gentoo-hardened June 2008 archive
Main Archive Page > Month Archives  > gentoo-hardened archives
gentoo-hardened: [gentoo-hardened] SELinux: Samba changes in lat

[gentoo-hardened] SELinux: Samba changes in latest ref policy

From: Mike Edenfield <kutulu_at_nospam>
Date: Fri Jun 13 2008 - 16:26:05 GMT
To: gentoo-hardened@lists.gentoo.org


I noticed that the changes to samba's winbind rules are in the latest base policy but it's still not quite right. I think I can finally explain how it's supposed to work based on samba's behavior, but I'm not sure how this should be translated into rules.

The winbind daemon actually opens two separate sockets (both called "pipe" for some reason, but that's another issue). By default they go into:

/tmp/.winbindd/pipe

$LOCKDIR/winbindd_privileged/pipe

The first socket is intended to be the "unprivileged" communication point between winbind and a client program; this pipe only allows a limited number of operations to be done. The second socket allows full access, including uid/gid mapping management. Under standard UNIX permissions, the first pipe is world-visible while the second pipe is only accessible by root.

The updated refpolicy template grants access to one or the other of these sockets, depending on distro: the RedHat path adds a rule for the privileged socket, the other path adds a rule for the unprivileged socket.

For RedHat this works -- they've moved the unprivileged socket out of
/tmp into /var/run, so both sockets have the same security context. For
other distros, I think access to *both* types need to be granted. I suppose ideally you'd have two separate templates -- a priv. and an unpriv. one, but I have no idea which programs need which.

I've run with the attached patch to samba.if for a few days now and it seems to have gotten rid of all the winbind-related AVC's I was getting under the new policy (which itself got rid of the AVC's I was getting under the old policy :) )

--Mike

  • samba.if.orig 2008-06-13 12:20:52.000000000 -0400 +++ samba.if 2008-06-13 12:21:56.000000000 -0400 @@ -484,15 +484,17 @@ ## </param> # interface(`samba_stream_connect_winbind',` - ifdef(`distro_redhat',` - gen_require(` - type samba_var_t, winbind_t, winbind_var_run_t; - ') + gen_require(` + type samba_var_t, winbind_t, winbind_var_run_t; + ')
    • files_search_pids($1)
    • allow $1 samba_var_t:dir search_dir_perms;
    • stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t)
    • ',` + files_search_pids($1) + allow $1 samba_var_t:dir search_dir_perms; + stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t) + + # RedHat has moved this socket into /var/run and is covered by the first + # rule. + ifdef(`distro_redhat',`', ` gen_require(` type winbind_t, winbind_tmp_t; ') -- gentoo-hardened@lists.gentoo.org mailing list