Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Any documentation on systemd and selinux ?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
wichtounet
Tux's lil' helper
Tux's lil' helper


Joined: 17 Mar 2012
Posts: 116

PostPosted: Fri May 08, 2015 7:48 pm    Post subject: Any documentation on systemd and selinux ? Reply with quote

Hello Gentoo folks :)

I started installing a new server following the Gentoo hardened information and it works well for now with SELINUX in permissive mode. However, I have a lot of denial that seems related to selinux and I don't find any information on how to work with the two together.

Here are some examples of denials I have:

Quote:
avc: denied { search } for pid=3481 comm="systemd-journal" name="4119" dev="proc" ino=10406 scontext=system_u:system_r:init_t tcontext=staff_u:sysadm_r:sysadm_sudo_t tclass=dir permissive=1
avc: denied { read } for pid=3481 comm="systemd-journal" name="cgroup" dev="proc" ino=9616 scontext=system_u:system_r:init_t tcontext=staff_u:sysadm_r:sysadm_sudo_t tclass=file permissive=1
avc: denied { open } for pid=3481 comm="systemd-journal" path="/proc/4119/cgroup" dev="proc" ino=9616 scontext=system_u:system_r:init_t tcontext=staff_u:sysadm_r:sysadm_sudo_t tclass=file permissive=1
avc: denied { getattr } for pid=3481 comm="systemd-journal" path="/proc/4119/cgroup" dev="proc" ino=9616 scontext=system_u:system_r:init_t tcontext=staff_u:sysadm_r:sysadm_sudo_t tclass=file permissive=1
avc: denied { read } for pid=3481 comm="systemd-journal" name="exe" dev="proc" ino=9618 scontext=system_u:system_r:init_t tcontext=staff_u:sysadm_r:sysadm_sudo_t tclass=lnk_file permissive=1
avc: denied { write } for pid=4119 comm="sudo" path="/run/systemd/sessions/2.ref" dev="tmpfs" ino=9130 scontext=staff_u:sysadm_r:sysadm_sudo_t tcontext=system_u:object_r:init_var_run_t tclass=fifo_file permissive=1
avc: denied { sendto } for pid=4046 comm="systemd-network" path="/run/systemd/notify" scontext=system_u:system_r:init_t tcontext=system_u:system_r:init_t tclass=unix_dgram_socket permissive=1


Have I missed something in the installation ?

Another question with this kind of denial:

Quote:
avc: denied { use } for pid=4119 comm="sudo" path="/dev/pts/0" dev="devpts" ino=3 scontext=staff_u:sysadm_r:sysadm_sudo_t tcontext=system_u:system_r:init_t tclass=fd permissive=1


I have read that it is necessary to put tmpfs/devpts and other non-physical file systems in fstab for selinux, but in my case, it is systemd that is mounting them. What do I have to do to fix this ?

This is my first functional selinux system, so maybe there is something trivial that I forgot, don't hesitate to point me out to docs.

Thanks a lot :)
Back to top
View user's profile Send private message
gienah
Developer
Developer


Joined: 24 Nov 2010
Posts: 211
Location: AU

PostPosted: Mon May 11, 2015 3:43 am    Post subject: Reply with quote

If you like you could join the effort to create a selinux systemd policy, the repo
is linked from the email thread linked from comment 1 of the tracker:

https://bugs.gentoo.org/show_bug.cgi?id=528674

Or the other alternative, since it appears that the selinux systemd policy is not ready yet:

https://bugs.gentoo.org/show_bug.cgi?id=508390#c5

is to switch to OpenRC.
Back to top
View user's profile Send private message
wichtounet
Tux's lil' helper
Tux's lil' helper


Joined: 17 Mar 2012
Posts: 116

PostPosted: Wed May 20, 2015 6:22 am    Post subject: Reply with quote

gienah wrote:
If you like you could join the effort to create a selinux systemd policy, the repo
is linked from the email thread linked from comment 1 of the tracker:

https://bugs.gentoo.org/show_bug.cgi?id=528674

Or the other alternative, since it appears that the selinux systemd policy is not ready yet:

https://bugs.gentoo.org/show_bug.cgi?id=508390#c5

is to switch to OpenRC.


Thanks for your answer. I assumed that systemd policy would be complete since so many people are using it now, but it seems I was too optimistic :oops:

It is my first system every with selinux, I'm probably not a good candidate to help with creating the policy. OpenRC is not an option on this server. I'm gonna try seeing what I can do with audit2allow for starter.

Thanks
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum