Re: [systemd-devel] socket activation selinux context on create

2022-09-07 Thread Ted Toth
I'm testing a runner of a patch but what I'm seeing is
setsockcreatecon called (in a sd-listen process) with the context I've
set using 'semanage port -t' but then when I look at the listening
socket context (netstat -Z) it is still init_t and not the type set by
setsockcreatecon. I'm not clear about how systemd uses a child process
(sd-listen) to create a listening socket and whether the socket
context persists across the processes, can someone explain this to me?

Ted

On Tue, Sep 6, 2022 at 4:51 PM Ted Toth  wrote:
>
> I think I figured out how to add libsemanage to the link, when you see
> the patch you can tell me if I did it right.
>
> On Tue, Sep 6, 2022 at 11:46 AM Ted Toth  wrote:
> >
> > I'm working on a patch and adding a function to selinux_util.c which
> > calls libsemanage functions but I don't know how to add this library
> > to the link of the systemd (libsystemd-shared-.so) shared
> > library as I'm not familiar with the build, how do I do this?
> > Also a lot of the semanage functions on failure do not set errno so
> > how should I log these failures, i.e. which log_ function should I
> > call?
> >
> > Ted
> >
> > On Fri, Sep 2, 2022 at 9:13 AM Lennart Poettering
> >  wrote:
> > >
> > > On Fr, 02.09.22 09:04, Ted Toth (txt...@gmail.com) wrote:
> > >
> > > > I have set the type for the port in question using the 'semanage port'
> > > > command so the loaded policy has a type which systemd should use when
> > > > calling setsockcreatecon. It is my opinion that
> > > > socket_determine_selinux_label function should query policy for the
> > > > port type and if it has been set use it and if not fallback to its
> > > > current behavior.
> > >
> > > Sure, patch very welcome.
> > >
> > > SELinux code really requires external contributions, none of the core
> > > developers know SELinux too well to do feel confident to implement
> > > that.
> > >
> > > (consider filing an RFE issue on github, so that this is tracked)
> > >
> > > Lennart
> > >
> > > --
> > > Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-09-06 Thread Ted Toth
I think I figured out how to add libsemanage to the link, when you see
the patch you can tell me if I did it right.

On Tue, Sep 6, 2022 at 11:46 AM Ted Toth  wrote:
>
> I'm working on a patch and adding a function to selinux_util.c which
> calls libsemanage functions but I don't know how to add this library
> to the link of the systemd (libsystemd-shared-.so) shared
> library as I'm not familiar with the build, how do I do this?
> Also a lot of the semanage functions on failure do not set errno so
> how should I log these failures, i.e. which log_ function should I
> call?
>
> Ted
>
> On Fri, Sep 2, 2022 at 9:13 AM Lennart Poettering
>  wrote:
> >
> > On Fr, 02.09.22 09:04, Ted Toth (txt...@gmail.com) wrote:
> >
> > > I have set the type for the port in question using the 'semanage port'
> > > command so the loaded policy has a type which systemd should use when
> > > calling setsockcreatecon. It is my opinion that
> > > socket_determine_selinux_label function should query policy for the
> > > port type and if it has been set use it and if not fallback to its
> > > current behavior.
> >
> > Sure, patch very welcome.
> >
> > SELinux code really requires external contributions, none of the core
> > developers know SELinux too well to do feel confident to implement
> > that.
> >
> > (consider filing an RFE issue on github, so that this is tracked)
> >
> > Lennart
> >
> > --
> > Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-09-06 Thread Ted Toth
I'm working on a patch and adding a function to selinux_util.c which
calls libsemanage functions but I don't know how to add this library
to the link of the systemd (libsystemd-shared-.so) shared
library as I'm not familiar with the build, how do I do this?
Also a lot of the semanage functions on failure do not set errno so
how should I log these failures, i.e. which log_ function should I
call?

Ted

On Fri, Sep 2, 2022 at 9:13 AM Lennart Poettering
 wrote:
>
> On Fr, 02.09.22 09:04, Ted Toth (txt...@gmail.com) wrote:
>
> > I have set the type for the port in question using the 'semanage port'
> > command so the loaded policy has a type which systemd should use when
> > calling setsockcreatecon. It is my opinion that
> > socket_determine_selinux_label function should query policy for the
> > port type and if it has been set use it and if not fallback to its
> > current behavior.
>
> Sure, patch very welcome.
>
> SELinux code really requires external contributions, none of the core
> developers know SELinux too well to do feel confident to implement
> that.
>
> (consider filing an RFE issue on github, so that this is tracked)
>
> Lennart
>
> --
> Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-09-02 Thread Lennart Poettering
On Fr, 02.09.22 09:04, Ted Toth (txt...@gmail.com) wrote:

> I have set the type for the port in question using the 'semanage port'
> command so the loaded policy has a type which systemd should use when
> calling setsockcreatecon. It is my opinion that
> socket_determine_selinux_label function should query policy for the
> port type and if it has been set use it and if not fallback to its
> current behavior.

Sure, patch very welcome.

SELinux code really requires external contributions, none of the core
developers know SELinux too well to do feel confident to implement
that.

(consider filing an RFE issue on github, so that this is tracked)

Lennart

--
Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-09-02 Thread Ted Toth
I have set the type for the port in question using the 'semanage port'
command so the loaded policy has a type which systemd should use when
calling setsockcreatecon. It is my opinion that
socket_determine_selinux_label function should query policy for the
port type and if it has been set use it and if not fallback to its
current behavior.

Ted

On Thu, Aug 25, 2022 at 4:19 AM Lennart Poettering
 wrote:
>
> On Mi, 24.08.22 11:50, Ted Toth (txt...@gmail.com) wrote:
>
> > I don't see a way to set the context of the socket that systemd
> > listens on. If there is a way to do this please tell me otherwise I'd
> > like to see an option (SELinuxCreateContext?) added to be able to set
> > the context (setsockcreatecon) to be used by systemd when creating the
> > socket. Currently as an extra layer of security I add code called in
> > the socket activation ExecStartPre process to check that the source
> > context (peercon) can connect to the target context (getcon). If a
> > sockets context was set by systemd I would have to perform this
> > additional check as my SELinux policy would do it for me.
>
> This was proposed before, but SELinux maintainers really want that the
> loaded selinux policy picks the label, and not unit files.
>
> i.e. as I understand their philosophy: how labels are assigned should
> be encoded in the database and in the policy but not elsewhere,
> i.e. in unit files. I think that philosophy does make sense.
>
> Lennart
>
> --
> Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-08-26 Thread Lennart Poettering
On Do, 25.08.22 14:46, Ted Toth (txt...@gmail.com) wrote:

> I've tested setting the type of the port using semanage port -a
> however when I start the service netstat still shows the type as
> init_t. I don't know of any other way to get a type transition of a
> socket to happen, do you?. I've also posted to the selinux list but
> haven't gotten any responses yet.

Uh, that's a question for the selinux people. I only have a limited
insight into selinux, and wouldn't know how to do such things.

Lennart

--
Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-08-25 Thread Ted Toth
I've tested setting the type of the port using semanage port -a
however when I start the service netstat still shows the type as
init_t. I don't know of any other way to get a type transition of a
socket to happen, do you?. I've also posted to the selinux list but
haven't gotten any responses yet.

Ted

On Thu, Aug 25, 2022 at 4:19 AM Lennart Poettering
 wrote:
>
> On Mi, 24.08.22 11:50, Ted Toth (txt...@gmail.com) wrote:
>
> > I don't see a way to set the context of the socket that systemd
> > listens on. If there is a way to do this please tell me otherwise I'd
> > like to see an option (SELinuxCreateContext?) added to be able to set
> > the context (setsockcreatecon) to be used by systemd when creating the
> > socket. Currently as an extra layer of security I add code called in
> > the socket activation ExecStartPre process to check that the source
> > context (peercon) can connect to the target context (getcon). If a
> > sockets context was set by systemd I would have to perform this
> > additional check as my SELinux policy would do it for me.
>
> This was proposed before, but SELinux maintainers really want that the
> loaded selinux policy picks the label, and not unit files.
>
> i.e. as I understand their philosophy: how labels are assigned should
> be encoded in the database and in the policy but not elsewhere,
> i.e. in unit files. I think that philosophy does make sense.
>
> Lennart
>
> --
> Lennart Poettering, Berlin


Re: [systemd-devel] socket activation selinux context on create

2022-08-25 Thread Lennart Poettering
On Mi, 24.08.22 11:50, Ted Toth (txt...@gmail.com) wrote:

> I don't see a way to set the context of the socket that systemd
> listens on. If there is a way to do this please tell me otherwise I'd
> like to see an option (SELinuxCreateContext?) added to be able to set
> the context (setsockcreatecon) to be used by systemd when creating the
> socket. Currently as an extra layer of security I add code called in
> the socket activation ExecStartPre process to check that the source
> context (peercon) can connect to the target context (getcon). If a
> sockets context was set by systemd I would have to perform this
> additional check as my SELinux policy would do it for me.

This was proposed before, but SELinux maintainers really want that the
loaded selinux policy picks the label, and not unit files.

i.e. as I understand their philosophy: how labels are assigned should
be encoded in the database and in the policy but not elsewhere,
i.e. in unit files. I think that philosophy does make sense.

Lennart

--
Lennart Poettering, Berlin


[systemd-devel] socket activation selinux context on create

2022-08-24 Thread Ted Toth
I don't see a way to set the context of the socket that systemd
listens on. If there is a way to do this please tell me otherwise I'd
like to see an option (SELinuxCreateContext?) added to be able to set
the context (setsockcreatecon) to be used by systemd when creating the
socket. Currently as an extra layer of security I add code called in
the socket activation ExecStartPre process to check that the source
context (peercon) can connect to the target context (getcon). If a
sockets context was set by systemd I would have to perform this
additional check as my SELinux policy would do it for me.

Ted