[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    Re: Permissive mode for xace is broken.
From:       Steve G <linux_4ever () yahoo ! com>
Date:       2008-03-24 15:55:13
Message-ID: 729568.16778.qm () web51505 ! mail ! re2 ! yahoo ! com
[Download RAW message or body]



----- Original Message ----
> From: Eamon Walsh <ewalsh@tycho.nsa.gov>
> To: Steve Grubb <sgrubb@redhat.com>
> Cc: Stephen Smalley <sds@tycho.nsa.gov>; Daniel J Walsh <dwalsh@redhat.com>; SE \
>                 Linux <selinux@tycho.nsa.gov>
> Sent: Wednesday, March 19, 2008 11:56:00 PM
> Subject: Re: Permissive mode for xace is broken.
> 
> Steve Grubb wrote:
> > On Thursday 28 February 2008 21:02:28 Eamon Walsh wrote:
> > 
> > > Steve Grubb wrote:
> > > 
> > > > On Thursday 28 February 2008 13:51:05 Stephen Smalley wrote:
> > > > 
> > > > > On Thu, 2008-02-28 at 13:48 -0500, Eamon Walsh wrote:
> > > > > 
> > > > > > Stephen Smalley wrote:
> > > > > > 
> > > > > > > On Mon, 2008-02-25 at 20:12 -0500, Eamon Walsh wrote:
> > > > > > > 
> > > > > > > > Eamon Walsh wrote:
> > > > > > > > 
> > > > > > > > > The X object manager logs all avc's and status messages (including
> > > > > > > > > the AVC netlink stuff) through the audit system using libaudit \
> > > > > > > > > calls (audit_log_user_avc_message, etc.)
> > > > > > > > > 
> > > > Please tell me they have different record types. Also do you have any
> > > > samples that we can look over to make sure they conform?
> > > > 
> > > type=USER_AVC msg=audit(1204226161.048:268): user pid=21267 uid=0
> > > auid=4294967295 subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023
> > > msg='avc:  denied  { read } for request=X11:QueryPointer
> > > comm=/usr/libexec/at-spi-registryd xdevice="Virtual core pointer"
> > > scontext=staff_u:staff_r:staff_t:s0
> > > tcontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tclass=x_device :
> > > exe="/usr/bin/Xorg" (sauid=0, hostname=?, addr=?, terminal=?)'
> > > 
> > 
> > comm & xdevice are not escaped the right way. exe is. The audit utilities are 
> > expecting the comm field to be comm="/usr/libexec/at-spi-registryd" in this 
> > case. The standard has been untrusted fields have " " enclosing the field. 
> > Whenever there is a space, double quote, or control character, its ASCII HEX 
> > encoded with no quotes. xdevice is not a field that the audit system knows 
> > about, so we could do something different with it, but comm is known for a 
> > long time and has to follow the standards.
> > 
> 
> Why can't libaudit automatically perform this escaping?

Well, it could. However, this is the API that you currently have:

extern int audit_log_user_avc_message(int audit_fd, int type,
        const char *message, const char *hostname, const char *addr,
        const char *tty, uid_t uid);

The whole avc from msg=  up to the exe= statement comes from libselinux. So, \
libselinux has to do the escaping unless we build a better API for selinux use. I \
could probably expose the function that does the escaping, but I had really wanted to \
try to maintain some consistency in the event by API.


> That way we avoid promulgating this "standard" into every caller of libaudit.
> 
> If everything is going to be name-value based, then I want a libaudit 
> function that takes a list of name/value pairs.

SE Linux is the only user of the audit system that does not follow the name=value \
standard. Would you (and the community) really be willing to convert selinux over to \
that if we have the API for it?  Do you have any suggestions about how you'd like to \
see the new API implemented?


> > Also, is there any information about who caused the event? uid, auid, gid? 
> > Even though this was a denied action, what is the results? Were they 
> > successful (permissive) or was it really a failed and denied request?
> > 
> 
> I don't understand this last part with the result of the action.  How am 
> I supposed to specify this?

res=0 for failed and res=1 for success even though the action was denied. Admittedly, \
the audit avc API does not require this from SE Linux, but I could fix that if we \
change the API to something around name value pairs.


> I need to modify libselinux (again) to support all of this extra uid and 
> hostname stuff getting passed into the logging callback.

Yes, CAPP and other CC protection profiles require that sufficient information be \
logged to determine who did the action that was denied or granted. 

 
> > Would it make sense to fill in the workspace:window information for the 
> > terminal? If X is being used remotely, is the addr & hostname fields correct?
> > 
> 
> The X server has a terminal that it runs on, /dev/tty7 or whatever.  The 
> desktop workspaces and gnome-terminal/xterm pseudo-tty's are external to 
> the X server and it doesn't know about them.

So, should we also make a new field that logs the workspace:window that a request \
came from?

Thanks,
-Steve





      ____________________________________________________________________________________
 Never miss a thing.  Make Yahoo your home page. 
http://www.yahoo.com/r/hs

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.


[prev in list] [next in list] [prev in thread] [next in thread]