Looks like I'm the second newbie in a week to introduce himself to the list. I've been a unix/Linux systems administrator for over a decade, and have been running Gentoo for at least the past 3 years. I have just in the last week or so switched over to the hardened profile and am completely new to SELinux, I know this is going to take a while, but I'm up for it because I also know it will be good for me to gain a more comprehensive understanding and be able to effectively manage and properly configure a SELinux system no matter what flavor the distro happens to be. So, thanks in advance for your patience and guidance as I try to get my mind wrapped around all of this.
With that said, I am running ~amd64, no multilib, now with the hardened
profile. Thanks to the recently updated selinux-handbook I was able to
get switched over with only a small bump or two. That part was actually
fairly easy. I am running the strict policy in permissive mode since it
is quite obvious to me at this point I would have a severely broken
system if I switched on enforcing. Here are the policies I currently
have installed:
#semodule -l
UWimap 0.6
alsa 1.11.0
apache 2.3.0
apcupsd 1.8.0
apm 1.11.0
automount 1.13.0
bind 1.11.0
cdrecord 2.4.0
clamav 1.9.0
consolekit 1.7.0
cpucontrol 1.3.0
cpufreqselector 1.3.0
cups 1.14.0
dbus 1.15.0
dhcp 1.9.0
dmidecode 1.4.0
gpg 2.4.0
gpm 1.8.0
inetd 1.11.0
java 2.4.0
ldap 1.10.0
logrotate 1.14.0
logwatch 1.11.0
lpd 1.12.0
milter 1.3.0
mono 1.8.0
mozilla 2.4.0
mplayer 2.3.0
mysql 1.12.0
ntp 1.10.0
policykit 1.1.0
portmap 1.9.0
ppp 1.12.0
procmail 1.12.0
pyzor 2.1.0
radvd 1.13.0
rpc 1.13.0
rpcbind 1.5.0
samba 1.14.0
sasl 1.14.0
screen 2.4.0
sendmail 1.11.0
shutdown 1.1.0
skype 0.0.2
spamassassin 2.4.0
thunderbird 2.2.0
uptime 1.4.0
xscreensaver 1.0.0
xserver 3.6.0
I should also mention that my system runs mail, DNS, and web servers as
well as being used as my personal desktop system. I am running this at
home -- not work (i.e. not getting paid for doing it) I would like to
ask for some feedback from the group on my first attempt at writing
selinux rules in the form of a new policy module. I chose my imap
server (net-mail/uw-imap) which runs from xinetd, as my starting point
for analyzing the audit log entries it was generating and coming up with
some selinux rules to address them. I didn't see any pre-existing
policy in portage for the UW-imap server, though one of the other
policies may cover what is needed and what I have written is not
necessary. This policy module has eliminated all of the audit log
entries I had been seeing to date that are associated with my imap, but
that alone doesn't mean I've written a good policy. I would like for
those of you in the group who are more experienced to look this over and
offer some feedback with regard to the way I have done things. Thanks
for your time.
UWimap.if:
interface(`UWimap_domtrans',`
gen_require(`type inetd_t, user_mail_exec_t, user_mail_t;')
domtrans_pattern($1,inetd_t,user_mail_exec_t)
domtrans_pattern($1,user_mail_exec_t,user_mail_t)
')
UWimap.fc:
/usr/sbin/imapd --
gen_context(system_u:object_r:user_mail_exec_t,s0)
UWimap.te
policy_module(UWimap, 0.6)
require {
type mail_spool_t;
type user_mail_t;
type fs_t;
type chkpwd_exec_t;
type inetd_t;
class file { execute setattr read lock create execute_no_trans
write getattr link unlink open append };
class dir { write getattr remove_name add_name };
class filesystem associate;
class capability sys_resource;
class tcp_socket { read write getattr};
class fd use;
class process setrlimit;
}
type user_mail_exec_t;
application_domain(user_mail_t, user_mail_exec_t)
domain_auto_trans(inetd_t, user_mail_exec_t, user_mail_t)
allow user_mail_t fs_t:filesystem associate;
allow user_mail_t chkpwd_exec_t:file { read execute open execute_no_trans };
allow user_mail_t inetd_t:fd use;
allow user_mail_t inetd_t:tcp_socket { read write getattr};
allow user_mail_t self:file {setattr create link unlink};
allow user_mail_t self:dir {write getattr remove_name add_name};
allow inetd_t self:capability sys_resource;
allow inetd_t self:process setrlimit;
--
Stan & HD Tashi Grad 10/08 Edgewood, NM SWR
PR - Cindy and Jenny - Sammamish, WA NWR
http://www.sblan.net/tashi
signature.asc
Description: OpenPGP digital signature
