auditctl se_sen & se_clr

Hey all,

I'm trying to figure out how the se_sen and se_clr labels are supposed to be used with auditctl.

Here is the selinux context:
subj=root:staff_r:staff_t:s0-s15:c0.c255

       ^      ^       ^        ^
    se_user   ^    se_type     ^

se_role se_clr & se_sen

What is the difference between se_clr and se_sen? And if you have any enlightening examples, that would be appreciated.

Quoted 10 lines · Michael C Thompson

Hey all,

I'm trying to figure out how the se_sen and se_clr labels are supposed to be used with auditctl.

Here is the selinux context:
subj=root:staff_r:staff_t:s0-s15:c0.c255

       ^      ^       ^        ^
    se_user   ^    se_type     ^

se_role se_clr & se_sen

Quoted 1 line

What is the difference between se_clr and se_sen? And if you have any enlightening examples, that would be appreciated.

IIRC, se_sen is how audit refers to the low level (aka sensitivity, current level) and se_clr is how audit refers to the high level (aka clearance, max level) of a MLS range in a SELinux context. In the context above, the se_sen would be the "s0" and the se_clr would be the "s15:c0.c255".

Thanks, that's what I thought as well. Here is my result of testing this:

root linux user, id:
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:staff_r:staff_t:SystemLow-SystemHigh

mcthomps linux user, id:
uid=500(mcthomps) gid=500(mcthomps) groups=500(mcthomps) context=user_u:user_r:user_t:SystemLow

When I have the following audit rule is
auditctl -a entry,always -S chmod -F se_clr=s0
the chmod actions taken by mcthomps get logged, but not those done by root (this is as expected).

When the audit rule is
auditctl -a entry,always -S chmod -F se_clr=s15:c0.c255
the chmod actions taken by root get logged, but not by mcthomps (also expected).

However, for se_sen, this does not seem to be the case. The rule:
auditctl -a entry,always -S chmod -F se_se=s0
should cause chmod actions taken by both mcthomps and root to be logged, right? However, I'm only seeing the result of actions taken by mcthomps.

Quoted 11 lines · Michael C Thompson

Thanks, that's what I thought as well. Here is my result of testing this:

root linux user, id:
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:staff_r:staff_t:SystemLow-SystemHigh

mcthomps linux user, id:
uid=500(mcthomps) gid=500(mcthomps) groups=500(mcthomps) context=user_u:user_r:user_t:SystemLow

When I have the following audit rule is
auditctl -a entry,always -S chmod -F se_clr=s0
the chmod actions taken by mcthomps get logged, but not those done by root (this is as expected).

This means that a "range" of s0 is being interpreted as:

se_sen=''
se_clr='s0'

...which isn't what I'd expect, but given that...

Quoted 7 lines

When the audit rule is
auditctl -a entry,always -S chmod -F se_clr=s15:c0.c255
the chmod actions taken by root get logged, but not by mcthomps (also expected).

However, for se_sen, this does not seem to be the case. The rule:
auditctl -a entry,always -S chmod -F se_se=s0
should cause chmod actions taken by both mcthomps and root to be logged, right? However, I'm only seeing the result of actions taken by mcthomps.

This follows the same methodology.

Quoted 15 lines · James Antill

Quoted 12 lines · Michael C Thompson

Thanks, that's what I thought as well. Here is my result of testing this:

root linux user, id:
context=root:staff_r:staff_t:SystemLow-SystemHigh

mcthomps linux user, id:
context=user_u:user_r:user_t:SystemLow

When I have the following audit rule is
auditctl -a entry,always -S chmod -F se_clr=s0
the chmod actions taken by mcthomps get logged, but not those done by root (this is as expected).

Quoted 6 lines

This means that a "range" of s0 is being interpreted as:

se_sen=''
se_clr='s0'

...which isn't what I'd expect, but given that...

I'm sorry, I do not follow what you mean here.

Quoted 19 lines · Michael C Thompson

Quoted 18 lines · James Antill

Quoted 11 lines · Michael C Thompson

Thanks, that's what I thought as well. Here is my result of testing this:

root linux user, id:
context=root:staff_r:staff_t:SystemLow-SystemHigh

mcthomps linux user, id:
context=user_u:user_r:user_t:SystemLow

When I have the following audit rule is
auditctl -a entry,always -S chmod -F se_clr=s0
the chmod actions taken by mcthomps get logged, but not those done by root (this is as expected).

This means that a "range" of s0 is being interpreted as:

se_sen=''
se_clr='s0'

Quoted 2 lines

Quoted 1 line

...which isn't what I'd expect, but given that...

I'm sorry, I do not follow what you mean here.

The mls range for root is s0-s0:c0.c255, where:

se_sen = s0
se_clr = s0:c0.c255

The mls range for mcthomps is s0, given the above works then:

se_clr = s0

...and given the range is s0 and not s0-s0 then se_sen must be blank (and so won't match s0).

This leads me to believe either our definition of se_sen is wrong, or if our definition of se_sen is correct, then the implementation of se_sen has some bug in it.

Quoted 25 lines · James Antill

Quoted 23 lines · Michael C Thompson

Quoted 20 lines · James Antill

Quoted 11 lines · Michael C Thompson

Thanks, that's what I thought as well. Here is my result of testing this:

root linux user, id:
context=root:staff_r:staff_t:SystemLow-SystemHigh

mcthomps linux user, id:
context=user_u:user_r:user_t:SystemLow

When I have the following audit rule is
auditctl -a entry,always -S chmod -F se_clr=s0
the chmod actions taken by mcthomps get logged, but not those done by root (this is as expected).

This means that a "range" of s0 is being interpreted as:

se_sen=''
se_clr='s0'

...which isn't what I'd expect, but given that...

Quoted 7 lines

Quoted 1 line

I'm sorry, I do not follow what you mean here.

The mls range for root is s0-s0:c0.c255, where:

se_sen = s0
se_clr = s0:c0.c255

Right, this makes sense.

Quoted 6 lines

The mls range for mcthomps is s0, given the above works then:

se_clr = s0

...and given the range is s0 and not s0-s0 then se_sen must be blank (and so won't match s0).

AFIAK, you must have both a low and a high, which means for mcthomps, se_sen=0 and se_clr=s0.

The testing that I have done with auditctl's se_sen and se_clr filters has the se_clr working for both the root user and the mcthomps user, but
se_sen only captures audit events for mcthomps when:
auditctl -a entry,always -S chmod -F se_sen=s0

I would expect that since se_sen=s0 for both root and mcthomps, that both of their chmod actions would be logged, but root's actions are not being captured.

This leads me to believe either our definition of se_sen is wrong, or if our definition of se_sen is correct, then the implementation of se_sen has some bug in it.

Hey all,

I'm trying to figure out how the se_sen and se_clr labels are supposed to be used with auditctl.

Here is the selinux context:
subj=root:staff_r:staff_t:s0-s15:c0.c255

      ^      ^       ^        ^
   se_user   ^    se_type     ^

se_role se_clr & se_sen

What is the difference between se_clr and se_sen? And if you have any enlightening examples, that would be appreciated.