On 12/11/20 2:01 AM, Russell Coker wrote:
allow systemd_modules_load_t systemd_modules_load_t:lockdown integrity;
allow udev_t udev_t:lockdown confidentiality;
I've seen access that caused the above to be generated from audit2allow.
/var/log/audit/audit.log.1:type=AVC msg=audit(1607515838.132:56): avc: denied
{ confidentiality } for pid=253 comm="systemd-udevd" lockdown_reason="use of
tracefs" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=lockdown permissive=1
Above is the only log entry I've got for that from my previous testing (I
haven't been able to reproduce whatever it was that caused the
systemd_modules_load_t to get that audited).
https://www.paul-moore.com/blog/d/2020/03/linux_v56.html
I've read the above blog post and I'm still not sure exactly how we are to use
it. Do I allow this for systemd_modules_load_t because loading modules is an
integrity issue? Do I allow it for udev_t because changing device names etc
allows universal MITM attacks?
The SELinux check mirrors the lockdown LSM checks but the policy's granularity,
instead of the single granularity (system-wide)that lockdown LSM has.
If you had the lockdown LSM running too and set to the integrity level, the
systemd_modules_load_t would have been denied by lockdown instead of getting to
SELinux's check. The udev access to tracefs in would be allowed by the lockdown
LSM and go to SELinux's check.
Effectively you could reimplement the lockdown LSM in SELinux like this:
bool lockdown_integrity false;
bool lockdown_confidentiality false;
if (!lockdown_integrity && !lockdown_confidentiality) {
allow domain self:lockdown integrity;
}
if (!lockdown_confidentiality) {
allow domain self:lockdown confidentiality;
}
--
Chris PeBenito
