On 5/12/20 2:18 AM, Sam Varshavchik wrote:
> Lukas Vrabec writes:
>
>>
>> Can please run following commands before you reproduce the scenario
>> again:
>>
>> # chcon -t courier_exec_t /usr/lib/courier/sbin/couriertcpd
>> # dnf install selinux-policy-devel -y
>> $ cat httpd_courier.te
>> policy_module(httpd_courier, 1.0)
>> gen_require(`
>> type httpd_sys_script_t;
>> type courier_spool_t;
>> type system_mail_t;
>> ')
>>
>> stream_connect_pattern(httpd_sys_script_t, courier_spool_t,
>> courier_spool_t, system_mail_t)
>>
>> # make -f /usr/share/selinux/devel/Makefile httpd_courier.pp
>> # semodule -i httpd_courier.pp
>>
>> ### reproduce the scenario
>>
>> And attach output of:
>> # ausearch -m AVC -ts today
>
> The above was done:
>
> [root@jack ~]# semodule --list | grep courier
> courier
> httpd_courier
> [root@jack ~]# ls -alZ /usr/lib/courier/sbin/couriertcpd
> -r-xr-xr-x. 1 daemon daemon system_u:object_r:courier_exec_t:s0 142456
> May 10 01:14 /usr/lib/courier/sbin/couriertcpd
>
> The server daemons were restarted.
>
> Both the webmail socket connection was blocked, as well as signals to
> courierlogger. The first two AVCs is the webmail connection:
>
> ----
> time->Mon May 11 20:00:38 2020
> type=AVC msg=audit(1589241638.443:3693): avc: denied { connectto }
> for pid=1629725 comm="webmail" path="/var/spool/courier/sqwebmail.sock"
> scontext=system_u:system_r:httpd_sys_script_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0
> tclass=unix_stream_socket permissive=0
> ----
> time->Mon May 11 20:00:54 2020
> type=AVC msg=audit(1589241654.975:3701): avc: denied { connectto }
> for pid=1629864 comm="webmail" path="/var/spool/courier/sqwebmail.sock"
> scontext=system_u:system_r:httpd_sys_script_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0
> tclass=unix_stream_socket permissive=0
>
> The socket and the cgi-bin binary are labeled thusly:
>
> [root@jack ~]# ls -alZ /var/spool/courier/sqwebmail.sock
> srwxrwxrwx. 1 root root system_u:object_r:courier_spool_t:s0 0 May 11
> 20:01 /var/spool/courier/sqwebmail.sock
> [root@jack ~]# ls -alZ /var/www/cgi-bin/webmail
> -r-xr-xr-x. 1 root bin system_u:object_r:httpd_sys_script_exec_t:s0
> 31464 May 10 01:14 /var/www/cgi-bin/webmail
>
> The remaining AVCs are for the signal issue:
>
> ----
> time->Mon May 11 20:02:13 2020
> type=AVC msg=audit(1589241733.799:3740): avc: denied { signal } for
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:23 2020
> type=AVC msg=audit(1589241743.799:3743): avc: denied { sigkill } for
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:33 2020
> type=AVC msg=audit(1589241753.800:3744): avc: denied { sigkill } for
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:43 2020
> type=AVC msg=audit(1589241763.800:3751): avc: denied { sigkill } for
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=1
> ----
> time->Mon May 11 20:02:43 2020
> type=AVC msg=audit(1589241763.807:3752): avc: denied { signal } for
> pid=1630256 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=1
>
> Noting that the running processes are unconfined, even though the binary
> is labeled:
>
> # ps -efZ | grep courierlogger
> system_u:system_r:unconfined_service_t:s0 root 1630457 1 0 20:10
> ? 00:00:00 /usr/sbin/courierlogger - ... every one of them
> root@jack ~]# ls -alZ /usr/sbin/courierlogger
> -rwxr-xr-x. 1 daemon daemon system_u:object_r:courier_exec_t:s0 25296
> May 9 23:19 /usr/sbin/courierlogger
>
For some reason courierlogger runs as unconfined_service_t.
Can you describe flow how binaries are executed? Also can you attach
systemd unit file executing this service?
Thanks,
Lukas.
>
> _______________________________________________
> selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
>
--
Lukas Vrabec
SELinux Evangelist,
Senior Software Engineer, Security Technologies
Red Hat, Inc.
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
