I've recently installed a few proof-of-concept hardened Gentoo servers
at work, with the hardened toolchain + SELinux as security measures.
I'll probably end to "training" the admins and other devs on how to
write and configure security policy, so I'm trying to understand it
better myself :) The documentation from the hardened project has been
helpful, but there's one element that I seem to be missing.
I have a good grasp on how the policy rules work, and how to write a
policy rule, but I'm still confused on exactly *why* I should be writing
a policy rule. My confusion stems from the fact that there are what I
believe to be an excessive number of avc denial messages being logged
right out of the box, just to boot the system. I obviously could run
audit2allow and figure out what TE rules to add, and silence the log
messages. But some of the rules it recommends just look wrong to me.
Things like this:
allow consoletype_t file_t:chr_file { getattr ioctl read write };
allow consoletype_t file_t:dir search;
allow dmesg_t file_t:chr_file { read write };
I was under the impression that nothing should ever be permitted to
transition to file_t, and that errors referencing the file_t domain mean
there's something mis-labelled. In this case, it looks like
/dev/console is the biggest culprit, but I've also 20 or so errors from
initrc, a few from ifconfig, a half-dozen from udev. If I install, say,
sshd or sudo, I get more, even after merging and reloading their policy
files.
Is this normal or expected? Should I just add all of these rules that
audit2allow recommends, or did I miss some key step in the installation?
Are there any guidelines for tracking down the cause of these errors
and fixing them "the right way" so as not to compromise the security of
the system with over-broad rules? Are there any kinds of best practices
guidelines for SELinux that I can use to explain the "why" of policy
writing, once I get past the "how"?
Thanks for any help you can give me,
--Mike
--
[email protected] mailing list
