Re: Fixing denials

--===============0989700404085153644==
Content-Type: multipart/alternative; boundary="000000000000dec82a062bb10a85"

--000000000000dec82a062bb10a85
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This procedure will probably silence AVC denials, but may or may not result
in a correct policy.
The reason is stated in e.g.

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/us=
ing_selinux/changing-selinux-states-and-modes_using-selinux#changing-selinu=
x-modes_changing-selinux-states-and-modes
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/us=
ing_selinux/troubleshooting-problems-related-to-selinux_using-selinux#fixin=
g-an-analyzed-selinux-denial_troubleshooting-problems-related-to-selinux
https://source.android.com/docs/security/features/selinux/device-policy

"When systems run SELinux in permissive mode, users and processes might
label various file-system objects incorrectly."
"Be careful when the tool suggests using the audit2allow tool for
configuration changes. You should not use audit2allow to generate a local
policy module as your first option when you see an SELinux denial."
"Simply accepting the output from audit2allow [here] would result in an
incorrect and overly permissive rule."

It used to be common practice to generate policy from the Reference Policy,
to make use of existing interfaces whenever possible. (man audit2allow, -R)=
.
OP is using CIL. Admittedly, I haven't tried to use both -R and -C.


On Tue, Jan 14, 2025 at 9:47=E2=80=AFPM John Griffiths via selinux <
[email protected]> wrote:

> I think you may be going about this the hard way.
>
> Are you using the setroubleshoot packages?
>
> setroubleshoot.x86_64
> setroubleshoot-plugins.noarch
> setroubleshoot-server.x86_64
>
> They provide sealert and some other tools for analyzing AVCs and writing
> local policies.
>
> The original policy module doesn't need to be replaced. It can just be
> augmented.
>
> When I need to write or add to a policy, I put selinux in permissive mode=
,
> make note of the time, run the program and exercise it.
>
> Then I put selinux back in enforcing mode.
>
> Then I run:
> ausearch -ts 01/06/2025 09:53:57 --raw | audit2allow -M my-moduleName
>
> Substitute your date and time for above. The module name just needs to be
> something you recognize. I always preface the package with "my-" so I can
> search on my policy modules.
>
> The command will produce a te file and a pp file.
>
> You install the my-moduleName.pp file using:
> semodule -X 300 -i my-moduleName.pp
>
> Your new policy is now installed and selinux is using it.
> --
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[email protected]=
.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>

--000000000000dec82a062bb10a85
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>This procedure will probably silence AVC denials, but=
 may or may not result in a correct policy.</div><div></div><div>The reason=
 is stated in e.g.</div><div><br></div><div><a href=3D"https://docs.redhat.=
com/en/documentation/red_hat_enterprise_linux/8/html/using_selinux/changing=
-selinux-states-and-modes_using-selinux#changing-selinux-modes_changing-sel=
inux-states-and-modes" target=3D"_blank">https://docs.redhat.com/en/documen=
tation/red_hat_enterprise_linux/8/html/using_selinux/changing-selinux-state=
s-and-modes_using-selinux#changing-selinux-modes_changing-selinux-states-an=
d-modes</a></div><div><a href=3D"https://docs.redhat.com/en/documentation/r=
ed_hat_enterprise_linux/8/html/using_selinux/troubleshooting-problems-relat=
ed-to-selinux_using-selinux#fixing-an-analyzed-selinux-denial_troubleshooti=
ng-problems-related-to-selinux">https://docs.redhat.com/en/documentation/re=
d_hat_enterprise_linux/8/html/using_selinux/troubleshooting-problems-relate=
d-to-selinux_using-selinux#fixing-an-analyzed-selinux-denial_troubleshootin=
g-problems-related-to-selinux</a></div><div></div><div><a href=3D"https://s=
ource.android.com/docs/security/features/selinux/device-policy" target=3D"_=
blank">https://source.android.com/docs/security/features/selinux/device-pol=
icy</a></div><div><br></div><div>&quot;When systems run SELinux in permissi=
ve mode, users and processes might label various file-system objects incorr=
ectly.&quot;</div><div>&quot;Be careful when the tool suggests using the <c=
ode class=3D"gmail-literal">audit2allow</code> tool for configuration chang=
es. You should not use <code class=3D"gmail-literal">audit2allow</code> to =
generate a local policy module as your first option when you see an SELinux=
 denial.&quot;<br></div><div>&quot;Simply accepting
the output from
audit2allow
[here] would result in an incorrect and overly permissive rule.&quot;<br></=
div><div><br></div><div>It used to be common practice to generate policy fr=
om the Reference Policy, to make use of existing interfaces whenever possib=
le. (man audit2allow, -R).</div><div>OP is using CIL. Admittedly, I haven&#=
39;t tried to use both -R and -C.</div><div></div><div><br></div></div><br>=
<div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Ja=
n 14, 2025 at 9:47=E2=80=AFPM John Griffiths via selinux &lt;<a href=3D"mai=
lto:[email protected]" target=3D"_blank">[email protected]=
project.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">I think you may be going about this the hard way.<br>
<br>
Are you using the setroubleshoot packages?<br>
<br>
setroubleshoot.x86_64<br>
setroubleshoot-plugins.noarch<br>
setroubleshoot-server.x86_64<br>
<br>
They provide sealert and some other tools for analyzing AVCs and writing lo=
cal policies.<br>
<br>
The original policy module doesn&#39;t need to be replaced. It can just be =
augmented.<br>
<br>
When I need to write or add to a policy, I put selinux in permissive mode, =
make note of the time, run the program and exercise it.<br>
<br>
Then I put selinux back in enforcing mode.<br>
<br>
Then I run:<br>
ausearch -ts 01/06/2025 09:53:57 --raw | audit2allow -M my-moduleName<br>
<br>
Substitute your date and time for above. The module name just needs to be s=
omething you recognize. I always preface the package with &quot;my-&quot; s=
o I can search on my policy modules.<br>
<br>
The command will produce a te file and a pp file.<br>
<br>
You install the my-moduleName.pp file using:<br>
semodule -X 300 -i my-moduleName.pp<br>
<br>
Your new policy is now installed and selinux is using it.<br>
-- <br>
_______________________________________________<br>
selinux mailing list -- <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
aproject.org" target=3D"_blank">[email protected]</a><b=
r>
Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro=
ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe=
doraproject.org/en-US/project/code-of-conduct/</a><br>
List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui=
delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik=
i/Mailing_list_guidelines</a><br>
List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel=
[email protected]" rel=3D"noreferrer" target=3D"_blank">https://=
lists.fedoraproject.org/archives/list/[email protected]</a><b=
r>
Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras=
tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/=
fedora-infrastructure/new_issue</a><br>
</blockquote></div>

--000000000000dec82a062bb10a85--

--===============0989700404085153644==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo=

--===============0989700404085153644==--