Allow lvm_t to use unconfined_t SysV semaphores
PATCH 1/1 Allow lvm_t to use unconfined_t SysV semaphores
When an unconfined user uses truecrypt to mount an encrypted file, following logs appears in audit.log:
type=AVC msg=audit(1397491934.868:164): avc: denied { associate } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
type=AVC msg=audit(1397491934.868:165): avc: denied { unix_read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
type=AVC msg=audit(1397491934.868:165): avc: denied { read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
type=AVC msg=audit(1397491934.868:166): avc: denied { unix_write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
type=AVC msg=audit(1397491934.868:166): avc: denied { write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=semaudit2allow gives:
allow lvm_t unconfined_t:sem { unix_read read write unix_write associate };Allowing this access requires a new interface in unconfined.if.
--- policy/modules/system/lvm.te | 4 ++++ policy/modules/system/unconfined.if | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+)
policy/modules/system/lvm.te +4 -0
@@ -347,6 +347,10 @@ optional_policy(` ') optional_policy(` + unconfined_rw_semaphores(lvm_t) +') + +optional_policy(` virt_manage_images(lvm_t) ')
policy/modules/system/unconfined.if +37 -0
@@ -463,6 +463,43 @@ interface(`unconfined_dontaudit_rw_pipes',` ######################################## ## <summary> +## Read and write unconfined domain SysV semaphores. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`unconfined_rw_semaphores',` + gen_require(` + type unconfined_t; + ') + + allow $1 unconfined_t:sem rw_sem_perms; +') + +######################################## +## <summary> +## Do not audit attempts to read and write +## unconfined domain SysV semaphores. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`unconfined_dontaudit_rw_semaphores',` + gen_require(` + type unconfined_t; + ') + + dontaudit $1 unconfined_t:sem rw_sem_perms; +') + +######################################## +## <summary> ## Connect to the unconfined domain using ## a unix domain stream socket. ## </summary>
Signature · 1 line
1.9.1
PATCH 1/1 Allow lvm_t to use unconfined_t SysV semaphores
Quoted 9 lines · Nicolas Iooss
When an unconfined user uses truecrypt to mount an encrypted file, following logs appears in audit.log:
type=AVC msg=audit(1397491934.868:164): avc: denied { associate } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { unix_read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { unix_write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
Quoted 5 lines
audit2allow gives:
allow lvm_t unconfined_t:sem { unix_read read write unix_write associate };Allowing this access requires a new interface in unconfined.if.
It might make more sense to add this access to lvm_run(), since any user than can run lvm could potentially need this. It also warrants a comment in the policy about Truecrypt.
Quoted 69 lines
--- policy/modules/system/lvm.te | 4 ++++ policy/modules/system/unconfined.if | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+)policy/modules/system/lvm.te +4
-0@@ -347,6 +347,10 @@ optional_policy(` ') optional_policy(` + unconfined_rw_semaphores(lvm_t) +') + +optional_policy(` virt_manage_images(lvm_t) ')policy/modules/system/unconfined.if +37
-0@@ -463,6 +463,43 @@ interface(`unconfined_dontaudit_rw_pipes',` ######################################## ## <summary> +## Read and write unconfined domain SysV semaphores. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`unconfined_rw_semaphores',` + gen_require(` + type unconfined_t; + ') + + allow $1 unconfined_t:sem rw_sem_perms; +') + +######################################## +## <summary> +## Do not audit attempts to read and write +## unconfined domain SysV semaphores. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`unconfined_dontaudit_rw_semaphores',` + gen_require(` + type unconfined_t; + ') + + dontaudit $1 unconfined_t:sem rw_sem_perms; +') + +######################################## +## <summary> ## Connect to the unconfined domain using ## a unix domain stream socket. ## </summary>
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow lvm_t to use unconfined_t SysV semaphores
2014-04-21 15:17 GMT+02:00 Christopher J. PeBenito <[email protected]>:
Quoted 10 lines · Nicolas Iooss
Quoted 9 lines
When an unconfined user uses truecrypt to mount an encrypted file, following logs appears in audit.log:
type=AVC msg=audit(1397491934.868:164): avc: denied { associate } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { unix_read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { unix_write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem
Quoted 7 lines
Quoted 5 lines
audit2allow gives:
allow lvm_t unconfined_t:sem { unix_read read write unix_write associate };Allowing this access requires a new interface in unconfined.if.
It might make more sense to add this access to
lvm_run(), since any user than can run lvm could potentially need this. It also warrants a comment in the policy about Truecrypt.
Thanks for your answer. As code and policy are a bit difficult to understand here, I needed to take time to dig more and understand what's going on here. Here is what I've found so far:
* unconfined_t doesn't use lvm_run(). More precisely, "sesearch -A -p transition -t lvm_t" shows transitions for udev_t, sysadm_t, init_t, initrc_t... but not unconfined_t. So I would expect dmsetup to run in unconfined_t context, not lvm_t.
* "strace -f truecrypt --mount mydata" shows that after truecrypt asks for a decryption key, it:
- creates /dev/loop0 with "mydata" file (using losetup),
- calls "dmsetup create truecrypt1" and gives through stdin a table
which basically configures /dev/mapper/truecrypt1 to decrypt data from /dev/loop0 using kernel crypto API,
- mounts /dev/mapper/truecrypt1.
* Moreover, "dmsetup create truecrypt1" uses SysV semaphores. The code [1][2] shows that the semaphores are used to sync with udev notifications.
* Using a custom kernel module which logs every call to execve(), it appears that udev calls "/usr/bin/dmsetup udevflags 6307491", "/usr/lib/udev/udisks-dm-export 254 0", "/usr/lib/udev/udisks-part-id /dev/dm-0" and "/usr/bin/dmsetup udevcomplete 6307491" right after truecrypt calls "dmsetup create truecrypt1". The policy says that when udev runs dmsetup, it is in lvm_t context.
If I understand correctly, when unconfined_t user uses truecrypt, this program executes dmsetup in unconfined_t context and dmsetup creates a semaphore in unconfined_t context. Then it notifies udev about a new device and udev executes dmsetup to sync with the first dmsetup process. The new dmsetup processes run in lvm_t context and use the semaphore created in unconfined_t context. This behavior is denied by the current reference policy.
I'm quite new to SELinux but this kind of scenario where a resource (here a semaphore) is shared between a confined daemon (udev) and an unconfined user (who uses truecrypt) might have occurred in the past and a kind of general solution may exist. There are at least two
solutions: to allow the restricted daemon to access unconfined resources (ie. allow lvm_t to use unconfined_t semaphores), or to add a transition so that the user creates a confined resource (ie. add "lvm_run(unconfined_t)"). What is the best way to solve this issue?
Regards,
Nicolas
PS: If it matters, I'm using Arch Linux with device-mapper 2.02.106, truecrypt 1:7.1a, udev from systemd 212, linux 3.14.2 and a custom SELinux policy heavily patched from the reference policy.
[1] https://git.fedorahosted.org/cgit/lvm2.git/tree/tools/dmsetup.c
[2] https://git.fedorahosted.org/cgit/lvm2.git/tree/libdm/libdm-common.c
PATCH 1/1 Allow lvm_t to use unconfined_t SysV semaphores
Quoted 24 lines · Nicolas Iooss
2014-04-21 15:17 GMT+02:00 Christopher J. PeBenito <[email protected]>:
Quoted 10 lines · Nicolas Iooss
Quoted 9 lines
When an unconfined user uses truecrypt to mount an encrypted file, following logs appears in audit.log:
type=AVC msg=audit(1397491934.868:164): avc: denied { associate } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { unix_read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:165): avc: denied { read } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { unix_write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=sem type=AVC msg=audit(1397491934.868:166): avc: denied { write } for pid=3695 comm="dmsetup" key=223198474 scontext=system_u:system_r:lvm_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=semQuoted 7 lines
Quoted 5 lines
audit2allow gives:
allow lvm_t unconfined_t:sem { unix_read read write unix_write associate };Allowing this access requires a new interface in unconfined.if.
It might make more sense to add this access to
lvm_run(), since any user than can run lvm could potentially need this. It also warrants a comment in the policy about Truecrypt.Thanks for your answer. As code and policy are a bit difficult to understand here, I needed to take time to dig more and understand what's going on here. Here is what I've found so far:
*
unconfined_tdoesn't uselvm_run(). More precisely, "sesearch -A -p
[...]
Quoted 3 lines
* Moreover, "dmsetup create truecrypt1" uses SysV semaphores. The code [1][2] shows that the semaphores are used to sync with udev notifications.
[...]
Quoted 1 line
when udev runs dmsetup, it is in
lvm_tcontext.
[...]
Quoted 8 lines
I'm quite new to SELinux but this kind of scenario where a resource (here a semaphore) is shared between a confined daemon (udev) and an unconfined user (who uses truecrypt) might have occurred in the past and a kind of general solution may exist. There are at least two
solutions: to allow the restricted daemon to access unconfined resources (ie. allowlvm_tto useunconfined_tsemaphores), or to add a transition so that the user creates a confined resource (ie. add "lvm_run(unconfined_t)"). What is the best way to solve this issue?
Thanks for the very detailed investigation. Based on your results, I'd say that these denials indicate that the semaphores have the wrong label, i.e. the semaphores should be labeled lvm_t, rather than unconfined_t. To make that happen, the solution is to have unconfined_t transition to lvm_t.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com