Strange syslog-ng, logger, /dev/log behaviour
"Javier Martínez" <[email protected]>
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I'm having some strange problems labelling all IPC's between this two binaries and the /dev/log socket. This is my policy related definitions rc_set_item TYPE 4 type_fd_name "user_bin_t" rc_set_item TYPE 5 type_fd_name "suser_bin_t" rc_set_item TYPE 6 type_fd_name "secoff_bin_t" rc_set_item TYPE 7 type_fd_name "perl_bin_t" rc_set_item TYPE 8 type_fd_name "python_bin_t" rc_set_item TYPE 9 type_fd_name "script_aux_t" rc_set_item TYPE 10 type_fd_name "info_bin_t" rc_set_item TYPE 11 type_fd_name "net_bin_t" rc_set_item TYPE 12 type_fd_name "samhain_bin_t" rc_set_item TYPE 13 type_fd_name "boot_bin_t" rc_set_item TYPE 14 type_fd_name "kernel_data_t" rc_set_item TYPE 15 type_fd_name "kernel_code_t" rc_set_item TYPE 16 type_fd_name "libs" rc_set_item TYPE 17 type_fd_name "pam_data" rc_set_item TYPE 18 type_fd_name "pam_modules" rc_set_item TYPE 19 type_fd_name "libopenssl" rc_set_item TYPE 20 type_fd_name "rc_scripts" rc_set_item TYPE 21 type_fd_name "runlevels" rc_set_item TYPE 22 type_fd_name "init.d" rc_set_item TYPE 23 type_fd_name "openssl_data" rc_set_item TYPE 24 type_fd_name "config_gen" rc_set_item TYPE 25 type_fd_name "libexec" rc_set_item TYPE 26 type_fd_name "portage_data" rc_set_item TYPE 27 type_fd_name "logs" rc_set_item TYPE 28 type_fd_name "samhain" rc_set_item TYPE 29 type_fd_name "localtime_cfg" rc_set_item TYPE 30 type_fd_name "linker_cfg" rc_set_item TYPE 31 type_fd_name "terminfo_cfg" rc_set_item TYPE 32 type_fd_name "cron_cfg" rc_set_item TYPE 33 type_fd_name "cron_bin" rc_set_item TYPE 34 type_fd_name "cron_data" rc_set_item TYPE 35 type_fd_name "/var" rc_set_item TYPE 36 type_fd_name "/dev" rc_set_item TYPE 37 type_fd_name "/" rc_set_item TYPE 38 type_fd_name "/etc/syslog-ng" rc_set_item TYPE 39 type_fd_name "/dev/log" rc_set_item TYPE 3 type_process_name "cron_proc" rc_set_item TYPE 4 type_process_name "syslog" rc_set_item TYPE 3 type_dev_name "disk_devs" rc_set_item TYPE 4 type_dev_name "urandom" rc_set_item TYPE 5 type_dev_name "ttys" rc_set_item TYPE 3 type_ipc_name "syslog" rc_set_item TYPE 40 type_fd_name "syslog_files" rc_set_item TYPE 41 type_fd_name "syslog_tty" rc_set_item TYPE 5 type_process_name "logger" rc_set_item TYPE 4 type_ipc_name "logger" rc_set_item TYPE 6 type_dev_name "null" rc_set_item TYPE 42 type_fd_name "initctl" rc_set_item TYPE 5 type_ipc_name "init" rc_set_item TYPE 6 type_process_name "init" rc_set_item TYPE 43 type_fd_name "common_cfg" rc_set_item TYPE 44 type_fd_name "conf.d" rc_set_item TYPE 45 type_fd_name "tty" rc_set_item TYPE 46 type_fd_name "utmp" rc_set_item TYPE 47 type_fd_name "/var/run" rc_set_item TYPE 6 type_ipc_name "cron_ipc" rc_set_item TYPE 3 type_user_name "root" rc_set_item TYPE 4 type_user_name "secoff" rc_set_item TYPE 5 type_user_name "gen_users" rc_set_item TYPE 7 type_ipc_name "/dev/log" rc_set_item TYPE 48 type_fd_name "logger" The assignations of my policy: attr_set_file_dir RC FILE "/usr/sbin/syslog-ng" rc_force_role 9 attr_set_file_dir RC FILE "/usr/bin/logger" rc_force_role 18 attr_set_file_dir DIR "/etc/syslog-ng" rc_type_fd 38 and the policy related itself: #logger rc_set_item -a ROLE 18 def_process_create_type 5 rc_set_item -a ROLE 18 def_ipc_create_type 4 rc_set_item -a ROLE 18 type_comp_fd 39 SEARCH rc_set_item -a ROLE 18 type_comp_fd 36 R rc_set_item -a ROLE 18 type_comp_fd 37 R rc_set_item -a ROLE 18 type_comp_fd 24 SEARCH rc_set_item -a ROLE 18 type_comp_fd 30 R rc_set_item -a ROLE 18 type_comp_fd 16 R MAP_EXEC rc_set_item -a ROLE 18 type_comp_fd 29 R rc_set_item -a ROLE 18 type_comp_dev 4 R rc_set_item -a ROLE 18 def_unixsock_create_type 48 rc_set_item -a ROLE 18 type_comp_ipc 4 RW #syslog-ng rc_set_item -a ROLE 9 type_comp_fd 47 RW rc_set_item -a ROLE 9 def_fd_create_type 40 rc_set_item -a ROLE 9 type_comp_fd 40 RW rc_set_item -a ROLE 9 def_process_create_type 4 rc_set_item -a ROLE 9 def_ipc_create_type 4 rc_set_item -a ROLE 9 type_comp_ipc 3 CREATE rc_set_item -a ROLE 9 type_comp_process 4 CLONE CREATE rc_set_item -a ROLE 9 type_comp_fd 37 READ READ_OPEN SEARCH rc_set_item -a ROLE 9 type_comp_fd 35 R CREATE rc_set_item -a ROLE 9 type_comp_fd 36 SEARCH CREATE rc_set_item -a ROLE 9 type_comp_fd 41 SEARCH CREATE CHANGE_OWNER MODIFY_PERMISSIONS_DATA rc_set_item -a ROLE 9 type_comp_fd 29 R rc_set_item -a ROLE 9 type_comp_fd 24 SEARCH for role in 2 9; do rc_set_item -a ROLE "$role" type_comp_dev 4 R; done rc_set_item -a ROLE 9 type_comp_fd 16 R MAP_EXEC EXECUTE rc_set_item -a ROLE 9 type_comp_dev 3 R rc_set_item -a ROLE 9 type_comp_fd 30 R rc_set_item -a ROLE 9 type_comp_fd 38 R rc_set_item -a ROLE 9 type_comp_fd 27 RW rc_set_item -a ROLE 9 type_comp_fd 39 RW rc_set_item -a ROLE 9 type_comp_scd 7 GET_STATUS_DATA rc_set_item -a ROLE 9 type_comp_dev 5 WRITE rc_set_item -a ROLE 9 type_comp_ipc 4 RW rc_set_item -a ROLE 9 def_unixsock_create_type 39 rc_set_item -a ROLE 9 type_comp_dev 5 W rc_set_item -a ROLE 9 type_comp_dev 6 RW In my logs appears this: Jun 15 12:11:28 andromeda 0000010267|check_comp_rc(): pid 2323 (syslog-ng), owner 0, rc_role 9, PROCESS rc_type 0, request ACCEPT -> NOT_GRANTED! Jun 15 12:11:28 andromeda 0000010268|rsbac_adf_request(): request ACCEPT, pid 2323, ppid 1, prog_name syslog-ng, prog_file /usr/sbin/syslog-ng, uid 0, target_type UNIXSOCK, tid Device 03:01 Inode 496003 Path /dev/log, attr process, value 2322, result NOT_GRANTED (Softmode) by RC Jun 15 12:11:28 andromeda 0000010269|check_comp_rc(): pid 2323 (syslog-ng), owner 0, rc_role 9, IPC rc_type 0, request MODIFY_SYSTEM_DATA -> NOT_GRANTED! Jun 15 12:11:28 andromeda 0000010270|rsbac_adf_request(): request MODIFY_SYSTEM_DATA, pid 2323, ppid 1, prog_name syslog-ng, prog_file /usr/sbin/syslog-ng, uid 0, target_type IPC, tid AnonUnix-ID 3869, attr setsockopt_level, value 1, result NOT_GRANTED (Softmode) by RC Jun 15 12:11:27 andromeda 0000010204|check_comp_rc(): pid 2678 (logger), owner 0, rc_role 18, PROCESS rc_type 0, request SEND -> NOT_GRANTED! Jun 15 12:11:27 andromeda 0000010205|rsbac_adf_request(): request SEND, pid 2678, ppid 2382, prog_name logger, prog_file /usr/bin/logger, uid 0, target_type UNIXSOCK, tid Device 03:01 Inode 496003 Path /dev/log, attr process, value 2322, result NOT_GRANTED (Softmode) by RC I'm missing something¿?, why the process is of type 0 if I have labeled it before¿?