1:45 p.m.
I'm running Spotify (a streaming music service,
http://www.spotify.com/). They don't have a native Linux client, but
they recommend Linux users to use the Windows client under wine. And
it does indeed work fine.
But I'm not completely comfortable with running this application
unconfined. After all, it is a binary blob I download that does a lot
of network traffic. Who knows what bugs it may contain? So I was
considering if it would be able to write an SELinux policy module for
it, to confine it.
As it is a wine application, the binary that runs is wine. For
obvious reasons, I do not want all wine applications to be confined by
this policy.
Is there some good way to do this?
One possible way, I guess, would be to write a small wrapper binary
that starts wine with Spotify, and make sure that program transitions
into some spotify_t domain. This domain would not be allowed to
transition further into wine_t. I could then implement the spotify
module as a stripped down version of the wine module.
I assume it would work, wouldn't it? It would be slightly fragile, in
that I need to remember to not start spotify "directly", but always
use the wrapper. Is there a better way to do this? Has anybody else
made some efforts in confining specific wine applications? Thoughts
and ideas are welcome!
5:54 p.m.
New subject: Confining Applications running as root user
We are trying to migrate our existing security policies to SELinux. We
are new to SELinux and hence are finding it difficult to map our
existing policies.
In our existing policy, all applications (including ones running as root
user) with the exception of insmod and modprobe, are denied access to
/lib directory. How would we go about writing such a policy without
actually confining every application manually, since that would indeed
be cumbersome?
Thanks,
Anamitra & Radha.
10:15 a.m.
New subject: Confining Applications running as root user
On Tue, Aug 11, 2009 at 6:54 PM, Anamitra Dutta Majumdar
(anmajumd)<anmajumd(a)cisco.com> wrote:
We are trying to migrate our existing security policies to SELinux. We
are new to SELinux and hence are finding it difficult to map our
existing policies.
I would recommend SELinux by Example since you will need to be
familiar with the policy language to properly make the transition. I
am not aware of any website that covers it in the same detail but if
you find one let me know.
In our existing policy, all applications (including ones running as
root
user) with the exception of insmod and modprobe, are denied access to
/lib directory. How would we go about writing such a policy without
actually confining every application manually, since that would indeed
be cumbersome?
Denied access completely? I'd think that might cause some
problems but
there is still plenty I don't know so...
You were using AppArmor or something similar?
Interesting. I think a neverallow rule is probably your best bet here,
it will generate compiler error if you have any rules that violate it.
I don't specifically remember how the errors get reported i.e. does it
spit out the specific allow rules that cause the problem? Seems I need
another refpolicy refresher.
Anyway after I'd cleaned up the errors which might be a task and
two-thirds, I'd add my allow rules for insmod and modprobe which share
the same label, insmod_exec_t, so at least that would be easy :^)
Though the thing to consider is really do I need to completely deny
access to this directory. SELinux allows fine-grained access control
so depending on your security goals the restriction need not
necessarily require heavy modification of the policy,
Have you used the policy analysis tools? These should help you get a
better idea of the scope of things affected by restricting access to
lib_t , they take a little getting used to so be patient.
yum install setools
There is also a GUI policy dev tool, two of them actually. SLIDE is
the one I think you'd need to tackle this task. I haven't really used
it much, I like to beat my head against brick walls don't you know,
you can install it with yum but its separate from setools, yum install
slide?
http://oss.tresys.com/projects/slide
I highly recommend the book mentioned above, if your completely new to SELinux.
So that's how I'd start to go about it anyway, there are much more
experienced hands monitoring this list but they are busy folk. You
could try the IRC chat #selinux and #fedora-selinux for more direct
and immediate help.
dgrift is usually around there and is a good resource for these kinds
of questions.
Also you don't mention exactly what its for but there is a minimal
selinux policy you can load and that might cut down on a lot of the
work.
3:34 p.m.
New subject: Confining Applications running as root user
On 08/11/2009 06:54 PM, Anamitra Dutta Majumdar (anmajumd) wrote:
We are trying to migrate our existing security policies to SELinux. We
are new to SELinux and hence are finding it difficult to map our
existing policies.
In our existing policy, all applications (including ones running as root
user) with the exception of insmod and modprobe, are denied access to
/lib directory. How would we go about writing such a policy without
actually confining every application manually, since that would indeed
be cumbersome?
Thanks,
Anamitra & Radha.
So you want to control an administrator that is logged in as root from writing to
/lib?
Not very easy to do. If he can disable selinux, load kernel modules, install rpm ...
He can easily circumvent your protection.
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
1:44 p.m.
New subject: Confining Applications running as root user
Thanks everyone for their responses.
I have another followup question.
Is it mandatory to add all the neverallow rules to assert.te. If so does
that imply that we need to maintain our own version of assert.te with
the modifications.
Thanks
Anamitra & Radha
-----Original Message-----
From: Daniel J Walsh [mailto:dwalsh@redhat.com]
Sent: Wednesday, August 12, 2009 1:34 PM
To: Anamitra Dutta Majumdar (anmajumd)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Confining Applications running as root user
On 08/11/2009 06:54 PM, Anamitra Dutta Majumdar (anmajumd) wrote:
We are trying to migrate our existing security policies to SELinux. We
are new to SELinux and hence are finding it difficult to map our
existing policies.
In our existing policy, all applications (including ones running as
root
user) with the exception of insmod and modprobe, are denied access to
/lib directory. How would we go about writing such a policy without
actually confining every application manually, since that would indeed
be cumbersome?
Thanks,
Anamitra & Radha.
So you want to control an administrator that is logged in as root from
writing to /lib?
Not very easy to do. If he can disable selinux, load kernel modules,
install rpm ...
He can easily circumvent your protection.
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
5386
days inactive
5396
days old
selinux@lists.fedoraproject.org
4 comments
4 participants
participants (4)
-
Anamitra Dutta Majumdar -
Daniel J Walsh -
Göran Uddeborg -
max