init: run sysvinit without the dangerous unconfined_domain() call

The aim of this patch is to start securing the init module so that it can run in confined mode instead of in the most unsafe unconfined mode.

At the moment it has been fully tested only with sysvinit.

Testing with other init daemons is needed before this is released, so a "permissive" statement has been added in order to log further needed permissions during this testing phase (with systemd, upstart, and so on).

[...]

+permissive init_t;

Quoted 11 lines · On Tue, 27 Dec 2016 23:16:46 +0100 (CET) Guido Trentalancia via refpolicy…

The aim of this patch is to start securing the init module so that it can run in confined mode instead of in the most unsafe unconfined mode.

At the moment it has been fully tested only with sysvinit.

Testing with other init daemons is needed before this is released, so a "permissive" statement has been added in order to log further needed permissions during this testing phase (with systemd, upstart, and so on).

Quoted 3 lines

[...]

+permissive init_t;

Please don't add that. Debugging statements such as this one should only be added to local policies, not to refpol's master branch. This statement would be a huge step backwards for everyone who isn't using the 'unconfined' module.

Ok, that's fine. Consider, I have completed testing it with sysvinit, so I don't really need to debug anything.

It comes from the following recent advice that has been posted (I was not even aware of the existence of such statement):

http://oss.tresys.com/pipermail/refpolicy/2016-December/008835.html

but, if it is more likely to cause problems, then I can create a new patch which just dumps the dangerous call to unconfined_domain() and that's the end of the story.

At the end, there must be a way out of it !

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

diff -pru a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if

policy/modules/kernel/devices.if +18 -0

@@ -3953,6 +3953,24 @@ interface(`dev_mounton_sysfs',`
 
 ########################################
 ## <summary>
+##	Mount a sysfs filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_mount_sysfs',`
+	gen_require(`
+		type sysfs_t;
+	')
+
+	allow $1 sysfs_t:filesystem mount;
+')
+
+########################################
+## <summary>
 ##	Associate a file to a sysfs filesystem.
 ## </summary>
 ## <param name="file_type">

diff -pru a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if

policy/modules/kernel/kernel.if +18 -0

@@ -828,6 +828,24 @@ interface(`kernel_mount_kvmfs',`
 
 ########################################
 ## <summary>
+##	Mount the proc filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_mount_proc',`
+	gen_require(`
+		type proc_t;
+	')
+
+	allow $1 proc_t:filesystem mount;
+')
+
+########################################
+## <summary>
 ##	Unmount the proc filesystem.
 ## </summary>
 ## <param name="domain">

diff -pru a/policy/modules/system/init.te b/policy/modules/system/init.te

policy/modules/system/init.te +5 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

Quoted 126 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/kernel/devices.if |???18 ++++++++++++++++++
?policy/modules/kernel/kernel.if??|???18 ++++++++++++++++++
?policy/modules/system/init.te????|????7 +++++++

?3 files changed, 43 insertions(+)

diff -pru a/policy/modules/kernel/devices.if
b/policy/modules/kernel/devices.if
--- a/policy/modules/kernel/devices.if 2016-12-27
22:41:00.650390161 +0100
+++ b/policy/modules/kernel/devices.if 2016-12-27
22:50:19.301315139 +0100

(quoted diff) +0 -0

@@ -3953,6 +3953,24 @@ interface(`dev_mounton_sysfs',`
 

?########################################
?## <summary>

policy/modules/kernel/devices.if +18 -0

+##	Mount a sysfs filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_mount_sysfs',`
+	gen_require(`
+		type sysfs_t;
+	')
+
+	allow $1 sysfs_t:filesystem mount;
+')
+
+########################################
+## <summary>

?## Associate a file to a sysfs filesystem.
?## </summary>
?## <param name="file_type">
diff -pru a/policy/modules/kernel/kernel.if
b/policy/modules/kernel/kernel.if
--- a/policy/modules/kernel/kernel.if 2016-12-27
22:41:00.652390190 +0100
+++ b/policy/modules/kernel/kernel.if 2016-12-27
22:51:01.009904157 +0100

(quoted diff) +0 -0

@@ -828,6 +828,24 @@ interface(`kernel_mount_kvmfs',`
 

?########################################
?## <summary>

policy/modules/kernel/kernel.if +18 -0

+##	Mount the proc filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_mount_proc',`
+	gen_require(`
+		type proc_t;
+	')
+
+	allow $1 proc_t:filesystem mount;
+')
+
+########################################
+## <summary>

?## Unmount the proc filesystem.
?## </summary>
?## <param name="domain">
diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

(quoted diff) +0 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi

?# Modify utmp.
?allow init_t initrc_var_run_t:file { rw_file_perms setattr };

policy/modules/system/init.te +2 -0

+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)

?kernel_read_system_state(init_t)
?kernel_share_state(init_t)
?kernel_dontaudit_search_unlabeled(init_t)

policy/modules/system/init.te +2 -0

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 ?corecmd_exec_chroot(init_t)
 ?corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 ?dev_read_sysfs(init_t)

?# Early devtmpfs
?dev_rw_generic_chr_files(init_t)

(quoted diff) +1 -0

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 ?files_dontaudit_rw_root_files(init_t)
 ?files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 ?fs_list_inotifyfs(init_t)

?# cjp: this may be related to /dev/log
?fs_write_ramfs_sockets(init_t)

policy/modules/system/init.te +2 -0

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 ?mls_process_write_all_levels(init_t)
 ?mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 ?selinux_set_all_booleans(init_t)
 

Review mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

(quoted diff) +0 -0

 ?term_use_all_terms(init_t)

I'm not clear why this is necessary.??Sysvinit should only be loading?
the policy if is not loaded yet, so these permissions should be unnecessary.

Quoted 127 lines · Chris PeBenito

Quoted 126 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

diff -pru a/policy/modules/kernel/devices.if
b/policy/modules/kernel/devices.if
--- a/policy/modules/kernel/devices.if 2016-12-27
22:41:00.650390161 +0100
+++ b/policy/modules/kernel/devices.if 2016-12-27
22:50:19.301315139 +0100

policy/modules/kernel/devices.if +18 -0

@@ -3953,6 +3953,24 @@ interface(`dev_mounton_sysfs',`
 
 ########################################
 ## <summary>
+##	Mount a sysfs filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_mount_sysfs',`
+	gen_require(`
+		type sysfs_t;
+	')
+
+	allow $1 sysfs_t:filesystem mount;
+')
+
+########################################
+## <summary>
 ##	Associate a file to a sysfs filesystem.
 ## </summary>
 ## <param name="file_type">

diff -pru a/policy/modules/kernel/kernel.if
b/policy/modules/kernel/kernel.if
--- a/policy/modules/kernel/kernel.if 2016-12-27
22:41:00.652390190 +0100
+++ b/policy/modules/kernel/kernel.if 2016-12-27
22:51:01.009904157 +0100

policy/modules/kernel/kernel.if +18 -0

@@ -828,6 +828,24 @@ interface(`kernel_mount_kvmfs',`
 
 ########################################
 ## <summary>
+##	Mount the proc filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_mount_proc',`
+	gen_require(`
+		type proc_t;
+	')
+
+	allow $1 proc_t:filesystem mount;
+')
+
+########################################
+## <summary>
 ##	Unmount the proc filesystem.
 ## </summary>
 ## <param name="domain">

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

policy/modules/system/init.te +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

policy/modules/system/init.te mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

policy/modules/system/init.te +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission in the kernel module, but surely not here, otherwise the system won't boot
!

Thanks.

Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 26 lines · Chris PeBenito

Quoted 24 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---

?policy/modules/kernel/devices.if |???18 ++++++++++++++++++
?policy/modules/kernel/kernel.if??|???18 ++++++++++++++++++
?policy/modules/system/init.te????|????7 +++++++

?3 files changed, 43 insertions(+)

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

(quoted diff) +0 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi

?# Modify utmp.
?allow init_t initrc_var_run_t:file { rw_file_perms setattr };

policy/modules/system/init.te +2 -0

+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)

?kernel_read_system_state(init_t)
?kernel_share_state(init_t)
?kernel_dontaudit_search_unlabeled(init_t)

policy/modules/system/init.te +2 -0

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 ?corecmd_exec_chroot(init_t)
 ?corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 ?dev_read_sysfs(init_t)

?# Early devtmpfs
?dev_rw_generic_chr_files(init_t)

(quoted diff) +1 -0

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 ?files_dontaudit_rw_root_files(init_t)
 ?files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 ?fs_list_inotifyfs(init_t)

?# cjp: this may be related to /dev/log
?fs_write_ramfs_sockets(init_t)

policy/modules/system/init.te +2 -0

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 ?mls_process_write_all_levels(init_t)
 ?mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 ?selinux_set_all_booleans(init_t)
 

Quoted 6 lines

Review mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

(quoted diff) +0 -0

 ?term_use_all_terms(init_t)

I'm not clear why this is necessary.??Sysvinit should only be loading?
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission in the kernel module, but surely not here, otherwise the system won't boot
?!

Hello again.

Quoted 27 lines · Guido Trentalancia via refpolicy

Quoted 26 lines · Chris PeBenito

Quoted 24 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 47 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

policy/modules/system/init.te +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

policy/modules/system/init.te mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

policy/modules/system/init.te +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

Quoted 6 lines

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission in the kernel module, but surely not here, otherwise the system won't boot
!

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for the init_t domain, when using sysvinit.

Quoted 25 lines · Guido Trentalancia via refpolicy

Hello again.

Quoted 21 lines · Guido Trentalancia via refpolicy

Quoted 20 lines · Chris PeBenito

Quoted 18 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Quoted 59 lines

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 50 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

policy/modules/system/init.te +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

policy/modules/system/init.te mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

policy/modules/system/init.te +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission

in

Quoted 8 lines

Quoted 3 lines

the kernel module, but surely not here, otherwise the system won't boot
!

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for the init_t domain, when using sysvinit.

I still run sysvinit systems. It isn't.

Quoted 25 lines · Guido Trentalancia via refpolicy

Hello again.

Quoted 21 lines · Guido Trentalancia via refpolicy

Quoted 20 lines · Chris PeBenito

Quoted 18 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Quoted 59 lines

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 50 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

policy/modules/system/init.te +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

policy/modules/system/init.te mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

policy/modules/system/init.te +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission

in

Quoted 4 lines

Quoted 3 lines

the kernel module, but surely not here, otherwise the system won't boot
!

Quoted 4 lines

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for the init_t domain, when using sysvinit.

I still run sysvinit systems. It isn't.

On 3 Jan 2017 2:06 am, "Guido Trentalancia via refpolicy" < refpolicy at oss.tresys.com> wrote:

On systems using sysvinit and not using initramfs, the init daemon from sysvinit needs to load the policy or it aborts the system initalization!

The call to selinux_init_load_policy is in the latest sysvinit source code
at src/init.c.

All my machines use sysvinit. And none of the initramfs' have anything SELinux related. Sysvinit loads the policy for me and it all works fine.

If sysvinit is loading the policy because it isn't in the initramfs then by
definition there is no policy yet at all so how can this rule make any difference at all?

This rule is absolutely not required on sysvinit systems I'm not sure why
you need it but you're gonna have to give us more info if you want help figuring out why.

-- Jason

Regards,

Guido

Quoted 90 lines · Chris PeBenito

Quoted 25 lines · Guido Trentalancia via refpolicy

Hello again.

Quoted 21 lines · Guido Trentalancia via refpolicy

Quoted 20 lines · Chris PeBenito

Quoted 18 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Quoted 59 lines

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 50 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

(quoted diff) +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

Review mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

(quoted diff) +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission

in

Quoted 4 lines

Quoted 3 lines

the kernel module, but surely not here, otherwise the system won't boot
!

Quoted 6 lines

Quoted 4 lines

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for the init_t domain, when using sysvinit.

I still run sysvinit systems. It isn't.

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

On systems using sysvinit and not using initramfs, the init daemon from sysvinit needs to load the policy or it aborts the system initalization!

The call to selinux_init_load_policy is in the latest sysvinit source code at src/init.c.

Regards,

Guido

Quoted 90 lines · Chris PeBenito

Quoted 25 lines · Guido Trentalancia via refpolicy

Hello again.

Quoted 21 lines · Guido Trentalancia via refpolicy

Quoted 20 lines · Chris PeBenito

Quoted 18 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes the call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Quoted 59 lines

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 50 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

policy/modules/system/init.te +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

policy/modules/system/init.te mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

policy/modules/system/init.te +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission

in

Quoted 4 lines

Quoted 3 lines

the kernel module, but surely not here, otherwise the system won't boot
!

Quoted 6 lines

Quoted 4 lines

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for the init_t domain, when using sysvinit.

I still run sysvinit systems. It isn't.

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 1 line · Guido Trentalancia via refpolicy

On systems using sysvinit and not using initramfs, the init daemon

from sysvinit needs to load the policy or it aborts the system initalization!

How does that work? The policy is obviously already loaded because else you would not need this permission. So it is "re-loading" the policy?

Allowing init to load_policy is not a good idea IMHO

Quoted 2 lines

The call to selinux_init_load_policy is in the latest sysvinit source

code at src/init.c.

Quoted 6 lines

Regards,

Guido

On the 02nd of January 2017 18:55:07 CET, Chris PeBenito

Quoted 15 lines · <[email protected]> wrote:

Quoted 15 lines · Guido Trentalancia via refpolicy

Quoted 14 lines

Hello again.

Quoted 10 lines · Guido Trentalancia via refpolicy

Quoted 9 lines · Chris PeBenito

Quoted 7 lines · Guido Trentalancia via refpolicy

Originally the aim of this patch was to start securing the init module so that it could run in confined mode instead of in the most unsafe unconfined mode and therefore the patch was removing the call to unconfined_domain().

Quoted 7 lines

Quoted 7 lines

Quoted 7 lines

Quoted 7 lines

Quoted 7 lines

Quoted 7 lines

However, the removal of the unconfined_domain() call has been rejected on the basis of the fact that it can be avoided by not loading the "unconfined" policy module (which unfortunately at the moment, still gets added to the configuration file during "make conf").

Currently, this second version of the patch no longer removes

the

Quoted 63 lines

Quoted 63 lines

Quoted 63 lines

Quoted 10 lines

Quoted 10 lines

Quoted 10 lines

call to unconfined_domain() and it only adds permissions needed by sysvinit (most notably the ability to load the policy during the system boot).

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/kernel/devices.if |   18 ++++++++++++++++++
 policy/modules/kernel/kernel.if  |   18 ++++++++++++++++++
 policy/modules/system/init.te    |    7 +++++++
 3 files changed, 43 insertions(+)

[...]

Quoted 50 lines

Quoted 40 lines

Quoted 40 lines

diff -pru a/policy/modules/system/init.te
b/policy/modules/system/init.te
--- a/policy/modules/system/init.te 2016-12-22
23:12:47.784929729 +0100
+++ b/policy/modules/system/init.te 2016-12-27
23:05:37.731451479 +0100

(quoted diff) +7 -0

@@ -134,6 +134,8 @@ dev_filetrans(init_t, initctl_t, fifo_fi
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
 
+kernel_mounton_proc_dirs(init_t)
+kernel_mount_proc(init_t)
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
 kernel_dontaudit_search_unlabeled(init_t)

@@ -141,6 +143,8 @@ kernel_dontaudit_search_unlabeled(init_t
 corecmd_exec_chroot(init_t)
 corecmd_exec_bin(init_t)
 
+dev_mounton_sysfs(init_t)
+dev_mount_sysfs(init_t)
 dev_read_sysfs(init_t)
 # Early devtmpfs
 dev_rw_generic_chr_files(init_t)

@@ -162,6 +166,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)

@@ -174,6 +179,8 @@ mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
 
+selinux_load_policy(init_t)
+selinux_mount_fs(init_t)
 selinux_set_all_booleans(init_t)
 

Quoted 6 lines

Review mls_file_write_all_levels(init_t) · line 186

Quoted 1 line

(quoted diff) +0 -0

 term_use_all_terms(init_t)

I'm not clear why this is necessary. Sysvinit should only be loading
the policy if is not loaded yet, so these permissions should be unnecessary.

The init daemon absolutely needs to load the SELinux policy !

Perhaps, it is possible to get rid of the other similar permission

Quoted 8 lines

Quoted 8 lines

in

Quoted 7 lines

Quoted 3 lines

the kernel module, but surely not here, otherwise the system won't boot
!

How about this patch ?

The selinux_load_policy() permission is absolutely necessary for

the

Quoted 9 lines

Quoted 3 lines

Quoted 1 line

init_t domain, when using sysvinit.

I still run sysvinit systems. It isn't.

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Add a permission needed for the correct functioning of sysvinit on systems using the initramfs.

Without the selinux_get_fs_mount() interface call, the call to libselinux:is_selinux_enabled() fails and sysvinit tries to do the initial policy load again.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/system/init.te |    5 +++++
 1 file changed, 5 insertions(+)

diff -pru a/policy/modules/system/init.te b/policy/modules/system/init.te

policy/modules/system/init.te +1 -0

@@ -162,6 +162,7 @@ files_exec_etc_files(init_t)
 files_dontaudit_rw_root_files(init_t)
 files_dontaudit_rw_root_chr_files(init_t)
 
+fs_getattr_xattr_fs(init_t)
 fs_list_inotifyfs(init_t)
 # cjp: this may be related to /dev/log
 fs_write_ramfs_sockets(init_t)