute ping. +

+ +

+Booleans can be toggled on or off using setsebool or toggleseb= ool. +With setsebool you need to give the value (on or off) whereas +togglesebool switches the value. +

+ +
+# setsebool user_ping off
+
+ +

+By default, setsebool does not store the boolean values - after a= reboot, +the old values are used again. To persist such changes, you need to add = the +-P option: +

+ +
+# setsebool -P user_dmesg on
+
+ +

+Booleans allow administrators to tune the policy, and allow security +administrators to write policies that are flexible enough for a more wid= espread +use. In terms of Gentoo flexibility, these booleans might not be used en= ough (it +would be nice to couple these booleans on USE flags, so that a server bu= ild with +USE=3D"ldap" gets the SELinux policy to use ldap, whereas USE=3D"-ldap" = disallows +it). But still, the use of booleans is a popular method for making a mor= e +flexible SELinux policy.

=20