The Selinux Notebook, Volume 2
Total Page:16
File Type:pdf, Size:1020Kb
The SELinux Notebook - Sample Policy Source The SELinux Notebook Volume 2 Sample Policy Source (2nd Edition) Page 1 The SELinux Notebook - Sample Policy Source 0. Notebook Information 0.1 Copyright Information Copyright © 2010 Richard Haines. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled “GNUFree Documentation License”. The scripts and source code in this Notebook are covered by the GNU General Public License. The scripts and code are free source: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version. These are distributed in the hope that they will be useful in researching SELinux, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with scripts and source code. If not, see <http://www.gnu.org/licenses/>. 0.2 Revision History Edition Date Changes 1.0 20th Nov ‘09 First released. 2.0 9th May '10 Split the Notebook into two volumes: 1. The Foundations - covers SELinux and its supporting services. 2. Sample Policy Source - contains sample application and policy source code to build a simple message filter and experiment with X- Windows. In this volume: • Updated all relevant sections to reflect Fedora 12 release and correct errors. • Modified sample policies to work with F-12 (signal handling changed). • Added sections on: Experimenting with X- Windows polyinstantiation copy & paste code and policy; A test module for XSELinux functions. Page 2 The SELinux Notebook - Sample Policy Source 0.3 Acknowledgements Logo designed by Máirín Duffy 0.4 Abbreviations Term Definition apol Policy analysis tool AV Access Vector AVC Access Vector Cache F-12 Fedora 12 MAC Mandatory Access Control OM Object Manager RBAC Role-based Access Control SELinux Security-Enhanced Linux SID Security Identifier SL Security Level TE Type Enforcement UID User Identifier XACE X (windows) Access Control Extension 0.5 Index 0. NOTEBOOK INFORMATION .............................................................................. 2 0.1 COPYRIGHT INFORMATION .......................................................................................... 2 0.2 REVISION HISTORY ................................................................................................... 2 0.3 ACKNOWLEDGEMENTS ................................................................................................ 3 0.4 ABBREVIATIONS ........................................................................................................ 3 0.5 INDEX ..................................................................................................................... 3 1. THE SELINUX NOTEBOOK ................................................................................ 6 1.1 INTRODUCTION .......................................................................................................... 6 1.2 VOLUME 1 - THE FOUNDATIONS OVERVIEW ................................................................. 6 1.3 VOLUME 2 - SAMPLE POLICY SOURCE OVERVIEW ......................................................... 7 1.3.1 Sample Policy Source Sections ..................................................................... 7 1.4 RELEVANT F-12 PACKAGES ....................................................................................... 8 2. BUILDING A BASIC POLICY .............................................................................. 9 2.1 INTRODUCTION .......................................................................................................... 9 2.1.1 Overall Objectives ........................................................................................ 9 2.1.2 Build Requirements ....................................................................................... 9 2.1.3 The Test Policies ......................................................................................... 10 2.2 BUILDING THE POLICY SOURCE FILES ....................................................................... 10 2.2.1 Policy Source Files ..................................................................................... 13 2.2.1.1 Problem Resolution .............................................................................. 14 2.2.1.2 Monolithic and Base Policy Source File .............................................. 14 Page 3 The SELinux Notebook - Sample Policy Source 2.2.1.3 file_contexts File .................................................................................. 20 2.2.1.4 default_contexts File ............................................................................ 20 2.2.1.5 seusers File .......................................................................................... 20 2.2.1.6 dbus_contexts File ............................................................................... 20 2.2.1.7 x_contexts File ..................................................................................... 21 2.3 BUILDING THE MONOLITHIC POLICY .......................................................................... 21 2.3.1 Checking the Build ...................................................................................... 23 2.4 BUILDING THE BASE POLICY MODULE ....................................................................... 24 2.4.1 Checking the Base Policy Build .................................................................. 26 3. BUILDING THE MESSAGE FILTER LOADABLE MODULES ................... 27 3.1 OVERVIEW OF MODULES ........................................................................................... 27 3.2 BUILDING THE SECMARK TEST LOADABLE MODULE .............................................. 28 3.2.1 Testing the Module ...................................................................................... 42 3.2.1.1 Running the Tests ................................................................................. 43 3.2.2 Points to Note .............................................................................................. 46 3.2.2.1 Importance of Loading the iptables ..................................................... 46 3.2.2.2 Running tests out of sequence .............................................................. 46 3.3 BUILDING THE NETLABEL LOADABLE MODULE .......................................................... 47 3.4 BUILDING THE REMAINING MESSAGE FILTER SERVICE ................................................. 49 3.4.1 Internal Gateway Loadable Policy Module ................................................ 49 3.4.2 File Move Application ................................................................................. 52 3.4.3 File Mover Loadable Policy Module .......................................................... 55 3.4.4 Testing the Message Filter Build ................................................................ 58 4. EXPERIMENTING WITH X-WINDOWS ......................................................... 61 4.1 SECTION OVERVIEW ................................................................................................ 61 4.2 OVERVIEW OF MODULES AND APPLICATIONS .............................................................. 61 4.2.1 The x_contexts Files and Supporting Loadable Module ............................. 61 4.2.2 The Select - Paste Applications and Loadable Module .............................. 63 4.2.2.1 Test Conclusions .................................................................................. 65 4.2.2.2 Calling the XSELinux Functions ......................................................... 67 4.3 BUILDING THE X-WINDOWS SELECT AND PASTE EXAMPLES ......................................... 67 4.3.1 Building the x_contexts Files and Loadable Module .................................. 68 4.3.2 Building the X-select and X-paste Applications .......................................... 79 4.3.3 Building the X-select and X-paste Loadable Module ............................... 107 4.3.4 Testing Derived Labels ............................................................................. 113 4.3.4.1 Derived Object Test Conclusions ....................................................... 116 4.3.5 Testing Polyinstantiated Labels ................................................................ 117 4.3.5.1 Polyinstantiated Object Test Conclusions .......................................... 122 4.4 BUILDING THE XSELINUX FUNCTION TEST APPLICATION .......................................... 122 5. APPENDIX A - POLICY INVESTIGATION TOOLS .................................... 131 5.1 INTRODUCTION ...................................................................................................... 131 5.2 USING AUDIT2ALLOW AND AUDIT2WHY ................................................................... 131 5.3 USING SEAUDIT AND SETROUBLESHOOT .................................................................... 132 5.4 USING SEDIFFX .................................................................................................... 132 5.5 USING SECHECKER ...............................................................................................