Re: Issues with the include/contrib/courier.if policy

Lukas Vrabec <[email protected]> Tue, 12 May 2020 18:06:26 +0200
Newsgroups	gmane.linux.redhat.fedora.selinux
Organization	Red Hat, Inc.
Message-ID	<[email protected]>
On 5/12/20 2:18 AM, Sam Varshavchik wrote:
> Lukas Vrabec writes:
> 
>>
>> Can please run following commands before you reproduce the scenario
>> again:
>>
>> # chcon -t courier_exec_t /usr/lib/courier/sbin/couriertcpd
>> # dnf install selinux-policy-devel -y
>> $ cat httpd_courier.te
>> policy_module(httpd_courier, 1.0)
>> gen_require(`
>>     type httpd_sys_script_t;
>>     type courier_spool_t;
>>     type system_mail_t;
>> ')
>>
>> stream_connect_pattern(httpd_sys_script_t, courier_spool_t,
>> courier_spool_t, system_mail_t)
>>
>> # make -f /usr/share/selinux/devel/Makefile httpd_courier.pp
>> # semodule -i httpd_courier.pp
>>
>> ### reproduce the scenario
>>
>> And attach output of:
>> # ausearch -m AVC -ts today
> 
> The above was done:
> 
> [root@jack ~]# semodule --list | grep courier
> courier
> httpd_courier
> [root@jack ~]# ls -alZ /usr/lib/courier/sbin/couriertcpd
> -r-xr-xr-x. 1 daemon daemon system_u:object_r:courier_exec_t:s0 142456
> May 10 01:14 /usr/lib/courier/sbin/couriertcpd
> 
> The server daemons were restarted.
> 
> Both the webmail socket connection was blocked, as well as signals to
> courierlogger. The first two AVCs is the webmail connection:
> 
> ----
> time->Mon May 11 20:00:38 2020
> type=AVC msg=audit(1589241638.443:3693): avc:  denied  { connectto }
> for  pid=1629725 comm="webmail" path="/var/spool/courier/sqwebmail.sock"
> scontext=system_u:system_r:httpd_sys_script_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0
> tclass=unix_stream_socket permissive=0
> ----
> time->Mon May 11 20:00:54 2020
> type=AVC msg=audit(1589241654.975:3701): avc:  denied  { connectto }
> for  pid=1629864 comm="webmail" path="/var/spool/courier/sqwebmail.sock"
> scontext=system_u:system_r:httpd_sys_script_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0
> tclass=unix_stream_socket permissive=0
> 
> The socket and the cgi-bin binary are labeled thusly:
> 
> [root@jack ~]# ls -alZ /var/spool/courier/sqwebmail.sock
> srwxrwxrwx. 1 root root system_u:object_r:courier_spool_t:s0 0 May 11
> 20:01 /var/spool/courier/sqwebmail.sock
> [root@jack ~]# ls -alZ /var/www/cgi-bin/webmail
> -r-xr-xr-x. 1 root bin system_u:object_r:httpd_sys_script_exec_t:s0
> 31464 May 10 01:14 /var/www/cgi-bin/webmail
> 
> The remaining AVCs are for the signal issue:
> 
> ----
> time->Mon May 11 20:02:13 2020
> type=AVC msg=audit(1589241733.799:3740): avc:  denied  { signal } for 
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:23 2020
> type=AVC msg=audit(1589241743.799:3743): avc:  denied  { sigkill } for 
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:33 2020
> type=AVC msg=audit(1589241753.800:3744): avc:  denied  { sigkill } for 
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=0
> ----
> time->Mon May 11 20:02:43 2020
> type=AVC msg=audit(1589241763.800:3751): avc:  denied  { sigkill } for 
> pid=1630215 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=1
> ----
> time->Mon May 11 20:02:43 2020
> type=AVC msg=audit(1589241763.807:3752): avc:  denied  { signal } for 
> pid=1630256 comm="courierlogger"
> scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
> permissive=1
> 
> Noting that the running processes are unconfined, even though the binary
> is labeled:
> 
> # ps -efZ | grep courierlogger
> system_u:system_r:unconfined_service_t:s0 root 1630457 1  0 20:10
> ?        00:00:00 /usr/sbin/courierlogger - ... every one of them
> root@jack ~]# ls -alZ /usr/sbin/courierlogger
> -rwxr-xr-x. 1 daemon daemon system_u:object_r:courier_exec_t:s0 25296
> May  9 23:19 /usr/sbin/courierlogger
> 


For some reason courierlogger runs as unconfined_service_t.

Can you describe flow how binaries are executed? Also can you attach
systemd unit file executing this service?

Thanks,
Lukas.

> 
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
> 


-- 
Lukas Vrabec
SELinux Evangelist,
Senior Software Engineer, Security Technologies
Red Hat, Inc.

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
signature.asc (application/pgp-signature, 488 B)