Re: A basic question about the security_* hooks

[Kyle Moffett <kyle@moffetthome.net>]

[-- Attachment #1: Type: text/plain, Size: 2398 bytes --]

On Mon, Dec 28, 2009 at 20:43, Casey Schaufler <casey@schaufler-ca.com> wrote:
> Kyle Moffett wrote:
>> On Sat, Dec 26, 2009 at 14:50, Michael Stone <michael@laptop.org> wrote:
>>> I'm willing to entertain pretty much any implementation or interface request
>>> which meets that goal and which implements the desired semantics.
>>>
>>
>> If you aren't using SELinux at this time (and therefore have no
>> existing policy), then it's actually pretty straightforward
>> (relatively speaking) to set up for your particular goals.  On top of
>> that, once you actually get the system set up, it's very easy to
>> extend your sandbox security model to additional processes, actions,
>> etc.
>>
>> [...]
>
> I would be very surprised if the policy you've described actually
> covered all the bases. I would also be surprised if a functional
> policy that meets the needs described was considerably smaller than
> Lake Michigan. It's really easy to toss off the basics of what needs
> to be done, it's quite another to get the whole thing right.
>
>> If all you need is something much simpler, the policy
>> language is very flexible and easy to customize.
>>
>
> I'm willing to bet all the beers you can drink in a sitting that
> the policy would be bigger than the proposed LSM. You can count that
> in either bytes or lines.

If that bet's in Mountain Dew or "Bawls" energy drinks
(http://www.bawls.com/) instead of beer... then you've got a deal :-D

Here's a very fast first cut at such a policy.  In this version I
actually completely ignore the type-enforcement mechanism, although if
you decide to start mediating file access then you may want to
reenable it.  The policy is pretty straightforward and easy to read...
customizations would initially mostly be in the "constraint" rules.

The only thing I actually had to write was the base-policy.pp file.  I
personally absolutely detest M4... so these particular files are
designed to be preprocessed with "cpp" instead.  Those 3 ".h" files
are simply lists of the kernel's access vectors and such run through
"sed" to convert the "#" comments into "//" comments.

I have a Makefile I've been using personally to build that policy, but
right now it's rather interdependent with my working environment, so
it may take me several days to find the time to extract it cleanly.

Cheers,
Kyle Moffett

[-- Attachment #2: access_vectors.h --]
[-- Type: application/octet-stream, Size: 8806 bytes --]

//
// Define common prefixes for access vectors
//
// common common_name { permission_name ... }


//
// Define a common prefix for file access vectors.
//

common file
{
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
	unlink
	link
	rename
	execute
	swapon
	quotaon
	mounton
}


//
// Define a common prefix for socket access vectors.
//

common socket
{
// inherited from file
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
// socket-specific
	bind
	connect
	listen
	accept
	getopt
	setopt
	shutdown
	recvfrom
	sendto
	recv_msg
	send_msg
	name_bind
}	

//
// Define a common prefix for ipc access vectors.
//

common ipc
{
	create
	destroy
	getattr
	setattr
	read
	write
	associate
	unix_read
	unix_write
}

//
//  Define a common prefix for userspace database object access vectors.
//

common database
{
	create
	drop
	getattr
	setattr
	relabelfrom
	relabelto
}

//
// Define a common prefix for pointer and keyboard access vectors.
//

common x_device
{
	getattr
	setattr
	use
	read
	write
	getfocus
	setfocus
	bell
	force_cursor
	freeze
	grab
	manage
	list_property
	get_property
	set_property
	add
	remove
	create
	destroy
}

//
// Define the access vectors.
//
// class class_name [ inherits common_name ] { permission_name ... }


//
// Define the access vector interpretation for file-related objects.
//

class filesystem
{
	mount
	remount
	unmount
	getattr
	relabelfrom
	relabelto
	transition
	associate
	quotamod
	quotaget
}

class dir
inherits file
{
	add_name
	remove_name
	reparent
	search
	rmdir
	open
}

class file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
	open
}

class lnk_file
inherits file

class chr_file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
	open
}

class blk_file
inherits file
{
	open
}

class sock_file
inherits file
{
	open
}

class fifo_file
inherits file
{
	open
}

class fd
{
	use
}


//
// Define the access vector interpretation for network-related objects.
//

class socket
inherits socket

class tcp_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
	node_bind
	name_connect
}

class udp_socket
inherits socket
{
	node_bind
}

class rawip_socket
inherits socket
{
	node_bind
}

class node 
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
	enforce_dest
	dccp_recv
	dccp_send
	recvfrom
	sendto
}

class netif
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
	dccp_recv
	dccp_send
	ingress
	egress
}

class netlink_socket
inherits socket

class packet_socket
inherits socket

class key_socket
inherits socket

class unix_stream_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
}

class unix_dgram_socket
inherits socket

//
// Define the access vector interpretation for process-related objects
//

class process
{
	fork
	transition
	sigchld // commonly granted from child to parent
	sigkill // cannot be caught or ignored
	sigstop // cannot be caught or ignored
	signull // for kill(pid, 0)
	signal  // all other signals
	ptrace
	getsched
	setsched
	getsession
	getpgid
	setpgid
	getcap
	setcap
	share
	getattr
	setexec
	setfscreate
	noatsecure
	siginh
	setrlimit
	rlimitinh
	dyntransition
	setcurrent
	execmem
	execstack
	execheap
	setkeycreate
	setsockcreate
}


//
// Define the access vector interpretation for ipc-related objects
//

class ipc
inherits ipc

class sem
inherits ipc

class msgq
inherits ipc
{
	enqueue
}

class msg
{
	send
	receive
}

class shm
inherits ipc
{
	lock
}


//
// Define the access vector interpretation for the security server. 
//

class security
{
	compute_av
	compute_create
	compute_member
	check_context
	load_policy
	compute_relabel
	compute_user
	setenforce     // was avc_toggle in system class
	setbool
	setsecparam
	setcheckreqprot
}


//
// Define the access vector interpretation for system operations.
//

class system
{
	ipc_info
	syslog_read  
	syslog_mod
	syslog_console
	module_request
}

//
// Define the access vector interpretation for controling capabilies
//

class capability
{
	// The capabilities are defined in include/linux/capability.h
	// Capabilities >= 32 are defined in the capability2 class.
	// Care should be taken to ensure that these are consistent with
	// those definitions. (Order matters)

	chown           
	dac_override    
	dac_read_search 
	fowner          
	fsetid          
	kill            
	setgid           
	setuid           
	setpcap          
	linux_immutable  
	net_bind_service 
	net_broadcast    
	net_admin        
	net_raw          
	ipc_lock         
	ipc_owner        
	sys_module       
	sys_rawio        
	sys_chroot       
	sys_ptrace       
	sys_pacct        
	sys_admin        
	sys_boot         
	sys_nice         
	sys_resource     
	sys_time         
	sys_tty_config  
	mknod
	lease
	audit_write
	audit_control
	setfcap
}

class capability2 
{
	mac_override	// unused by SELinux
	mac_admin	// unused by SELinux
}

//
// Define the access vector interpretation for controlling
// changes to passwd information.
//
class passwd
{
	passwd	// change another user passwd
	chfn	// change another user finger info
	chsh	// change another user shell
	rootok  // pam_rootok check (skip auth)
	crontab // crontab on another user
}

//
// SE-X Windows stuff
//
class x_drawable
{
	create
	destroy
	read
	write
	blend
	getattr
	setattr
	list_child
	add_child
	remove_child
	list_property
	get_property
	set_property
	manage
	override
	show
	hide
	send
	receive
}

class x_screen
{
	getattr
	setattr
	hide_cursor
	show_cursor
	saver_getattr
	saver_setattr
	saver_hide
	saver_show
}

class x_gc
{
	create
	destroy
	getattr
	setattr
	use
}

class x_font
{
	create
	destroy
	getattr
	add_glyph
	remove_glyph
	use
}

class x_colormap
{
	create
	destroy
	read
	write
	getattr
	add_color
	remove_color
	install
	uninstall
	use
}

class x_property
{
	create
	destroy
	read
	write
	append
	getattr
	setattr
}

class x_selection
{
	read
	write
	getattr
	setattr
}

class x_cursor
{
	create
	destroy
	read
	write
	getattr
	setattr
	use
}

class x_client
{
	destroy
	getattr
	setattr
	manage
}

class x_device
inherits x_device

class x_server
{
	getattr
	setattr
	record
	debug
	grab
	manage
}

class x_extension
{
	query
	use
}

class x_resource
{
	read
	write
}

class x_event
{
	send
	receive
}

class x_synthetic_event
{
	send
	receive
}

//
// Extended Netlink classes
//
class netlink_route_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_firewall_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_tcpdiag_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_nflog_socket
inherits socket

class netlink_xfrm_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_selinux_socket
inherits socket

class netlink_audit_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
	nlmsg_relay
	nlmsg_readpriv
	nlmsg_tty_audit
}

class netlink_ip6fw_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_dnrt_socket
inherits socket

// Define the access vector interpretation for controlling
// access and communication through the D-BUS messaging
// system.
//
class dbus
{
	acquire_svc
	send_msg
}

// Define the access vector interpretation for controlling
// access through the name service cache daemon (nscd).
//
class nscd
{
	getpwd
	getgrp
	gethost
	getstat
	admin
	shmempwd
	shmemgrp
	shmemhost
	getserv
	shmemserv
}

// Define the access vector interpretation for controlling
// access to IPSec network data by association
//
class association
{
	sendto
	recvfrom
	setcontext
	polmatch
}

// Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
inherits socket

class appletalk_socket
inherits socket

class packet
{
	send
	recv
	relabelto
	flow_in		// deprecated
	flow_out	// deprecated
	forward_in
	forward_out
}

class key
{
	view
	read
	write
	search
	link
	setattr
	create
}

class context
{
	translate
	contains
}

class dccp_socket
inherits socket
{
	node_bind
	name_connect
}

class memprotect
{
	mmap_zero
}

class db_database
inherits database
{
	access
	install_module
	load_module
	get_param	// deprecated
	set_param	// deprecated
}

class db_table
inherits database
{
	use		// deprecated
	select
	update
	insert
	delete
	lock
}

class db_procedure
inherits database
{
	execute
	entrypoint
	install
}

class db_column
inherits database
{
	use		// deprecated
	select
	update
	insert
}

class db_tuple
{
	relabelfrom
	relabelto
	use		// deprecated
	select
	update
	insert
	delete
}

class db_blob
inherits database
{
	read
	write
	import
	export
}

// network peer labels
class peer
{
	recv
}

class x_application_data
{
	paste
	paste_after_confirm
	copy
}

class kernel_service
{
	use_as_override
	create_files_as	
}

class tun_socket
inherits socket

class x_pointer
inherits x_device

class x_keyboard
inherits x_device

[-- Attachment #3: base-policy.te --]
[-- Type: application/octet-stream, Size: 2332 bytes --]

/* These lists of binary access vectors match what the kernel expects */
#include <flask/security_classes.h>
#include <flask/initial_sids.h>
#include <flask/access_vectors.h>

/* Make sure we're running on a new enough kernel */
policycap network_peer_controls;

/* We have no attributes or booleans */

/* Only one type */
type any_t;

/* A few roles */
role obj_r;
role proc_r;
role nonet_r;

/* Allow each rule to assume the only type */
role obj_r   types any_t;
role proc_r  types any_t;
role nonet_r types any_t;

/* Completely disable type-enforcement */
allow any_t any_t:{ all_classes } *;

/* Only one "user" */
user any_u roles { obj_r proc_r nonet_r };

/* The below rules control what is or isn't allowed */

/* Make sure that "nonet" mode is unescapable */
constrain process { transition dyntransition noatsecure siginh rlimitinh } (
	(r1 == r2) or
	(r1 == proc_r and r2 == nonet_r)
);

/* 
 * Disallow various actions from nonet.  There are probably more hooks
 * missing from this list (see the very exhaustive list in the include file
 * <flask/access_vectors.h>), but they are trivial to add and very
 * straightforward.
 */
constrain tcp_socket { bind connect        } (r1 != nonet_r);
constrain udp_socket { bind connect sendto } (r1 != nonet_r);

// Default SIDs (Tell the kernel to label almost anything the same)
sid netmsg		any_u:obj_r:any_t
sid port		any_u:obj_r:any_t
sid node		any_u:obj_r:any_t
sid netif		any_u:obj_r:any_t
sid devnull		any_u:obj_r:any_t
sid file		any_u:obj_r:any_t
sid fs			any_u:obj_r:any_t
sid sysctl		any_u:obj_r:any_t
sid unlabeled		any_u:obj_r:any_t
sid any_socket		any_u:obj_r:any_t
sid file_labels		any_u:obj_r:any_t
sid icmp_socket		any_u:obj_r:any_t
sid igmp_packet		any_u:obj_r:any_t
sid init		any_u:obj_r:any_t
sid kmod		any_u:obj_r:any_t
sid policy		any_u:obj_r:any_t
sid scmp_packet		any_u:obj_r:any_t
sid sysctl_modprobe	any_u:obj_r:any_t
sid sysctl_fs		any_u:obj_r:any_t
sid sysctl_kernel	any_u:obj_r:any_t
sid sysctl_net		any_u:obj_r:any_t
sid sysctl_net_unix	any_u:obj_r:any_t
sid sysctl_vm		any_u:obj_r:any_t
sid sysctl_dev		any_u:obj_r:any_t
sid tcp_socket		any_u:obj_r:any_t
sid security		any_u:obj_r:any_t

// This label is used when the kernel starts new processes
sid kernel  any_u:proc_r:any_t

// No manual FS labels, everything should just pick up default SIDs

[-- Attachment #4: initial_sids.h --]
[-- Type: application/octet-stream, Size: 422 bytes --]

// FLASK

//
// Define initial security identifiers 
//

sid kernel
sid security
sid unlabeled
sid fs
sid file
sid file_labels
sid init
sid any_socket
sid port
sid netif
sid netmsg
sid node
sid igmp_packet
sid icmp_socket
sid tcp_socket
sid sysctl_modprobe
sid sysctl
sid sysctl_fs
sid sysctl_kernel
sid sysctl_net
sid sysctl_net_unix
sid sysctl_vm
sid sysctl_dev
sid kmod
sid policy
sid scmp_packet
sid devnull

// FLASK

[-- Attachment #5: security_classes.h --]
[-- Type: application/octet-stream, Size: 3670 bytes --]

// FLASK

//
// Define the security object classes 
//

// Classes marked as userspace are classes
// for userspace object managers

class security
class process
class system
class capability

// file-related classes
class filesystem
class file
class dir
class fd
class lnk_file
class chr_file
class blk_file
class sock_file
class fifo_file

// network-related classes
class socket
class tcp_socket
class udp_socket
class rawip_socket
class node
class netif
class netlink_socket
class packet_socket
class key_socket
class unix_stream_socket
class unix_dgram_socket

// sysv-ipc-related classes
class sem
class msg
class msgq
class shm
class ipc

//
// userspace object manager classes
//

// passwd/chfn/chsh
class passwd			// userspace

// SE-X Windows stuff (more classes below)
class x_drawable		// userspace
class x_screen			// userspace
class x_gc			// userspace
class x_font			// userspace
class x_colormap		// userspace
class x_property		// userspace
class x_selection		// userspace
class x_cursor			// userspace
class x_client			// userspace
class x_device			// userspace
class x_server			// userspace
class x_extension		// userspace

// extended netlink sockets
class netlink_route_socket
class netlink_firewall_socket
class netlink_tcpdiag_socket
class netlink_nflog_socket
class netlink_xfrm_socket
class netlink_selinux_socket
class netlink_audit_socket
class netlink_ip6fw_socket
class netlink_dnrt_socket

class dbus			// userspace
class nscd			// userspace

// IPSec association
class association

// Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket

class appletalk_socket

class packet

// Kernel access key retention
class key

class context			// userspace

class dccp_socket

class memprotect

class db_database		// userspace
class db_table			// userspace
class db_procedure		// userspace
class db_column			// userspace
class db_tuple			// userspace
class db_blob			// userspace

// network peer labels
class peer

// Capabilities >= 32
class capability2

// More SE-X Windows stuff
class x_resource		// userspace
class x_event			// userspace
class x_synthetic_event		// userspace
class x_application_data	// userspace

// kernel services that need to override task security, e.g. cachefiles
class kernel_service 

class tun_socket

// Still More SE-X Windows stuff
class x_pointer			// userspace
class x_keyboard		// userspace

#define all_classes			\
	security			\
	process				\
	system				\
	capability			\
	filesystem			\
	file				\
	dir				\
	fd				\
	lnk_file			\
	chr_file			\
	blk_file			\
	sock_file			\
	fifo_file			\
	socket				\
	tcp_socket			\
	udp_socket			\
	rawip_socket			\
	node				\
	netif				\
	netlink_socket			\
	packet_socket			\
	key_socket			\
	unix_stream_socket		\
	unix_dgram_socket		\
	sem				\
	msg				\
	msgq				\
	shm				\
	ipc				\
	passwd				\
	x_drawable			\
	x_screen			\
	x_gc				\
	x_font				\
	x_colormap			\
	x_property			\
	x_selection			\
	x_cursor			\
	x_client			\
	x_device			\
	x_server			\
	x_extension			\
	netlink_route_socket		\
	netlink_firewall_socket		\
	netlink_tcpdiag_socket		\
	netlink_nflog_socket		\
	netlink_xfrm_socket		\
	netlink_selinux_socket		\
	netlink_audit_socket		\
	netlink_ip6fw_socket		\
	netlink_dnrt_socket		\
	dbus				\
	nscd				\
	association			\
	netlink_kobject_uevent_socket	\
	appletalk_socket		\
	packet				\
	key				\
	context				\
	dccp_socket			\
	memprotect			\
	db_database			\
	db_table			\
	db_procedure			\
	db_column			\
	db_tuple			\
	db_blob				\
	peer				\
	capability2			\
	x_resource			\
	x_event				\
	x_synthetic_event		\
	x_application_data		\
	kernel_service			\
	tun_socket			\
	x_pointer			\
	x_keyboard

// FLASK