Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing List
subject: Make Dummy Policy Date: Wed, 20 Aug 2008 15:58:16 -0400
For those interested in the changes there were only two significant changes. The first is that the iteration through the list of classes used NULL as a sentinel value. The problem with this is that the class_to_string array actually has NULL entries in its table as place holders for the user space object classes. The second change was that it would seem at some point the initial sids table was NULL terminated. This is no longer the case so that iteration has to be done on array length instead of looking for NULL. Some statistics on the policy that it generates: The policy consists of 523 lines which contain no blank lines. Of those 523 lines 453 of them are class, permission, and initial sid definitions. These lines are usually little to no concern to the policy developer since they will not be adding object classes or permissions. Of the remaining 70 lines there is one type, one role, and one user statement. The remaining lines are broken into three portions. The first group are TE allow rules which make up 29 of the remaining lines, the second is assignment of labels to the initial sids which consist of 27 lines, and file system labeling statements which are the remaining 11. In addition to the policy.conf generated there is a single file_contexts file containing two lines which labels the entire system with base_t. This policy generates a policy.23 binary that is 7920 bytes. Dave
/ user_u:base_r:base_t
class security
class lnk_file class chr_file class blk_file class sock_file class fifo_file class socket class tcp_socket class udp_socket class rawip_socket class node class netif class netlink_socket class packet_socket class key_socket class unix_stream_socket class unix_dgram_socket class sem class msg class msgq class shm class ipc class netlink_route_socket class netlink_firewall_socket class netlink_tcpdiag_socket class netlink_nflog_socket class netlink_xfrm_socket class netlink_selinux_socket class netlink_audit_socket class netlink_ip6fw_socket class netlink_dnrt_socket class association class netlink_kobject_uevent_socket class appletalk_socket class packet class key class dccp_socket class memprotect class peer class capability2
sid kernel
sid sysctl_fs sid sysctl_kernel sid sysctl_net sid sysctl_net_unix sid sysctl_vm sid sysctl_dev sid kmod sid policy sid scmp_packet sid devnull
common file
ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton }
common socket
ioctl read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind }
common ipc
create destroy getattr setattr read write associate unix_read unix_write }
class security
compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot }
class process
fork transition sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate }
class system
ipc_info syslog_read syslog_mod syslog_console }
class capability
chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap }
class filesystem
mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }
class file
execute_no_trans entrypoint execmod open }
class dir
add_name remove_name reparent search rmdir open }
class fd
use
class lnk_file
class chr_file
execute_no_trans entrypoint execmod open }
class blk_file
open
class sock_file
class fifo_file
open
class socket
class tcp_socket
connectto newconn acceptfrom node_bind name_connect }
class udp_socket
node_bind
class rawip_socket
node_bind
class node
tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send enforce_dest dccp_recv dccp_send recvfrom sendto }
class netif
tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send ingress egress }
class netlink_socket
class packet_socket
class key_socket
class unix_stream_socket
connectto newconn acceptfrom }
class unix_dgram_socket
class sem
class msg
send receive }
class msgq
enqueue
class shm
lock
class ipc
class netlink_route_socket
nlmsg_read nlmsg_write }
class netlink_firewall_socket
nlmsg_read nlmsg_write }
class netlink_tcpdiag_socket
nlmsg_read nlmsg_write }
class netlink_nflog_socket
class netlink_xfrm_socket
nlmsg_read nlmsg_write }
class netlink_selinux_socket
class netlink_audit_socket
nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv }
class netlink_ip6fw_socket
nlmsg_read nlmsg_write }
class netlink_dnrt_socket
class association
sendto recvfrom setcontext polmatch }
class netlink_kobject_uevent_socket
class appletalk_socket
class packet
send recv relabelto flow_in flow_out forward_in forward_out }
class key
view read write search link setattr create }
class dccp_socket
node_bind name_connect }
class memprotect
mmap_zero
class peer
recv
class capability2
mac_override mac_admin }
type base_t;
allow base_t base_t:security *; allow base_t base_t:process *; allow base_t base_t:system *; allow base_t base_t:capability *; allow base_t base_t:filesystem *; allow base_t base_t:file *; allow base_t base_t:dir *; allow base_t base_t:fd *; allow base_t base_t:lnk_file *; allow base_t base_t:chr_file *; allow base_t base_t:blk_file *; allow base_t base_t:sock_file *; allow base_t base_t:fifo_file *; allow base_t base_t:socket *; allow base_t base_t:tcp_socket *; allow base_t base_t:udp_socket *; allow base_t base_t:rawip_socket *; allow base_t base_t:node *; allow base_t base_t:netif *; allow base_t base_t:netlink_socket *; allow base_t base_t:packet_socket *; allow base_t base_t:key_socket *; allow base_t base_t:unix_stream_socket *; allow base_t base_t:unix_dgram_socket *; allow base_t base_t:sem *; allow base_t base_t:msg *; allow base_t base_t:msgq *; allow base_t base_t:shm *; allow base_t base_t:ipc *; user user_u roles { base_r };
sid kernel user_u:base_r:base_t
sid file user_u:base_r:base_t sid file_labels user_u:base_r:base_t sid init user_u:base_r:base_t sid any_socket user_u:base_r:base_t sid port user_u:base_r:base_t sid netif user_u:base_r:base_t sid netmsg user_u:base_r:base_t sid node user_u:base_r:base_t sid igmp_packet user_u:base_r:base_t sid icmp_socket user_u:base_r:base_t sid tcp_socket user_u:base_r:base_t sid sysctl_modprobe user_u:base_r:base_t sid sysctl user_u:base_r:base_t sid sysctl_fs user_u:base_r:base_t sid sysctl_kernel user_u:base_r:base_t sid sysctl_net user_u:base_r:base_t sid sysctl_net_unix user_u:base_r:base_t sid sysctl_vm user_u:base_r:base_t sid sysctl_dev user_u:base_r:base_t sid kmod user_u:base_r:base_t sid policy user_u:base_r:base_t sid scmp_packet user_u:base_r:base_t sid devnull user_u:base_r:base_t fs_use_xattr ext2 user_u:base_r:base_t; fs_use_xattr ext3 user_u:base_r:base_t; fs_use_xattr jfs user_u:base_r:base_t; fs_use_xattr xfs user_u:base_r:base_t; fs_use_xattr reiserfs user_u:base_r:base_t; fs_use_task pipefs user_u:base_r:base_t; fs_use_task sockfs user_u:base_r:base_t; fs_use_trans devpts user_u:base_r:base_t; fs_use_trans tmpfs user_u:base_r:base_t; fs_use_trans shm user_u:base_r:base_t; genfscon proc / user_u:base_r:base_t
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: Casey Schaufler <casey_at_schaufler-ca.com> subject: Re: Make Dummy Policy Date: Wed, 20 Aug 2008 14:48:20 -0700
Thank you. I noticed that class "capability2" is defined but never used. Is this intentional? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: David P. Quigley <dpquigl_at_tycho.nsa.gov> subject: Re: Make Dummy Policy Date: Wed, 20 Aug 2008 17:41:48 -0400
Whoops. There are some other object classes missing as well. I must have missed one of the conversions on class list. I'll fix that and send out a new copy. Dave -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: David P. Quigley <dpquigl_at_tycho.nsa.gov> subject: Re: Make Dummy Policy Date: Wed, 20 Aug 2008 17:45:28 -0400
Ok here is a fixed version of the program. It increases the TE allow rules to 47 from 29 so it isn't much larger and increases the policy.23 file to 8136 bytes. Dave
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: David P. Quigley <dpquigl_at_tycho.nsa.gov> subject: Re: Make Dummy Policy Date: Thu, 21 Aug 2008 10:00:26 -0400
OK, so in testing this policy I ran into a small idiocincracy of policy creation. I was under the false assumption that I could strip out the user space object classes. This is not the case so I will fix up the program once again to emit fake names for the user space object classes. Dave -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: David P. Quigley <dpquigl_at_tycho.nsa.gov> subject: Re: Make Dummy Policy Date: Thu, 21 Aug 2008 12:41:05 -0400
Ok so this seems like the final version of this patch. The policy compiles and installs properly and the system boots. This policy does not provide you any protection with respect to SELinux since it allows everything and every program runs under the same domain. So do not use it with the expectation of it providing any security. Now that the disclaimer is out of the way here are some stats on the policy. The new policy is 587 lines (stripped of blank lines) with 476 of those lines being the boilerplate that I mentioned last time. The remaining 111 lines have the 3 lines for type, user, and role, 70 lines for the allow rules (one for each object class including user space object classes), 27 lines to assign types to the initial sids, and 11 lines for file system labeling. The policy binary is 9194 bytes. One issue I ran into was that dbus wants a dbus_contexts file if it detects if SELinux is enabled and it won't fall back on an empty rule set. This is weird since the dbus file_context file in the fedora policy is an empty rule set as it is. I have included this file in the patch just in case dbus wants it. Dave
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
/ user_u:base_r:base_t
class security
class lnk_file class chr_file class blk_file class sock_file class fifo_file class socket class tcp_socket class udp_socket class rawip_socket class node class netif class netlink_socket class packet_socket class key_socket class unix_stream_socket class unix_dgram_socket class sem class msg class msgq class shm class ipc class user30 class user31 class user32 class user33 class user34 class user35 class user36 class user37 class user38 class user39 class user40 class user41 class user42 class netlink_route_socket class netlink_firewall_socket class netlink_tcpdiag_socket class netlink_nflog_socket class netlink_xfrm_socket class netlink_selinux_socket class netlink_audit_socket class netlink_ip6fw_socket class netlink_dnrt_socket class user52 class user53 class association class netlink_kobject_uevent_socket class appletalk_socket class packet class key class user59 class dccp_socket class memprotect class user62 class user63 class user64 class user65 class user66 class user67 class peer class capability2 class user70
sid kernel
sid sysctl_fs sid sysctl_kernel sid sysctl_net sid sysctl_net_unix sid sysctl_vm sid sysctl_dev sid kmod sid policy sid scmp_packet sid devnull
common file
ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton }
common socket
ioctl read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind }
common ipc
create destroy getattr setattr read write associate unix_read unix_write }
class security
compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot }
class process
fork transition sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate }
class system
ipc_info syslog_read syslog_mod syslog_console }
class capability
chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap }
class filesystem
mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }
class file
execute_no_trans entrypoint execmod open }
class dir
add_name remove_name reparent search rmdir open }
class fd
use
class lnk_file
class chr_file
execute_no_trans entrypoint execmod open }
class blk_file
open
class sock_file
class fifo_file
open
class socket
class tcp_socket
connectto newconn acceptfrom node_bind name_connect }
class udp_socket
node_bind
class rawip_socket
node_bind
class node
tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send enforce_dest dccp_recv dccp_send recvfrom sendto }
class netif
tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send ingress egress }
class netlink_socket
class packet_socket
class key_socket
class unix_stream_socket
connectto newconn acceptfrom }
class unix_dgram_socket
class sem
class msg
send receive }
class msgq
enqueue
class shm
lock
class ipc
class netlink_route_socket
nlmsg_read nlmsg_write }
class netlink_firewall_socket
nlmsg_read nlmsg_write }
class netlink_tcpdiag_socket
nlmsg_read nlmsg_write }
class netlink_nflog_socket
class netlink_xfrm_socket
nlmsg_read nlmsg_write }
class netlink_selinux_socket
class netlink_audit_socket
nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv }
class netlink_ip6fw_socket
nlmsg_read nlmsg_write }
class netlink_dnrt_socket
class association
sendto recvfrom setcontext polmatch }
class netlink_kobject_uevent_socket
class appletalk_socket
class packet
send recv relabelto flow_in flow_out forward_in forward_out }
class key
view read write search link setattr create }
class dccp_socket
node_bind name_connect }
class memprotect
mmap_zero
class peer
recv
class capability2
mac_override mac_admin }
type base_t;
allow base_t base_t:security *; allow base_t base_t:process *; allow base_t base_t:system *; allow base_t base_t:capability *; allow base_t base_t:filesystem *; allow base_t base_t:file *; allow base_t base_t:dir *; allow base_t base_t:fd *; allow base_t base_t:lnk_file *; allow base_t base_t:chr_file *; allow base_t base_t:blk_file *; allow base_t base_t:sock_file *; allow base_t base_t:fifo_file *; allow base_t base_t:socket *; allow base_t base_t:tcp_socket *; allow base_t base_t:udp_socket *; allow base_t base_t:rawip_socket *; allow base_t base_t:node *; allow base_t base_t:netif *; allow base_t base_t:netlink_socket *; allow base_t base_t:packet_socket *; allow base_t base_t:key_socket *; allow base_t base_t:unix_stream_socket *; allow base_t base_t:unix_dgram_socket *; allow base_t base_t:sem *; allow base_t base_t:msg *; allow base_t base_t:msgq *; allow base_t base_t:shm *; allow base_t base_t:ipc *; allow base_t base_t:user30 *; allow base_t base_t:user31 *; allow base_t base_t:user32 *; allow base_t base_t:user33 *; allow base_t base_t:user34 *; allow base_t base_t:user35 *; allow base_t base_t:user36 *; allow base_t base_t:user37 *; allow base_t base_t:user38 *; allow base_t base_t:user39 *; allow base_t base_t:user40 *; allow base_t base_t:user41 *; allow base_t base_t:user42 *; allow base_t base_t:netlink_route_socket *; allow base_t base_t:netlink_firewall_socket *; allow base_t base_t:netlink_tcpdiag_socket *; allow base_t base_t:netlink_nflog_socket *; allow base_t base_t:netlink_xfrm_socket *; allow base_t base_t:netlink_selinux_socket *; allow base_t base_t:netlink_audit_socket *; allow base_t base_t:netlink_ip6fw_socket *; allow base_t base_t:netlink_dnrt_socket *; allow base_t base_t:user52 *; allow base_t base_t:user53 *; allow base_t base_t:association *; allow base_t base_t:netlink_kobject_uevent_socket *; allow base_t base_t:appletalk_socket *; allow base_t base_t:packet *; allow base_t base_t:key *; allow base_t base_t:user59 *; allow base_t base_t:dccp_socket *; allow base_t base_t:memprotect *; allow base_t base_t:user62 *; allow base_t base_t:user63 *; allow base_t base_t:user64 *; allow base_t base_t:user65 *; allow base_t base_t:user66 *; allow base_t base_t:user67 *; allow base_t base_t:peer *; allow base_t base_t:capability2 *; allow base_t base_t:user70 *; user user_u roles { base_r };
sid kernel user_u:base_r:base_t
sid file user_u:base_r:base_t sid file_labels user_u:base_r:base_t sid init user_u:base_r:base_t sid any_socket user_u:base_r:base_t sid port user_u:base_r:base_t sid netif user_u:base_r:base_t sid netmsg user_u:base_r:base_t sid node user_u:base_r:base_t sid igmp_packet user_u:base_r:base_t sid icmp_socket user_u:base_r:base_t sid tcp_socket user_u:base_r:base_t sid sysctl_modprobe user_u:base_r:base_t sid sysctl user_u:base_r:base_t sid sysctl_fs user_u:base_r:base_t sid sysctl_kernel user_u:base_r:base_t sid sysctl_net user_u:base_r:base_t sid sysctl_net_unix user_u:base_r:base_t sid sysctl_vm user_u:base_r:base_t sid sysctl_dev user_u:base_r:base_t sid kmod user_u:base_r:base_t sid policy user_u:base_r:base_t sid scmp_packet user_u:base_r:base_t sid devnull user_u:base_r:base_t fs_use_xattr ext2 user_u:base_r:base_t; fs_use_xattr ext3 user_u:base_r:base_t; fs_use_xattr jfs user_u:base_r:base_t; fs_use_xattr xfs user_u:base_r:base_t; fs_use_xattr reiserfs user_u:base_r:base_t; fs_use_task pipefs user_u:base_r:base_t; fs_use_task sockfs user_u:base_r:base_t; fs_use_trans devpts user_u:base_r:base_t; fs_use_trans tmpfs user_u:base_r:base_t; fs_use_trans shm user_u:base_r:base_t; genfscon proc / user_u:base_r:base_t
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
|
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |