Re: Zoneminder Policy Fixes

On 03/07/18 15:54, Lukas Vrabec wrote:
> On 06/18/2018 10:11 PM, Tristan Santore wrote:
>> On 17/06/18 10:25, Lukas Vrabec wrote:
>>> On 06/13/2018 03:17 PM, Tristan Santore wrote:
>>>> Dear Lukas and Petr,
>>>>
>>>> I have made fixes to the Zoneminder Policy module. Zoneminder will not
>>>> start with the current one.
>>>>
>>>> Also I took them liberty to add two bools, one for email sending,
>>>> because Zoneminder can send emails with images, when an alarm event was
>>>> detected on a camera, and another boolean for ftp access, as Zoneminder
>>>> can upload alarm events to a ftp, for safe keeping, in case somebody
>>>> burgles your house and steals your CCTV gear.
>>>>
>>>> It can also use sftp, but not sure I would really like to add a port for
>>>> that. But if you would like to add that option, I would leave that up to
>>>> you.
>>>>
>>>> If you could be so kind, to look over the additions, I suspect, there
>>>> might be a few things in there, one might want to avoid, or require
>>>> labelling. Or ways to make it more secure.
>>>>
>>>>
>>>
>>> Hi,
>>>
>>> Thank you for help on SELinux policy for zoneminder!
>>>
>>> Could you send me please raw AVC messages (SELinux denials) from audit
>>> log?
>>>
>>> Please, reproduce your scenario how you're using zoneminder policy and
>>> then attach output of:
>>>
>>> # ausearch -m AVC -ts today -m USER_AVC
>>>
>>> I would like to also see these messages, before I merge it with Fedora
>>> distribution policy.
>>>
>>> Thanks,
>>> Lukas.
>>>
>>>> Policy additions below(Will require merging into existing policy):
>>>>
>>>> module zoneminder2018 1.3;
>>>>
>>>> require {
>>>>           type sysfs_t;
>>>>           type zoneminder_script_t;
>>>>           type zoneminder_var_lib_t;
>>>>           type zoneminder_t;
>>>>           type v4l_device_t;
>>>>           type init_var_run_t;
>>>>           type cert_t;
>>>>           type httpd_t;
>>>>           type syslogd_t;
>>>>           type zoneminder_tmpfs_t;
>>>>           type smtp_port_t;
>>>>           type tmpfs_t;
>>>>           type ftp_port_t;
>>>>           type ephemeral_port_t;
>>>>           class file { create getattr lock map open read unlink write };
>>>>           class chr_file map;
>>>>           class lnk_file read;
>>>>           class dir { create read rmdir search write add_name };
>>>>           class unix_dgram_socket sendto;
>>>>           class sock_file { create unlink };
>>>>           class process { noatsecure rlimitinh siginh };
>>>>           class tcp_socket name_connect;
>>>> }
>>>>
>>>> bool zoneminder_can_sendmail false;
>>>> bool zoneminder_can_ftp false;
>>>>
>>>> #============= httpd_t ==============
>>>> #allow httpd_t zoneminder_script_t:process { noatsecure rlimitinh
>>>> siginh };
>>>>
>>>> #Flagged, but not required.
>>>>
>>>> allow httpd_t zoneminder_tmpfs_t:file map;
>>>> allow httpd_t zoneminder_tmpfs_t:file { getattr open read write };
>>>> allow httpd_t zoneminder_var_lib_t:sock_file { create unlink };
>>>>
>>>> #============= syslogd_t ==============
>>>>
>>>> allow syslogd_t init_var_run_t:lnk_file read;
>>>>
>>>> #============= zoneminder_script_t ==============
>>>>
>>>> allow zoneminder_script_t cert_t:dir search;
>>>> allow zoneminder_script_t cert_t:file { getattr open read };
>>>> allow zoneminder_script_t httpd_t:unix_dgram_socket sendto;
>>>> allow zoneminder_script_t init_var_run_t:dir search;
>>>> allow zoneminder_script_t sysfs_t:dir read;
>>>> allow zoneminder_script_t sysfs_t:file { getattr open read };
>>>> allow zoneminder_script_t zoneminder_tmpfs_t:file map;
>>>> allow zoneminder_script_t zoneminder_var_lib_t:dir { create rmdir };
>>>> allow zoneminder_script_t zoneminder_var_lib_t:file { create getattr
>>>> lock open read unlink write };
>>>> allow zoneminder_script_t tmpfs_t:dir { add_name write };
>>>>
>>>> #============= zoneminder_t ==============
>>>> if (zoneminder_can_sendmail) {
>>>> allow zoneminder_t smtp_port_t:tcp_socket name_connect;
>>>> }
>>>> #add ftp and sftp here
>>>> #sftp needs some extra work I guess.
>>>> if (zoneminder_can_ftp) {
>>>> allow zoneminder_t ftp_port_t:tcp_socket name_connect;
>>>> allow zoneminder_t ephemeral_port_t:tcp_socket name_connect;
>>>> }
>>>>
>>>> allow zoneminder_t v4l_device_t:chr_file map;
>>>> allow zoneminder_t zoneminder_tmpfs_t:file map;
>>>>
>>>>
>>>>
>>>
>>>
>> Tracking bug created:
>>
>> https://bugzilla.redhat.com/show_bug.cgi?id=1592555
>>
>> Ausearch added and additional information added, for you to understand
>> how this works. Because they, rightfully, tried to
>> compartmentalise/least privilege everything and it is a web app, it is
>> kind of a mess and difficult to get your head around what is going on.
>>
>> If it would be easier to get this finally fixed, on a permanent basis, I
>> could drop in #fedora-selinux.
>>
>> Let me know, if I can be of further assistance, regarding this issue.
>> Most of the original module I did with Dominic Grift and added help by
>> Miroslav (mgrepl) and Dan (dwalsh)...also fixed a sudo/pam issue at that
>> time.
>>
>> Regards,
>>
>> Tristan
>>
> 
> Hi,
> 
> I add all allow rules to our distribution policy.
> 
> Lukas.
> 
> 
> 
> 
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/ORQMZAX6XOKSG4DS45E2LEU6GM2FPIZS/
> 

Cheers Lukas! Really appreciate it.

Regards,
Tristan
-- 
Tristan Santore BSc MBCS
TS4523-RIPE
Network and Infrastructure Operations
InterNexusConnect
Mobile +44-78-55069812
[email protected]

Former Thawte Notary
(Please note: Thawte has closed its WoT programme down,
and I am therefore no longer able to accredit trust)

For Fedora related issues, please email me at:
[email protected]
_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/4NA52RUIJ2EPBJGU25F32CUZVHJVPK6D/