dracut: ordering of modules

DISCUSSION Mimi Zohar 6 participants 12 messages Feb 10, 2012 – Feb 14, 2012

Share & tools

Mimi Zohar

author

2012-02-10 15:01 UTC #0 lore raw

Hi Harald,

Originally, 98integrity/ima-policy-load.sh didn't start executing before 98selinux/selinux-loadpolicy.sh finished, but unfortunately it now does.

inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"

As the IMA policy could be dependent on LSM runtime info, this is a problem.

[   10.040574] type=1805 audit(1328865524.387:2): action="dont_measure" fsmagic="0x9fa0" res=0
[   10.040663] type=1805 audit(1328865524.387:3): action="dont_appraise" fsmagic="0x9fa0" res=0
[   10.040729] type=1805 audit(1328865524.387:4): action="dont_measure" fsmagic="0x62656572" res=0
[   10.040792] type=1805 audit(1328865524.387:5): action="dont_appraise" fsmagic="0x62656572" res=0
[   10.040857] type=1805 audit(1328865524.387:6): action="dont_measure" fsmagic="0x64626720" res=0
[   10.040921] type=1805 audit(1328865524.387:7): action="dont_appraise" fsmagic="0x64626720" res=0
[   10.040985] type=1805 audit(1328865524.387:8): action="dont_measure" fsmagic="0x01021994" res=0
[   10.041047] type=1805 audit(1328865524.387:9): action="dont_appraise" fsmagic="0x01021994" res=0
[   10.041113] type=1805 audit(1328865524.387:10): action="dont_measure" fsmagic="0x73636673" res=0
[   10.041177] type=1805 audit(1328865524.387:11): action="dont_appraise" fsmagic="0x73636673" res=0
[   11.898956] SELinux:  Completing initialization.

I've tried adding a depend for selinux, but it doesn't seem to resolve the problem, nor does delaying 98integrity to later. Any suggestions would be appreciated.

thanks,

Mimi

Roberto Sassu

2012-02-10 15:31 UTC #1 lore raw

Hi Mimi

i'm CCing the systemd and Fedora SELinux mailing lists.

Unfortunately, the SELinux policy initialization (at least in Fedora 16) has been moved to systemd, so, now, loading an IMA policy cannot be done in the initial ramdisk.

Further, the SELinux policy loading code is not in a unit file but embedded in the main binary, which means that the new code for loading IMA policies must be added just after that point.

I already wrote a patch for this. I need some time to test it and will post in the systemd mailing list at the beginning of the next week.

Roberto Sassu

Quoted 31 lines · Mimi Zohar

Hi Harald,
Originally, 98integrity/ima-policy-load.sh didn't start executing before 98selinux/selinux-loadpolicy.sh finished, but unfortunately it now does.
inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
As the IMA policy could be dependent on LSM runtime info, this is a problem.
[   10.040574] type=1805 audit(1328865524.387:2): action="dont_measure" fsmagic="0x9fa0" res=0
[   10.040663] type=1805 audit(1328865524.387:3): action="dont_appraise" fsmagic="0x9fa0" res=0
[   10.040729] type=1805 audit(1328865524.387:4): action="dont_measure" fsmagic="0x62656572" res=0
[   10.040792] type=1805 audit(1328865524.387:5): action="dont_appraise" fsmagic="0x62656572" res=0
[   10.040857] type=1805 audit(1328865524.387:6): action="dont_measure" fsmagic="0x64626720" res=0
[   10.040921] type=1805 audit(1328865524.387:7): action="dont_appraise" fsmagic="0x64626720" res=0
[   10.040985] type=1805 audit(1328865524.387:8): action="dont_measure" fsmagic="0x01021994" res=0
[   10.041047] type=1805 audit(1328865524.387:9): action="dont_appraise" fsmagic="0x01021994" res=0
[   10.041113] type=1805 audit(1328865524.387:10): action="dont_measure" fsmagic="0x73636673" res=0
[   10.041177] type=1805 audit(1328865524.387:11): action="dont_appraise" fsmagic="0x73636673" res=0
[   11.898956] SELinux:  Completing initialization.
I've tried adding a depend for selinux, but it doesn't seem to resolve the problem, nor does delaying 98integrity to later. Any suggestions would be appreciated.
thanks,
Mimi

Lennart Poettering

2012-02-10 18:14 UTC #2 lore raw

Quoted 9 lines · Roberto Sassu

Hi Mimi
i'm CCing the systemd and Fedora SELinux mailing lists.
Unfortunately, the SELinux policy initialization (at least in Fedora 16) has been moved to systemd, so, now, loading an IMA policy cannot be done in the initial ramdisk.

Quoted 7 lines

Further, the SELinux policy loading code is not in a unit file but embedded in the main binary, which means that the new code for loading IMA policies must be added just after that point.
I already wrote a patch for this. I need some time to test it and will post in the systemd mailing list at the beginning of the next week.

Hmm, what is this about? You need a place to load additional security policies into the kernel at early boot? For SELinux that indeed takes place from within PID 1 now in systemd. I'd expect that other security technologies like AppArmor should work the same.

If you want to hack on this basing your work on selinux-setup.c in the systemd tree should be fairly easy.

Lennart

Signature · 1 line

Lennart Poettering - Red Hat, Inc.

Mimi Zohar

author

2012-02-12 00:17 UTC #3 lore raw

Quoted 11 lines · Lennart Poettering

Quoted 9 lines · Roberto Sassu
Hi Mimi
i'm CCing the systemd and Fedora SELinux mailing lists.
Unfortunately, the SELinux policy initialization (at least in Fedora 16) has been moved to systemd, so, now, loading an IMA policy cannot be done in the initial ramdisk.

Quoted 7 lines

Quoted 7 lines
Further, the SELinux policy loading code is not in a unit file but embedded in the main binary, which means that the new code for loading IMA policies must be added just after that point.
I already wrote a patch for this. I need some time to test it and will post in the systemd mailing list at the beginning of the next week.

Thanks Roberto!

Quoted 4 lines

Hmm, what is this about? You need a place to load additional security policies into the kernel at early boot? For SELinux that indeed takes place from within PID 1 now in systemd. I'd expect that other security technologies like AppArmor should work the same.

The IMA measurement/appraisal policy, which is described in Documentation/ABI/testing/ima_policy, can be based on a number of criteria. One of these criteria are LSM subj/obj labels. The IMA measurement/appraisal policy should be loaded as early as possible, but only after the LSM policy has been loaded.

Mimi

Quoted 4 lines

If you want to hack on this basing your work on selinux-setup.c in the systemd tree should be fairly easy.
Lennart

Harald Hoyer

2012-02-13 09:59 UTC #4 lore raw

In reply to Mimi Zohar

Am 10.02.2012 16:01, schrieb Mimi Zohar:

Quoted 23 lines

Hi Harald,

Originally, 98integrity/ima-policy-load.sh didn't start executing before 98selinux/selinux-loadpolicy.sh finished, but unfortunately it now does.

inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"

As the IMA policy could be dependent on LSM runtime info, this is a problem.

[   10.040574] type=1805 audit(1328865524.387:2): action="dont_measure" fsmagic="0x9fa0" res=0
[   10.040663] type=1805 audit(1328865524.387:3): action="dont_appraise" fsmagic="0x9fa0" res=0
[   10.040729] type=1805 audit(1328865524.387:4): action="dont_measure" fsmagic="0x62656572" res=0
[   10.040792] type=1805 audit(1328865524.387:5): action="dont_appraise" fsmagic="0x62656572" res=0
[   10.040857] type=1805 audit(1328865524.387:6): action="dont_measure" fsmagic="0x64626720" res=0
[   10.040921] type=1805 audit(1328865524.387:7): action="dont_appraise" fsmagic="0x64626720" res=0
[   10.040985] type=1805 audit(1328865524.387:8): action="dont_measure" fsmagic="0x01021994" res=0
[   10.041047] type=1805 audit(1328865524.387:9): action="dont_appraise" fsmagic="0x01021994" res=0
[   10.041113] type=1805 audit(1328865524.387:10): action="dont_measure" fsmagic="0x73636673" res=0
[   10.041177] type=1805 audit(1328865524.387:11): action="dont_appraise" fsmagic="0x73636673" res=0
[   11.898956] SELinux:  Completing initialization.

Quoted 8 lines

I've tried adding a depend for selinux, but it doesn't seem to resolve the problem, nor does delaying 98integrity to later. Any suggestions would be appreciated.
thanks,
Mimi

In Fedora the selinux dracut module is disabled by default. You have to enable it manually.

echo 'add_dracutmodules+=" selinux "' >> /etc/dracut.conf.d/99-my.conf

although, this also should do the thing:

$ git diff modules.d/98integrity/module-setup.sh

(quoted diff) +0 -0

b/modules.d/98integrity/module-setup.sh
index 7d5771c..ff1b4aa 100755

modules.d/98integrity/module-setup.sh +1 -1

@@ -7,7 +7,7 @@ check() {
 }
 
 depends() {
-    echo masterkey securityfs
+    echo masterkey securityfs selinux
     return 0
 }

Roberto Sassu

2012-02-13 10:17 UTC #5 lore raw

Quoted 28 lines · Harald Hoyer

Am 10.02.2012 16:01, schrieb Mimi Zohar:
Quoted 27 lines
Hi Harald,
Originally, 98integrity/ima-policy-load.sh didn't start executing before 98selinux/selinux-loadpolicy.sh finished, but unfortunately it now does.
inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
As the IMA policy could be dependent on LSM runtime info, this is a problem.
[   10.040574] type=1805 audit(1328865524.387:2): action="dont_measure" fsmagic="0x9fa0" res=0
[   10.040663] type=1805 audit(1328865524.387:3): action="dont_appraise" fsmagic="0x9fa0" res=0
[   10.040729] type=1805 audit(1328865524.387:4): action="dont_measure" fsmagic="0x62656572" res=0
[   10.040792] type=1805 audit(1328865524.387:5): action="dont_appraise" fsmagic="0x62656572" res=0
[   10.040857] type=1805 audit(1328865524.387:6): action="dont_measure" fsmagic="0x64626720" res=0
[   10.040921] type=1805 audit(1328865524.387:7): action="dont_appraise" fsmagic="0x64626720" res=0
[   10.040985] type=1805 audit(1328865524.387:8): action="dont_measure" fsmagic="0x01021994" res=0
[   10.041047] type=1805 audit(1328865524.387:9): action="dont_appraise" fsmagic="0x01021994" res=0
[   10.041113] type=1805 audit(1328865524.387:10): action="dont_measure" fsmagic="0x73636673" res=0
[   10.041177] type=1805 audit(1328865524.387:11): action="dont_appraise" fsmagic="0x73636673" res=0
[   11.898956] SELinux:  Completing initialization.
I've tried adding a depend for selinux, but it doesn't seem to resolve the problem, nor does delaying 98integrity to later. Any suggestions would be appreciated.

Quoted 8 lines

Quoted 4 lines
thanks,
Mimi
In Fedora the selinux dracut module is disabled by default. You have to enable it manually.

Hi Harald

this functionality seems to be broken in dracut due to a change in the SELinux load_policy tool.
After enabling the selinux module in dracut, i obtain:

[    3.369059] dracut: Loading SELinux policy
[    3.449850] dracut: /sbin/load_policy: Can't load policy: No such file or directory
[    3.659899] dracut: Switching root

Quoted 23 lines

echo 'add_dracutmodules+=" selinux "'>> /etc/dracut.conf.d/99-my.conf
although, this also should do the thing:
$ git diff modules.d/98integrity/module-setup.sh
modules.d/98integrity/module-setup.sh +1 -1
index 7d5771c..ff1b4aa 100755
@@ -7,7 +7,7 @@ check() {
  }
 
  depends() {
-    echo masterkey securityfs
+    echo masterkey securityfs selinux
      return 0
  }
 

Harald Hoyer

2012-02-13 10:29 UTC #6 lore raw

Am 13.02.2012 11:17, schrieb Roberto Sassu:

Quoted 11 lines

Hi Harald
this functionality seems to be broken in dracut due to a change in the SELinux load_policy tool.
After enabling the selinux module in dracut, i obtain:
[    3.369059] dracut: Loading SELinux policy
[    3.449850] dracut: /sbin/load_policy: Can't load policy: No such file or
directory
[    3.659899] dracut: Switching root

This error can have multiple causes... Dan?

Daniel J Walsh

2012-02-13 17:00 UTC #7 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 7 lines · Harald Hoyer

Am 13.02.2012 11:17, schrieb Roberto Sassu:
Quoted 6 lines
Hi Harald
this functionality seems to be broken in dracut due to a change in the SELinux load_policy tool. After enabling the selinux module in dracut, i obtain:

Quoted 6 lines

Quoted 4 lines
[    3.369059] dracut: Loading SELinux policy [    3.449850]
dracut: /sbin/load_policy: Can't load policy: No such file or
directory [ 3.659899] dracut: Switching root
This error can have multiple causes... Dan?

Well likeliest would be selinux-policy package is not installed. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk85QaIACgkQrlYvE4MpobMNbwCgi8JG0fmlQsnvo2HNnA+Orxzr UYcAoKqHj0+Ll8lfbYpvGzANxck4MAwP
=geIr
-----END PGP SIGNATURE-----
--
selinux mailing list
[email protected]
https://admin.fedoraproject.org/mailman/listinfo/selinux

Roberto Sassu

2012-02-14 15:53 UTC #8 lore raw

Hi Dan

i confirm this issue happens in a Fedora 16 system with the selinux-policy package installed.

The selinux dracut module tries to load the policy but returns with the error below. After switching root, the policy is successfully loaded by Systemd.

Thanks

Roberto Sassu

Quoted 23 lines · Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 7 lines · Harald Hoyer
Am 13.02.2012 11:17, schrieb Roberto Sassu:
Quoted 6 lines
Hi Harald
this functionality seems to be broken in dracut due to a change in the SELinux load_policy tool. After enabling the selinux module in dracut, i obtain:
Quoted 6 lines
Quoted 4 lines
[    3.369059] dracut: Loading SELinux policy [    3.449850]
dracut: /sbin/load_policy: Can't load policy: No such file or
directory [ 3.659899] dracut: Switching root
This error can have multiple causes... Dan?
Well likeliest would be selinux-policy package is not installed. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

Quoted 4 lines

iEYEARECAAYFAk85QaIACgkQrlYvE4MpobMNbwCgi8JG0fmlQsnvo2HNnA+Orxzr UYcAoKqHj0+Ll8lfbYpvGzANxck4MAwP
=geIr
-----END PGP SIGNATURE-----

--
selinux mailing list
[email protected]
https://admin.fedoraproject.org/mailman/listinfo/selinux

Daniel J Walsh

2012-02-14 18:53 UTC #9 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 5 lines · Roberto Sassu

Hi Dan
i confirm this issue happens in a Fedora 16 system with the selinux-policy package installed.

Quoted 9 lines

The selinux dracut module tries to load the policy but returns with the error below. After switching root, the policy is successfully loaded by Systemd.
Thanks
Roberto Sassu

Well in F16 dracut is not supposed to load the policy.

Quoted 15 lines

Quoted 13 lines · Harald Hoyer
Quoted 13 lines
Quoted 13 lines
Am 13.02.2012 11:17, schrieb Roberto Sassu:
Quoted 11 lines
Hi Harald
this functionality seems to be broken in dracut due to a change in the SELinux load_policy tool. After enabling the selinux module in dracut, i obtain:
[    3.369059] dracut: Loading SELinux policy [
3.449850] dracut: /sbin/load_policy: Can't load policy: No
such file or directory [ 3.659899] dracut: Switching
root

Quoted 6 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
This error can have multiple causes... Dan?
Well likeliest would be selinux-policy package is not installed.
-- selinux mailing list selinux-TuqUDEhatI4ANWPb/1PvSmm0pvjS0E/[email protected]
https://admin.fedoraproject.org/mailman/listinfo/selinux

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk86rZ4ACgkQrlYvE4MpobPKXwCfbVdkQuaylTtHIASztazyokqN u4wAnR9bueXLrFH4vvDxSPYSNqBDYP19
=W0oJ
-----END PGP SIGNATURE-----

Mimi Zohar

author

2012-02-13 14:56 UTC #10 lore raw

In reply to Harald Hoyer

Quoted 47 lines · Harald Hoyer

Am 10.02.2012 16:01, schrieb Mimi Zohar:
Quoted 23 lines
Hi Harald,
Originally, 98integrity/ima-policy-load.sh didn't start executing before 98selinux/selinux-loadpolicy.sh finished, but unfortunately it now does.
inst_hook pre-pivot 50 "$moddir/selinux-loadpolicy.sh" inst_hook pre-pivot 62 "$moddir/ima-policy-load.sh"
As the IMA policy could be dependent on LSM runtime info, this is a problem.
[   10.040574] type=1805 audit(1328865524.387:2): action="dont_measure" fsmagic="0x9fa0" res=0
[   10.040663] type=1805 audit(1328865524.387:3): action="dont_appraise" fsmagic="0x9fa0" res=0
[   10.040729] type=1805 audit(1328865524.387:4): action="dont_measure" fsmagic="0x62656572" res=0
[   10.040792] type=1805 audit(1328865524.387:5): action="dont_appraise" fsmagic="0x62656572" res=0
[   10.040857] type=1805 audit(1328865524.387:6): action="dont_measure" fsmagic="0x64626720" res=0
[   10.040921] type=1805 audit(1328865524.387:7): action="dont_appraise" fsmagic="0x64626720" res=0
[   10.040985] type=1805 audit(1328865524.387:8): action="dont_measure" fsmagic="0x01021994" res=0
[   10.041047] type=1805 audit(1328865524.387:9): action="dont_appraise" fsmagic="0x01021994" res=0
[   10.041113] type=1805 audit(1328865524.387:10): action="dont_measure" fsmagic="0x73636673" res=0
[   10.041177] type=1805 audit(1328865524.387:11): action="dont_appraise" fsmagic="0x73636673" res=0
[   11.898956] SELinux:  Completing initialization.
Quoted 8 lines
I've tried adding a depend for selinux, but it doesn't seem to resolve the problem, nor does delaying 98integrity to later. Any suggestions would be appreciated.
thanks,
Mimi
In Fedora the selinux dracut module is disabled by default. You have to enable it manually.
echo 'add_dracutmodules+=" selinux "' >> /etc/dracut.conf.d/99-my.conf
although, this also should do the thing:
$ git diff modules.d/98integrity/module-setup.sh
modules.d/98integrity/module-setup.sh +0 -0
index 7d5771c..ff1b4aa 100755

modules.d/98integrity/module-setup.sh check() { · line 12

Quoted 7 lines

modules.d/98integrity/module-setup.sh +1 -1

@@ -7,7 +7,7 @@ check() {
 }
 
 depends() {
-    echo masterkey securityfs
+    echo masterkey securityfs selinux
     return 0
 }

Already tried that, as mentioned above.

thanks,

Mimi

Hannes Reinecke

2012-02-13 15:02 UTC #11 lore raw

In reply to Harald Hoyer

Quoted 3 lines · Harald Hoyer

Am 10.02.2012 16:01, schrieb Mimi Zohar:
Quoted 2 lines
Hi Harald,

[ .. ]

Ohh, can you _order_ dracut modules now?

Harald, that'll be four modules for me, please :-)

Sorry, I just _had_ to go for that cheap pun.

Cheers,

Hannes

Signature · 4 lines

Dr. Hannes Reinecke		      zSeries & Storage
[email protected]			      +49 911 74053 688
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: J. Hawn, J. Guild, F. Imendörffer, HRB 16746 (AG Nürnberg)