Hello,
On Friday, January 6, 2023 10:10:21 AM EST Steve Grubb wrote:
> One approach to solving this is to use selinux policy. I was informed
> overnight that policy 38.2-1 should now enforce kernel transitions to
> specific helper applications. So, maybe this is solved well enough?
I can verify the selinux approach works on rawhide. What this does is copy
wall to the admin directory where it gets the home_t label, then we change
core_pattern to point to it, then run a program that will dump core, and then
check the audit logs.
[root@ospp ~]# cp /usr/bin/wall /home/admin/
[root@ospp ~]# ls -Z /home/admin/wall
unconfined_u:object_r:user_home_t:s0 /home/admin/wall
[root@ospp ~]# echo "|/home/admin/wall" > /proc/sys/kernel/core_pattern
[root@ospp ~]# cat dump.c
#include <stdio.h>
#include <string.h>
#include <stddef.h>
int main(int argc, char *argv[])
{
if (strcmp(*argv[2], argv[3]) == 0)
printf("foo\n");
else
printf("bar\n");
return 0;
}
[root@ospp ~]# gcc -o dump dump.c 2>/dev/null
[root@ospp ~]# ./dump
Segmentation fault
[root@ospp ~]# ausearch --start recent
----
time->Fri Jan 6 11:24:48 2023
node=ospp type=ANOM_ABEND msg=audit(1673022288.639:253): auid=1000 uid=0 gid=0
ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=1078
comm="dump" exe="/root/dump" sig=11 res=1
----
time->Fri Jan 6 11:24:48 2023
node=ospp type=AVC msg=audit(1673022288.639:254): avc: denied { execute }
for pid=1079 comm="kworker/u8:2" name="wall" dev="dm-7" ino=17051899
scontext=system_u:system_r:kernel_t:s0
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
I think this closes the modprobe path escalation if you have selinux enabled.
This should be publicized. I'd still like to do something for those not using
selinux for whatever reason.
-Steve
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
