[snip] Ok so this seems like the final version of this patch. The policy compiles and installs properly and the system boots. This policy does not provide you any protection with respect to SELinux since it allows everything and every program runs under the same domain. So do not use it with the expectation of it providing any security. Now that the disclaimer is out of the way here are some stats on the policy. The new policy is 587 lines (stripped of blank lines) with 476 of those lines being the boilerplate that I mentioned last time. The remaining 111 lines have the 3 lines for type, user, and role, 70 lines for the allow rules (one for each object class including user space object classes), 27 lines to assign types to the initial sids, and 11 lines for file system labeling. The policy binary is 9194 bytes. One issue I ran into was that dbus wants a dbus_contexts file if it detects if SELinux is enabled and it won't fall back on an empty rule set. This is weird since the dbus file_context file in the fedora policy is an empty rule set as it is. I have included this file in the patch just in case dbus wants it. Dave
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd";> <busconfig> <selinux> </selinux> </busconfig>
/ user_u:base_r:base_t /.* user_u:base_r:base_t
class security class process class system class capability class filesystem class file class dir class fd class lnk_file class chr_file class blk_file class sock_file class fifo_file class socket class tcp_socket class udp_socket class rawip_socket class node class netif class netlink_socket class packet_socket class key_socket class unix_stream_socket class unix_dgram_socket class sem class msg class msgq class shm class ipc class user30 class user31 class user32 class user33 class user34 class user35 class user36 class user37 class user38 class user39 class user40 class user41 class user42 class netlink_route_socket class netlink_firewall_socket class netlink_tcpdiag_socket class netlink_nflog_socket class netlink_xfrm_socket class netlink_selinux_socket class netlink_audit_socket class netlink_ip6fw_socket class netlink_dnrt_socket class user52 class user53 class association class netlink_kobject_uevent_socket class appletalk_socket class packet class key class user59 class dccp_socket class memprotect class user62 class user63 class user64 class user65 class user66 class user67 class peer class capability2 class user70 sid kernel sid security sid unlabeled sid fs sid file sid file_labels sid init sid any_socket sid port sid netif sid netmsg sid node sid igmp_packet sid icmp_socket sid tcp_socket sid sysctl_modprobe sid sysctl sid sysctl_fs sid sysctl_kernel sid sysctl_net sid sysctl_net_unix sid sysctl_vm sid sysctl_dev sid kmod sid policy sid scmp_packet sid devnull common file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton } common socket { ioctl read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind } common ipc { create destroy getattr setattr read write associate unix_read unix_write } class security { compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot } class process { fork transition sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate } class system { ipc_info syslog_read syslog_mod syslog_console } class capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap } class filesystem { mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget } class file inherits file { execute_no_trans entrypoint execmod open } class dir inherits file { add_name remove_name reparent search rmdir open } class fd { use } class lnk_file inherits file class chr_file inherits file { execute_no_trans entrypoint execmod open } class blk_file inherits file { open } class sock_file inherits file class fifo_file inherits file { open } class socket inherits socket class tcp_socket inherits socket { connectto newconn acceptfrom node_bind name_connect } class udp_socket inherits socket { node_bind } class rawip_socket inherits socket { node_bind } class node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send enforce_dest dccp_recv dccp_send recvfrom sendto } class netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send ingress egress } class netlink_socket inherits socket class packet_socket inherits socket class key_socket inherits socket class unix_stream_socket inherits socket { connectto newconn acceptfrom } class unix_dgram_socket inherits socket class sem inherits ipc class msg { send receive } class msgq inherits ipc { enqueue } class shm inherits ipc { lock } class ipc inherits ipc class netlink_route_socket inherits socket { nlmsg_read nlmsg_write } class netlink_firewall_socket inherits socket { nlmsg_read nlmsg_write } class netlink_tcpdiag_socket inherits socket { nlmsg_read nlmsg_write } class netlink_nflog_socket inherits socket class netlink_xfrm_socket inherits socket { nlmsg_read nlmsg_write } class netlink_selinux_socket inherits socket class netlink_audit_socket inherits socket { nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv } class netlink_ip6fw_socket inherits socket { nlmsg_read nlmsg_write } class netlink_dnrt_socket inherits socket class association { sendto recvfrom setcontext polmatch } class netlink_kobject_uevent_socket inherits socket class appletalk_socket inherits socket class packet { send recv relabelto flow_in flow_out forward_in forward_out } class key { view read write search link setattr create } class dccp_socket inherits socket { node_bind name_connect } class memprotect { mmap_zero } class peer { recv } class capability2 { mac_override mac_admin } type base_t; role base_r types { base_t }; allow base_t base_t:security *; allow base_t base_t:process *; allow base_t base_t:system *; allow base_t base_t:capability *; allow base_t base_t:filesystem *; allow base_t base_t:file *; allow base_t base_t:dir *; allow base_t base_t:fd *; allow base_t base_t:lnk_file *; allow base_t base_t:chr_file *; allow base_t base_t:blk_file *; allow base_t base_t:sock_file *; allow base_t base_t:fifo_file *; allow base_t base_t:socket *; allow base_t base_t:tcp_socket *; allow base_t base_t:udp_socket *; allow base_t base_t:rawip_socket *; allow base_t base_t:node *; allow base_t base_t:netif *; allow base_t base_t:netlink_socket *; allow base_t base_t:packet_socket *; allow base_t base_t:key_socket *; allow base_t base_t:unix_stream_socket *; allow base_t base_t:unix_dgram_socket *; allow base_t base_t:sem *; allow base_t base_t:msg *; allow base_t base_t:msgq *; allow base_t base_t:shm *; allow base_t base_t:ipc *; allow base_t base_t:user30 *; allow base_t base_t:user31 *; allow base_t base_t:user32 *; allow base_t base_t:user33 *; allow base_t base_t:user34 *; allow base_t base_t:user35 *; allow base_t base_t:user36 *; allow base_t base_t:user37 *; allow base_t base_t:user38 *; allow base_t base_t:user39 *; allow base_t base_t:user40 *; allow base_t base_t:user41 *; allow base_t base_t:user42 *; allow base_t base_t:netlink_route_socket *; allow base_t base_t:netlink_firewall_socket *; allow base_t base_t:netlink_tcpdiag_socket *; allow base_t base_t:netlink_nflog_socket *; allow base_t base_t:netlink_xfrm_socket *; allow base_t base_t:netlink_selinux_socket *; allow base_t base_t:netlink_audit_socket *; allow base_t base_t:netlink_ip6fw_socket *; allow base_t base_t:netlink_dnrt_socket *; allow base_t base_t:user52 *; allow base_t base_t:user53 *; allow base_t base_t:association *; allow base_t base_t:netlink_kobject_uevent_socket *; allow base_t base_t:appletalk_socket *; allow base_t base_t:packet *; allow base_t base_t:key *; allow base_t base_t:user59 *; allow base_t base_t:dccp_socket *; allow base_t base_t:memprotect *; allow base_t base_t:user62 *; allow base_t base_t:user63 *; allow base_t base_t:user64 *; allow base_t base_t:user65 *; allow base_t base_t:user66 *; allow base_t base_t:user67 *; allow base_t base_t:peer *; allow base_t base_t:capability2 *; allow base_t base_t:user70 *; user user_u roles { base_r }; sid kernel user_u:base_r:base_t sid security user_u:base_r:base_t sid unlabeled user_u:base_r:base_t sid fs user_u:base_r:base_t sid file user_u:base_r:base_t sid file_labels user_u:base_r:base_t sid init user_u:base_r:base_t sid any_socket user_u:base_r:base_t sid port user_u:base_r:base_t sid netif user_u:base_r:base_t sid netmsg user_u:base_r:base_t sid node user_u:base_r:base_t sid igmp_packet user_u:base_r:base_t sid icmp_socket user_u:base_r:base_t sid tcp_socket user_u:base_r:base_t sid sysctl_modprobe user_u:base_r:base_t sid sysctl user_u:base_r:base_t sid sysctl_fs user_u:base_r:base_t sid sysctl_kernel user_u:base_r:base_t sid sysctl_net user_u:base_r:base_t sid sysctl_net_unix user_u:base_r:base_t sid sysctl_vm user_u:base_r:base_t sid sysctl_dev user_u:base_r:base_t sid kmod user_u:base_r:base_t sid policy user_u:base_r:base_t sid scmp_packet user_u:base_r:base_t sid devnull user_u:base_r:base_t fs_use_xattr ext2 user_u:base_r:base_t; fs_use_xattr ext3 user_u:base_r:base_t; fs_use_xattr jfs user_u:base_r:base_t; fs_use_xattr xfs user_u:base_r:base_t; fs_use_xattr reiserfs user_u:base_r:base_t; fs_use_task pipefs user_u:base_r:base_t; fs_use_task sockfs user_u:base_r:base_t; fs_use_trans devpts user_u:base_r:base_t; fs_use_trans tmpfs user_u:base_r:base_t; fs_use_trans shm user_u:base_r:base_t; genfscon proc / user_u:base_r:base_t
diff --git a/Makefile b/Makefile index 53bf6ec..2a23083 100644 --- a/Makefile +++ b/Makefile @@ -1655,6 +1655,13 @@ clean := -f $(if $(KBUILD_SRC),$(srctree)/)scripts/Makefile.clean obj endif # skip-makefile +selinux_policy: + cd $(srctree)/scripts/selinux; sh ./compile_policy.sh + +selinux_install: selinux_policy + cd $(srctree)/scripts/selinux; sh ./install_policy.sh + + PHONY += FORCE FORCE: diff --git a/scripts/selinux/compile_policy.sh b/scripts/selinux/compile_policy.sh new file mode 100644 index 0000000..ab385cb --- /dev/null +++ b/scripts/selinux/compile_policy.sh @@ -0,0 +1,15 @@ +#!/bin/sh +CP=`which checkpolicy` +POLICYVERS=`cat /selinux/policyvers` +if [ $? -eq 1 ]; then + echo "no selinux tools installed" + exit 1 +fi + +cd mdp +sh ./build.sh -k ../../.. +if [ $? -ne 0 ]; then + echo "Failure building dummy policy." + exit 1 +fi +$CP -o policy.`checkpolicy -V | awk '{print $1}'` policy.conf diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh new file mode 100644 index 0000000..3c8fbfa --- /dev/null +++ b/scripts/selinux/install_policy.sh @@ -0,0 +1,45 @@ +#!/bin/sh +if [ `id -u` -ne 0 ]; then + echo "$0: must be root to install the selinux policy" + exit 1 +fi +SF=`which setfiles` +if [ $? -eq 1 ]; then + if [ -f /usr/sbin/setfiles ]; then + SF="/usr/sbin/setfiles" + else + echo "no selinux tools installed: setfiles" + exit 1 + fi +fi + +cd mdp + +mkdir -p /etc/selinux/dummy/policy +mkdir -p /etc/selinux/dummy/contexts/files + +cp file_contexts /etc/selinux/dummy/contexts/files +cp dbus_contexts /etc/selinux/dummy/contexts +cp policy.`checkpolicy -V | awk '{print $1}'` /etc/selinux/dummy/policy +FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts +if [ ! -f $FC_FILE ]; then + echo "no file contests file. Please run" + echo "make selinux_policy_install" + exit 1 +fi + +cd /etc/selinux/dummy/contexts/files +$SF file_contexts / + +mounts=`cat /proc/$$/mounts | egrep "ext2|ext3|xfs|jfs" | awk '{ print $2 '}` +for line in $mounts; do + $SF file_contexts $line +done + +dodev=`cat /proc/$$/mounts | grep "/dev "` +if [ "eq$dodev" != "eq" ]; then + mount --move /dev /mnt + $SF file_contexts /dev + mount --move /mnt /dev +fi + diff --git a/scripts/selinux/mdp/build.sh b/scripts/selinux/mdp/build.sh new file mode 100644 index 0000000..8c82961 --- /dev/null +++ b/scripts/selinux/mdp/build.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +usage() { + echo "Usage: mdp -k <kernel_dir> [-m]" + exit 1 +} + +polf="policy.conf" +ctxf="file_contexts" +mls=0 +kerneldir="" +while [ 1 ]; do + getopts k:m name + if [ $? -gt 0 ]; then + break 2 + fi + if [ $name == "m" ]; then + mls=1; + echo "Making mls policy" + elif [ $name == "k" ]; then + kerneldir=$OPTARG + echo "Using kernel under $kerneldir" + else + echo "bogus argument \"$name\"" + usage + fi +done + +if [ -z $kerneldir ]; then + if [ ! -d "../linux" ]; then + echo "No kernel directory specified and ../linux does not exist." + usage + fi + $kerneldir="../linux" +fi + +secd="$kerneldir/security" +seld="$secd/selinux" +incd="$seld/include" +if [ ! -d "$kerneldir" -o ! -d "$secd" -o ! -d "$seld" -o ! -d "$incd" ]; then + echo "$incd does not exist" + usage +fi + +#echo "char *classlist[] = {" > classlist.h +#cat $incd/class_to_string.h | sed -e 's/S_(//g' | sed -e 's/)/,/g' >> classlist.h +#echo "};" >> classlist.h + +gcc -I$incd -o mdp mdp.c > makeout 2>&1 +if [ $? -ne 0 ]; then + echo "Error compiling mdp. Please see file \"makeout\" for errors" + usage +fi + +if [ $mls -eq 1 ]; then + ./mdp -m $polf $ctxf > mdpout 2>&1 +else + ./mdp $polf $ctxf > mdpout 2>&1 +fi + +if [ $? -ne 0 ]; then + echo "Error running mdp. Please see \"mdpout\" for errors" + usage +fi + +echo "Policy is in $polf and file contexts are in $ctxf." +echo "Have a nice day." diff --git a/scripts/selinux/mdp/dbus_contexts b/scripts/selinux/mdp/dbus_contexts new file mode 100644 index 0000000..116e684 --- /dev/null +++ b/scripts/selinux/mdp/dbus_contexts @@ -0,0 +1,6 @@ +<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" + "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd";> +<busconfig> + <selinux> + </selinux> +</busconfig> diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c new file mode 100644 index 0000000..5d2bf14 --- /dev/null +++ b/scripts/selinux/mdp/mdp.c @@ -0,0 +1,240 @@ +/* + * + * mdp - make dummy policy + * + * When pointed at a kernel tree, builds a dummy policy for that kernel + * with exactly one type with full rights to itself. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Copyright (C) IBM Corporation, 2006 + * + * Authors: Serge E. Hallyn <serue@xxxxxxxxxx> + */ + +#include <stdio.h> +#include <unistd.h> + +#include "flask.h" + +void usage(char *name) +{ + printf("usage: %s [-m] policy_file context_file\n", name); + exit(1); +} + +void find_common_name(char *cname, char *dest, int len) +{ + char *start, *end; + + start = strchr(cname, '_')+1; + end = strchr(start, '_'); + if (!start || !end || start-cname > len || end-start > len) { + printf("Error with commons defines\n"); + exit(1); + } + strncpy(dest, start, end-start); + dest[end-start] = '\0'; +} + +#define S_(x) x, +static char *classlist[] = { +#include "class_to_string.h" + NULL +}; +#undef S_ + +#include "initial_sid_to_string.h" + +#define TB_(x) char *x[] = { +#define TE_(x) NULL }; +#define S_(x) x, +#include "common_perm_to_string.h" +#undef TB_ +#undef TE_ +#undef S_ + +struct common { + char *cname; + char **perms; +}; +struct common common[] = { +#define TB_(x) { #x, x }, +#define S_(x) +#define TE_(x) +#include "common_perm_to_string.h" +#undef TB_ +#undef TE_ +#undef S_ +}; + +#define S_(x, y, z) {x, #y}, +struct av_inherit { + int class; + char *common; +}; +struct av_inherit av_inherit[] = { +#include "av_inherit.h" +}; +#undef S_ + +#include "av_permissions.h" +#define S_(x, y, z) {x, y, z}, +struct av_perms { + int class; + int perm_i; + char *perm_s; +}; +struct av_perms av_perms[] = { +#include "av_perm_to_string.h" +}; +#undef S_ + +int main(int argc, char *argv[]) +{ + int i, j, mls = 0; + char **arg, *polout, *ctxout; + int classlist_len, initial_sid_to_string_len; + FILE *fout; + + if (argc < 3) + usage(argv[0]); + arg = argv+1; + if (argc==4 && strcmp(argv[1], "-m") == 0) { + mls = 1; + arg++; + } + polout = *arg++; + ctxout = *arg; + + fout = fopen(polout, "w"); + if (!fout) { + printf("Could not open %s for writing\n", polout); + usage(argv[0]); + } + + classlist_len = sizeof(classlist) / sizeof(char *); + /* print out the classes */ + for (i=1; i < classlist_len; i++) { + if(classlist[i]) + fprintf(fout, "class %s\n", classlist[i]); + else + fprintf(fout, "class user%d\n", i); + } + fprintf(fout, "\n"); + + initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); + /* print out the sids */ + for (i=1; i < initial_sid_to_string_len; i++) + fprintf(fout, "sid %s\n", initial_sid_to_string[i]); + fprintf(fout, "\n"); + + /* print out the commons */ + for (i=0; i< sizeof(common)/sizeof(struct common); i++) { + char cname[101]; + find_common_name(common[i].cname, cname, 100); + cname[100] = '\0'; + fprintf(fout, "common %s\n{\n", cname); + for (j=0; common[i].perms[j]; j++) + fprintf(fout, "\t%s\n", common[i].perms[j]); + fprintf(fout, "}\n\n"); + } + fprintf(fout, "\n"); + + /* print out the class permissions */ + for (i=1; i < classlist_len; i++) { + if (classlist[i]) { + int firstperm = -1, numperms = 0; + + fprintf(fout, "class %s\n", classlist[i]); + /* does it inherit from a common? */ + for (j=0; j < sizeof(av_inherit)/sizeof(struct av_inherit); j++) + if (av_inherit[j].class == i) + fprintf(fout, "inherits %s\n", av_inherit[j].common); + + for (j=0; j < sizeof(av_perms)/sizeof(struct av_perms); j++) { + if (av_perms[j].class == i) { + if (firstperm == -1) + firstperm = j; + numperms++; + } + } + if (!numperms) { + fprintf(fout, "\n"); + continue; + } + + fprintf(fout, "{\n"); + /* print out the av_perms */ + for (j=0; j < numperms; j++) { + fprintf(fout, "\t%s\n", av_perms[firstperm+j].perm_s); + } + fprintf(fout, "}\n\n"); + } + } + fprintf(fout, "\n"); + + /* NOW PRINT OUT MLS STUFF */ + if (mls) { + printf("MLS not yet implemented\n"); + exit(1); + } + + /* types, roles, and allows */ + fprintf(fout, "type base_t;\n"); + fprintf(fout, "role base_r types { base_t };\n"); + for (i=1; i < classlist_len; i++) { + if (classlist[i]) + fprintf(fout, "allow base_t base_t:%s *;\n", classlist[i]); + else + fprintf(fout, "allow base_t base_t:user%d *;\n", i); + } + fprintf(fout, "user user_u roles { base_r };\n"); + fprintf(fout, "\n"); + + /* default sids */ + for (i=1; i < initial_sid_to_string_len; i++) + fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); + fprintf(fout, "\n"); + + + fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); + + fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); + + fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); + fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); + + fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); + + fclose(fout); + + fout = fopen(ctxout, "w"); + if (!fout) { + printf("Wrote policy, but cannot open %s for writing\n"); + usage(argv[0]); + } + fprintf(fout, "/ user_u:base_r:base_t\n"); + fprintf(fout, "/.* user_u:base_r:base_t\n"); + fclose(fout); + + return 0; +}