Get CLIP RHEL7 Booting in Enforcing #86

mpalmi · 2015-01-13T19:48:42Z

The first step in addressing #4 is to get CLIP booting in Enforcing.

With the new systemd architecture, there are some significant changes to the way processes spawn.
We will need to pull in Chris PeBenito's changes to the RHEL7 updates to refpolicy (https://github.com/pebenito/refpolicy), specifically the following commits:

pebenito/refpolicy@0872c57 -> adding to the list of permissions for the service class,
add service class to security classes, update various init module interfaces with ifdefs for init_systemd
pebenito/refpolicy@e56024d -> allow dynamic transition from kernel domain to init for ifdef
init_systemd
pebenito/refpolicy@505158a -> On Debian, systemd binaries are installed in / not /usr
pebenito/refpolicy@c93002d -> Drop bin_t label for /lib/systemd/systemd.*
pebenito/refpolicy@9896345 -> Merge pull request Revert "Map environment variables into XCCDF and modify aqueduct scripts... #1 from bigon/systemd
pebenito/refpolicy@5227336 -> More systemd apps cleanup
pebenito/refpolicy@9f1fc53 -> Run the misc initializations that systemd does in initrc_t

From there, it is a matter of typical policy development. Gather denials, write policy, wash, rinse, repeat.

As of 4/22, we are able to boot in Enforcing with several permissive domains:
tomhurd/clip@646f163
tomhurd/clip@498ddcd

We really only need a subset of these to be permissive, however:

kernel_t
initrc_t
init_t
syslogd_t
lvm_t
udev_t

The future efforts will be driven by pulling all domains out of permissive, but for the sake of getting CLIP booting in Enforcing, the following are the priority:

Resolve kernel denials #126 - Pull kernel_t out of Permissive
Resolve initrc_t denials #127 - Pull initrc_t out of Permissive
Resolve init denials #118 - Pull init_t out of Permissive
Resolve syslogd_t denials #129 - Pull syslogd_t out of Permissive
Resolve lvm_t denials #128 - Pull lvm_t out of Permissive
Resolve udev_t denials #130 - Pull udev_t out of Permissive

To get CLIP cleanly booting in Enforcing, the following will need to be done as well:

Resolve insmod_t denials #132 - Pull insmod_t out of Permissive.
Resolve local_login_t denials #131 - Pull local_login_t out of Permissive
Resolve systemd_tmpfiles_t denials #150 - Pull systemd_tmpfiles out of Permissive

Some nice-to-haves (not necessarily needed to get CLIP booting in Enforcing):

Resolve toor_t denials #134 - Pull toor_t out of Permissive
Resolve ssh[d]_keygen_t denials #135 - Pull sshd_keygen_t out of Permissive

The text was updated successfully, but these errors were encountered:

…y CLIP - These were removed when pulling in a new refpolicy (#699d65b) - Remove unneeded files - Secstate is no longer needed, so it may be removed

…sing shadow Fixed in 2fef7c5

…RHEL 7.0

mpalmi · 2015-01-20T14:37:55Z

Rather than cherry-pick commits, we have updated the base refpolicy to pebenito/refpolicy@5fd2953

Further development is being done on top of this to get CLIP booting in Enforcing.

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy

- Various Makefile/specfile changes

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Give systemd-utmp can_relabelto_binary_policy to clear up constraints

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Give systemd-utmp can_relabelto_binary_policy to clear up constraints

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Give systemd-utmp can_relabelto_binary_policy to clear up constraints

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Give systemd-utmp can_relabelto_binary_policy to clear up constraints

- Many /sbin/ file contexts do not have their corresponding /usr/sbin files labeled properly. Label them en mass and sort contexts appropriately.

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Give systemd-utmp can_relabelto_binary_policy to clear up constraints

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Add some file_contexts.subs_dist mappings - Label some unlabeled files

…olicy - Get rid of conditional and remove redundant policy.

- Various Makefile/specfile changes

… scripts Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions.

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Add some file_contexts.subs_dist mappings - Label some unlabeled files - Make semanage_t an init_system_domain, so initrc_t can transition to semanage and run genhomedircon. - Begin labeling unit files

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Add some file_contexts.subs_dist mappings - Label some unlabeled files - Make semanage_t an init_system_domain, so initrc_t can transition to semanage and run genhomedircon. - Begin labeling unit files

- Various Makefile/specfile changes

… scripts Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions.

@csmith-tresys

- Pull in @csmith-tresys's additional interfaces and policy - Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Add some file_contexts.subs_dist mappings - Label some unlabeled files - Make semanage_t an init_system_domain, so initrc_t can transition to semanage and run genhomedircon. - Begin labeling unit files

- Separate systemd-service forks into their own contexts - Use existing policy for the following: contrib/readahead (systemd-readahead) contrib/shutdown (systemd-shutdown) system/fstools (systemd-fsck) system/hostname (systemd-hostname) system/logging (systemd-journald) - Add some file_contexts.subs_dist mappings - Label some unlabeled files - Make semanage_t an init_system_domain, so initrc_t can transition to semanage and run genhomedircon. - Begin labeling unit files

ghost · 2015-04-23T15:50:22Z

@mpalmi please assign a time estimate label for this issue.

mpalmi · 2015-04-24T14:06:12Z

We are currently able to boot in Enforcing, using several permissive domains.
The future tasks will be focused on taking these domains out of permissive.

See:
tomhurd/clip@646f163
tomhurd/clip@498ddcd

- Various Makefile/specfile changes

… scripts Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions.

- Separate long-running processes/daemons into their own contexts - Let short-running processes fall through to initrc - Label unit files - Add some file_contexts.subs_dist mappings

- Some initrc policy

Fix formatting of systemd interfaces

Add permissions for systemd. Mostly systemd_logind_t

Add permissions for shutdown_t and sshd_keygen_t

…ermissive domains

mpalmi · 2015-05-22T19:47:59Z

Though we're booting in Enforcing, there are still some lingering denials.
Attached are the errors that are seen on boot

Potentially related to denials seen in:
#118
#130
#164
#126
#128

tomhurd · 2015-05-22T23:22:25Z

The /lib/systemd/rhel-autorelabel problem is related to issue #127.

I expect the contexts that aren't valid are from rhel targeted policy and not in the clip policy.

Issue #86 - Include RHEL_7-Alpha3 policy doc in README.md

- Include systemd policy via init_systemd ifdef - Various Makefile/specfile changes - Modify init interfaces to support old init scripts -- Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions. - Separate long-running processes/daemons into their own contexts - Let short-running processes fall through to initrc - Label unit files - Add some file_contexts.subs_dist mappings - Updates for systemd_logind_t - Add permissions for systemd_logind_t

… goals

- Include systemd policy via init_systemd ifdef - Various Makefile/specfile changes - Modify init interfaces to support old init scripts -- Systemd still supports traditional init scripts, so modify init_daemon_domain and init_system_domain to allow both initrc_t and init_t transitions if systemd policy is turned on. Else, default to only intrc_t transitions. - Separate long-running processes/daemons into their own contexts - Let short-running processes fall through to initrc - Label unit files - Add some file_contexts.subs_dist mappings - Updates for systemd_logind_t - Add permissions for systemd_logind_t

… goals

mpalmi · 2015-06-04T17:19:02Z

Closing the master ticket for now, even though all subtickets are not completely resolved. Will open future tickets to fix issues found in testing.

mpalmi added the selinux label Jan 13, 2015

mpalmi self-assigned this Jan 13, 2015

mpalmi added this to the RHEL 7 milestone Jan 13, 2015

ghost mentioned this issue Jan 13, 2015

SELinux policy for RHEL 7 #4

Open

mpalmi pushed a commit to mpalmi/clip that referenced this issue Jan 15, 2015

Issue OwlCyberDefense#86: Fix neverallow error caused by toor_t acces…

32b5227

…sing shadow Fixed in 2fef7c5

mpalmi pushed a commit to mpalmi/clip that referenced this issue Jan 15, 2015

Issue OwlCyberDefense#86: Add new refpolicy source zip

caad928

mpalmi pushed a commit to mpalmi/clip that referenced this issue Jan 15, 2015

Issue OwlCyberDefense#86: Update clip-selinux-policy rpm version for …

640b140

…RHEL 7.0

mpalmi added a commit to mpalmi/clip that referenced this issue Jan 15, 2015

Issue OwlCyberDefense#86: Get CLIP RHEL7 booting in Enforcing

f816505

mpalmi added a commit to mpalmi/clip that referenced this issue Jan 20, 2015

Issue OwlCyberDefense#86: Get CLIP RHEL7 booting in Enforcing

0b47de6

- Pull in @csmith-tresys's additional interfaces and policy

mpalmi added a commit to mpalmi/clip that referenced this issue Feb 2, 2015

Issue OwlCyberDefense#86: Add support for audit.log pulling

9c0c2fa

mpalmi pushed a commit to mpalmi/clip that referenced this issue Feb 2, 2015

Issue OwlCyberDefense#86: Include systemd policy via init_systemd ifdef

6df6d99

- Various Makefile/specfile changes

mpalmi added a commit to mpalmi/clip that referenced this issue Feb 5, 2015

Issue OwlCyberDefense#86 - Add /usr/sbin entries to all modules

df40eac

- Many /sbin/ file contexts do not have their corresponding /usr/sbin files labeled properly. Label them en mass and sort contexts appropriately.

mpalmi added a commit to mpalmi/clip that referenced this issue Feb 5, 2015

Issue OwlCyberDefense#86 - Add /usr/sbin entries to all modules

f601577

- Many /sbin/ file contexts do not have their corresponding /usr/sbin files labeled properly. Label them en mass and sort contexts appropriately.

mpalmi added a commit to mpalmi/clip that referenced this issue Feb 12, 2015

Issue OwlCyberDefense#86 - Simplify init_systemd init_daemon_domain p…

891dd82

…olicy - Get rid of conditional and remove redundant policy.

mpalmi pushed a commit to mpalmi/clip that referenced this issue Feb 13, 2015

Issue OwlCyberDefense#86: Include systemd policy via init_systemd ifdef

059f85f

- Various Makefile/specfile changes

mpalmi pushed a commit to mpalmi/clip that referenced this issue Feb 14, 2015

Issue OwlCyberDefense#86: Include systemd policy via init_systemd ifdef

b7d9e30

- Various Makefile/specfile changes

mpalmi added High Priority long-task labels Apr 24, 2015

ghost mentioned this issue Apr 24, 2015

create a list of all denials and subtickets from this list #58

Closed

mpalmi pushed a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86: Include systemd policy via init_systemd ifdef

7f3a79b

- Various Makefile/specfile changes

mpalmi added a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86 - More policy to get RHEL7 booting in Enforcing

1f4f46c

- Some initrc policy

mpalmi pushed a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86

582d118

Fix formatting of systemd interfaces

mpalmi pushed a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86

4220567

Add permissions for systemd. Mostly systemd_logind_t

mpalmi pushed a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86

9eaf070

Add permissions for shutdown_t and sshd_keygen_t

mpalmi added a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86 - Satisfy shutdown policy constraint

885fe3d

mpalmi added a commit to mpalmi/clip that referenced this issue Apr 27, 2015

Issue OwlCyberDefense#86 - Get CLIP RHEL7 booting in Enforcing with P…

5aae6eb

…ermissive domains

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

4364394

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

f269636

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

33f2d14

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

7f052b7

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

93d5849

mpalmi added a commit to mpalmi/clip that referenced this issue May 28, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

f48bf6d

mpalmi added a commit to mpalmi/clip that referenced this issue Jun 2, 2015

Issue OwlCyberDefense#86 - Include RHEL_7-Alpha3 policy doc in README.md

291350c

mpalmi added a commit that referenced this issue Jun 2, 2015

Merge pull request #170 from mpalmi/master

fd254c6

Issue #86 - Include RHEL_7-Alpha3 policy doc in README.md

mpalmi added a commit to mpalmi/clip that referenced this issue Jun 4, 2015

Issue OwlCyberDefense#86 - Update SELinux Policy docs to reflect CLIP…

d42836c

… goals

mpalmi added a commit to mpalmi/clip that referenced this issue Jun 4, 2015

Issue OwlCyberDefense#86 - Update SELinux Policy docs to reflect CLIP…

1a758e2

… goals

mpalmi closed this as completed Jun 4, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Get CLIP RHEL7 Booting in Enforcing #86

Get CLIP RHEL7 Booting in Enforcing #86

mpalmi commented Jan 13, 2015

mpalmi commented Jan 20, 2015

ghost commented Apr 23, 2015

mpalmi commented Apr 24, 2015

mpalmi commented May 22, 2015

tomhurd commented May 22, 2015

mpalmi commented Jun 4, 2015

Get CLIP RHEL7 Booting in Enforcing #86

Get CLIP RHEL7 Booting in Enforcing #86

Comments

mpalmi commented Jan 13, 2015

mpalmi commented Jan 20, 2015

ghost commented Apr 23, 2015

mpalmi commented Apr 24, 2015

mpalmi commented May 22, 2015

tomhurd commented May 22, 2015

mpalmi commented Jun 4, 2015