Re: [Openvpn-devel] [PATCH] Post-initialization SELinux support for OpenVPN

[James Yonan]

Sebastien Raveau wrote:

Hi everybody!


OpenVPN already has support for dropping privileges and confining
itself to a directory *after* startup (thanks to calls like setgid,
setuid and chroot) which makes for much better management than if you
had to respectively start OpenVPN unprivileged and add the privileges
it (only) needs during startup, or if you chroot'ed OpenVPN before
startup and had to copy the necessary files in the confinement
directory.

The very same problem occurs with SELinux policy enforcement: one can
apply a policy before startup (such as the ready-to-use one provided
by 
http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/services/openvpn.te)
but it is wy too complicated, just because many rights have to be
granted to OpenVPN during its initialization... or one can apply a
very simple SELinux policy to OpenVPN when the only need left is
basically network I/O operations.

The only downside to this is that, just like with setuid() and
chroot(), OpenVPN has to call setcon() itself, which is why I am
submitting this patch :-)

Please note that, while this patch does indeed bring a new dependency
to libselinux in OpenVPN on Linux:
* the feature will of course only be added if detected by ./configure
* libselinux is so common now that even /bin/ls is linked against it
on most Linux systems
so OpenVPN should get SELinux support quite transparently ;-)


Sebastien,

This looks good...  Thanks for putting it together!

A couple things:

Can you adapt the patch to the OpenVPN 2.1 branch?

Can you modify the patch slightly so that no code is added unless #ifdef 
HAVE_SETCON is true?


Thanks,
James

Re: [Openvpn-devel] PATCH 2.1-RC*: critical fix for FreeBSD 8 in topology subnet mode.

[James Yonan]

Thanks Stefan and Matthias.  I've committed the patch.

James

Matthias Andree wrote:

Hi Jim,

there has been a recent change in FreeBSD 8 BETA that will break OpenVPN
2.1's "topology subnet" mode by (rightfully!) rejecting the ifconfig
command we're currently using (which incorrectly sets the local and
remote P2P IPv4 addresses to be the same, the FreeBSD 8 kernel will
reject that.)

FreeBSD's TUN interface can be switched from P2P to broadcast mode
however, which we will need to leverage in order to support subnet
topology.

Stefan Bethke (in CC) has written, revised and tested an OpenVPN patch
that works on all currently supported FreeBSD 6.X and 7.X versions and
also the upcoming FreeBSD 8.0. The patch makes sure that the tun
interface is switched to broadcast mode and configured appropriately.

Find it inlined below for easier review and also attached.

Please apply!

Thank you.

Best regards
Matthias
OpenVPN packager for FreeBSD ports

--- /home/stb/tun.c.orig2009-08-05 14:25:55.204943408 +0200
+++ tun.c   2009-08-05 17:57:51.886753309 +0200
@@ -863,11 +863,10 @@
   else {
if (tt->topology == TOP_SUBNET)
 argv_printf (,
-  "%s %s %s %s netmask %s mtu %d up",
+  "%s %s %s netmask %s mtu %d up",
   IFCONFIG_PATH,
   actual,
   ifconfig_local,
-  ifconfig_local,
   ifconfig_remote_netmask,
   tun_mtu
   );
@@ -1745,14 +1744,19 @@
 {
   open_tun_generic (dev, dev_type, dev_node, ipv6, true, true, tt);
 
-  if (tt->fd >= 0)

+  if (tt->fd >= 0 && tt->type == DEV_TYPE_TUN)
 {
   int i = 0;
 
-  /* Disable extended modes */

-  ioctl (tt->fd, TUNSLMODE, );
+  i = tt->topology == TOP_SUBNET ? IFF_BROADCAST : IFF_POINTOPOINT;
+  i |= IFF_MULTICAST;
+  if (ioctl (tt->fd, TUNSIFMODE, ) < 0) {
+   msg (M_WARN | M_ERRNO, "ioctl(TUNSIFMODE): %s", strerror(errno));
+  }
   i = 1;
-  ioctl (tt->fd, TUNSIFHEAD, );
+  if (ioctl (tt->fd, TUNSIFHEAD, ) < 0) {
+   msg (M_WARN | M_ERRNO, "ioctl(TUNSIFHEAD): %s", strerror(errno));
+  }
 }
 }