Strange syslog-ng, logger, /dev/log behaviour

"Javier Martínez" <[email protected]>
Newsgroups gmane.linux.rsbac
Message-ID <[email protected]>
Hi all, I'm having some strange problems labelling all IPC's between
this two binaries and the /dev/log socket.

This is my policy related definitions


rc_set_item TYPE 4 type_fd_name "user_bin_t"
rc_set_item TYPE 5 type_fd_name "suser_bin_t"
rc_set_item TYPE 6 type_fd_name "secoff_bin_t"
rc_set_item TYPE 7 type_fd_name "perl_bin_t"
rc_set_item TYPE 8 type_fd_name "python_bin_t"
rc_set_item TYPE 9 type_fd_name "script_aux_t"
rc_set_item TYPE 10 type_fd_name "info_bin_t"
rc_set_item TYPE 11 type_fd_name "net_bin_t"
rc_set_item TYPE 12 type_fd_name "samhain_bin_t"
rc_set_item TYPE 13 type_fd_name "boot_bin_t"
rc_set_item TYPE 14 type_fd_name "kernel_data_t"
rc_set_item TYPE 15 type_fd_name "kernel_code_t"
rc_set_item TYPE 16 type_fd_name "libs"
rc_set_item TYPE 17 type_fd_name "pam_data"
rc_set_item TYPE 18 type_fd_name "pam_modules"
rc_set_item TYPE 19 type_fd_name "libopenssl"
rc_set_item TYPE 20 type_fd_name "rc_scripts"
rc_set_item TYPE 21 type_fd_name "runlevels"
rc_set_item TYPE 22 type_fd_name "init.d"
rc_set_item TYPE 23 type_fd_name "openssl_data"
rc_set_item TYPE 24 type_fd_name "config_gen"
rc_set_item TYPE 25 type_fd_name "libexec"
rc_set_item TYPE 26 type_fd_name "portage_data"
rc_set_item TYPE 27 type_fd_name "logs"
rc_set_item TYPE 28 type_fd_name "samhain"
rc_set_item TYPE 29 type_fd_name "localtime_cfg"
rc_set_item TYPE 30 type_fd_name "linker_cfg"
rc_set_item TYPE 31 type_fd_name "terminfo_cfg"
rc_set_item TYPE 32 type_fd_name "cron_cfg"
rc_set_item TYPE 33 type_fd_name "cron_bin"
rc_set_item TYPE 34 type_fd_name "cron_data"
rc_set_item TYPE 35 type_fd_name "/var"
rc_set_item TYPE 36 type_fd_name "/dev"
rc_set_item TYPE 37 type_fd_name "/"
rc_set_item TYPE 38 type_fd_name "/etc/syslog-ng"
rc_set_item TYPE 39 type_fd_name "/dev/log"
rc_set_item TYPE 3 type_process_name "cron_proc"
rc_set_item TYPE 4 type_process_name "syslog"
rc_set_item TYPE 3 type_dev_name "disk_devs"
rc_set_item TYPE 4 type_dev_name "urandom"
rc_set_item TYPE 5 type_dev_name "ttys"
rc_set_item TYPE 3 type_ipc_name "syslog"
rc_set_item TYPE 40 type_fd_name "syslog_files"
rc_set_item TYPE 41 type_fd_name "syslog_tty"
rc_set_item TYPE 5 type_process_name "logger"
rc_set_item TYPE 4 type_ipc_name "logger"
rc_set_item TYPE 6 type_dev_name "null"
rc_set_item TYPE 42 type_fd_name "initctl"
rc_set_item TYPE 5 type_ipc_name "init"
rc_set_item TYPE 6 type_process_name "init"
rc_set_item TYPE 43 type_fd_name "common_cfg"
rc_set_item TYPE 44 type_fd_name "conf.d"
rc_set_item TYPE 45 type_fd_name "tty"
rc_set_item TYPE 46 type_fd_name "utmp"
rc_set_item TYPE 47 type_fd_name "/var/run"
rc_set_item TYPE 6 type_ipc_name "cron_ipc"
rc_set_item TYPE 3 type_user_name "root"
rc_set_item TYPE 4 type_user_name "secoff"
rc_set_item TYPE 5 type_user_name  "gen_users"
rc_set_item TYPE 7 type_ipc_name "/dev/log"
rc_set_item TYPE 48 type_fd_name "logger"

The assignations of my policy:

attr_set_file_dir RC FILE "/usr/sbin/syslog-ng" rc_force_role 9
attr_set_file_dir RC FILE "/usr/bin/logger" rc_force_role 18
attr_set_file_dir DIR "/etc/syslog-ng" rc_type_fd 38


and the policy related itself:
#logger
rc_set_item -a ROLE 18 def_process_create_type 5
rc_set_item -a ROLE 18 def_ipc_create_type 4
rc_set_item -a ROLE 18 type_comp_fd 39 SEARCH
rc_set_item -a ROLE 18 type_comp_fd 36 R
rc_set_item -a ROLE 18 type_comp_fd 37 R
rc_set_item -a ROLE 18 type_comp_fd 24 SEARCH
rc_set_item -a ROLE 18 type_comp_fd 30 R
rc_set_item -a ROLE 18 type_comp_fd 16 R MAP_EXEC
rc_set_item -a ROLE 18 type_comp_fd 29 R
rc_set_item -a ROLE 18 type_comp_dev 4 R
rc_set_item -a ROLE 18 def_unixsock_create_type 48
rc_set_item -a ROLE 18 type_comp_ipc 4 RW

#syslog-ng
rc_set_item -a ROLE 9 type_comp_fd 47 RW
rc_set_item -a ROLE 9 def_fd_create_type 40
rc_set_item -a ROLE 9 type_comp_fd 40 RW
rc_set_item -a ROLE 9 def_process_create_type 4
rc_set_item -a ROLE 9 def_ipc_create_type 4
rc_set_item -a ROLE 9 type_comp_ipc 3 CREATE
rc_set_item -a ROLE 9 type_comp_process 4 CLONE CREATE
rc_set_item -a ROLE 9 type_comp_fd 37 READ READ_OPEN SEARCH
rc_set_item -a ROLE 9 type_comp_fd 35 R CREATE
rc_set_item -a ROLE 9 type_comp_fd 36 SEARCH CREATE
rc_set_item -a ROLE 9 type_comp_fd 41 SEARCH CREATE CHANGE_OWNER
MODIFY_PERMISSIONS_DATA
rc_set_item -a ROLE 9 type_comp_fd 29 R
rc_set_item -a ROLE 9 type_comp_fd 24 SEARCH

for role in 2 9; do rc_set_item -a ROLE "$role" type_comp_dev 4 R; done

rc_set_item -a ROLE 9 type_comp_fd 16 R MAP_EXEC EXECUTE
rc_set_item -a ROLE 9 type_comp_dev 3 R
rc_set_item -a ROLE 9 type_comp_fd 30 R
rc_set_item -a ROLE 9 type_comp_fd 38 R
rc_set_item -a ROLE 9 type_comp_fd 27 RW
rc_set_item -a ROLE 9 type_comp_fd 39 RW
rc_set_item -a ROLE 9 type_comp_scd 7 GET_STATUS_DATA
rc_set_item -a ROLE 9 type_comp_dev 5 WRITE
rc_set_item -a ROLE 9 type_comp_ipc 4 RW
rc_set_item -a ROLE 9 def_unixsock_create_type 39
rc_set_item -a ROLE 9 type_comp_dev 5 W
rc_set_item -a ROLE 9 type_comp_dev 6 RW

In my logs appears this:

Jun 15 12:11:28 andromeda 0000010267|check_comp_rc(): pid 2323
(syslog-ng), owner 0, rc_role 9, PROCESS rc_type 0, request ACCEPT ->
NOT_GRANTED!
Jun 15 12:11:28 andromeda 0000010268|rsbac_adf_request(): request
ACCEPT, pid 2323, ppid 1, prog_name syslog-ng, prog_file
/usr/sbin/syslog-ng, uid 0, target_type UNIXSOCK, tid Device 03:01
Inode 496003 Path /dev/log, attr process, value 2322, result
NOT_GRANTED (Softmode) by RC
Jun 15 12:11:28 andromeda 0000010269|check_comp_rc(): pid 2323
(syslog-ng), owner 0, rc_role 9, IPC rc_type 0, request
MODIFY_SYSTEM_DATA -> NOT_GRANTED!
Jun 15 12:11:28 andromeda 0000010270|rsbac_adf_request(): request
MODIFY_SYSTEM_DATA, pid 2323, ppid 1, prog_name syslog-ng, prog_file
/usr/sbin/syslog-ng, uid 0, target_type IPC, tid AnonUnix-ID 3869,
attr setsockopt_level, value 1, result NOT_GRANTED (Softmode) by RC

Jun 15 12:11:27 andromeda 0000010204|check_comp_rc(): pid 2678
(logger), owner 0, rc_role 18, PROCESS rc_type 0, request SEND ->
NOT_GRANTED!
Jun 15 12:11:27 andromeda 0000010205|rsbac_adf_request(): request
SEND, pid 2678, ppid 2382, prog_name logger, prog_file
/usr/bin/logger, uid 0, target_type UNIXSOCK, tid Device 03:01 Inode
496003 Path /dev/log, attr process, value 2322, result NOT_GRANTED
(Softmode) by RC

I'm missing something¿?, why the process is of type 0 if I have
labeled it before¿?
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.