10. SELinux - Source Targeted Policy

The file_context file with respect to Source Targeted Policy:
    The binary installation of the Targeted Policy created the file "file_contexts" inside /etc/selinux/targeted/contexts/files, it involves many individual files for creation of the file_contexts file.
After installation of the source policy we will get a folder called /etc/selinux/targeted/src. Beneath "src" a folder called "policy" contains many files and folders including version information, role based access control information and other related files. Two important files in this folder are "attrib.te" used for the Type Enforcement for attributes and another file called "assert.te".The "file_contexts" sub directory inside the policy folder of "src" has additional file called "types.fc", which is almost similar as the binary installation "file_contexts". "distro.fc" file is having information about the linux distros to make conditional matches for m4 usage while building the policy(i.e, it guides to the exact file location according to the distro variable.)
Note:-

(filename.fc = file context
 filename.te = type enforcement)

In "program" directory of the "file_contexts" have many *.fc files which defines the file context information about the various system utilities and daemons.
Eg:-

# cat ping.fc
# ping
/bin/ping.*        --    system_u:object_r:ping_exex_t
/usr/sbin/hping2    --    system_u:object_r:ping_exex_t

    This file defines the file context information for the binary ping. i.e, if there were policy applied in the system then the security label will be as above. But if we look at the binary /bin/ping, it will show something that not matches the above statement.
The context information of the current binary is

# ls -alz /bin/ping
-rwx-rx-rx    root root system_u:object_r:bin_t

    This is because each file context defined inside the folder "/etc/selinux/targeted/src/policy/file_contexts/program" should have a corresponding type enforcement defined. Here the type "bin_t" is applied/inherited from the context of parent ( /bin) directory. The corresponding ".te" files should be located in /etc/selinux/targeted/src/policy/domains/program. This folder houses all the TE files that corresponds to .fc files. eg:- apache.te, dhcpd.te, ntpd.te etc. So the listed daemons (which corresponds to the programs) will be protected.
Check whether the protection for apache has been enforced

# cat /etc/selinux/targeted/src/policy/file_contexts/program/apache.fc | grep /var/www
/var/www(/.*)?    system_u:object:httpd_sys_content_t
(And the corresponding TE file has been created inside "/etc/selinux/targeted/src/policy/domains/program" )
# ls -al /etc/selinux/targeted/src/policy/domains/program |grep apache
-rwx------    root root Jan 8 2010    apache.te

Now check the file_context of folder /var/www

# ls -ldZ /var/www
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t

    The folder is correctly labeled because of .fc has corressponding .te file defined. i.e, the Type has been enforced because it has a corressponding TE file for FC file.

Focus on TE files which relate to FC files.
    TE files resides inside /etc/selinux/targeted/src/policy/domains/program.
Function of TE :
1. TE Files enforce Type
    a. TE Files describes what are each domains able to do, this includes the types that domains that able to access as well as the system related calls (link, unlink, read, tcp_open, udp_open etc).
2. Now the action that are to be enabled in the object are defined in the TE file."TE" file enables actions on objects.
3. THIS FILE PERMITS BASICALLY SUBJECT TO OBJECT ACCESS.

   " We will explain this process with apache service."

        The SELinux admin should have low level of understanding about the operating system in order to understand the calls that made by a program.
The general system calls that apache makes are described below.
    a. read files (config files, content files and log files)
    b. bind to network ports (TCP: 80, TCP :443)
    c. write to file (log files)
    d. execute scripts (cgi, php etc)

Now take a look at apache file:

# vim /etc/selinux/targeted/src/policy/domains/program/apache.te

    Initially it defines about the booleans that can be over written by the configurations in "/etc/selinux/targeted/booleans" file. Under the "Apache Types" we defines the types that supported by apache. This is where actually the labels that defined for the domains which usually corresponds the types that applied to the filenames.
For Eg:-

#ls -alZ /var/www/
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_script_exec_t cgi-bin
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t error
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t html
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t icons
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t manual
-rwxr-x--x    root root Jan 8 2010 system_u:object:httpd_sys_content_t usage

    Notice that the context entries in this folder are defined in the "apache.te" file. Beneath "Apache Types" we can see the type for allowing access for apache defined
Eg:-

# cat /etc/selinux/targeted/src/policy/domains/program/apache.te

    "This file governs what the apache and its related programs are allowed to do on your system."
# Syntax: The syntax is as follows

allow|neverallow|audit|dontaudit     subject|domains     object     object_class     {premissions that to be appiled}

allow httpd_t httpd_log_t:link_file read

    allows httpd_t domain to Object httpd_log_t with object class as link_file with permission read

allow httpd_suexec_t self:capability {setuid setgid };

    # allows the subject httpd_suexec_t domain to object self capability with permissions setuid & setgid

dontaudit httpd_suexec_t var_run_t:dir search;

    This will stop auditing the given process

allow httpd_suexec_t home_root_t:dir search;

    This grands apache the permission to search the object having label home_root_t in which the object class is a directory) This means the apache can search any directory having the label "home_root_t", which is a directory (object class :dir)
The permission should be in "{}" curly brackets while defining two or more at a time.

9. SELinux Targeted Policy (RedHat) - IV

Now we will discuss about Preparing system with the source policies that are associated with the policy number 18 (by default comes with RHEL 4)
Inside the "/etc/selinux" folder have "targeted" folder which contains the source & Binary policies. If we intend to make any changes to the Policy we have to install the targeted source policy. The default installation will be the Binary policy which is unchangeable. So for changing the policy we have to install the targeted source policy. Again "the default installation of RHEL 4 installs the binary packages."

Need of source Policy installation

1. In order to customize the policy or changing the policy
2. In order to Learn more about the targeted Policy that how it is written.
3. May need to define a policy in case of installation of a new program (which moves the newly installed program to the confined domains in SELinux).

    SELinux which operates in the kernel, processes existing policy, based on binary format in memory, so the source file are not used by the SELinux portion of the kernel.
The "/etc/selinux" folder contains

• targeted/
• config,v
• config

The "Targeted" folder Contains

• booleans  (This file contains the variables for enabling and disabling features on the fly such as cgi enabled apache http_enable_homedirs (refer previous topic) etc)

• policy/ (This Folder contains the actual binary file of the policy called policy.xx(Eg:- "policy.18" RHEL 4)

• contexts/ (This Folder consists of information about the contexts. All the contexts (Tuples) are defined inside this folder. The "file_contexts" file inside the folder "contexts/files" is the key file that actually maintains the relation ship between directories of the files system and how those directories and files should be labeled. Also the file contains the context entries of all sorts of mount points (i.e, how should the the files created in the file system labeled by default).

Installing source policy for Targeted Policy:

# rpm -qa |grep -i selinux

    This will show the selinux-policy-targeted package. This is responsible for the binary policy installation.
For installation of the selinux source policy download the source package of the policy named selinux-policy-targeted-sources.version.rpm .The installation creates the folder called /etc/selinux/targeted/src.
Install the package

# rpm -ivh selinux-policy-targeted.version.rpm
# cd /etc/selinux/targeted/src

 Beneath the /etc/selinux/targeted/src have a directory called "policy" which contains all of the files and directories that pertained to targeted policy.

The "file_contexts" file:
    This file contains the labeling information of all objects and subjects. It uses regular expressions for labeling
the files. check the "/home" definitions in the file to get more idea about the regular expressions used in the file_contexts..
The format used in the file is

" regexp -type context|none "
(types
-d = directory
  -- = file)
Eg:-
/home     -d     system_u:object_r:home_root_t

    The knowledge in this file is useful while creating the new policies.
Another eg:-

/media/[^/]*/.*    none

    This will make no labeling for the mounted object beneath the folder /media (eg:- cdrom mounted inside the /media). In short this file describes how the files in the system should be labeled to take effect of the targeted policy. So if we run the "fixfiles" (Refer previous posts) utility it refers this file for labeling.

RUN_INIT (Process at system boots with respect to SELinux)
    While system boots INIT determines the SELinux support and if found, it creates the process or allocates the space inside the memory with the help of utility called "run_init". "run_init" sets up the programs that are protected by SELinux in to distinct spaces that cannot be overlaped by each other or interacted by other daemons. So this way it increases the system security.

Key Start-up Utility For SELinux-Protected Daemons:
    If we need to restart a daemon, run_init will help that programs to run with in their protected spaces i.e, "run_init" ensures protected daemon isolation. "run_init" has been installed by package named "policycoreutils".

How to Check the process whether its out of context or running correctly with policy defined context:

We will use the apache to check whether the daemon is having the correct context

# ps -axZ |grep httpd
root:system_r:httpd_t    3111    ?    S    0:00    /usr/sbin/httpd

    Here we can see the Tuple/Context as "root:system_r:httpd_t". Here apache is running with the wrong user_id root:.

To change it First kill the process

# kill 3111

Now run the process/httpd daemon using run_init

# /usr/sbin/run_init /etc/init.d/httpd start
    ( This Will promt you for authentication for root user)

        This will start the httpd daemon in the domain that specified in the policy. i.e, the policy enforces the type or honors the type.
Now we check the httpd process again

# ps -axZ |grep httpd
user_u:system_r:httpd_t    5114    ?    S    0:00    /usr/sbin/httpd

    We can see that the apache is up and running with the proper context.

8. SELinux Targeted Policy (RedHat) - III

SELinux Context Definition:
    Here we will discuss about the basics behind roles, types and domains in SELinux. Its important that we have a clear understanding of the three key pieces of information used in the security context Tuple.

Security Context or Tuple:
    A security context or Tuple consist of 2 or more related fields in given row.
eg:- user_u:system_r:unconfined_t
explained in simple word is  "id:first_name:last_name"

Field/Degree 1: USER LABEL
eg:- user_u, root_u etc
In general the first value will be the user value. Usually the non-privilege user will be described as "user_u". However the root user is treated as "root_u". The targeted policy in RHEL is not much more concentrated in the first and second fields

Field/Degree 2: (Role based Access control[RBAC])
    SELinux supports users being the members of Role (same like a typical DAC system where the user belongs to a group). i.e, in this example of Tuple user_u:system_r:unconfined_t & root_u:system_r:unconfined_t  the non privilege & privilege user is having a common role "system_r"

Field/Degree 3: Type/Domain
    It makes a difference whether we apply this to a subject or object. i.e, Type is applied to objects such as files and Domains are applied to Subjects (Programs or users).
Eg:-
Privilege as well as non privilege users are grouped in to unconfined "Type" by default .
For process such as httpd, each process has a domain named after the process with a suffix of "_t" eg:- httpd_t, dhcpd_t