1:16 p.m.
I'm using Fedora 23 with confined users:
[root@earth ~]# semanage user -l | egrep '^(SELinux|staff_u)'
SELinux User Prefix MCS Level MCS Range SELinux Roles
staff_u user s0 s0-s0:c0.c1023 staff_r system_r
unconfined_r
I'd like to allow this user to start a process running as themselves
under a targeted policy, nodejswebserver_t, but when I try to run the
executable, I get "Permission denied":
[markmont@earth ~]$ id -Z
staff_u:staff_r:staff_t:s0
[markmont@earth ~]$ ls -lZ /sw/sbin/node
-rwxr-xr-x. 1 markmont markmont
system_u:object_r:nodejswebserver_exec_t:s0 29949360 Oct 4 16:39
/sw/sbin/node
[markmont@earth ~]$ /sw/sbin/node
-bash: /sw/sbin/node: Permission denied
[markmont@earth ~]$
The following denials appear in the audit log:
2016-10-12 18:05:29 type=AVC msg=audit(1476295529.526:48313): avc:
denied { transition } for pid=1034 comm="bash" path="/sw/sbin/node"
dev="dm-0" ino=294783 scontext=staff_u:staff_r:staff_t:s0
tcontext=staff_u:system_r:nodejswebserver_t:s0 tclass=process permissive=0
2016-10-12 18:05:29 type=PATH msg=audit(1476295529.526:48313): item=0
name="/sw/sbin/node" inode=294783 dev=fc:00 mode=0100755 ouid=1000
ogid=1000 rdev=00:00 obj=system_u:object_r:nodejswebserver_exec_t:s0
nametype=NORMAL
audit2allow suggests the following:
allow staff_t nodejswebserver_t:process transition;
...but this is already in my local policy:
domain_system_change_exemption(staff_t);
domtrans_pattern(staff_t, nodejswebserver_exec_t, nodejswebserver_t);
type_transition staff_t nodejswebserver_exec_t:process nodejswebserver_t;
role_transition staff_r nodejswebserver_exec_t system_r;
allow staff_t nodejswebserver_t:process transition;
allow staff_t nodejswebserver_t:process { noatsecure rlimitinh siginh };
I feel like I'm overlooking something fundamental regarding
transitioning out of a confined user domain to another domain. Any ideas?
--
Mark Montague
mark(a)catseye.org
12:15 a.m.
On 13/10/16 04:16, Mark Montague wrote:
I'm using Fedora 23 with confined users:
[root@earth ~]# semanage user -l | egrep '^(SELinux|staff_u)'
SELinux User Prefix MCS Level MCS Range SELinux Roles
staff_u user s0 s0-s0:c0.c1023 staff_r system_r
unconfined_r
I'd like to allow this user to start a process running as themselves
under a targeted policy, nodejswebserver_t, but when I try to run the
executable, I get "Permission denied":
[markmont@earth ~]$ id -Z
staff_u:staff_r:staff_t:s0
[markmont@earth ~]$ ls -lZ /sw/sbin/node
-rwxr-xr-x. 1 markmont markmont
system_u:object_r:nodejswebserver_exec_t:s0 29949360 Oct 4 16:39
/sw/sbin/node
[markmont@earth ~]$ /sw/sbin/node
-bash: /sw/sbin/node: Permission denied
[markmont@earth ~]$
The following denials appear in the audit log:
2016-10-12 18:05:29 type=AVC msg=audit(1476295529.526:48313): avc:
denied { transition } for pid=1034 comm="bash"
path="/sw/sbin/node"
dev="dm-0" ino=294783 scontext=staff_u:staff_r:staff_t:s0
tcontext=staff_u:system_r:nodejswebserver_t:s0 tclass=process
permissive=0
2016-10-12 18:05:29 type=PATH msg=audit(1476295529.526:48313): item=0
name="/sw/sbin/node" inode=294783 dev=fc:00 mode=0100755 ouid=1000
ogid=1000 rdev=00:00 obj=system_u:object_r:nodejswebserver_exec_t:s0
nametype=NORMAL
audit2allow suggests the following:
allow staff_t nodejswebserver_t:process transition;
...but this is already in my local policy:
domain_system_change_exemption(staff_t);
domtrans_pattern(staff_t, nodejswebserver_exec_t, nodejswebserver_t);
type_transition staff_t nodejswebserver_exec_t:process nodejswebserver_t;
role_transition staff_r nodejswebserver_exec_t system_r;
allow staff_t nodejswebserver_t:process transition;
allow staff_t nodejswebserver_t:process { noatsecure rlimitinh siginh };
I feel like I'm overlooking something fundamental regarding
transitioning out of a confined user domain to another domain. Any
ideas?
I think your policy is missing this:
role staff_t types nodejswebserver_t
Cheers,
Doug
8:22 a.m.
On 2016-10-13 01:15, Doug Brown wrote:
I think your policy is missing this:
role staff_t types nodejswebserver_t
Thanks for the suggestion! I added this (changing "staff_t" to
"staff_r" above) but the problem still occurs.
On 2016-10-13 08:03, Miroslav Grepl wrote:
Could you paste your outpus of audit2allow and we can continue with
that?
I tried this as shown below, but the rule output by audit2allow is
already in the loaded policy:
[root@earth nodejs_webserver]# ausearch -m avc -su staff_t -ts recent
|grep transition |audit2allow
#============= staff_t ==============
allow staff_t nodejswebserver_t:process transition;
[root@earth nodejs_webserver]# sesearch -A -s staff_t -t
nodejswebserver_t -c process
Found 2 semantic av rules:
allow staff_t nodejswebserver_t : process { transition noatsecure
siginh rlimitinh } ;
allow staff_t domain : process { getsched getcap getattr } ;
[root@earth nodejs_webserver]#
Here is what I currently have:
role staff_r types nodejswebserver_t;
domain_system_change_exemption(staff_t);
domtrans_pattern(staff_t, nodejswebserver_exec_t, nodejswebserver_t);
type_transition staff_t nodejswebserver_exec_t:process nodejswebserver_t;
role_transition staff_r nodejswebserver_exec_t system_r;
allow staff_t nodejswebserver_t:process transition;
allow staff_t nodejswebserver_t:process { noatsecure rlimitinh siginh };
And the audit log entries:
2016-10-13 13:11:45 type=AVC msg=audit(1476364305.299:49175): avc:
denied { transition } for pid=3566 comm="bash" path="/sw/sbin/node"
dev="dm-0" ino=294783 scontext=staff_u:staff_r:staff_t:s0
tcontext=staff_u:system_r:nodejswebserver_t:s0 tclass=process permissive=0
2016-10-13 13:11:45 type=PATH msg=audit(1476364305.299:49175): item=0
name="/sw/sbin/node" inode=294783 dev=fc:00 mode=0100755 ouid=1000
ogid=1000 rdev=00:00 obj=system_u:object_r:nodejswebserver_exec_t:s0
nametype=NORMAL
--
Mark Montague
mark(a)catseye.org
10:10 a.m.
On 2016-10-13 09:22, Mark Montague wrote:
Many thanks for everyone's help on this!
--
Mark Montague
mark(a)catseye.org
I tried this as shown below, but the rule output by audit2allow is
already in the loaded policy:
[root@earth nodejs_webserver]# ausearch -m avc -su staff_t -ts recent
|grep transition |audit2allow
#============= staff_t ==============
allow staff_t nodejswebserver_t:process transition;
[root@earth nodejs_webserver]# sesearch -A -s staff_t -t
nodejswebserver_t -c process
Found 2 semantic av rules:
allow staff_t nodejswebserver_t : process { transition noatsecure
siginh rlimitinh } ;
allow staff_t domain : process { getsched getcap getattr } ;
[root@earth nodejs_webserver]#
I've found the solution:
The original file context for the executable was
system_u:object_r:nodejswebserver_exec_t:s0, and this was the source of
the problem. As soon as I changed the file context for the executable
to system_u:system_r:nodejswebserver_exec_t:s0 everything started working.
The problem was that when I tried various things before, the command
chcon system_u:system_r:nodejswebserver_exec_t:s0 /sw/sbin/node
gave the error "invalid context". So I incorrectly assumed that the
original context was correct and tried other solutions instead.
In order to get the chcon command to succeed, I had to add the following
rule to the local targeted policy:
role system_r types nodejswebserver_exec_t;
As soon as I added this rule and changed the file context the denial
went away. Although audit2allow said that the rule "allow staff_t
nodejswebserver_t:process transition;" is what was needed, this was not
accurate in this case since the suggested rule was already present via
the domtrans_pattern macro -- what was missing was changing the file
context role from object_r to system_r, which was enabled by the other
rule above.
Here is the final set of rules to allow transition from the confined
user domain staff_t to nodejswebserver_t:
role system_r types nodejswebserver_exec_t;
role_transition staff_r nodejswebserver_exec_t system_r;
domain_system_change_exemption(staff_t);
domtrans_pattern(staff_t, nodejswebserver_exec_t, nodejswebserver_t);
And here is a demonstration of the result:
[markmont@earth ~]$ id -Z
staff_u:staff_r:staff_t:s0
[markmont@earth ~]$ /sw/sbin/node
require('child_process').execFileSync('id',
['-Z'], { stdio:
'inherit' } );
staff_u:system_r:nodejswebserver_t:s0
null
7:03 a.m.
On 10/12/2016 08:16 PM, Mark Montague wrote:
I'm using Fedora 23 with confined users:
[root@earth ~]# semanage user -l | egrep '^(SELinux|staff_u)'
SELinux User Prefix MCS Level MCS Range SELinux Roles
staff_u user s0 s0-s0:c0.c1023 staff_r system_r
unconfined_r
I'd like to allow this user to start a process running as themselves
under a targeted policy, nodejswebserver_t, but when I try to run the
executable, I get "Permission denied":
[markmont@earth ~]$ id -Z
staff_u:staff_r:staff_t:s0
[markmont@earth ~]$ ls -lZ /sw/sbin/node
-rwxr-xr-x. 1 markmont markmont
system_u:object_r:nodejswebserver_exec_t:s0 29949360 Oct 4 16:39
/sw/sbin/node
[markmont@earth ~]$ /sw/sbin/node
-bash: /sw/sbin/node: Permission denied
[markmont@earth ~]$
The following denials appear in the audit log:
2016-10-12 18:05:29 type=AVC msg=audit(1476295529.526:48313): avc:
denied { transition } for pid=1034 comm="bash"
path="/sw/sbin/node"
dev="dm-0" ino=294783 scontext=staff_u:staff_r:staff_t:s0
tcontext=staff_u:system_r:nodejswebserver_t:s0 tclass=process permissive=0
2016-10-12 18:05:29 type=PATH msg=audit(1476295529.526:48313): item=0
name="/sw/sbin/node" inode=294783 dev=fc:00 mode=0100755 ouid=1000
ogid=1000 rdev=00:00 obj=system_u:object_r:nodejswebserver_exec_t:s0
nametype=NORMAL
audit2allow suggests the following:
allow staff_t nodejswebserver_t:process transition;
...but this is already in my local policy:
domain_system_change_exemption(staff_t);
domtrans_pattern(staff_t, nodejswebserver_exec_t, nodejswebserver_t);
type_transition staff_t nodejswebserver_exec_t:process nodejswebserver_t;
role_transition staff_r nodejswebserver_exec_t system_r;
allow staff_t nodejswebserver_t:process transition;
allow staff_t nodejswebserver_t:process { noatsecure rlimitinh siginh };
I feel like I'm overlooking something fundamental regarding
transitioning out of a confined user domain to another domain. Any ideas?
Hi Mark,
this is a constraint issue for "transition" permission. The problem is
your role are different.
You can try to use "audit2allow" which will tell you what is wrong.
1. Re-test it
2. Execute
# ausearch -m avc -su staff_t -ts recent |grep transition |audit2allow
Could you paste your outpus of audit2allow and we can continue with that?
Either you can have it running with staff_r role without
role_transition staff_r nodejswebserver_exec_t system_r;
rule or you will need to add additional attributes from audit2allow
suggestions.
Thank you,
--
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.
2760
days inactive
2761
days old
selinux@lists.fedoraproject.org
4 comments
3 participants
participants (3)
-
Doug Brown -
Mark Montague -
Miroslav Grepl