Re: 'chcon': possible weakness

On Monday 02 October 2006 08:59, "Salvo Giuffrida" <giuffsalvo@hotmail.it> wrote:
> I found in the FC5 targeted policy that httpd_t has execute access on files
> of type bin_t...Isn't this an huge security hole? Couldn't one who exploit
> an httpd weakness execute 'chcon' (which has security attributes rwxr-xr-x
> root root system_u:object_r:bin_t), and change the Security Context of a
> file he wants access to?

Sure they can execute chcon, but they can only change context in accordance with policy.

Having chcon with type bin_t is no more a security issue than having chmod with mode 0755 in the Unix permissions system. You can run the program without limits, but what operations that program will be capable of are very limited.

Do an experiment by running a shell as httpd_t and try execing chcon and see what you can do. Or use "apol" to analyse the policy and see what relabelto and relabelfrom operations are permitted.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.