http://selinuxnews.org/planet/ Planet SELinux - http://selinuxnews.org/planet/ http://etbe.coker.com.au/2010/03/08/designing-secure-linux/ <h3>The Threat</h3> <p><a href="http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html">Bruce Schneier&#8217;s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]</a>. Note that the threat is considered to be remote attackers, that means viruses and trojan horses &#8211; which includes infected files run from USB devices (IE you aren&#8217;t safe just because you aren&#8217;t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it &#8211; a typical computer user is at risk of theft only for the resale value of a second-hand computer.</p> <p>So the question is, how do can we most effectively use free software to protect against such threats?</p> <p>The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a <a href="http://en.wikipedia.org/wiki/Trusted_Platform_Module">TPM</a> seem unlikely to provide a useful benefit due to the TPM being designed more for <a href="http://en.wikipedia.org/wiki/Digital_rights_management">Digital Restrictions Management</a> than for protecting the user &#8211; and due to TPM not being widely enough used.</p> <h3>The BIOS and the Bootloader</h3> <p>It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it&#8217;s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. <a href="http://www.coreboot.org/Welcome_to_coreboot">Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2]</a> (the <a href="http://en.wikipedia.org/wiki/Coreboot">Coreboot Wikipedia page has a good summary</a>). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards.</p> <p>If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don&#8217;t want to upgrade the BIOS.</p> <p>One of the payloads for Coreboot is GRUB. <a href="http://grub.enbug.org/FeatureRequests">The Grub Feature Requests page has as it&#8217;s first entry &#8220;Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs&#8221; [3]</a>. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel.</p> <h3>How to run User Space</h3> <p>The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it&#8217;s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don&#8217;t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can&#8217;t be run against a kernel that has direct hardware access.</p> <p>It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as <a href="http://en.wikipedia.org/wiki/Xen">Xen</a> or <a href="http://en.wikipedia.org/wiki/Kernel-based_Virtual_Machine">KVM</a>. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the <a href="http://en.wikipedia.org/wiki/NetTop">NSA NetTop project</a>, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it.</p> <p>One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has <a href="http://en.wikipedia.org/wiki/Iommu">IOMMU</a> support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free.</p> <h3>Maintaining the Virtual Machine Image</h3> <p><a href="http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening">Google has a good design for the ChromiumOS in terms of security [4]</a>. They are using <a href="http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/">CGroups [5]</a> to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well.</p> <p>For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the &#8220;console&#8221;) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed.</p> <p>The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn&#8217;t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) &#8211; but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best.</p> <p>Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don&#8217;t want any part of the virtual machine to be able to write to it&#8217;s data files or programs. So if the user selects to install a new application then the request &#8220;please install application X&#8221; would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it&#8217;s something that MS-Windows users have become used to &#8211; but it would get a negative reaction from the more skilled Linux users.</p> <h3>Would this be Accepted?</h3> <p>The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don&#8217;t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don&#8217;t need it.</p> <p>At this time it seems that computer security isn&#8217;t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.</p> <ul> <li>[1]<a href="http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html"> http://www.schneier.com/blog/archives/2010/03/mariposa_botnet.html</a></li> <li>[2]<a href="http://www.coreboot.org/Welcome_to_coreboot"> http://www.coreboot.org/Welcome_to_coreboot</a></li> <li>[3]<a href="http://grub.enbug.org/FeatureRequests"> http://grub.enbug.org/FeatureRequests</a></li> <li>[4]<a href="http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening"> http://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/system-hardening</a></li> <li>[5]<a href="http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/"> http://lxr.linux.no/linux+v2.6.30/Documentation/cgroups/</a></li> </ul> 2010-03-08T05:05:22+00:00 etbe http://etbe.coker.com.au/2010/03/04/opera-trust-applications-vs-servers/ <h3>The Opera-Mini Dispute</h3> <p><a href="http://counternotions.com/2010/02/18/mini/">I have just read an interesting article about the Opera browser [1]</a>. The article is very critical of Opera-Mini on the iPhone for many reasons &#8211; most of which don&#8217;t interest me greatly. There are lots of technical trade-offs that you can make when designing an application for a constrained environment (EG a phone with low resolution and low bandwidth).</p> <p>What does interest me is the criticism of the Opera Mini browser for proxying all Internet access (including HTTPS) through their own servers, this has been getting some traction around the Internet. Now it is obvious that if you have one server sitting on the net that proxies connections to lots of banks then there will be potential for abuse. What apparently isn&#8217;t obvious to as many people is the fact that you have to trust the application.</p> <h3>Causes of Software Security Problems</h3> <p>When people think about computer security they usually think about worms and viruses that exploit existing bugs in software and about Trojan horse software that the user has to be tricked into running. These are both significant problems.</p> <p>But another problem is that of malicious software releases. I think that this is significantly different from Trojan horses because instead of having an application which was written for the sole purpose of tricking people (as is most similar to Greek history) you have an application that was written by many people who genuinely want to make a good product but you have a single person or small group that hijacks it.</p> <p>Rumor has it that rates well in excess of $10,000 are sometimes paid for previously unknown security vulnerabilities in widely used software. It seems likely that a programmer who was in a desperate financial situation could bolster their salary by deliberately putting bugs in software and then selling the exploits, this would not be a trivial task (making such bugs appear to be genuine mistakes would take some skill) &#8211; but there are lots of people who could do it and plausibly deny any accusation other than carelessness. There have been many examples of gambling addicts who have done more foolish things to fund their habit.</p> <p>I don&#8217;t think it&#8217;s plausible to believe that every security flaw which has been discovered in widely used software was there purely as the result of a mistake. Given the huge number of programmers who have the skill needed to deliberately introduce a security flaw into the source of a program and conceal it from their colleagues I think it&#8217;s quite likely that someone has done so and attempted to profit from it.</p> <p>Note that even if it could be proven that it was impossible to profit from creating a security flaw in a program that would not be sufficient to prove that it never happened. There is plenty of evidence of people committing crimes in the mistaken belief that it would be profitable for them.</p> <h3>Should We Trust a Proprietary Application or an Internet Server?</h3> <p>I agree with the people who don&#8217;t like the Opera proxy idea, I would rather run a web browser on my phone that directly accesses the Internet. But I don&#8217;t think that the web browser that is built in to my current smart-phone is particularly secure. It seems usual for a PC to need a security update for the base OS or the web browser at least once a year while mobile phones have a standard service life of two years without any updates. I suspect that there is a lot of flawed code running on smart phones that never get updated.</p> <p>It seems to me that the risks with Opera are the single point of failure of the proxy server in addition to the issues of code quality while the risks with the browser that is on my smart-phone is just the quality of the code. I suspect that Opera may do a better job of updating their software to fix security issues so this may mitigate the risk from using their proxy.</p> <p>At the moment China is producing a significant portion of the world&#8217;s smart-phones. Some brands like LG are designed and manufactured in China, others are manufactured in China for marketing/engineering companies based in Europe and the US. <a href="http://www.faluninfo.net/">A casual browse of information regarding Falun Gong makes the character of the Chinese leadership quite clear [2]</a>, I think that everything that comes out of China should be considered to be less trustworthy than equivalent products from Europe and the US. So I think that anyone who owns a Chinese mobile phone and rails against the Opera Mini hasn&#8217;t considered the issue enough.</p> <p>I don&#8217;t think it&#8217;s possible to prove that an Opera Mini with it&#8217;s proxy is more or less of a risk than a Chinese smart-phone. I&#8217;m quite happy with my <a href="http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/">LG Viewty [3]</a> &#8211; but I wouldn&#8217;t use it for Internet banking or checking my main email account.</p> <p>Also we have to keep in mind that mobile phones are really owned by telephone companies. You might pay for your phone or even get it &#8220;<b>unlocked</b>&#8221; so you can run it on a different network, but you won&#8217;t get the custom menus of your telco removed. Most phones are designed to meet the needs of telcos not users and I doubt that secure Internet banking is a priority for a telco.</p> <p><b>Update:</b> You can buy unlocked mobile phones. But AFAIK the Android is the only phone which might be described as not being designed for the needs of the telcos over the needs of the users. So while you can get a phone without custom menus for a telco, you probably can&#8217;t get a phone that was specifically designed for what you want to do.</p> <h3>The Scope of the Problem</h3> <p>Mobile phones are not the extent of the problem, I think that anyone who buys a PC from a Chinese manufacturer and doesn&#8217;t immediately wipe the hard drive and do a fresh OS install is taking an unreasonable risk. The same thing goes for anyone who buys a PC from a store where it&#8217;s handled by low wage employees, I can imagine someone on a minimum income accepting a cash payment to run some special software on every PC before it goes out the door &#8211; that wouldn&#8217;t be any more difficult or risky than the employees who copy customer credit card numbers (a reasonably common crime).</p> <p>It&#8217;s also quite conceivable that any major commercial software company could have a rogue employee who is deliberately introducing bugs into it&#8217;s software. That includes Apple. If the iPhone OS was compromised before it shipped then the issue of browser security wouldn&#8217;t matter much.</p> <p>I agree that having the minimum possible number of potential security weak points is a good idea. They should allow Opera Mini users to select that HTTPS traffic should not be proxied. But I don&#8217;t think that merely not using a proxy would create a safe platform for Internet banking. In terms of mobile phones most things are done in the wrong way to try and get more money out of the users. Choose whichever phone or browser you want and it will probably still be a huge security risk.</p> <p><a href="http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch">Harald Welte is doing some really good work on developing free software for running a GSM network [4]</a>. But until that project gets to the stage of being widely usable I think that we just have to accept a certain level of security risk when using mobile phones.</p> <ul> <li>[1]<a href="http://counternotions.com/2010/02/18/mini/"> http://counternotions.com/2010/02/18/mini/</a></li> <li>[2]<a href="http://www.faluninfo.net/"> http://www.faluninfo.net/</a></li> <li>[3]<a href="http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/"> http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/</a></li> <li>[4]<a href="http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch"> http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch</a></li> </ul> 2010-03-04T13:41:31+00:00 etbe http://thetoms-random-thoughts.blogspot.com/2010/03/new-restful-fuzzer-and-ror-code-scanner.html <p>To better update my code and to improve collaboration I pushed my code to <a href="http://www.gitorious.org/">gitorious</a>.<br /><!-- BlogCounter Code START --></p><ul><li>fuzz-cmdline: Unix command-line tool fuzzer: <a href="http://gitorious.org/fuzzer/fuzz-cmdline">http://gitorious.org/fuzzer/fuzz-cmdline</a></li><li>fuzz-xmlrpc: XML-RPC, RESTful, HTTP file upload, POST/PUT URL fuzzer: <a href="http://gitorious.org/fuzzer/fuzz-xmlrpc">http://gitorious.org/fuzzer/fuzz-xmlrpc</a><br /></li><li>ror-sec-scanner: Ruby on Rails source-code vulnerability scanner: <a href="http://gitorious.org/code-scanner/ror-sec-scanner">http://gitorious.org/code-scanner/ror-sec-scanner</a></li></ul><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-4989369607950802009?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2010-03-01T00:36:50+00:00 Thomas (noreply@blogger.com) http://d.hatena.ne.jp/kaigai/20100227 <div class="section"> <p>Mixiからの転載</p> </div> 2010-02-26T22:40:09+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267222854 <div class="section"> <p>最終デンマーク戦を観戦して、King Edwards駅から Canada Train で Richmond Brighouse駅へ </p> <p>そして、バスで宿へ帰る。この時間帯、帰りのバスである410系統は30分毎なので、結構待つ </p> <p>事になる。 </p> <p>しばらくすると、バスがやってきた。401系統…だめぽ。 </p> <p>またしばらくすると、バスがやってきた。403系統…だめぽ。 </p> <p>さらに、バスがやってきた。NOT IN SERVICE…だめぽ、と思ったら、運転手が </p> <p>『お前ら、何のバス待ってるんだ？』 </p> <p>「410」 </p> <p>「410」 </p> <p>「402」 </p> <p>「410」 </p> <p>『よし、俺に任せろ』 </p> <p>という事で、そのバスは410系統に早代わり。カナダのバスってフリーダムなのねｗｗｗｗ </p> <p>宿に帰ると、もう疲れ果てたって感じ。 </p> <p>風呂に入る。欧米の風呂はシャワーを浴びるように作られているが、知らん。風呂だ風呂。お湯を張って久々にリラックス。 </p> <br /> <p>翌朝、宿のオーナーがバンクーバ国際空港まで送ってくれることになっていたので、そそくさと荷造り。まだ全身的な倦怠感は残る。 </p> <p>飛行機の中は結構冷えるので、観戦中に来ていたバイク用のオーバーパンツを着込む。 </p> <p>Richmondから空港に向かう間、スピードスケートの会場、Olympic ovalが見える。 </p> <p>高速道を走り、五輪のモニュメントを脇目に、空港が見えてくると、もう一度、この場所を訪れることがあるかなーと、ちょっと感慨に浸る。 </p> <p>空港で遅い朝ごはん。なんせ、昨日の夕方から何も食べてないので本当に腹ペコ。 </p> <p>何か文化侵略くさいレストラン（写真）があるが、ピザとかハンバーガーもねーだろという事で、チャーハンと酢豚と麻婆豆腐のセットを頼む。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100225042556" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100225/20100225042556.jpg" alt="f:id:kaigai:20100225042556j:image:w320" title="f:id:kaigai:20100225042556j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>セキュリティチェックを抜けて、職場その他へのお土産品を探す。 </p> <p>おや、オリンピック公式ショップが。そういえば、みっちゃさんにカウベルを探しといてと </p> <p>頼まれてた事を思い出すと…あった。即購入。 </p> <p>その他、メープルシロップのお菓子等を購入して５３番搭乗口へ。 </p> <p>まだしばらく時間がある。眠い。気がつくと、ソファに横になってて、搭乗時間の５分前だった。 </p> <p>わさわさと機内に乗り込む。 </p> <p>機内ではひたすら寝るのと、読書と、あとMixiの日記を書いてたｗ </p> <p>帰りの機内では『FREE-無料からお金を生み出す新戦略-』を読了 </p> <p>興味深い視点が提起されていた。これはまたどっかでレビュー書きたい。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100225091925" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100225/20100225091925.jpg" alt="f:id:kaigai:20100225091925j:image:w320" title="f:id:kaigai:20100225091925j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>エアカナダの機内食はこんな感じ（写真）。</p> <p>普段JALユーザの俺様には貧相に見えるけど、普通のエコノミーだとこんなもんかな？ </p> <p>たださすがに、JALの機内食とエアカナダの機内食の間に、３〜４万円の価値の差は見出せない。 </p> <p>成田に到着。総武線が信号故障の影響で成田エキスプレスの運転再開の目途が立っていないらしい。 </p> <p>まぁ、安いしスカイライナーで帰るか。日暮里乗換えで、目黒から東急線。 </p> <p>西小山に帰って、いつもの駅前の定食屋で肉野菜炒めライスを注文。 </p> <p>なんか帰ってきた実感がする。 </p> <p>疲れた。本格的に風邪をひかないよう、ビタミンウォーターを購入して帰宅。 </p> <p>畳の上の布団は素晴らしい。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100226175828" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100226/20100226175828.jpg" alt="f:id:kaigai:20100226175828j:image:w320" title="f:id:kaigai:20100226175828j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>写真はお土産の一部。まだ部屋の片付けとか、CASの景品一覧のぶんたまさんへの送付とか色々あるけど、とにかく疲れた。寝る。 </p> <p>以上、KaiGaiのバンクーバ訪問珍道中でした。</p> </div> 2010-02-26T22:20:54+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267222853 <div class="section"> <p>２月２３日　１９：００　vs デュポン姉妹率いるデンマーク戦 </p> <p>今回の観戦ツアーの最後の試合であり、既に予選敗退が決まった日本代表チームにとっても、 </p> <p>バンクーバ五輪での最後のゲームである。バグパイプの演奏に先導されて入場してくる選手達。感慨深い。 </p> <p>試合前、カーラー各位のメッセージを書いた国旗をポールに結んでいたところ、実況席の小林さんに発見され、記念の一枚。残り試合も解説頑張って下さい。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224111730" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224111730.jpg" alt="f:id:kaigai:20100224111730j:image:w320" title="f:id:kaigai:20100224111730j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>試合開始。 </p> <p>1END/2ENDは静かな攻防。 </p> <p>試合が動いたのは3END。相手のスルーを契機に、テイクの打ち合いからガードを配してのゲームになる。だが、本橋さんのガードが僅かストーン半個ずれたのを見逃してくれず、ダブルテイクアウトで局面がひっくり返る。そして目黒さん、痛恨のスルー。 </p> <p>見てたのは横からだけど、ちょっと幅に対してウェイトが強かった気がする。 </p> <p>最後にドローをきっちり置かれて０−３。ありゃりゃ。 </p> <p>4ENDも、目黒さんの１投目でロールしたかったけども、反対方向に流れて３点ならず。 </p> <p>２点返して２−３。おっしゃまだまだ。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224124653" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224124653.jpg" alt="f:id:kaigai:20100224124653j:image:w320" title="f:id:kaigai:20100224124653j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>5END、途中で相手のダブルテイクアウトもあったり、タップバックがずれたりと、緊迫した場面もあったけど、目黒さんがポケットにきっちりフリーズを決めて、１点取らせて２−４。 </p> <p>6END、中継を見れなかった人にはイマイチラストショットの意図が分からなかったとの事。</p> <p>これは目黒さん、完全に３点を取ろうとしたショットでした。本橋さんの２投目、自身の１投目が完全にティー前を支配できず、微妙にNo.2/4だったので、相手のNo.1を押して自分のNo.2を押し、相手はピールアウトさせつつ、押したNo.2で相手No.3をアウトにしようという作戦。 </p> <p>角度が完璧なら自分のNo.4は動かないので、もし自分がスキップでも同じ選択をしたと思う（成功するかどうかは置いておいてｗ） </p> <p>ただ、ちょっとウェイトが強すぎて、自分のNo.4ストーンにまで接触してしまった。 </p> <p>ノーマルダウンくらいのウェイトで、微妙なアングルの調整はスイーパーに任せた方が上手く行ったかも。何はともあれ、同点に追いつく。４−４ </p> <p>7END、クリーンな展開を保ってブランク。綺麗にセンターガードを置けたんだけども、ロールする方向が逆になったり、ステイしたりと、なかなかジャムな展開を作れない。 </p> <p>まずいな．．．偶数エンドでの後攻を取られたぞ。 </p> <p>8END。石崎さんのショットは結果論ながら綺麗なダブルセンターガードの形になる。 </p> <p>先攻だけども結構期待できる…が、山浦さんのカマーが前を割ってしまった。 </p> <p>前後に距離のあるセンターガードだと、カマー合戦になりがちなので、スチールの展開もアリかと思ったが…。 </p> <p>山浦さん２投目、本橋さん２投目でダブルテイクアウトを狙うも決まらず。</p> <p>この辺、微妙な、それこそ数cmのレベルのコントロールで相手に分があった気がする。 </p> <p>目黒さんのラストショット、観客席からの視点だと思わず『やめて！萌絵ちゃん！』と叫びたいくらいのアクロバティック 赤→赤→黄→黄 のアングル・レイズ・ダブルテイクアウト </p> <p>でも、ここでうまく処理できないと、３点を献上した上に、10END先攻という展開。</p> <p>『がんばれ！目黒！』と祈るが、無情にもアングルがついた当たり方で、相手のストーンを動かすことはできず。嗚呼、４−７ </p> <p>9END、そりゃ逃げにかかるよな…。 </p> <p>結局、折角の後攻も１点を取らされる形に。 </p> <p>ただ、２点スチールと、３点後攻と、難易度的には変わらないかも。 </p> <p>応援席も一段とボルテージが上がって『日本！』コール。既に試合の終わったカナダの応援団も混じって『NIPPON!!』コール。まるでホーム会場のようだ。 </p> <p>10END、なんとか２点を取りたいところだが．．．． </p> <p>あぁぁぁぁ、、、石崎さんの置いたガードが見事にウィックでずらされた。なんて憎々しい。 </p> <p>目黒さん、なんとか反転攻勢をしようとガードを置くが、ことごとくヒットで打たれて、刻々と残り少なくなっていくストーン。</p> <p>本橋さんは相手ストーンの裏にカマーを試みるも、ヒットできる位置。目黒さんの２投目もカマーすることができず、これを弾かれたところでコンシード。残念！ </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224145031" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224145031.jpg" alt="f:id:kaigai:20100224145031j:image:w320" title="f:id:kaigai:20100224145031j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>これで、チーム青森のバンクーバオリンピックは終わり。 </p> <p>試合が終わった後、静けさを取り戻したシートの周りを名残惜しそうにぐるりと一週歩いて、観客席の各区画ごとに応援へのお礼をしていた目黒さん・本橋さんの姿が印象的でした。 </p> <br /> <p>観客席からは「ありがとう！」「胸張って日本へ帰って来いよ！」の声 </p> <p>外野からは色々とノイズが聞こえてくるかもしれないけども、チーム青森が全国のカーラーの代表として世界の競合と全力を尽くして戦ったという事は、なんら恥じることの無い事実。</p> <p>３勝６敗（８位）という成績だったのは、勝負の時の運もあるし、100%の力でぶつかり合った結果の力不足という事もあるだろう。 </p> <p>誰のミスがどーのこーのとか、そういうのはコーチなり協会なりがきちっと分析して、今後の強化方針にフィードバックすれば良いだけ。 </p> <p>自分としては、わざわざ地球の裏側に出向いてまでその場の空気の中でゲームを見る事ができたというだけでも、素晴らしい経験だったように思う。 </p> <p>チーム青森／チーム日本に拍手！！</p> </div> 2010-02-26T22:20:53+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267222852 <div class="section"> <p>厳密に言うと、これは出発前の記録でもあるわけだが。 </p> <p>プロデュースド by せりあさんによる、女子カーリング『日本 vs イギリス』の観戦イベントに参加、その足で成田空港に向かっているNEXの車内でこの日記を書いている。 </p> <p>六本木のシダックスに参集、およそ20数名程度が集まって応援。 </p> <p>今日は土曜日の12:30〜ＮＨＫ総合での生中継と、まさにバンクーバ五輪を通して、最も多くの人に観戦の機会があったゲームではなかろうか。 </p> <p>（さすがに平日2:00AMとか7:00AMは厳しいよね・・・） </p> <p>放送時間の関係で３ＥＮＤ、日本１−０英国で日本先攻の場面から。 </p> <p>目黒のラストショットでピールアウトになってしまうミスが出たものの、 英国スキップエヴァ・ミューヘッドのラストもピールできずステイ。</p> <p>１点取らせる事に成功。 </p> <p>後攻の４ＥＮＤ、相手のラストはNo.1/2を確保しに行くドローだったが、ウェイト強く若干奥に行ってしまう。No.1/2ではあるが、距離近くダブルテイクアウトが可能な位置。 </p> <p>目黒さんの本来の作戦は、左→右と当てて両方を出す狙いだったんだろうけど、少しワイドに出て右→左に当たって３点。 </p> <p>前にある石を避けるタイトなラインを狙わなくちゃいけないから、ナローにだけは出ちゃいけないという心理だったのかな…。非常によく理解できる（笑 </p> <p>５ＥＮＤは２点返されて、４−３とリード、後攻を持っておやつタイムに。 </p> <p>前の中国戦ではイマイチというか、いま二つだった近江屋さんが後半に素晴らしい働きを見せる。何ＥＮＤだったか少し定かじゃないけども、狭いラインをジャストのウェイトで通してセンター近くのストーンに当てて、石半個分をずらすロールとかがビシビシ決まっていたので、目黒さんも楽だったんじゃないかと思う。 </p> <p>（あ、しかし一本ヌルーがあったような…。） </p> <p>後半はかなりタイトなライン取りを要求するショットが沢山あったけども、チームＪＡＰＡＮの精度が神がかり的。本橋さんのダブルテイクアウトとか、目黒さんのレイズテイクアウトとか、完全にお腹一杯です本当にありがとうございました状態。 </p> <p>６ＥＮＤは少し英国に形を作られたものの、目黒さんのこれぞスキップというドローで１点。事なきを得る。５−３ </p> <p>７ＥＮＤ、確か本橋さんが長距離のダブルテイクアウトとか、近江屋さんの神ロールがあり、最終的に１点スチール。６−３ </p> <p>８ＥＮＤ、英国には非常に難しい陣形に。センターの日本のストーンの後ろに、英国、さらに日本の石が団子状態。しかも、前はがっちりガード。 </p> <p>これを見ていたぶんたまさん、１点スチールは間違いないと信じてトイレに。 </p> <p>だが、英国はここで信じられない（Amazing!）なショットを選択。10時方向の石にヒットさせ、ストーンの方向を変えてセンターに。見事ヒット！ </p> <p>微妙に最後のストーンが中心に近く、英国が一点を返して６−４ </p> <p>後攻の９ＥＮＤ、日本としてはこのエンドブランクでも良いはずだけど、盤面がゴチャゴチャしはじめる。スキップ目黒のラスト１投を残した段階で、相手にNo.1/2。ガードストーンに守られている。最後のＥＮＤで後攻ということを考えても、２点までなら取られても大丈夫な場面。 </p> <p>俺なら3/4は見えている相手No.2を10時方向から押して、ダブルで出せたら儲けもの。残して相手に１点でもいいやと思いそうな場面（しかも目黒さんは左利きだし）。 </p> <p>しかし、目黒さんの選択は、味方の石をピンポイントで押して、相手のNo.1/2の両方を弾き出す Amazing! Amazing! Amazing! な一投。狙って本当に決めてしまうのがすごい。 </p> <p>ニュースなんかでは『大量５点を奪って突き放した』という書き方が多いけれども、これ、実際はそこに至る試合展開の中で、英国に対して大量失点のリスクを犯してでも先攻でスチールを狙わざるを得ないという流れを作ったという事だわな。 </p> <p>マジで見ごたえのある神ゲーム。そして、土曜日の午後という、日本の視聴者に優しい時間帯にＮＨＫの地上波でこのゲームを放映できた意味は限りなく大きいように思う。 </p> <p>実はこの試合、（ドメスティックに）解説はぶんたまさんがしていて、小林さんの解説はあまり聞けてなかったんだけど </p> <p>『カーリング』コミュニティ『【ネタバレ】予選 イギリス戦』トピックでの書き込み </p> <blockquote> <p>今日の小林さん </p> <p>序盤「カーリングが分からない人のために解説する（キリッ」 </p> <p>中盤「相手の国のためにも中立に解説する（キリッ」 </p> <p>終盤「イエース！イエース！イエーーーーーーース！！！！」 </p> <p>たすけてｗｗｗｗｗｗｗｗｗｗｗ </p> </blockquote> <p>これは見てみたいｗｗｗｗ </p> <br /> <p>試合終了後は、六本木から地下鉄で東京駅。NEXに乗って成田空港に。 </p> <p>19:00成田発バンクーバ行きのAirCanada便に搭乗。普段はJALでごじゃるので、第一ターミナルは確か初体験だったような気がする。 </p> <p>一応、夜に出て朝に着く予定のフライトなので、機内では睡眠を心がける。 </p> <p>「青森ドロップキッカーズ」読了。機内食を食べてみて、JALは頑張ってるんだなぁというのを実感。 </p> <p>翌、現地時間の10:56に現地に到着。ブリティッシュ・コロンビアの島の上を通過し、入り組んだ海岸線の奥に広がるバンクーバの町並みは綺麗。 </p> <p>雨が多いと聞いていたが、現地は雲一つない快晴。 </p> <p>日本時間では朝。ちーと眠いが、これから宿からカーリングの行われている Vancouver Olympic Center へ公共交通機関を使って行く予行練習。 </p> <p>あと、ダウンタウンで飯を食うことにしよう。この辺、コンビニの一つもないのよね。住宅街だし。</p> </div> 2010-02-26T22:20:52+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267222204 <div class="section"> <p>翌２３日は、私のオリンピック観戦の最終日。 </p> <p>疲れは残っているが、少し厚着をして観戦に臨めば、破滅的な状況にはなるまい。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224015049" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224015049.jpg" alt="f:id:kaigai:20100224015049j:image:w320:left" title="f:id:kaigai:20100224015049j:image:w320:left" class="hatena-fotolife hatena-image-left" width="320" /></a></p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224021558" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224021558.jpg" alt="f:id:kaigai:20100224021558j:image:w320" title="f:id:kaigai:20100224021558j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>朝７時に目が覚め、準備して7:55頃出立。一昨日の経験からすれば、これできちんと </p> <p>1ENDから観戦できるはず・・・甘かった。 </p> <p>入り口のセキュリティチェック待ちで長蛇の列が。結局、入場できたのは9:10頃。 </p> <p>これで、9:00〜の試合は２回とも遅刻という事になるが、前回は逆転勝利を収めたロシア戦。</p> <p>ゲン担ぎという事で前向きに考える。 </p> <p>実はスウェーデン戦はかなり疲労困憊だったので、写真を撮るのを忘れていた。 </p> <p>体調的には実はそれくらい辛かった。。。。 </p> <p>でも、試合の要点は忘れないうちに書いておくのだ。 </p> <p>まず、最初のポイントは3END </p> <p>相手がNo.1-3まで持っている状況で、目黒さんの選択は、ちょい強めのドローウェイトで僅かに押せる可能性のあるNo.4ストーンを軽く押してハウス中心部に。 </p> <p>このショットが決まった瞬間、このエンドはスチールだと思った。いやマジで。 </p> <p>でも、ノルベリは自分のストーンにアングルを付けて当て、背後の日本No.1をピールアウト。 </p> <p>何が起こったのか、正直よくわからんかった。 </p> <p>が、これでスウェーデン３点。かなりまずい状況。 </p> <p>ただ、中盤の5END/6ENDは立ち直ってゲームの展開を支配していた。 </p> <p>5END。ダブルセンターガードからジャムな展開を作り、相手サードのドローがショートしてバイターの位置で止まったところで、目黒さんのショットが決まってNo.1-3 </p> <p>相手に１点取らせて後攻をゲト </p> <p>6END。途中、相手のストーンがハウスに溜まるいやな展開になりかけたが、本橋さんのフリーズが決まって、相手はそれを出し切れず。ノルベリに際どい場所に置かれるものの、目黒さんも丁寧に叩いて味方の石を出すことなくステイ。３点返す！５−６！ </p> <p>次の7END、目黒さん最後のショットで痛恨のスルー。これ、現地ではよく分からなかったんだけど、ニュースでは何かゴミを噛んだとか言っていた。痛すぎる。。。 </p> <p>確かに、ほぼ満員の会場で、防寒着の綿とかが結構飛んでいた。クリーンは重要。 </p> <p>ただ、角度的にはかなり難しい所（スウェーデンNo.1ステイの可能性も高い）だから、ティー奥のスウェーデンの石にくっつけても良かったとは思うんだな。 </p> <p>事実上、これでゲームは決まったみたいな感じ。 </p> <p>逃げ切りにかかるスウェーデン、こっちがガードを置いてもウィックで外しにかかるし。 </p> <p>うわー、見てて憎々しい。でも上手ぇ。 </p> <p>シートのギリギリに飛ぶけど、アウトにならない絶妙なショット。 </p> <p>コーナーガードを基点になんとか組み立てようとするも、要所でダブルテイクアウト…。 </p> <p>結局、9END終了時点で10-6。点差はかなり絶望的なんだけど、チームで長い相談の後、目黒さん、最後の可能性がある限りは試合を続けることを決断。 </p> <p>隣のシートでは、スイスが5ENDくらい連続でスチールして早々に米国を下している。 </p> <p>そういった事も頭をよぎったのかも。 </p> <p>ただ、粘りはしたものの、最終的には目黒さんのラストショットを前に数学的な可能性も消滅し、コンシード。残念無念…。 </p> <br /> <br /> <p>この後、試合会場を後にして、バンクーバのダウンタウンに向かった。 </p> <p>飯を食べるためと、どこかスターバックスのソファーで寝るためｗｗｗ </p> <p>本当に体調的に辛くて、このまま歩き回っていたら死ぬかと思った。 </p> <p>なので、昼ご飯は日本食。TERIYAKI Beafというのを食った。そこそこ美味かった。 </p> <p>その後、ソファのあるスタバを探す。あった。 </p> <p>その前に、市内でこんなアトラクションを見つける。 </p> <p> <a href="http://d.hatena.ne.jp/video/niconico/sm9850141" alt="この動画を含む日記"><img src="http://d.hatena.ne.jp/images/d_entry.gif" alt="D" border="0" title="この動画を含む日記" /></a></p> <p>乗ってみようかと思ったが、すごい長蛇の列。ショッピングと違ってなかなか進まないので、マジ３時間コースとか思って諦める。 </p> <p>さすがにこの体調で３時間も立ちっぱなしだと最後の試合の前に倒れるｗｗｗｗ </p> <p>バンクーバ、意外に乾燥しててノドが痛かったので、スタバでチャイ・ラテとフルーツ盛り合わせを購入してソファーでうとうと。幸せ。。。。 </p> <p>気がつくと、もう３時半。外では雨が降り出している。これがバンクーバの典型的な気候らしい。 </p> <p>ここまでの３日間、全くの快晴続きだったので雨具は持ってなかったが、諦めて購入。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224080241" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224080241.jpg" alt="f:id:kaigai:20100224080241j:image:w320" title="f:id:kaigai:20100224080241j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>雨のバンクーバ市内の写真をお楽しみください。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224080311" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224080311.jpg" alt="f:id:kaigai:20100224080311j:image:w320" title="f:id:kaigai:20100224080311j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224080805" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224080805.jpg" alt="f:id:kaigai:20100224080805j:image:w320" title="f:id:kaigai:20100224080805j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>トロリーバスが走っている！電池型の電気自動車より燃費はいいかも。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224080952" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224080952.jpg" alt="f:id:kaigai:20100224080952j:image:w320" title="f:id:kaigai:20100224080952j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>五輪公式ショップの隣のドラッグストアで、公式グッズの半額セール。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100224081744" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100224/20100224081744.jpg" alt="f:id:kaigai:20100224081744j:image:w320" title="f:id:kaigai:20100224081744j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>あまった時間で、再度オリンピック公式ショップへ。連れの人へのお土産と、みっちゃさんに頼まれていたカウベルを探しに。なんか、五輪終了が近付くにつれて値下げされてるような気がするんだが…。（一昨日、80CADで買ったジャージが、64CADで売られてた。ショボンヌ）</p> </div> 2010-02-26T22:10:04+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267222203 <div class="section"> <p>スイス戦の終了後、Vancouver Olympic Center隣接のVancouver Curling Club(VCC)を訪問する。オリンピック期間中、VCCでは Curling Clinic と題して、非会員の人にもカーリングの指導をするという企画を行っており、講師として長野五輪銀メダリストの Mike Harris を呼んでいる。まぁ、120CADくらいの参加費が必要なので、決して安くはないんだけど…。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223095421" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223095421.jpg" alt="f:id:kaigai:20100223095421j:image:w320" title="f:id:kaigai:20100223095421j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223120413" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223120413.jpg" alt="f:id:kaigai:20100223120413j:image:w320" title="f:id:kaigai:20100223120413j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>駄菓子菓子、実際にVCCの建物（100年くらい歴史のある由緒正しいクラブらしく、由緒ある建物である。）を訪れて受付を済ませてみると、この時間帯の申込者は自分１名だったらしい。というわけで、Mike Harrisとマンツーマンでレッスンを受けることになる。参加費が安くないなんてつぶやいてマジごめんなさい。 </p> <p>何回かインターン・アウトターンの両方のデリバリーを観察して、３つ指摘事項があるとの事。 </p> <p>一つは、ストーンを持つ腕が真っ直ぐに伸びていて "extension" が無いこと。 </p> <p>肘を180度伸ばすのではなく、（例えば）160度程度に保っておいて、蹴り出したは良いがヒットのウェイトが足りないとか、ラインが微妙にずれてるとか、そういう場合の微調整をできるようにするのだとか。 </p> <p>確かに、翌日のゲームで本橋のテイクショットを観察してて、最後に押してパワーを与える時に、一度引いて押し出すという動作をしていたように思える。 </p> <p>日本のコーチングでは、基本的に腕を伸ばしてブレないようにすると教わったハズだけども、それも一長一短って事か。 </p> <p>Make Harris曰く「君は常に正しい方向・強さで蹴り出せるのか？私は無理だ。なので、微調整は必要なんだよ。」との事。確かにそりゃ無理な相談だ。 </p> <p>あと、インターンの時にストーンが身体の正面にきていないので、リリースの時に余分な斜め角度が付いてしまい、他の人よりも余分にカールするんじゃないか？と言われた。 </p> <p>そｗｗｗれｗｗｗかｗｗｗ </p> <p>確かに、試合で例えばhibiki-cさんの後に同じラインで自分が投げたら、自分のストーンが余分にカールしてガードに当たったりした事が何度かあった。そんな所に原因があったのね！！ </p> <p>何度かVCCの氷でデリバリーの練習をしてみて驚いたのは、本当によく曲がる事。体感で8-10フット程度は曲がったんじゃないかなぁ。山中湖で壁→中心のラインと同じくらい、右にも左にも曲がる。これだけ左右に自由自在だと、カマーを使った戦略も楽しいだろうなぁ…。たぶん、ロングガードにしなくても、３の位置にガードを置いても十分成立するだろうな。 </p> <p>最後のは、俺みたく背が高い人はグライダー（スタビライザー）を使うのは止めたほうがいいんじゃない？って話。スタビライザーを使うとデリバリーの姿勢が低くなるので、背が高い人だと重心の上下移動が大きくなり、バランスを崩しやすい。 </p> <p>そもそもスタビライザを使い始めたのって、TCCの講習会でＯ澤さんに「ブラシを脇で抱える形になってるので、背骨が"く"の字型になってる」との指摘があり、ブラシを抱えずに済むにはスタビライザーという事だったんだけど、今だとどうだろう。 </p> <p>あと、スイーピングについての新しい豆知識。 </p> <p>基本的にスイープは左右２人でやるけども、常にそれが正しいわけではないと。 </p> <p>２年ほど前から言われ始めた事として、ストーンから遠い方のスイーパーは、ストーンを動かしたい方向を掃く。つまり、より強くカールさせたいのであれば、ストーンから遠い方のスイーパーは曲がるべき方向を掃く。逆にカールさせたくなければ、進行方向を掃く。ブラシの位置が身体から離れると体重が乗らないので、例えば左側にカールさせるなら、スイーパー２人が左側に居てもＯＫ。 </p> <p>確かこれは、園部さんに聞いたことがある。チーム長野でのアレンジかもしれないけど、カールの方向によって、左右どちらのスイーパーが石に近い方を掃くかを決めるとの事。カマーで攻める時なんかは1cmでも大きくカールさせたい訳だし、こういった差が、ゲーム展開上の違いに繋がってくるのかも。 </p> <p>あと、ウェイトを正しく出すには、ストップウォッチを使った練習が大切との事。 </p> <p>これは、やり方的に我々のやってきた方法で良かったようだ。ただ、内的感覚でバック−ホグ 3.xx 秒みたいのを身に付けるには、もっと練習の頻度が必要だわ。 </p> <p>んで、「これあげるよ」と、Make Harrisの使ってるストップウォッチをもらう。うわー、ありがてぇ！ </p> <p>一通りレッスンが終わった後、Goldlineのお姉さんが来ているとかで紹介される。 </p> <p>「俺のブルームはGoldlineだよ。軽くてすっげー気に入ってる。」と話したらなぜかハイタッチで挨拶。営業担当の人ってのは、あれくらいノリが良くないとダメなんだろう。きっと。 </p> <p>なんか色々貰って来た。メープルの葉のロゴが入ったブラシヘッド×２（１個はサイン入り）、長野五輪のポストカード、ピンバッジ。 </p> <p>極めつけは↓の写真。「恐れ多い」に対応する英単語のボキャブラリーを知らなかったので、ただオロオロするばかり。長野五輪の銀メダルを見せてもらって記念撮影（えへ）。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223114411" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223114411.jpg" alt="f:id:kaigai:20100223114411j:image:w320" title="f:id:kaigai:20100223114411j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>あと、夜になって女子のカナダ代表チームが練習に来るという事で『サイン貰っちゃいなよ』と急かされてこんな事に。 </p> <p>カーリングに使ってるジャージに Cori Bartell のサインを。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223145815" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223145815.jpg" alt="f:id:kaigai:20100223145815j:image:w320" title="f:id:kaigai:20100223145815j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>でも、大会期間中の代表選手に何を話しかけたらいいかなんて分かんないよ。 </p> <p>要約すると「金メダル目指して頑張って下さい。応援してます。」ぐらい（汗 </p> <p>VCCを後にすると、まだ19:00くらいだったので、午前中にちょっとうろついたYele Townという町で飯を食いにいく。この町並みは好き。もう少し日程に余裕を持って行けばよかった。試合が〜22:00とかだと、あまり普通のレストランは開いてないので、真っ当なレストランでの夕食はこれ一回じゃなかろうか（汗） </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223130807" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223130807.jpg" alt="f:id:kaigai:20100223130807j:image:w320" title="f:id:kaigai:20100223130807j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>レストラン・パブ街のメニューを見ながら、美味しそうな物はないかと歩く。 </p> <p>非常に豊満な乳のお姉さんが調理しているグリル。いかんいかん、あれは紛い物だと自分に言い聞かせる。 </p> <p>ある店の前でメニューを見ていると「IKA SUGATAYAKI」とか「TEMPURA」とか書いてある。気になって聞いてみる。 </p> <p>「ここ、アジアンレストラン？」 </p> <p>「いや、タイ料理」 </p> <p>「でも、メニューの一部は日本料理に見えるんだけど」 </p> <p>「大丈夫、辛い味付けをしているから」 </p> <p>・・・辛い味付けをすればタイ料理になるのか・・・ </p> <p>でも、面倒臭くなったので、結局、このお店でお食事。 </p> <p>トムヤンクンとライス、ビーフグリルとデザートを注文。満腹になったので、デザートを注文していた事を忘れて店から出てしまったんだけど、店員さんが後で追いかけて来て、デザートをパック詰めにして持って来てくれた。好感度ＵＰ。早食いですまん。 </p> <p>そんなこんなで、宿に帰ると22:00頃。ちょっと睡眠不足と疲労の蓄積がハンパないので、日記の更新は諦めて寝る。</p> </div> 2010-02-26T22:10:03+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267221409 <div class="section"> <p>そろそろ睡眠不足が祟って眠い。体調が良くない感じ。 </p> <p>頼むから、最後の試合を観戦する明日まではもってほしい。 </p> <p>今大会の関ヶ原決戦とも思えるスイス戦。 </p> <p>同じ三敗同士というのが信じられないくらい正確なショットで置いてくる。 </p> <p>で、こちらはどんどん苦しい状況でショットを打たざるを得なくなる。 </p> <p>例えば、1ENDは途中まで完全に2点ゴチの流れだったわけだけども、本橋さんのテイクが左にロールすべきところ、そのままステイしちゃったために、日本のNo.1/2が近い状況になり、結果はダブルテイクアウト。目黒さんは結局１点を取らされる事になってしまった。 </p> <p>でも、実際にロールするのとステイするのでは、当たる位置の違いは3cm程度。 </p> <p>要は、そのレベルの違いをコントロールできないと、世界で勝つのは難しいって事なんだなぁ、、、、とか思った。 </p> <p>結局、日本の挙げた４点は全て後攻のエンド。オットーに終始試合を支配され続けていたという点で、今後がちょっと心配な一戦でした。</p> <p>他力本願だけども決勝Ｔの望みはまだ消えていないので、なんとか残り２試合、気持ちを切り替えて頑張ってほしい。 </p> <p>あと、ひとつ気になったチーム青森の投げ方。 </p> <p>ヒットロールを狙うときに、右側にロールさせたいとしたら、左側からインターンで投げているけども、右側からアウトターンで投げた方がイージーじゃないか？？これだと、当たるアングルをスイープで調整できるし。。。。 </p> <p>今日もヒットロールのアングルを間違えて失敗に終わった作戦が何度かあったけど、これってどうなんだろう。 </p> <p>青森レベルのチームなら、反対からのラインに修正するだけで容易に対応できそうな気がするんだけどなぁ。。。。</p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223092720" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223092720.jpg" alt="f:id:kaigai:20100223092720j:image:w320" title="f:id:kaigai:20100223092720j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223093439" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223093439.jpg" alt="f:id:kaigai:20100223093439j:image:w320" title="f:id:kaigai:20100223093439j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p><a href="http://f.hatena.ne.jp/kaigai/20100223094209" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100223/20100223094209.jpg" alt="f:id:kaigai:20100223094209j:image:w320" title="f:id:kaigai:20100223094209j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>関係ないですが、写真はアンナちゃん（ロシアのスキップ：アンナ＝シドロヴァ）のモノ。 </p> <p>需要が多そうな感じがしたので、コンシードの後のエンドに撮影してましたｗｗｗ</p> </div> 2010-02-26T21:56:49+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267221163 <div class="section"> <p>というわけで、ドイツ戦。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222111541" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222111541.jpg" alt="f:id:kaigai:20100222111541j:image:w320" title="f:id:kaigai:20100222111541j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>入り口からカナダ人ノリノリである。 </p> <p>街中のいたるところで、突然『レッツゴ〜♪カナダ♪』と歌いだすｗｗｗ </p> <p>会場に入ると、昨日、Mixiの「Ｇｏ！バンクーバ」コミュニティに記念写真をアップしておられた某氏の姿を見つける。同じ業者を通じてチケットを手配したので、近い場所に席が配置されたのか…という事は、明日の試合（JOC割り当て分）はきっと青森関係者の近くだなｗ </p> <p>持参したメッセージ入り日の丸のセッティングにご協力いただく。 </p> <p>日本のカーラー諸氏にも見えるように、日本の試合のシートの裏側の低めの位置にスタンバイ </p> <p>そろそろ眠いので、各エンドの詳細云々よりも気がついた点。 </p> <p>あまり負け試合を細かく書きたい気にならないというのもあるが。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222142048" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222142048.jpg" alt="f:id:kaigai:20100222142048j:image:w320" title="f:id:kaigai:20100222142048j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>この試合も、クリーンゲームから。もしかして、序盤のシンプルな展開は、後半で時間を使うための布石なのかしら？ </p> <p>ただ、目黒さんは先攻の時に相手に一点取らせるためにクリーンな展開を取る傾向があるように見えるけども、オリンピックのレベルともなると、なかなか教科書通りには運ばないようだ。昨日今日と、あまり成功率は高くないように思う。</p> <p>目黒さんのショット自体は冴えてると思うし、いざという時に一投で局面を打開する力は持って </p> <p>いるんだから、もっと自信を持って投げてもいいと思うんだけどねぇ。 </p> <p>6END、ハウス後方の相手No.1/2を一気に弾き出して２点を確保したみたいに。 </p> <p>あれ、後ろからみるとかなりタイトなラインを通した上に、しっかり曲げて２個のストーンの間にドンピシャで当ててる。かなりすごい。 </p> <p>7END、これは１点取らせる局面が成功したケース。ただ、点差と残りENDを考えてもスチール狙いでも良かったんじゃないかと思える。ドイツの後攻ラストショットの選択がどうも自分には腑に落ちない。ハウスに日本のストーンが３つあり、トリプルも不可能な局面なら、あえてヒットロールなんかしなくても、バッキング付きのドローでいいじゃんとか思うんだけど。 </p> <p>8ENDは逆に１点取らされる格好。9END、うまくガードの裏、ハウスのセンター付近に石を密集させて、隙あらばスチールの構え。だが、相手スキップの一投は Amazing! </p> <p>10時方向からロールさせ、中央の団子に当ててプッシュ。9ENDで2点を奪われてしまった…。 </p> <p>10END、置きに来る日本をロシアが弾く展開だが、ロシアのミスもあって何とかハウス内にストーンを2個置ける展開に。ロシアはタイムアウトのあと、なぜかドローに切り替える。</p> <p>中央付近に溜まった石は、No.1日本、No.2ロシア、No.3日本。 </p> <p>ここで目黒さんの選択は、ロングガードをギリギリでかわして、No.2ロシアだけを叩いて後方に、自分はステイしてエキストラという青写真だったと思う。 </p> <p>最終的には投げたストーンの当たりが薄すぎて、No.3圏外にまでロールしたわけだけども、まさかあのラインを狙ってくる＆通してくるとは思わなかった。お見事、ナイストライ。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222135731" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222135731.jpg" alt="f:id:kaigai:20100222135731j:image:w320" title="f:id:kaigai:20100222135731j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>その後、カナダ−中国戦を最後まで見てから宿に帰る。 </p> <p>カナダのスキップが、最後のドローをガードストーンに当ててしまった時（この瞬間、中国の </p> <p>勝ち）に、中国のサードがぽん、と隣に立ってたスキップ王さんの腰を叩いたのが印象的。 </p> <p>相手のミスで決まっただけに、大騒ぎするのもカーリング精神に反するんだろうけども、やっぱりカナダに勝つってのはそれくらい嬉しい事なんだろうなと推測。 </p> <p>写真は中国−カナダ戦の一コマ。なんてレベルの高い試合をしてるんだ！！ </p> <p>で、エキストラまで見てしまったので、宿に着いたのはまた23:00頃。 </p> <p>しかも、風呂の照明が壊れていて風呂に入れない。朝風呂にする。うがー！！</p> </div> 2010-02-26T21:52:43+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267221162 <div class="section"> <p>さて、大逆転のロシア戦の後はしばらく時間があるので、ダウンタウンに買い物に。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222055855" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222055855.jpg" alt="f:id:kaigai:20100222055855j:image:w320" title="f:id:kaigai:20100222055855j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>まずはお腹が減ったので、フードコートで食事。 </p> <p>そして、スタバのwireless internetを使ってmixi日記に書き込んだり。 </p> <p>要は、東京でいう百貨店みたいな場所で、いろんなブティックとかが集まっている。 </p> <p>興味ないのでパスパスと思っていたら、『OLSON』という店の名前を見つけたので、 </p> <p>そのフロアに行ってみると…。 </p> <p>『OLSEN』という婦人服のブランドだった。紛らわしいわ！ </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222060301" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222060301.jpg" alt="f:id:kaigai:20100222060301j:image:w320" title="f:id:kaigai:20100222060301j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>写真は、紳士服のコーナーで見かけたマネキン。 </p> <p>うむ、やはりカーリングは紳士淑女のたしなみという事ですな。 </p> <p>ぶんたまさんに、CASの賞品にオリンピック関連グッズを買ってきてほしいと頼まれているので、 </p> <p>五輪公式ショップに行ってみる。デパートの一角が五輪公式ショップという事で、混みすぎないよう入場制限をしている。 </p> <p>「中に入るにはどこへ行けば？」 </p> <p>「そこを出て左に曲がったところから入ってくれ」 </p> <p>外に出ると、長蛇の列。なんじゃこりゃー！！</p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222080657" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222080657.jpg" alt="f:id:kaigai:20100222080657j:image:w320" title="f:id:kaigai:20100222080657j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>しかし、意外に行列の掃けるのが早く、３０分程度で中に入れる。 </p> <p>日本の感覚だと３時間コースの行列に見えたんだけどｗｗｗｗ </p> <p>中は五輪関連グッズ。 </p> <p>カナダ人の間で大流行の五輪ミトン（手袋）を買って帰りたかったんだけど、SOLD OUTで残念無念。子供用のしかなかった。Mixi情報によると、空港のショップには置いてあるらしい。</p> <p>で、自分用含めもさもさっとお土産を購入。</p> <p>個人的に一番気に入ってるのは、五輪記念コインの詰め合わせ。 </p> <p>（まぁ、ＣＡＳの商品になるんだけど） </p> <p>自分向けには、カーリングの時のウェア。はい、これから白色から灰色に変わります。 </p> <p>オリンピックのロゴ入りｗｗ </p> <p>てな事をしているうちに、17時。日本−ドイツ戦は19時〜なので、King Edward駅に移動することに。</p> </div> 2010-02-26T21:52:42+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267220532 <div class="section"> <p>Vancouver City Centerのスターバックスから。</p> <p>今日は 9:00〜 vsロシア戦、19:00〜 vsドイツ戦を観戦の予定。 </p> <p>昨日は男子の試合を観戦していて、宿に着いたら23:00、日記を書いたら25:00になっていたので、念のため、目覚ましを6:30にセットして寝た。 </p> <p>だが、目が覚めたら8:10だった（←氏ね）。やばいやばいやばいやばい。 </p> <p>とりあえず、５分で準備して宿を飛び出す。 </p> <p>見ると、向かいの角を４１０系統のバスが今まさに曲がろうとしているではないか。 </p> <p>手を振りながら全力疾走。バスを待っててくれた運ちゃん、ありがとう。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222020746" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222020746.jpg" alt="f:id:kaigai:20100222020746j:image:w320" title="f:id:kaigai:20100222020746j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>RichmondからSkyTrainに乗って、King Edwardで降車。シャトルバスに乗ってOlympic Centerに向かう。到着すると、、時刻は8:55。だが、テロ対策の手荷物検査の列がもどかしい。 </p> <p>結局、会場に入れたのは2ENDの近江屋さんが投げているあたり。 </p> <p>ただ、展開的には3ENDまでは小林さんも解説のしようがない感じだったので、とりあえずＯＫ </p> <p>4END、石崎さんのウェイトがずれたところを攻められ、この試合初めて石がハウスの中に溜まる展開に。目黒さんのショットも、相手の後ろに回り込むには至らず、ラストはウェイトが弱く早めにカールして、ハウスの中にある相手の３個が丸々得点に。 </p> <p>5END、ダブルコーナーガードが外されたので、カマーで攻めていくけども、隠れ切らずにその度にロールを決められてかなりピンチ。目黒さんのラストショットは４フット内に入らなきゃいけないけども、これもウェイトが少し弱く、早めにカールしてしまう。 </p> <p>それでも、No.4/5よりは内側まで持って来た。近江屋さんの「HURRY！！」の声が非常に悲壮だった。</p> <p>ここまで０−６でおやつタイム。自分の周囲一角は日本人ばかりだったんだけど、かなり深刻なムードが。 </p> <br /> <p>6ENDもダブルコーナーガードを外され、漂う重い空気。 </p> <p>駄菓子菓子、目黒が２投で局面をひっくり返した。 </p> <p>目黒一投目、相手のセンターティー前のストーンを打ってロール。完全にロシアの石の裏側に回りこむ。ロシア、ここでタイムアウト。 </p> <p>ロシアはセンターにカム（悪くても２点？）を狙うが、ショート気味でガードに接触。</p> <p>目黒のラストは、正確にロシアの石を叩き、少し本橋の投げたNo.3にかすったものの、３点を返す。 </p> <p>まだ点差は３点あるんだけども、目黒さんにすればこれで一息つけたし、ロシアにしてみれば焦りが生まれたんじゃなかろうか。7END以降、ずいぶん迷う場面が増えた気がする。 </p> <p>7END、ここから石崎さんに代わって山浦さんが入る。で、オーダーも山浦→近江屋→本橋→目黒の順に変更。これって、ルール的にありなんだっけ？？ </p> <p>先攻の7END、ティー前のハウス中心付近の攻防。 </p> <p>このエンドも、目黒の２投で局面を一気にひっくり返した。 </p> <p>目黒一投目、２個並んでいたロシアのNo.1/2ストーンをロングガードをかわして見事にダブルテイクアウト。２投目、あと40cm手前だったら Perfect! だったが、見事にNo.1/2/3/4を確保してロシアのラストショットを待つ。ロシアのスキップ、ガードに触れるのを恐れたか、少しワイドに出たため、日本のストーンに触れることなくティー奥へ。</p> <p>３点＋３点を失った後、３点＋３点を取り戻してゲームは振り出しへ戻る。 </p> <p>8ENDはうって変わってクリーンゲーム。だけど、近江屋さんが一本ヌルーしてしまった関係でロシアにNo.1/2を作られてしまい、ダブルテイクアウトもできなかったので２点を失って６−８に。 </p> <p>あと、このエンドの途中にカナダ−米国戦がコンシード。ひときわ大きな拍手が。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222050944" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222050944.jpg" alt="f:id:kaigai:20100222050944j:image:w320" title="f:id:kaigai:20100222050944j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>9END、ロシアはセンターの６〜８フットの位置に鉄壁のガードを置くも、近江屋のロール、本橋のドロー、目黒のドローが素晴らしい位置に決まって、後攻ラストショットの時点でNo.1/2/3を確保の状況。 </p> <p>仮に赤を動かしでもしたら大事なので、目黒さんの選択は10時方向ハウス外の相手ストーンを使ったヒットロール。まぁ、これならセーフティ…ってウェイト強くない！？ </p> <p>これ、ロシアのストーンの後ろを通過して事なきを得たけど、当たる角度がもう少しフラットなら味方を叩いたんじゃ…。 </p> <p>とにもかくにも、１点リードの10ENDは見ごたえがあった。 </p> <p>本橋のショットが相手の石を叩いて、ハウスの隅に2cmほど引っかかった状態。13時方向ハウスの20cmほど手前にロシアの石が。 </p> <p>ロシアとしては、No.1/2の状況を作って２点取りたい。日本としては、ハウスの中心付近にもう一個置いてダブルロールインを防ぎつつ、１点を取らせたい。 </p> <p>となると、ダブルロールインの方が先か、ハウス内のロシアストーンをテイクアウトしつつ、中心近くにステイするのが先か。結果的に、本橋さんの２投目でヒットステイ。ロシアは１点取るしかなく、日本後攻でエキストラエンドに。 </p> <p>ちなみに、9ENDの辺りから、カナダが既にコンシードしてしまったため、手持ち無沙汰なカナダの観客が『日本チャチャチャ！』に参加。地響きのような…（笑 </p> <p>エキストラエンド、ロシアは前を固めるし、日本はそれを外していく・・・が、最終的にはロングガードの裏にロシアのNo.1ストーンという局面。目黒のラストショットはコントロールウェイトで手前のストーンをかわして奥を狙う。イエスのコールがかかった瞬間、まさかナローに出たかと凍りつく（横からではラインがわからない）が、すぐに「ウォー」のコール。綺麗にNo.1ストーンに吸い込まれるようにヒットして勝負あり。 </p> <p>最初０−６の局面ではもうダメかとも思ったけれども、何とか頑張って取り返してくれた。諦めないそのタフさがすごい！ </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100222042243" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100222/20100222042243.jpg" alt="f:id:kaigai:20100222042243j:image:w320" title="f:id:kaigai:20100222042243j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>あと、関係ないけどロシアの選手はみんな美人そろいですごい。</p> <p>背が高くてみんなモデルみたい。試合そっちのけで眺めていたのは秘密だ（嘘</p> </div> 2010-02-26T21:42:12+00:00 kaigai http://d.hatena.ne.jp/kaigai/20100227/1267219855 <div class="section"> <p>という事で、無事に宿に到着。 </p> <p>今回宿泊したのは、バンクーバの南側、リッチモンドにある民宿。 </p> <p>一応、到着した20日に試合観戦の予定がなかったものの、明日の朝に迷ったりしないように、会場までのルートを確認がてら出かけることにする。 </p> <p>（注： この時点で、日本−英国戦観戦イベントから機中で仮眠しただけで起きっぱなしｗｗ眠いんじゃ！！） </p> <p>バンクーバ／リッチモンド市内は、スカイリンク社の運営する公共交通機関が整備されていて、結構いろんな所に行くのに重宝する。しかも、五輪期間中はチケットの提示だけで運賃は必要ないため、タクシーを使ったりするより格段に安く移動できる。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100221085311" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100221/20100221085311.jpg" alt="f:id:kaigai:20100221085311j:image:w320" title="f:id:kaigai:20100221085311j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>で、リッチモンドの中心部までは SkyTrain という都市鉄道が来ているのだが、宿はもう少しバスを乗り継いだ所にある。深夜になると30分に1本程度に本数が減るので、19:00〜の試合の時などは注意が必要。 </p> <p>SkyTrainは、丸の内線と同じように、レールの他に電力供給用のレールが敷設してある。これは地下部分の工事費削減のためか。</p> <p>リッチモンドから橋を渡ってバンクーバに入ると、鉄道は地下部分へ入る。15分程度で、Vancouver Olympic Center最寄の King Edward 駅に到着。 </p> <p>どうでもいいが、カナダにこの手の命名多いな。 </p> <p>前に PGcon2008 で行ったオタワにも King Edward Street てあった。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100221100255" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100221/20100221100255.jpg" alt="f:id:kaigai:20100221100255j:image:w320" title="f:id:kaigai:20100221100255j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>一応、会場への経路を確認して、まぁ、一時間くらいは移動時間を見ておかないとな…と思っていると、なんと当日券の売り場が。 </p> <p>手持ちのチケットは、日本チームの出場する５試合のみだったが、せっかくの機会だし、世界最高水準のカナダ男子のゲームでも見ておくかと思って、チケットを購入。19:00〜の試合を観戦することにした。 </p> <p>中へ入る前には、空港の保安区画みたいな手荷物検査があるので、これも早めの入場が必要な様子。食べ物・飲み物は中で買える。味はどうか知らないが。 </p> <p>トイレは簡易トイレが大量に設置されているが、かなり不潔なので、できればお世話になりたくない。 </p> <p>中へ入ると、急傾斜のスタンドに赤色の観客がびっしり。でも、これは仮設スタンドなのか？ </p> <p>カナダの応援は「Go〜カナダ〜ドカ！ドカ！ドカ！」と足元を踏み鳴らすので、かなり大きく響く。 </p> <p>日本チャチャチャは所詮手拍子なので、ボリューム的にかなり劣勢。どうしたものか。 </p> <p><a href="http://f.hatena.ne.jp/kaigai/20100221113413" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20100221/20100221113413.jpg" alt="f:id:kaigai:20100221113413j:image:w320" title="f:id:kaigai:20100221113413j:image:w320" class="hatena-fotolife" width="320" /></a></p> <p>観戦したカナダ−英国の試合。かなり別次元の戦い。まるで宇宙人（not 鳩山）同士のゲームのようだ。 </p> <p>なんであんなに弱いコントロールウェイトでピンポイントで狙ったところに当てて、ストーン半個分だけロールとかいう芸当が1ENDのうちに３回も４回も出てくるのか。 </p> <p>女子ではチーム青森がなんとか世界水準の相手とタメを張れてるが、男子でＳＣ軽井沢が出て行ったときに、こういう相手にどうやって戦うんだろう。</p> <p>で、ＳＣ軽井沢に続くチームが今の日本にどれくらい存在するんだろう。 </p> <p>少し絶望的な気分を感じた。。。。 </p> <p>まぁ、地道にカーリングの裾野を広げていくしかないんだろうけどもね。 </p> <p>全てのシートで試合が終わったのが22:00頃。 </p> <p>それからスカイトレインとバスを乗り継いで、宿に着いたのが23:00頃。 </p> <p>なんか、深夜のバスは怪しい。黒人の集団が大騒ぎしてるし、タバコのように見えるけど煙の出ない何か得体のしれない物を吸ってるオバチャンとかいるし。</p> <p>次からは、22:00終了のゲームのときはタクシーを捕まえた方がいいかも。 </p> <p>明日は、対ロシア戦と対ドイツ戦を観戦。 </p> <p>決勝Ｔ進出を考えると、絶対に落とせない戦い。頑張って応援してきます。</p> </div> 2010-02-26T21:30:55+00:00 kaigai http://danwalsh.livejournal.com/35420.html In Fedora 12 and Red Hat&nbsp;Enterprise Linux 6,&nbsp; I&nbsp; added a new flag to audit2allow, -D or --dontaudit.&nbsp; This option tells audit2allow to generate dontaudit rules rather then allow rules.<br /><span><br /># audit2allow -a<br /><br />#============= smokeping_t ==============<br />allow smokeping_t bin_t:file { read execute open execute_no_trans };<br /></span><br />vs<br /><span><br /># audit2allow -aD<br /><br />#============= smokeping_t ==============<br />dontaudit smokeping_t bin_t:file { read execute open execute_no_trans };</span><br /><br />If you want to allow the access and do not want SELinux pestering you, this is a great option.<br /><br />A great example of where this is handy is vbetool.<br /><span><br />man vbetool<br />...<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vbetool - run real-mode video BIOS code to alter hardware state</span><br /><br />vbetool is run at boot time and during suspend and resume.&nbsp; It requires mmap_zero access to run properly which is denied by default. &nbsp;This access is considered dangerous and is described in a previous <a href="http://danwalsh.livejournal.com/30084.html">blog</a>.&nbsp; Luckily most machines do not need vbetool to run successfully.&nbsp; However, SELinux complains to the audit system on each boot and suspend/resume about vbetool requesting mmap_zero.&nbsp; vbetool does not work,&nbsp; but it does not cause anything on your machine to not work.&nbsp; <br /><strong><br />How would I&nbsp;shut up the AVC?</strong><br /><br /><span># grep vbetool /var/log/audit/audit.log | audit2allow -DM myvbetool<br /># semodule -i myvbetool.pp</span><br /><br />This will stop the AVC&nbsp;without allowing a dangerous access.<br /><span><br /># cat myvbetool.te<br />module myvbetool 1.0;<br /><br />require {<br />&nbsp;&nbsp;&nbsp; type vbetool_t;<br />&nbsp;&nbsp;&nbsp; class memprotect mmap_zero;<br />}<br /><br />#============= vbetool_t ==============<br />#!!!! This avc can be allowed using the boolean 'mmap_low_allowed'<br /><br />dontaudit vbetool_t self:memprotect mmap_zero;</span><br /> 2010-02-24T18:03:25+00:00 dwalsh@redhat.com http://thetoms-random-thoughts.blogspot.com/2010/02/harder-you-fight-weaker-you-are.html <p><a href="http://blogs.msdn.com/user/Profile.aspx?UserID=56729">Shawn Hernan</a> from Microsoft <a href="http://blogs.msdn.com/shawnhernan/archive/2010/02/13/microsoft-s-many-eyeballs-and-the-security-development-lifecycle.aspx">spills some oil in the closed-source vs. open-source fire</a> again. How boring you think ...?<br /></p><p>I think so too - boring - and want to give a view of this topic that is more in touch with reality than the unsuccessful attempt to put open-source in a bad light by using ancient Greek logic (which is used wrong by the way b/c it is based on statistical/conditional premises not on axioms), random cites from MS-biased people as well as wisdoms (Voltaire - I think it was him - once said: "A wisdom is no proof." - I really like the contradiction in it :) )</p><p>Shawn also stumbles over his own rebuttal and says MS code is more secure because:<br /></p><blockquote>And it’s not like Microsoft source code is restricted to Microsoft personnel. There are more than a <a href="http://www.microsoft.com/resources/sharedsource/Licensing/default.mspx">dozen different programs</a> through which organizations and individuals can gain access to Microsoft source code.</blockquote><br />Well this is rounded off by too many wrong assumptions and biased thinking... no problem, this is what happens if you are not open. (Sorry can't resist.)<br /><br />Well let's stop comparing apples with oranges here.<br /><br />It has to be recognized that the mindset as well as the fundamentals of open-source and closed-source software are too different that nobody should try to compare them regarding security. But we can learn from each other. To repeat: I like the SDL and MS (and others) can only benefit from opening their code (Solaris would be dead for a long time if it just stays closed). Fact is that open-source does not make software more secure by default but this is especially true for closed software. But openness increases trust, adaptability, autonomy and agility - it is modern and democratic! And that is the main fact that matters for me! And for you?<br /><br />This is just my personal opinion but hopefully not mine alone. ;)<br /><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-4979036344025783724?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2010-02-18T03:58:48+00:00 Thomas (noreply@blogger.com) http://selinux-mac.blogspot.com/2010/02/about-apachecontenttemplate.html In refpolicy there are about eight modules that have calls to apache_content_template in their private policy. These template calls are located in optional policy blocks. This is so that these modules do not depend on the apache module being present. <br /><br />The problem is that seven out of these eight modules have file context specifications containing a executable type, that is declared in the apache content template, in their file context file. As far as i know file context specifications are never optional.<br /><br />So even though calls to apache content template are optional, they really aren't because the file context specifications that accompany them are not optional.<br /><br />This means that eight modules depend on the apache module being installed. Try to de-install the apache module (semodule -r apache) and you will be presented with some very unclear errors. Most people will not know what to do.<br /><br />So how can we fix that?<br /><br />Well here is an example. We use the apache_cgi_domain() instead:<br /><br />########################################<br />#<br /># BackupPC admin private declarations.<br />#<br /><br />type backuppc_admin_t, backuppc_domains;<br />type backuppc_admin_exec_t;<br />domain_type(backuppc_admin_t)<br />domain_entry_file(backuppc_admin_t, backuppc_admin_exec_t)<br />role system_r types backuppc_admin_t;<br /><br />########################################<br />#<br /># BackupPC admin private policy.<br />#<br /><br />optional_policy(`<br /> apache_cgi_domain(backuppc_admin_t, backuppc_admin_exec_t)<br />')<br /><br />/usr/share/BackupPC/sbin/BackupPC_Admin -- gen_context(system_u:object_r:backuppc_admin_exec_t, s0)<br /><br />This way we can make the call to apache_cgi_domain() *really* optional. It is a bit more work initially but in my view this is maintainable unlike apache_content_template.<div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-4928461313376429315?l=selinux-mac.blogspot.com" alt="" /></div> 2010-02-14T13:59:33+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://intrajp.no-ip.com/nucleus/?itemid=3 Hi !<br /> segatex-7.791 released as F12 friendly and having new refpolicy.<br /> Now you can edit any files in the system.<br /> If there are any bugs, please let me know at shintaro.fujiwara@gmail.com.<br /> Thanks.<a href="http://intrajp.no-ip.com/nucleus/media/1/20100210-screenshot.jpg">20100210-screenshot.jpg</a> 2010-02-09T13:04:25+00:00 http://danwalsh.livejournal.com/35127.html The bug report <a href="https://bugzilla.redhat.com/show_bug.cgi?id=561817">https://bugzilla.redhat.com/show_bug.cgi?id=561817</a> triggered me to write a blog on writing policy.&nbsp; Some people think writing SELinux policy is difficult. I figured I would show how quickly it can be done.<br /><br /><a name="cutid1"></a>The bug report shows rtkit-daemon trying to setsched on a process running with the type intirc_t.&nbsp; initrc_t is the default domain for all init script process and programs run from them.&nbsp; By default n targeted policy, initrct_t is an unconfined domain.&nbsp; We would prefer all daemons in Fedora have a policy defined. &nbsp; I asked the bug reporter what bug caused the AVC.&nbsp; He identified the icecast daemon as one of the initrc_t deamons.&nbsp; Here is how I wrote the policy for it.<br /><br />Note: This example was done on F13/Rawhide but it could have been done on Fedora 12 or Red Hat Enterprise Linux 6, when it ships.<br /><br />Knowing nothing about icecast, I figured I could get a pretty good start writing policy using sepolgen and rpm.<br /><font color="#999999"><br />rpm -qi icecast<br />...<br />Summary&nbsp;&nbsp;&nbsp;&nbsp; : ShoutCast compatible streaming media server<br />Description :<br />Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between.&nbsp; It is very versatile in that new formats can be added relatively easily and supports open standards for communication and interaction.</font><br /><br />I login as root and cd /root<br /><font color="#999999"># sepolgen /usr/bin/icecast<br />Created the following files:<br />Type Enforcement file&nbsp;&nbsp;&nbsp;&nbsp; ./icecast.te<br />Interface file&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ./icecast.if<br />File Contexts file&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ./icecast.fc<br />Setup Script&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ./icecast.sh</font><br /><br />This is the initial icecast.te file generated by sepolgen<br /><font color="#999999">policy_module(icecast,1.0.0)<br /><br />########################################<br />#<br /># Declarations<br />#<br /><br />type icecast_t;<br />type icecast_exec_t;<br />init_daemon_domain(icecast_t, icecast_exec_t)<br /><br />permissive icecast_t;<br /><br />type icecast_initrc_exec_t;<br />init_script_file(icecast_initrc_exec_t)<br /><br />type icecast_var_run_t;<br />files_pid_file(icecast_var_run_t)<br /><br />type icecast_log_t;<br />logging_log_file(icecast_log_t)<br /><br />########################################<br />#<br /># icecast local policy<br />#<br /><br />allow icecast_t self:capability { setgid setuid };<br />allow icecast_t self:process { fork signal };<br /><br /># Init script handling<br />domain_use_interactive_fds(icecast_t)<br /><br /># internal communication is often done using fifo and unix sockets.<br />allow icecast_t self:fifo_file rw_fifo_file_perms;<br />allow icecast_t self:unix_stream_socket create_stream_socket_perms;<br /><br />files_read_etc_files(icecast_t)<br /><br />miscfiles_read_localization(icecast_t)<br /><br />manage_dirs_pattern(icecast_t, icecast_var_run_t,&nbsp; icecast_var_run_t)<br />manage_files_pattern(icecast_t, icecast_var_run_t,&nbsp; icecast_var_run_t)<br />files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })<br /><br />manage_dirs_pattern(icecast_t, icecast_log_t,&nbsp; icecast_log_t)<br />manage_files_pattern(icecast_t, icecast_log_t,&nbsp; icecast_log_t)<br />logging_log_filetrans(icecast_t, icecast_log_t, { file dir } )<br /><br />auth_use_nsswitch(icecast_t)<br /><br />sysnet_dns_name_resolve(icecast_t)<br /></font><br />Looks good, but before I continued I wanted to know if I could find any add<br />Now I decided to look at the output of rpm -ql icecast<br /><br /><font color="#999999"># rpm -ql icecast<br />/etc/icecast.xml<br />/etc/logrotate.d/icecast<br />/etc/rc.d/init.d/icecast<br />/usr/bin/icecast<br />/usr/share/doc/icecast-2.3.2<br />...<br />/usr/share/icecast<br />/usr/share/icecast/admin<br />/usr/share/icecast/admin/listclients.xsl<br />...<br />/usr/share/icecast/web<br />/usr/share/icecast/web/auth.xsl<br />....<br />/usr/share/man/man1/icecast.1.gz<br />/var/log/icecast<br />/var/run/icecast</font><br /><br />/etc/logrotate.d/icecast cought my eye, so I investigated.&nbsp; <br /><br /><font color="#999999"># cat /etc/logrotate.d/icecast<br />/var/log/icecast/*log {<br />&nbsp;&nbsp;&nbsp; missingok<br />&nbsp;&nbsp;&nbsp; notifempty<br />&nbsp;&nbsp;&nbsp; sharedscripts<br />&nbsp;&nbsp;&nbsp; postrotate<br />&nbsp;&nbsp;&nbsp; /bin/kill -HUP `cat /var/run/icecast/icecast.pid 2&gt;/dev/null` 2&gt; /dev/null || true<br />&nbsp;&nbsp;&nbsp; endscript<br />}</font><br /><br />I know that logrotate runs as logrotate_t, it will need to send a signal to icecast_t.&nbsp; I need to add an interface to icecast.if for this<br /><br /><font color="#999999">########################################<br />## &lt;summary&gt;<br />##&nbsp;&nbsp;&nbsp; Allow domain signal icecast <br />## &lt;/summary&gt;<br />## &lt;param name=&quot;domain&quot;&gt;<br />##&nbsp;&nbsp;&nbsp; &lt;summary&gt;<br />##&nbsp;&nbsp;&nbsp; Domain to not audit.<br />##&nbsp;&nbsp;&nbsp; &lt;/summary&gt;<br />## &lt;/param&gt;<br />#<br />interface(`icecast_signal',`<br />&nbsp;&nbsp;&nbsp; gen_require(`<br />&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; type icecast_t;<br />&nbsp;&nbsp;&nbsp; ')<br /><br />&nbsp;&nbsp;&nbsp; allow $1 icecast_t:process signal;<br />')</font><br /><br />In icecast.te I added the following<br /><font color="#999999"><br />gen_require(`<br />&nbsp;&nbsp;&nbsp; type logrotate_t;<br />')<br /><br />icecast_signal(logrotate_t)</font><br /><br />Although I will eventually put this into logrotate.te<br /><br />I also noted /usr/share/icecast in the icecast package seems to be apache content.<br /><br /><font color="#999999">/usr/share/icecast<br />/usr/share/icecast/admin<br />/usr/share/icecast/admin/listclients.xsl<br />...<br />/usr/share/icecast/web<br />/usr/share/icecast/web/auth.xsl<br />....<br /><font color="#000000"><br />I figured I would add <br /><font color="#999999">/usr/share/icecast(/.*)?&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; gen_context(system_u:object_r:httpd_sys_content_t,s0)</font><br /></font></font><font color="#999999"><font color="#000000">to icecast.fc for now, eventually this should go in apache.fc in the policy package. </font></font><br /><font color="#999999"><font color="#000000"><br />Finally the original idea for writing this policy was caused by the AVC <br /></font></font><pre class="bz_comment_text"> allow rtkit_daemon_t initrc_t:process setsched; </pre><font color="#999999"><font color="#000000"> But I am creating a policy that will label icecast as icecast_t rather then initrc_t.&nbsp; I need to look for an interface that allows rtkit_daemon_t to setsched.</font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">&nbsp; Upstream SELinux Policy will not accept any &quot;te&quot; files that include types that are defined in a different policy file (rtkit_daemon_t).&nbsp; This means, I need to find an interface that will allow rktkit_daemon_t to setched on my process type, icecast_t.&nbsp; SELinux interface definitions are installed in the /usr/share/selinux/devel/include directory tree.&nbsp; Grepping through this for the correct interface, I find:<br /><br /></font></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999">grep -R rtkit_daemon_t.*setsched /usr/share/selinux/devel/include <br />/usr/share/selinux/devel/include/services/rtkit.if:&nbsp;&nbsp;&nbsp; allow rtkit_daemon_t $1:process { getsched setsched };</font><br /><br />Looking into </font></font><font color="#000000">/usr/share/selinux/devel/include/services/rtkit.if, </font>I see this access is granted using the<i> interface rtkit_daemon_system_domain</i>, which &nbsp; I add to icecast.te.<br /><br />optional_policy(`<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rtkit_daemon_system_domain(icecast_t)<br />')<br /><font color="#999999"><font color="#000000"><br />The optional_policy block will allow my policy to be installed systems that might not have rtkit policy defined.<br /><br />Compile and install the policy.</font></font><font color="#999999"><font color="#000000"><br /></font></font><font color="#999999"># sh icecast.sh <br />Building and Loading Policy<br />+ make -f /usr/share/selinux/devel/Makefile<br />Compiling targeted icecast module<br />/usr/bin/checkmodule:&nbsp; loading policy configuration from tmp/icecast.tmp<br />/usr/bin/checkmodule:&nbsp; policy configuration loaded<br />/usr/bin/checkmodule:&nbsp; writing binary representation (version 10) to tmp/icecast.mod<br />Creating targeted icecast.pp policy package<br />rm tmp/icecast.mod tmp/icecast.mod.fc<br />+ /usr/sbin/semodule -i icecast.pp</font><font color="#999999"><font color="#000000"><font color="#999999"><br /><br /><font color="#000000">I also want to set the correct apache labels for icecast.</font><br /><br /></font><font color="#999999"># restorecon -R -v /usr/share/icecast/</font><br /><font color="#999999">restorecon reset /usr/share/icecast context system_u:object_r:usr_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0<br />...<br /><br /># service icecast start<br />Starting icecast streaming daemon:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&nbsp; OK&nbsp; ]<br /># service icecast stop<br />Shutting down icecast streaming daemon:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&nbsp; OK&nbsp; ]<br /><br /><font color="#000000">The daemon runs and creates avc messages.&nbsp; Now I use the audit2allow command to generate allow rules.<br /><br /><font color="#999999"># audit2allow -la<br />#============= icecast_t ==============<br />allow icecast_t self:capability { sys_nice dac_override };<br />allow icecast_t self:process { setsched getsched };<br />#!!!! This avc can be allowed using the boolean 'allow_ypbind'<br /><br />allow icecast_t self:tcp_socket listen;<br />allow icecast_t soundd_port_t:tcp_socket name_bind;<br /></font><br /><br />While audit2allow suggested the allow_ypbind boolean, I realize that is not necessary.&nbsp;&nbsp; lets examine the allow rules.<br /></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999">allow icecast_t self:capability { sys_nice dac_override };<br /></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999">allow icecast_t self:process { setsched getsched };</font></font></font></font></font><br /><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">The sys_nice, getched and setsched&nbsp; permissions are caused by icecast_t setting its priority, which is probably ok.&nbsp; dac_override means that UID protection is being overridden.&nbsp; Looking closer at icecast I notice that the daemon runs as the icecast user and the avc is probably caused by writing to the /var/run/icecast directory.&nbsp; If this directory when owned by icecast, it probably would not generate this avc, but I am not sure.&nbsp; I will allow it for now.&nbsp; And open a bug with the icecast team to see if the directory should be owned by icecast.<br /><br /></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999">allow icecast_t self:tcp_socket listen;<br /></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999">allow icecast_t soundd_port_t:tcp_socket name_bind;<br /><br /></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">Since <i>rpm -qi</i> told me that icecast is a &quot;streaming media server&quot;, </font></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">Icecast listening on a soundd_port seems legitimate.&nbsp; <br /><br />I will add full permissions to the tcp_socket to icecast_t by adding the line.<br /><font color="#999999"><br />allow icecast_t self:tcp_socket create_stream_socket_perms;</font><br />&nbsp;&nbsp; <br />Note: SELinux permission macros are defined in /usr/share/selinux/devel/include/support/obj_perm_sets.spt. &nbsp; The sepolgen generated policy gave Icecast the ability to connect to tcp_sockets via the macro sysnet_dns_name_resolve(icecast_t).&nbsp; This macro allows icecast_t to connect to the dns port via tcp_socket.&nbsp; <br /><br />I can not use soundd_port_t in my te file since I did not define this type.&nbsp; I need to find an interface that allows icecast_t to bind to the soundd_port_t tcp port.&nbsp;&nbsp; Grepping through the SELinux interface files for the correct interface, if find:<br /><br /><font color="#999999"># grep -R interface.*soundd_port /usr/share/selinux/devel/include | grep tcp | grep bind<br />/usr/share/selinux/devel/include/kernel/corenetwork.if:interface(`corenet_tcp_bind_soundd_port',`<br />/usr/share/selinux/devel/include/kernel.xml:&lt;interface name=&quot;corenet_tcp_bind_soundd_port&quot; lineno=&quot;59287&quot;&gt;</font><br /><br />corenet_tcp_bind_soundd_port looks like the correct interface.<br /><br /></font></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999">corenet_tcp_bind_soundd_port(icecast_t)<br /></font></font></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><br />After I compile and install my policy,&nbsp; I restart the daemon and get no additional avc messages.&nbsp;&nbsp; </font></font></font></font></font></font><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">If I knew how to test icecast, I would run all lots of tests on it and and gather the avc messages.</font></font></font></font></font></font>&nbsp; But I have Rawhide :^).<font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000"><font color="#999999"><font color="#000000">&nbsp; I can just add my policy into rawhide and have people who actually use icecast generate AVC messages.&nbsp; Since the icecast policy runs in permissive mode, SELinux should not break icecast while I gather avc messages. <br /><br />Total time to write this policy was less then a half hour.&nbsp; It took me a lot longer to write this blog.<br /><br /></font></font></font></font></font></font><br /><br /><div class="zemanta-pixie"><img src="http://img.zemanta.com/pixy.gif?x-id=d1807c4e-cc42-87c0-9521-591643d92fb8" alt="" class="zemanta-pixie-img" /></div><div class="zemanta-pixie">&nbsp;</div> 2010-02-04T18:41:15+00:00 dwalsh@redhat.com http://jczucco.blogspot.com/2010/01/video-da-apresentacao-sobre-selinux-no.html <span>English version bellow.</span><br /><br />Abaixo segue o vídeo da apresentação feita por mim e pelo <a href="http://ulissescastro.wordpress.com">Ulisses Castro</a> no <a href="http://fisl.softwarelivre.org/10/www/">FISL-10 Forum Internacional de Software Livre</a>, realizado em Junho de 2009.<br /><br /><br /><br /><a href="http://stream.softwarelivre.org/video/selinux-everyday-sysadmins">http://stream.softwarelivre.org/video/selinux-everyday-sysadmins</a><br /><br /><div id="__ss_1669044"><a href="http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10" title="SELinux for Everyday SysAdmins - FISL 10">SELinux for Everyday SysAdmins - FISL 10</a><div>View more <a href="http://www.slideshare.net/">presentations</a> from <a href="http://www.slideshare.net/guest552ebe">guest552ebe</a>.</div></div><br /><br /><a href="http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10">http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10</a><br /><br />Na demonstração, confinamos uma <a href="http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/">PoC</a> de uma vulnerabilidade do PhpMyAdmin (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1151">CVE-2009-1151</a>), mostrando a sua exploração com selinux habilitado e desabilitado.<br /><br />Obrigado a todos que puderam comparecer na apresentação.<br /><br /><br /><span><br />English version:</span><br />Follow bellow the video of presentation that I've made with <a href="http://ulissescastro.wordpress.com">Ulisses Castro</a> in <a href="http://fisl.softwarelivre.org/10/www/">FISL-10 Free Software Internacional Forum</a>, in June of 2009.<br /><br /><br /><br /><div id="__ss_1669044"><a href="http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10" title="SELinux for Everyday SysAdmins - FISL 10">SELinux for Everyday SysAdmins - FISL 10</a><div>View more <a href="http://www.slideshare.net/">presentations</a> from <a href="http://www.slideshare.net/guest552ebe">guest552ebe</a>.</div></div><br /><br /><a href="http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10">http://www.slideshare.net/guest552ebe/selinux-for-everyday-sysadmins-fisl-10</a><br /><br />In the demonstration, we have confined a <a href="http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/">PoC</a> of a vulnerability of PhpMyAdmin (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1151">CVE-2009-1151</a>), with selinux enabled and disabled.<br /><br /> <br />Thanks to all who could attend the presentation.<div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/15117118-4027305150466239207?l=jczucco.blogspot.com" alt="" /></div> 2010-01-24T21:14:52+00:00 Jeronimo Zucco (jczucco@gmail.com) http://paulmoore.livejournal.com/5536.html There have been quite a few questions lately about how to enable the SELinux network ingress/egress controls on recent Fedora releases. This is good because it means people actually want to use this stuff, but it is also bad because it tells me that I haven't done a very good job explaining how to use them. Actually, looking back on this site I see that while I've written about the <a href="http://paulmoore.livejournal.com/2128.html">ingress/egress controls</a> I haven't described how you would enable them on a modern Linux distribution. Ooops.<br /><br />However, fear not faithful readers and confused administrators, for this is post shall explain, in four easy steps, how to enable the SELinux network ingress/egress controls. Without further ado, let's begin ...<br /><br />The first step is to ensure you have the <i>netlabel_tools</i> package installed. This is necessary because the <i>netlabel_tools</i> package contains the <i>netlabelctl</i> application which we will be using to configure NetLabel in the final step. Using <i>yum</i> you should be able to install <i>netlabel_tools</i> with the following command:<br /><br /><pre> # yum install netlabel_tools </pre><br />After you have installed the <i>netlabel_tools</i> package the next step is to ensure you have a SELinux policy module loaded which defines at least two new types: one to be assigned to a network interface and another to be assigned to network traffic. To be honest, you'll probably want to create more than just those two types but that will be dependent on your particular configuration; for more information I suggest you look at my <a href="http://paulmoore.livejournal.com/2128.html">original post on the ingress/egress controls</a> where I go into more detail on the policy aspect of these controls. Regardless of what you decide, for the example here I will be using "foo_netif_t" for the network interface type and "foo_peer_t" for the network traffic type.<br /><br />With the SELinux policy module loaded and our new types defined, it is time to assign our new network interface type to an interface on the system. We use the <i>semanage</i> tool to manipulate the SELinux types assigned to network interfaces, in order to add a type to an interface, "eth2" in this example, we use the following command:<br /><br /><pre> # semanage interface -a -t foo_netif_t eth2 </pre><br />We can verify that the interface is assigned the correct type with the following command:<br /><br /><pre> # semanage interface -l SELinux Interface Context eth2 system_u:object_r:foo_netif_t:s0 </pre><br />Now that we have the network interface labeled the final step is to setup some form of peer labeling on the network. For many of you not using CIPSO or labeled IPsec, this means configuring <a href="http://paulmoore.livejournal.com/1758.html">NetLabel's static/fallback labels</a>. In this example, we are going to configure all of the IPv4 and IPv6 traffic entering the system via "eth2" as having the "foo_peer_t" label; we do this with the following command:<br /><br /><pre> # netlabelctl unlbl add interface:eth2 address:0.0.0.0/0 label:system_u:object_r:foo_peer_t:s0 # netlabelctl unlbl add interface:eth2 address:::/0 label:system_u:object_r:foo_peer_t:s0 </pre><br />We can verify the configuration with the following command:<br /><br /><pre> # netlabelctl -p unlbl list Accept unlabeled packets : on Configured NetLabel address mappings (2) interface: eth2 address: 0.0.0.0/0 label: "system_u:object_r:foo_peer_t:s0" address: ::/0 label: "system_u:object_r:foo_peer_t:s0" </pre><br />At this point the SELinux network ingress/egress control should be up and running on your system. As a reminder, you'll want to be sure to have all the right allow rules for these new controls in your SELinux policy as simply adding the types without the allow rules could result in a total loss of network access; because of this I recommend you do this with SELinux in permissive mode until you are comfortable with how the system operates.<br /><br />Good luck, and as usual, if you have any problems or questions feel free to leave a comment below. 2010-01-22T22:35:42+00:00 http://paulmoore.livejournal.com/5194.html I'm more than a little late posting this, but below you'll find a copy of the NetLabel presentation I gave at this past year's LinuxCon. Sure, it is old news, but if you ever wanted to know what NetLabel does and why it exists in the first place this is still good stuff.<br /><br />Presentation download: <a href="http://free.linux.hp.com/~pmoore/files_lj/netlabel-linuxcon-09212009.pdf">NetLabel: What, Why &amp; Where</a> 2010-01-22T21:47:06+00:00 http://danwalsh.livejournal.com/34903.html Lets examine the SELinux error message; the AVC. <br />(Not something I like to do in a blog since AVC messages are scary)<br /><br />node=holycross.devel.redhat.com type=<b>AVC</b> msg=audit(12/13/2006 11:28:14.395:952) : avc: denied { getattr } for pid=7236 comm=<b>vsftpd</b> name=public_html dev=<b>dm-0</b> ino=<b>9601649</b> scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=<b>dir</b> <br /><br />node=holycross.devel.redhat.com type=<b>SYSCALL</b> msg=audit(12/13/2006 11:28:14.395:952) : arch=i386 syscall=<b>lstat64</b> success=no exit=0 <br />a0=8495230 a1=849c830 a2=874ff4 a3=328d28 items=0 ppid=7234 pid=7236 auid=dwalsh uid=dwalsh gid=dwalsh euid=dwalsh suid=dwalsh fsuid=dwalsh egid=dwalsh sgid=dwalsh fsgid=dwalsh tty=(none) comm=vsftpd exe=<b>/usr/sbin/vsftpd</b> subj=system_u:system_r:ftpd_t:s0 key=(null) <br /><br />This<b> </b>AVC<b> </b>message consists of two records, the actual <b>AVC</b> record and the <b>SYSCALL</b> record. The kernel generates both records when the SELinux system denies an access. This AVC message indicates that SELinux prevented <b>/usr/sbin/vsftpd</b> from the <b>getattr</b> access on a <b>dir</b> named <b>public_html</b>.<br /><br /><b>Which public_html directory? </b><br />Notice, the AVC records do not show the full path to public_html? Performance is the reason the kernel does not provide the full path. The kernel needs to allocate memory for the path before every syscall is called and then free it, when the syscall does not generate an error in order to add the full path to the AVC. Since AVC's should happen infrequently, the kernel reporting the full path is not considered worth the overhead. The AVC records do include the device, <b>dm-0</b>, and the inode, <b><b>9601649. </b></b>You can use the device and inode information to find the correct path if the file/directory still exists. <br /><br /><font color="#0036ff"># find / -inum <b><b>9601649</b></b></font><br /><br />But that is going to take a long time.<br /><br />The setroubleshoot tools uses the locate program to attempt to reassemble the path.<br /><br /><span># locate -r /public_html$<br />/home/dwalsh/public_html<br />/home/obama/public_html<br />...</span><br /><br />Then setroubleshoot uses stat to get the inode of each file returned and compares it to the ino in the AVC message, if they match it analyzes the full path. Of course you have to have mlocate package installed and running in a cron job to gather the paths.<br /><br />Sometimes AVC messages refer to mountpoints. In these cases the kernel reports the access against name=&quot;/&quot;. This is not necessarily the top level &quot;/&quot; that humans understand, but the root of the mounted file system. For example, if an AVC was generated against a file system mounted at /var, the kernel would say the name was &quot;/&quot; and report the device. Setroubleshoot attempts to translate the path &quot;/&quot; into &quot;/var&quot; by searching the mount table for a machine device.<br /><br />Sometimes AVC messages do not even report the name. For example look at this AVC message.<br />&nbsp;<br />node=freddi type=<b>AVC</b> msg=audit(1263843455.583:203): avc: denied { <b>dac_override</b> } for pid=6050 comm=&quot;<b>plymouthd</b>&quot; capability=1 scontext=system_u:system_r:plymouthd_t:s0 tcontext=system_u:system_r:plymouthd_t:s0 tclass=<b>capability</b><br /><br />node=freddi type=<b>SYSCALL</b> msg=audit(1263843455.583:203): arch=c000003e syscall=<b>open</b> success=no exit=-19 a0=d13a60 a1=2 a2=0 a3=7fff3cad2310 items=0 ppid=1 pid=6050 auid=4294967295 <b>uid=0 gid=0</b> euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=&quot;plymouthd&quot; exe=&quot;<b>/sbin/plymouthd</b>&quot; subj=system_u:system_r:plymouthd_t:s0 key=(null)<br /><br />These AVC records indicate that the <b>/sbin/plymouthd</b> program was denied the <b>open</b> access, because it required the <b>DAC_OVERRIDE capability</b>. Notice plymouthd is running as root (<b><b>uid=0 gid=0</b></b>).<br /><br /><b>What is the DAC_OVERRIDE capability?</b><br /><br />According to <a href="http://danwalsh.livejournal.com/data/&quot;http://www.selinuxbyexample.com/&amp;quot">SELinux By Example.</a> DAC_OVERRIDE allows a process to ignore Discretionary Access Controls including access lists. <br /><br />If a process running as root attempts to read a file in my homedir owned by dwalsh with -rw------- permissions, it would have to have DAC_OVERRIDE.<br /><br />This AVC message indicates that plymouthd tried to open some object (file/direcory/device) that root is not allowed to open, with standard permissions. But with capability checking the kernel does give us any information about the target object. This AVC access denial could simply be a file with the wrong permission bits or wrong ownership, and plymouthd would not need the access if the file permissions was fixed, but there is no way for us to figure it out from the AVC. :^(<br /><br />In this case we can turn on full auditing. This tells the kernel to save the path before each access check and report the path, if you generate an AVC. I do this on my machine by adding a rule to watch write on /etc/shadow. Add <br /><font color="#0036ff"><br /><span># echo &quot;-w /etc/shadow -p w&quot; &gt;&gt; /etc/audit/audit.rules <br /># service auditd restart</span><br /></font><br />These commands will turn on full auditing mode on your system. In this mode the kernel adds the <b>PATH</b> record to the AVC message:<br /><br />node=holycross.devel.redhat.com type=<b>PATH</b> msg=audit(12/13/2006 11:28:14.395:952) : name=<b>/home/dwalsh/public_html</b><br /><br />Making it clear which public_html directory is involved.<br /><br />When we suggested this to the person who reported the DAC_OVERRIDE problem above, he found that the /dev/fb device had permissions such that root could not open it.<br /><br />I run with full auditing turned on all the time, since I never notice any performance problems, most desktop users wouldn't. <br />If you want to turn off auditing you could remove the line and rerun <br /><span># service auditd restart.</span><br /><br />You can also add and remove rules using auditctl. 2010-01-20T19:14:44+00:00 dwalsh@redhat.com http://markelov.blogspot.com/2007/10/apparmor-novell-novell.html Когда говорят о мандатном контроле доступа (MAC) в Linux, обычно сравнивают Novell AppArmor (система более простая в использовании) и Fedora/RHEL SELinux (система, обеспечивающая более комплексную защиту). Так вот, на днях <a href="http://www.news.com/8301-13580_3-9796140-39.html">стало известно</a>, что Novell уволил лидера проекта AppArmor Crispin Cowan вместе с еще четырьмя разработчиками, работавшими над этим проектом. Cowan, ошеломленный увольнением, не собирается бросать свое детище. Он создал консалтинговую компанию <a href="http://www.mercenarylinux.com/">Mercenary Linux</a>, и, видимо, ждет, когда ее кто-нибудь поглотит: "If somebody loves us and one day wants to acquire Mercenary, that's great."<div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/7673377107942959487-6678427690171840198?l=markelov.blogspot.com" alt="" /></div> 2010-01-17T00:21:12+00:00 Andrey Markelov (noreply@blogger.com) http://danwalsh.livejournal.com/34765.html <a href="http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=222300840&amp;pgno=1"><br /></a><h2 class="headline"><a href="http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=222300840&amp;pgno=1"> Spear-Phishing Attacks Out Of China Targeted Source Code, Intellectual Property </a></h2> <a href="http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=222300840&amp;pgno=1"><font class="text"><b> Attackers used intelligence, custom malware to access Google, Adobe, and other U.S. companies' systems </b></font></a><br /><br /><br />Oh wait there is, <a href="http://danwalsh.livejournal.com/31146.html">SELinux sandbox.</a><br /><br /><br /><div class="zemanta-pixie"><img class="zemanta-pixie-img" alt="" src="http://img.zemanta.com/pixy.gif?x-id=8213e798-9454-83e0-814b-4c9f3b6e6f47" /></div> 2010-01-14T18:26:18+00:00 dwalsh@redhat.com http://selinux-mac.blogspot.com/2010/01/test-git-daemon-policy.html Clone my latest selinux-modules git repository:<br /><br />git clone git://84.245.6.206/selinux-modules.git<br />cd selinux-modules &amp;&amp; make -f /usr/share/selinux/devel/Makefile gitd.pp<br />semodule -d git; semodule -i gitd.pp<br />cp gitd.if /usr/share/selinux/devel/include/services/gitd.if<br /><br />To test the Git session server you should build a custom module calling the gitd_session_role template for your role:<br /><br />echo "policy_module(mygittest, 1.0.0)" > mygittest.te;<br />echo "optional_policy(\`" >> mygittest.te;<br />echo "gen_require(\`" >> mygittest.te;<br />echo "# Assuming you want to test as unconfined_t" >> mygittest.te;<br />echo "type unconfined_t;" >> mygittest.te;<br />echo "role unconfined_r;" >> mygittest.te;<br />echo "')" >> mygittest.te;<br />echo "gitd_session_role(unconfined_r, unconfined_t)" >> mygittest.te;<br />echo "')" >> mygittest.te;<br /><br />make -f /usr/share/selinux/devel/Makefile mygittest.pp<br />semodule -i mygittest.pp<br /><br />Make sure that port tcp:9418 open and that tcp-wrappers is configured to accept connectivity on this port.<br /><br />install git-daemon and its dependencies: yum install git-daemon.<br /><br />You must edit /etc/xinetd.d/git. set "disable" to "no", "server" to "/usr/libexec/git-core/git-daemon", and remove the "daemon" argument from "server_args". Keep an eye on /var/log/messages in case it behaves strange.<br /><br />Restore the following contexts:<br /><br />restorecon -R -v /var/lib/git<br />restorecon -v /usr/libexec/git-core/git-daemon<br />restorecon -v ~/.gitconfig<br />restorecon -v ~/public_git<br /><br />Start xinetd: service xinetd start.<br /><br />Set up a default git shell user for generic shared repositories:<br /><br />groupadd git<br />useradd -Z git_shell_u -M -s /usr/bin/git-shell joe<br />usermod -a -G git joe<br />passwd joe<br /><br />Set up a bare "test" shared repostory:<br /><br />mkdir /var/lib/git/test.git<br />cd /var/lib/git/test.git &amp;&amp; git --bare init<br />chown -R root:git /var/lib/git/test.git<br />chmod -R g+w /var/lib/git/test.git<br />chmod -R g+s /var/lib/git/test.git<br />chmod -R +t /var/lib/git/test.git<br /><br />From your "normal" user account clone the bare repository:<br /><br />git clone git://localhost/test.git<br />cd test<br /><br />Make changes to it:<br /><br />echo "test" > test;<br />git init<br />git add .<br />git commit -a -s -m "My initial commit."<br /><br />As user "joe" push to the shared repository:<br /><br />git push --all git+ssh://joe@localhost/var/lib/git/test.git<br />git pull<br />git status<br />git show<br /><br />Testing Git session:<br /><br />Stop xinetd and in your "normal" (we are done with "joe" for now) user home directory make sure ~/public_git exists.<br />restorecon -R -v /public_git<br />Previously we called a "gitd_session_role" template for users operating in the unconfined_t domain. This means when your id -Z returns: unconfined_u:unconfined_r:unconfined_t:s0, git with the daemon option will run in a Git session SELinux environment for you.<br /><br />Create a new personal repository in ~/public_git:<br /><br />mkdir ~/public_git/hello<br />cd ~/public_git/hello<br />git init<br />echo "hello" > hello<br />git add .<br />git commit -a -s -m "My initial commit."<br /><br />Serve your personal repository with the following command:<br /><br />git daemon --export-all --user-path=public_git<br /><br />In another terminal clone the repository:<br /><br />git clone git://localhost/~yourloginnamehere/hello<br /><br />Make a commit to it:<br /><br />cd hello<br />echo "bye" >> hello<br />git commit -a -s -m "Add good bye"<br /><br />Push the change to your personal repository:<br /><br />git push --all ssh://yourloginnamehere@localhost/~/public_git/hello<br /><br />Hosting personal repositories with Git system daemon.<br /><br />Stop your Git session daemon (ctrl-c) and start xinetd.<br /><br />Set the boolean to allow the Git system daemon to search user home directories for personal Git repositories to serve:<br /><br />setsebool gitd_system_enable_homedirs on<br /><br />Now clone the personal repository again:<br /><br />git clone git://localhost/~yourloginnamehere/hello<br />cd hello<br />echo "hi" >> hello<br />git commit -a -s -m "Added Hi."<br /><br />And push to the personal repository:<br /><br />git push --all ssh://yourloginnamehere@localhost/~/public_git/hello<br /><br />Create a customized Git Shell user that has access to a restricted shared repository (besides having access to any generic system repositories) Also create a restricted repository and allow our created Git shell user access to this new restricted repository.<br /><br />echo "policy_module(secret_git_shell, 1.0.0)" > secret_git_shell.te;<br />echo "gitd_role_template(secret_git_shell)" >> secret_git_shell.te;<br />echo "gitd_content_template(secret)" >> secret_git_shell.te;<br />echo "gitd_content_delegation(secret_git_shell_t, gitd_secret_content_t)" >> secret_git_shell.te;<br />echo "gen_user(secret_git_shell_u, user, secret_git_shell_r, s0, s0)" >> secret_git_shell.te;<br /><br />echo "/var/lib/git/secret\.git(/.*)? gen_context(system_u:object_r:gitd_secret_content_t, s0)" > secret_git_shell.fc;<br /><br />make -f /usr/share/selinux/devel/Makefile secret_git_shell.pp<br />semodule -i secret_git_shell.pp<br /><br />Create a secret Git shell user:<br /><br />useradd -Z secret_git_shell_u -M -s /usr/bin/git-shell jane<br />usermod -a -G git jane<br />passwd jane<br /><br />Create a bare secret shared repository:<br /><br />mkdir /var/lib/git/secret.git<br />cd /var/lib/git/secret.git &amp;&amp; git --bare init<br />chown -R root:git /var/lib/git/secret.git<br />chmod -R g+w /var/lib/git/secret.git<br />chmod -R g+s /var/lib/git/secret.git<br />chmod -R +t /var/lib/git/secret.git<br /><br />Restore the context of the secret repository:<br /><br />restorecon -R -v /var/lib/git/secret.git<br /><br />Everyone can read it but only jane can push to it. As a "normal" user clone the secret repository.<br /><br />git clone git://localhost/secret.git<br />cd secret<br />echo "secret" > secret<br />git init<br />git add .<br />git commit -a -s -m "My first commit."<br /><br />Push it as user "jane"<br /><br />git push --all git+ssh://jane@localhost/var/lib/git/secret.git<br />git pull<br />git status<br />git show<br /><br />Make another commit:<br /><br />echo "Joe here" >> secret<br />git commit -a -s -m "add Joe here"<br /><br />Now try to push it as user "joe" (joe can push generic shared repositories but joe is not allowed to push to the secret repository)<br /><br />git push --all git+ssh://joe@localhost/var/lib/git/secret.git<div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-6107822133917796557?l=selinux-mac.blogspot.com" alt="" /></div> 2010-01-14T11:27:29+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://danwalsh.livejournal.com/34557.html If you go to<a href="http://planet.fedoraproject.org/security"> http://planet.fedoraproject.org/security/</a> you will see all Fedora people that have characterized their blogs as being interesting to security people.<br /><br />Fedora people can syndicate themselves by logging into their shell accounts on people.fedoraproject.org and create a file in their homedir called .planet or .planet.security.<br /><br />My file looks like<br /><br /><font color="#3366ff">more .planet<br />[<a href="http://www.livejournal.com/users/danwalsh/data/rss/]">http://www.livejournal.com/users/danwalsh/data/rss/]</a><br />name = Dan Walsh<br />face = <a href="http://dwalsh.fedorapeople.org/dwalsh.jpeg">http://dwalsh.fedorapeople.org/dwalsh.jpeg</a></font><br /><br />If the file is named .planet the blog will show up in <a href="http://planet.fedoraproject.org">http://planet.fedoraproject.org</a>.&nbsp; .planet.security will show the blog in <a href="http://planet.fedoraproject.org/security">http://planet.fedoraproject.org/security</a>.<br /><br />I have a symbolic link between the two files so my blog shows up in both places.&nbsp; The security planet currently consists of most of the IPA guys and myself.&nbsp; Hopefully others will join as it becomes more well known.<br /><br /><br /><div class="zemanta-pixie"><img class="zemanta-pixie-img" alt="" src="http://img.zemanta.com/pixy.gif?x-id=7075f070-09ee-8586-b252-dd9a7837e66d" /></div> 2010-01-12T20:25:55+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/34279.html I am writing this blog in ScribeFire, hopefully it will work correctly.<br /><br />I have been talking to Richard Jones about guestfish and SELinux and he is trying his best to educate me.<br /><br />One of the things I did not understand is that <a href="http://libguestfs.org/guestfs.3.html#architecture">guestfish</a> actually starts a kernel, it is sort of a mini virtual machine.<br /><br />Therefore load_policy would load into the the guest kernel, and not capable of harming the host os.<br /><br />Currently the administrator has to tell guestfish that it is using selinux, and even has a --selinux option.&nbsp; Sadly this flag does work if you specify -i.<br /><br /># guestfish -i rhel5 --selinux<br />guestfish: cannot use -i option with -a, -m, --listen, --remote or --selinux<br /><br />You can however execute<br /><br />guestfish `virt-inspector --fish rhel5` --selinux<br />&gt; &lt;fs&gt; sh "load_policy"<br />&gt; &lt;fs&gt; sh "restorecon /etc/resolv.conf"<br /><br />One problem I see with this is that guestfish should really figure out if the guest os is running selinux and then turn it on and load_policy by default.<br /><br /><a href="https://bugzilla.redhat.com/show_bug.cgi?id=554829">https://bugzilla.redhat.com/show_bug.cgi?id=554829</a><br /><br />Without fixing this problem, users of guestfish on selinux enabled systems have to be careful.&nbsp; Because if you do not turn on the -selinux flag and load_policy, you could create files/directories without labels (file_t).&nbsp; This could then cause the virtual machine to not work correctly when you boot it.<br /><br /><br /><br /><br /><br /><br /><div class="zemanta-pixie"><img class="zemanta-pixie-img" alt="" src="http://img.zemanta.com/pixy.gif?x-id=2f2d34aa-b5ea-8dd8-b5df-d69e63b158b4" /></div> 2010-01-12T20:10:36+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/33728.html Note:<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; First let me apologize for the previous post.&nbsp; For some reason livejournal.com was adding a bunch of line-breaks (&lt;/br&gt;) to my previous post when I submitted it. &nbsp;I tried to remove it but the editor did not show them.&nbsp;&nbsp;Must be a bug with using tables in the editor.<br /><br />The other day, <a href="http://rwmj.wordpress.com/2010/01/06/tip-autorelabel-a-vm/">Richard Jones posted a blog on using guestfish to fix an SELinux issue.</a><br /><br />After reading the blog, I&nbsp;thought I would play around with guestfish a little bit.&nbsp; He suggested that you could fix&nbsp; a labelling issue on a virtual image by execute touch /.autorelabel and then booting the virtual image.&nbsp;&nbsp; &nbsp;I&nbsp;experimented around and found that you could execute the following command and fix the labels before the boot.&nbsp; I have an virtual machine named f12.<br /><div class="entry"><p><span># guestfish -i f12</span><br /><br />A potential easier solution to fix the labelling issue brought up in Richard's blog would be</p> <p><span>&gt;&lt;fs&gt; sh &ldquo;/sbin/setfiles -q /etc/selinux/targeted/contexts/files/file_contexts /&rdquo;</span><br /><br />This command would correct the labels on the system.&nbsp; It will run for while.<br /><br /><span>&gt;&lt;fs&gt; sh &quot;/usr/sbin/sestatus&quot;<br />SELinux status:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; disabled</span><br /><br />One problem with guestfish is that it does not setup the environment enough for the SELinux libraries to recognise that this is an SELinux environment.&nbsp;&nbsp; libselinux uses the /proc/filesystem and /selinux file systems to figure out if SELinux is enabled or not.&nbsp; Since these file systems are not enabled, the tools are fooled into thinking the system is disabled.&nbsp; This is both a good and a bad thing.&nbsp; It is a good thing because tools like load_policy will not actually load the policy.&nbsp; Loading policy could mess up your host machine.&nbsp; S you were running on F12 and connected to a RHEL5 guest, if you loaded policy in the guest and it got loaded onto the host, you machine would probably break badly.&nbsp; Not recognising SELinux is enabled on this os can be a bad thing in that tools like restorecon will not work.&nbsp;&nbsp; Restorecon exits on disabled machines.&nbsp; Tools like setfiles and semanage can run on disabled machines.&nbsp; Semanage requires you to specify the store (-s targeted) in order to work on a &quot;disabled&quot; machine.&nbsp;&nbsp;For example semanage user -l -s targeted.<br /> <br />One possible use of this functionality would be to change the policy type on a guest os. If you wanted to turn the box into an MLS&nbsp;box you could execute.<br /><br /><span>&gt;&lt;fs&gt; sh &quot;/bin/sed s/SELINUXTYPE=.*/SELINUXTYPE=mls/g /etc/selinux/config&quot;<br />&gt;&lt;fs&gt; sh &quot;/sbin/setfiles -q /etc/selinux/mls/targeted/contexts/files/file_contexts /&quot;<br />&gt;&lt;fs&gt; sync<br />&gt;&lt;fs&gt; sync</span><br /><br />Of course the mls policy would have had to be installed before this would work.&nbsp; I don't think you can run yum install selinux-policy-mls from guestfish.&nbsp; <br /><br />If you wanted to change the ports that apache can listen on you could execute a command like:<br /><span><br />&gt;&lt;fs&gt; sh &quot;/usr/sbin/semanage port -a -s targeted -t http_port_t -p tcp 81&quot;</span><br /><br />Someone seems to have built some SELinux code into guestfish and guestfs. (Not me).<br /><br /><span>set-selinux 0 or 1</span><br />seems to set the boot flag to enable or disable SELinux (Enabled defaults to permissive mode)</p></div>Not sure if this works, as examining the /etc/grub and /etc/selinux/config file is not modified.&nbsp; <br /><br />I think I&nbsp;would tend to avoid using the built-in commands, as they do not seem to work correctly.<br /> 2010-01-11T18:42:59+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/33287.html I often get asked how many processes are confined with SELinux.&nbsp; <br /><br />In RHEL4 we estimated around 15.<br />In RHEL5 we estimated around 200.<br /><br />Well there is a cool tool called seinfo (setools package) that allows you query the installed policy for attributes and types,&nbsp; as well as other policy features.&nbsp; In SELinux, every process type has an attribute associated with it called &quot;domain&quot;.&nbsp; <br /><br />A good estimate of the number of different confined processes is to count the number of types with the domain attribute.<br /><span><br />seinfo -adomain -x | tail -n +2 | wc -l<br />513</span><br /><br />Note: I am removing the first line because it lists the attribute name.<br /><br />Not all domain types are confined. If we want to look at the number of unconfined domains, we can use the unconfined_domain attribute.<br /><br /><span>seinfo -aunconfined_domain_type -x | tail -n +2 | wc -l<br />52</span><br /><table width="200" cellspacing="1" cellpadding="1" border="1"><caption>Unconfined Domains</caption><tbody><br /><tr><br /><td>bootloader_t</td><br /><td>devicekit_power_t</td><br /><td>ldconfig_t</td><br /><td>unconfined_cronjob_t</td><br /><td>unconfined_sendmail_t</td><br /></tr><br /><tr><br /><td>setfiles_mac_t</td><br /><td>initrc_t</td><br /><td>ada_t</td><br /><td>fsadm_t</td><br /><td>kudzu_t</td><br /></tr><br /><tr><br /><td>lvm_t</td><br /><td>mdadm_t</td><br /><td>mono_t</td><br /><td>rpm_t</td><br /><td>wine_t</td><br /></tr><br /><tr><br /><td>unconfined_mount_t</td><br /><td>prelink_t</td><br /><td>anaconda_t</td><br /><td>rpm_script_t</td><br /><td>system_cronjob_t</td><br /></tr><br /><tr><br /><td>tmpreaper_t</td><br /><td>samba_unconfined_net_t</td><br /><td>unconfined_notrans_t</td><br /><td>unconfined_execmem_t</td><br /><td>devicekit_disk_t</td><br /></tr><br /><tr><br /><td>firstboot_t</td><br /><td>samba_unconfined_script_t</td><br /><td>unconfined_java_t</td><br /><td>unconfined_mono_t</td><br /><td>httpd_unconfined_script_t</td><br /></tr><br /><tr><br /><td>depmod_t</td><br /><td>insmod_t</td><br /><td>kernel_t</td><br /><td>livecd_t</td><br /><td>apmd_t</td><br /></tr><br /><tr><br /><td>clvmd_t</td><br /><td>crond_t</td><br /><td>inetd_t</td><br /><td>init_t</td><br /><td>udev_t</td><br /><td>virtd_t</td><br /></tr><br /><tr><br /><td>xend_t</td><br /><td>nagios_unconfined_plugin_t</td><br /><td>devicekit_t</td><br /><td>remote_login_t</td><br /><td>inetd_child_t</td><br /></tr><br /><tr><br /><td>qemu_unconfined_t</td><br /><td>unconfined_t</td><br /><td>ricci_modcluster_t</td><br /><td>useradd_t</td><br /><td>xserver_t</td><br /></tr><br /></tbody></table><br /><br />If you disable the unconfined policy package, which I recommend.<br /><br />This leaves only user domains unconfined, along with some domains that do not make sense to confine.&nbsp; (anaconda, firstboot, kernel,rpm)<br /><span><br /># semodule -d unconfined<br />seinfo -aunconfined_domain_type -x | tail -n +2 | wc -l<br />14</span><br /><br /><table width="200" cellspacing="1" cellpadding="1" border="1"><caption>Unconfined User Domains</caption><tbody><br /><tr><br /><td>unconfined_sendmail_t</td><br /><td>rpm_t</td><br /><td>unconfined_mount_t</td><br /><td>anaconda_t</td><br /><td>rpm_script_t</td><br /></tr><br /><tr><br /><td>unconfined_notrans_t</td><br /><td>unconfined_execmem_t</td><br /><td>firstboot_t</td><br /><td>unconfined_java_t</td><br /><td>unconfined_mono_t</td><br /></tr><br /><tr><br /><td>kernel_t</td><br /><td>livecd_t</td><br /><td>qemu_unconfined_t</td><br /><td>unconfined_t</td><br /></tr><br /></tbody></table><br /><br />You can disable all unconfined domains by disabling unconfineduser module<br /><span><br /># semodule -d unconfineduser</span><br /><br />Note: You need to setup all your users as confined users, before removing the unconfineduser module. <br />Disabling the unconfined and unconfineduser policy modules is the equivalent of what we used to call strict policy.<br /><br />One other interesting domain is permissive domains. Permissive domains can be listed with the --permissive qualifier.<br /><br /><span># seinfo --permissive -x | tail -n +3 | wc -l<br />31</span><br /><br /><table width="200" cellspacing="1" cellpadding="1" border="1"><caption>Permissive Domains</caption><tbody><br /><tr><br /><td>gitd_session_t</td><br /><td>smoltclient_t</td><br /><td>kdumpgui_t</td><br /><td>sandbox_xserver_t</td><br /><td>prelink_cron_system_t</td><br /></tr><br /><tr><br /><td>abrt_helper_t</td><br /><td>firewallgui_t</td><br /><td>corosync_t</td><br /><td>asterisk_t</td><br /><td>dnsmasq_t</td><br /></tr><br /><tr><br /><td>plymouth_t</td><br /><td>chrome_sandbox_t</td><br /><td>nut_upsd_t</td><br /><td>plymouthd_t</td><br /><td>ksmtuned_t</td><br /></tr><br /><tr><br /><td>nagios_checkdisk_plugin_t</td><br /><td>nagios_services_plugin_t</td><br /><td>abrt_t</td><br /><td>clogd_t</td><br /><td>gitd_t</td><br /></tr><br /><tr><br /><td>kdump_t</td><br /><td>tgtd_t</td><br /><td>tuned_t</td><br /><td>nagios_system_plugin_t</td><br /><td>nut_upsmon_t</td><br /></tr><br /><tr><br /><td>rgmanager_t</td><br /><td>certmonger_t</td><br /><td>sectoolm_t</td><br /><td>chronyd_t</td><br /><td>nut_upsdrvctl_t</td><br /></tr><br /><tr><br /><td>vhostmd_t</td><br /></tr><br /></tbody></table><br />A couple of other interesting statistics.<br /><br />Total number of file types.<br /><br /><span>seinfo -afile_type -x | tail -n +2&nbsp; | wc -l<br />1630</span><br /><br />In order to get the number of allow rules, you need to use sesearch<br /><span><br />sesearch --allow | wc -l<br />225042</span><br /><br />Dontaudit Rules<br /><br /><span>sesearch --dontaudit | wc -l<br />106021<br /></span> 2010-01-06T17:23:19+00:00 dwalsh@redhat.com http://thetoms-random-thoughts.blogspot.com/2010/01/odf-fuzzer.html <p>An ODF fuzzer is available at: <a href="http://gitorious.org/odf-fuzzer">http://gitorious.org/odf-fuzzer</a><br /><!-- BlogCounter Code START --></p><p>It was written by Ravipriya Thushara... feel free to use it and report bugs! :-)<br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-8578843398418873152?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2010-01-06T00:47:04+00:00 Thomas (noreply@blogger.com) http://danwalsh.livejournal.com/33090.html Every time I demonstrate sandbox to some one, they say, &quot;That's great, but can it do X, Y and Z?&quot;&nbsp;<br /><br />I&nbsp;have taken those suggestions along with some great patches from Josh Cogliati, I&nbsp;have updated the sandbox tool.<br /><br />New Features:<br /><br /><span>&gt; man sandbox</span><br /><br /><span>SANDBOX(8)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; User Commands&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SANDBOX(8)<br /> <br /> </span><span>NAME<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sandbox - Run cmd under an SELinux sandbox<br /> <br /> SYNOPSIS<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sandbox&nbsp; [-l level ] [[-M | -X]&nbsp; -H homedir -T tmpdir ] [-I includefile<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ] [[-i file ]...] [ -t type ] cmd<br />...<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -M&nbsp;&nbsp;&nbsp;&nbsp; Create a Sandbox&nbsp; with&nbsp; temporary&nbsp; files&nbsp; for&nbsp; $HOME&nbsp; and&nbsp; /tmp,<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; defaults to sandbox_t<br /><br /></span><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -H homedir<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Use alternate homedir to mount.&nbsp; Defaults to temporary. Requires<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -X or -M.<br /> <br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -T tmpdir<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Use alternate tempdir to mount.&nbsp; Defaults to temporary. Requires<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -X or -M.</span><br /> <span>...<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -l&nbsp;&nbsp;&nbsp;&nbsp; Specify the MLS/MCS&nbsp; Security&nbsp; Level&nbsp; to&nbsp; run&nbsp; the&nbsp; sandbox&nbsp; in.<br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Defaults to random.<br /> ...<br /></span><br />Several people asked for a permanent Homedir and tmpdir, rather then blowing it away when you exit.&nbsp; We added -H and -T qualifiers to allow you to specify a homedir and/or tmpdir that sandbox will use and leave in tact when it completes. <br /><br />For example you can use<br /><span><br />mkdir /tmp/myweb ~/myweb<br />sandbox -X -T /tmp/myweb -H ~/myweb -t sandbox_web_t firefox danwalsh.livejournal.com</span><br /><br />Then you can download any content, setup bookmarks ... and the sandbox will not remove them when you are done.&nbsp;&nbsp; If you later run a command with the same sandbox homedir and tmpdir, the content will be there.&nbsp; <br /><br /><span>sandbox -X -T /tmp/myweb -H ~/myweb -t sandbox_web_t firefox danwalsh.livejournal.com</span><br /><br />You could use similar sandbox commands for games, you could use sandbox to stop any rogue game from attacking your system, but be able to save your levels.<br /><br />Note: You would not be able to run two sanbox at the same time with the same homedir.&nbsp; Unless ....&nbsp; Read on.<br /><br />I met Stephen&nbsp; Smoogen at the Fedora Summit and he asked if we could use sandbox with MLS&nbsp;environments. &nbsp;<br />I added a -l option to sandbox which allows you to select the MCS/MLS&nbsp;level you wish to run at.&nbsp; <br /><br /><span>sandbox -X -l TopSecret ooffice ~/MySecrets.odf</span><br /><br />Should work on an MLS&nbsp;X Station.&nbsp; This would run a X Session at TopSecret running openoffice on a copy of MySecrets.odf.<br /><br />If you combine this with selection of levels, you can start to do stuff like<br /><span><br />mkdir ~/homedir_TopSecret /tmp/tmp_TopSecret<br />chcon -t TopSecret ~/homedir_TopSecret /tmp/tmp_TopSecret<br />sandbox -X -l TopSecret -H ~/homedir_TopSecret -I /tmp/tmp_TopSecret xterm</span><span><br /><br /></span>And now you are running an xterm at TopSecret on permanent files that are TopSecret. &nbsp; I&nbsp;actually like this better then Xace, but that is for another blog.<br /><br />Note:&nbsp; Fedora 12 has not been certified for LSPP, but you should be able to run MLS&nbsp;policy on it.<br /><br />MLS&nbsp;is not required, you can also specify an MCS&nbsp;domain and the tool will still work,&nbsp; This allows you to run two sandboxes at the same time with the same homedir/tmpdir. <br /><br />Finally we added the -M&nbsp;which allow non -X sandboxes to run with temporary or permanent storage.<br /><br />Depending on the sandbox's you might have to add more privs to the SELinux types in order to get them to work. &nbsp;For example, I&nbsp;think we need a sandbox_games_t type.&nbsp; Anyone want to take a stab.<br /><br />sandbox_x_domain_template(sandbox_games)<br /><br />Will get you started.<br /><br />Now if we could only get re-sizable Xephyr, or at least allow the user to specify the sandbox X window size. 2010-01-05T21:04:41+00:00 dwalsh@redhat.com http://thetoms-random-thoughts.blogspot.com/2010/01/command-line-tool-fuzzer-beta-2.html <p>Happy new year!</p><p><!-- BlogCounter Code START -->On my train travel to Nuernberg I heavily rewrote fuzz-cmdline while testing it by fuzzing several setuid command-line tools on openSUSE 11.2.</p><p><a href="http://www.suse.de/%7Ethomas/projects/fuzz-cmdline/index.html">fuzz-cmdline Beta 2 can be downloaded</a> and tested now. Your comments are welcome.</p><p>What is new:</p><ul><li>removed Fuzzled framework and use own Fuzz.pm (this, unfortunately, disables the reload option of beta 1)<br /></li><li>more fuzzing data</li><li>combination of different fuzz types<br /></li><li>better configuration</li><li>improved crash logging</li><li>...</li></ul>TODO:<br /><ul><li>'reload' option</li><li>also send data to stdin and local IPC constructs</li><li>better crash detection</li><li>more fine-tuning of fuzzing data</li><li>beep on crash (?)</li><li>re-enable gdb usage (?)<br /></li><li>...<br /></li></ul><br /><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-6930836094501982826?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2010-01-05T06:28:24+00:00 Thomas (noreply@blogger.com) http://etbe.coker.com.au/2009/12/15/play-machine-online-again/ <p>I have returned from the US and my <a href="http://www.coker.com.au/selinux/play.html">SE Linux Play Machine [1]</a> is online again.</p> <p>It was unfortunate that I forgot to pack one of my Play machine shirts, I ended up attending a meeting of the <a href="http://www.sdforum.org/">SDForum [2]</a> on the topic of Cloud Security (it was a joint meeting of the Cloud Services and Security SIGs) and it would have been good to have been wearing a root password.</p> <ul> <li>[1]<a href="http://www.coker.com.au/selinux/play.html"> http://www.coker.com.au/selinux/play.html</a></li> <li>[2]<a href="http://www.sdforum.org/"> http://www.sdforum.org/</a></li> </ul> 2009-12-15T02:00:50+00:00 etbe http://blog.namei.org/2009/12/09/foss-in2009-great-conference-or-greatest-conference/ <p>Last week, I attended <a href="http://foss.in/">FOSS.IN</a>, which had its origins as a community event <a href="http://linux-bangalore.org/blug/events/itcom99/">ten years ago</a>, and has evolved to become one of the world&#8217;s leading Free and Open Source developer gatherings.   Even in the years I&#8217;ve attended since 2005, it&#8217;s been remarkable to see the progress of the event, from a somewhat traditional presentation-based conference with most attendees being end users, to a developer-oriented week where the main track talks are secondary, and where a lot of real work is done.</p> <p>This year, the program included Project of the Day sessions, where major FOSS projects held a mini-conferences.    I attended some of the <a href="http://fedoraproject.org/wiki/Foss_in_2009">Fedora PoTD sessions</a>, including Joerg Simon&#8217;s talk on creating a Fedora Security Spin.  An expo area was also assigned for major projects throughout the conference, where you&#8217;d often find Fedora, KDE etc. folk hanging out &#8212; hacking, chatting, and helping people who passed by (including myself, when my Macbook decided to have EFI issues with F12).</p> <p><a title="FOSS.IN/2009 by x_jamesmorris, on Flickr" href="http://www.flickr.com/photos/x_jamesmorris/4165661072/"><img src="http://farm3.static.flickr.com/2786/4165661072_2720c8b9b3.jpg" alt="FOSS.IN/2009" width="500" height="375" /></a></p> <p><em>Fedora table at the FOSS expo area.</em></p> <p>There were also workshops (tutorials), and workout sessions, where groups of people would gather and work on a project for a period of hours or days (up to the full length of the conference).   Notable here were Harald Welte&#8217;s GSM workout, and a well-attended hardware hacking workout, run by Milosch and Brita Meriac of <a href="http://ccc.de/">CCC</a> and <a href="http://www.blinkenlights.net/stereoscope">Blinkenlights</a> fame.  I think these ran all week.  There were also workouts for GNOME performance, the <a href="http://www.sahana.lk/">SAHANA</a> disaster management system, <a href="http://edu.kde.org/kstars/">KStars</a>, and web identity, to name a few that I can recall off-hand.  There really was an incredible amount of stuff going on.</p> <p>I participated in the Linux Kernel workout, which filled the final afternoon of the conference, as well as all the remaining room in the workout area.</p> <p><a title="FOSS.IN/2009 Kernel Workout Session by x_jamesmorris, on Flickr" href="http://www.flickr.com/photos/x_jamesmorris/4160101260/"><img class="aligncenter" src="http://farm3.static.flickr.com/2607/4160101260_d1fce4ea64.jpg" alt="FOSS.IN/2009 Kernel Workout Session" width="500" height="375" /></a></p> <p><em>Linux Kernel Workout Session</em></p> <p>The kernel workout, which was organized by Kamalesh Babulal, included work on specific development tasks, and mentoring of new kernel developers.  It was a little chaotic at first, but ended up being a very productive session, and seemed to be over too soon.  I&#8217;d suggest holding this over perhaps 2-3 entire days next year.</p> <p>I also gave a talk on SELinux Sandboxing internals, to demonstrate how to utilize various Linux OS features such as namespaces and Mandatory Accees Control (MAC) security, and also how useable and effective security can be implemented via high-level abstractions and encapsulation.  This was similar to the talk I gave at FOSS.MY (and will also give at <a href="http://www.lca2010.org.nz/">LCA</a>), the slides of which may be found <a href="http://namei.org/presentations/selinux-sandboxing-fossmy2009.pdf">here</a>.  I think it&#8217;s very important for people to understand that there are no silver bullets for security, especially as we&#8217;re working with an OS which was not designed with security primarily in mind.   At the lowest levels, security on a general purpose OS is inherently complicated, and like most other problems in computing, we solve this with layers of abstraction.  You don&#8217;t need to understand the inner working of your CPU to play Scrabulous, for example.  I think we&#8217;re gradually getting the message across, and I really hope to see more people engaged in helping to solve the always increasingly difficult problems in computer security.  We&#8217;ve made a lot of progress overall, but still have a long way to go.</p> <p><a title="FOSS.IN/2009 by x_jamesmorris, on Flickr" href="http://www.flickr.com/photos/x_jamesmorris/4165670492/"><img class="aligncenter" src="http://farm3.static.flickr.com/2695/4165670492_62cd85f003.jpg" alt="FOSS.IN/2009" width="500" height="375" /></a></p> <p><em>Preparing for the closing session</em>.</p> <p>I&#8217;d like to give a special thanks to the FOSS.IN team, who are all volunteers, and who manage each year to organize a very complex event and provide truly great hospitality.  I missed the closing talk (and <a href="http://www.flickr.com/photos/swatisani/4165913600/">rock concert</a>) to make a flight, although read that <a href="http://atulchitnis.net/">Atul Chitnis</a> will be stepping back as leader of the event next year.   The conference as it is today reflects his personal vision for fostering core FOSS development activity in India, and it has been inspirational to witness the progress of this.  It will be interesting to see who steps up to lead the conference next, and where they will take it.</p> 2009-12-09T10:19:03+00:00 jamesm http://d.hatena.ne.jp/kaigai/20091204/1259939032 <div class="section"> <p>あまり有効に活用されているとは言い難いSELinuxのRBACだが、最近は地味にロールの種類が増えてきているようだ。</p> <p>Reference Policy の policy/modules/roles 以下を見てみると、こんな感じで結構盛りだくさん。</p> <blockquote> <p>$ ls *.te</p> <p>[kaigai@ayu roles]$ ls *.te</p> <p>auditadm.te</p> <p>guest.te</p> <p>logadm.te</p> <p>secadm.te</p> <p>staff.te</p> <p>sysadm.te</p> <p>unprivuser.te</p> <p>webadm.te</p> <p>xguest.te</p> </blockquote> <p>WebやAuditなど、特定用途に特化したROLEが定義されている。</p> <p>つまり、この人たちはWeb関連のファイルや、Audit関連のファイルしか</p> <p>アクセスできない。たとえ sudo を使って root の権限を取得したとしてもだ。</p> <p>データベース管理に特化したROLEというのは定義されていなかった…というか、多分それは俺の仕事なので、dbadm というロールを追加するパッチを投稿した。</p> <p><a href="http://oss.tresys.com/pipermail/refpolicy/2009-December/001804.html" target="_blank">http://oss.tresys.com/pipermail/refpolicy/2009-December/001804.html</a></p> <p>今のところ、PostgreSQL関連のファイルとMySQL関連のファイル（動作未確認）を操作する事ができ、suやsudoを実行する事ができる。</p> <p>加えて、SE-PostgreSQLの場合には CREATE TABLE などの DDL 文を実行して</p> <p>スキーマ定義を行う事ができる。但し、SELECTやUPDATEなどのDML文の実行は、sepgsql_unconfined_admin条件変数によって制御する。</p> <p>つまり、スキーマ定義はできるけども、ユーザデータの参照/更新は不可というデータベース管理者を作りたい。○racleのインスパイアという事だがｗ</p> <p>更に、将来的には JLS のセッションで紹介したシステムイメージを実現するような形にしたい。</p> <p><a href="http://f.hatena.ne.jp/kaigai/20091204233827" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20091204/20091204233827.png" alt="f:id:kaigai:20091204233827p:image" title="f:id:kaigai:20091204233827p:image" class="hatena-fotolife" /></a></p> <p>これは "System-wide consistency in access control" の最も先鋭的な例で、要は、データベース管理者であってもユーザデータを自由に参照/更新させたくないのであれば、そのアクセス手段に関係なく防がなくちゃいけないよね？というモデルである。</p> <p>このポリシーの下では、データベース管理者はＳＱＬでのユーザデータへのアクセスは不可。ファイルの直接アクセスもSELinuxが防ぐ。</p> <p>それだと、バックアップすら取得する事が不可能に思えるが、ポイントは、バックアップソフトを「起動する」事だけが可能。</p> <p>起動されたバックアップソフトは、ドメイン遷移により、データベース全体をダンプするのに必要な権限を付与されて動作する。そして、管理者であっても中身を参照できないファイルに書き出しを行う。</p> <p>したがって、確かにＤＢのバックアップは取得できるのだが、ＯＳとＤＢの連携により、管理者だからといって任意にそれを参照する事はできない。</p> <p>こういう事を実現したいと思っている。</p> </div> 2009-12-04T15:03:52+00:00 kaigai http://thetoms-random-thoughts.blogspot.com/2009/12/windows-mobile-phones-keep-data-after.html <p>I want to sell my <span>HTC Touch Diamond</span> on eBay, it contains a 4GB internal storage which I cleared and formated by using Settings->Clear Storage.</p><p><!-- BlogCounter Code START -->In the past I never trusted this tool therefore I cleared the storage, copied a big random file to the phone and cleared it again. This time copying the random 4GB file tooks very long and I want to make sure I do not waste time with being too paranoid here.</p><p>Therefore I used my <a href="http://www.suse.de/%7Ethomas/projects/jpeg-extract/index.html">jpeg-extractor</a> tool to extract everything that looks like a JPEG file from a raw disk/mem image of the internal storage. And after some minutes pictures popped up which are not on the original ROM but are images from podcasts and from the cam etc.</p><p>You, like I, already expect it, but this is the proof:</p><p></p><blockquote>Cleaning Windows Mobile Phones leaves personal Data on the Device.</blockquote><p></p><p>Take care what you sell on the Internet.</p><p>BTW, I always put a back-door on the phones I sell... just kidding. :-)</p><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-6554397293158893009?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-12-03T10:10:24+00:00 Thomas (noreply@blogger.com) http://etbe.coker.com.au/2009/11/29/play-machine-offline-for-2-weeks/ <p>I&#8217;m about to leave for San Francisco, so my SE Linux Play Machine is turned off and will remain off until after I return.</p> 2009-11-28T23:26:39+00:00 etbe http://d.hatena.ne.jp/kaigai/20091120/1258716549 <div class="section"> <p>久々の更新ｗ</p> <p>今日と明日は、PostgreSQL Conference 2009 Japan （主催： 日本PostgreSQLユーザ会） に参加 </p> <p>私の発表は明日なので今日は聞くだけ。 </p> <p>Bruce Momjian氏のPg_migratorの話題と、三三株式会社さんの名刺データ管理を提供する </p> <p>SaaSソリューションのバックエンドにPostgreSQLを使っている事例が秀逸。 </p> <p>Pg_migratorは、pg_dumpのコードの中にそれ対応のコードが何箇所か入っていたし、 </p> <p>後々、調べておかないとと思っていただけに、意外と（予想通り？）単純な構造で </p> <p>システムテーブルを置換するというモノで、これなら SE-PostgreSQL の将来的な </p> <p>フル機能実装時でも大丈夫そう。 </p> <p>名刺データのSaaSソリューションは、思いっきりシングルテナントで個人情報を </p> <p>取り扱っているという、個人的には面白げな感じ。（セキュリティ的な意味で） </p> <p>クエリによっては百行を越えるモノもあるとか言ってたが、本当にそれで大丈夫か、 </p> <p>一々検証するのは本当に大変。 </p> <p>そういう時に、プラットフォームでＭＡＣを提供できれば本当にありがたいと思う。 </p> <p>レセプションでは、海外からのゲストを含む沢山の人が来ているので、重要人物には </p> <p>重点的に接触。SE-PostgreSQLのレビューがなかなか進まないという問題があるので、 </p> <p>直接話して協力を取り付ける。 </p> <p>宴も盛り上がってきたところで、くじ引き大会。 </p> <p>なんか、発表者全員のサイン入りＴシャツ（限定一枚）とかいうありがたい物をもらってしまった。</p> <p><a href="http://f.hatena.ne.jp/kaigai/20091120202820" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20091120/20091120202820.jpg" alt="f:id:kaigai:20091120202820j:image" title="f:id:kaigai:20091120202820j:image" class="hatena-fotolife" /></a></p> <p>もちろん、自分も発表者なので、自分のサインも入っているｗ </p> <p>私の発表は、明日の 14:20〜 </p> <p>『LAPP/SELinux 〜 SE-PostgreSQL を用いたセキュア Web アプリケーション基盤〜』 </p> <p>基本的に JLS の内容を踏襲した発表ですが、日本語で聞けるというのは大きいかもｗ </p> <p>なお、下記のURLで、ustream中継されるとの事 ＞ 主に実家の親の人向け</p> <p><a href="http://www.ustream.tv/channel/pgcon09j-a" target="_blank">http://www.ustream.tv/channel/pgcon09j-a</a></p> </div> 2009-11-20T11:29:09+00:00 kaigai http://thetoms-random-thoughts.blogspot.com/2009/11/virtualbox-ose-guest-can-trigger-denial.html <p>I am surprised - positively of course :) : Sun released an update for a denial-of-service problem in virtualbox-ose:</p><p><a href="http://sunsolve.sun.com/search/document.do?assetkey=1-66-271149-1">http://sunsolve.sun.com/search/document.do?assetkey=1-66-271149-1</a></p><pre class="bz_comment_text" id="comment_text_6">CVE-2009-3940<br /></pre><p><!-- BlogCounter Code START --></p><p>Details:</p><p></p><blockquote>On 10/08/09 13:44, Thomas Biege wrote:<br />> Hi,<br />> just a question: Is this a real bug?<br />><br />> VirtualBox-3.0.6_OSE/src/VBox/Additions/linux/module> grep -n -E "XXX.*denial.*" *<br />><br />> vboxmod.c:1032: rc = VbglGRAlloc(&amp;reqFull, cbRequestSize, reqHeader.requestType); // XXX tom: denial of service! better use cbVanillaRequestSize?</blockquote><br /><br /><p></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-3614157649569909828?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-11-20T02:57:30+00:00 Thomas (noreply@blogger.com) http://thetoms-random-thoughts.blogspot.com/2009/11/x-mas-wish-list-for-security-team.html <a href="http://3.bp.blogspot.com/_YYeA-lwcHBA/SwWFK1GQMPI/AAAAAAAAAOk/EqhfjWtkbjQ/s1600/dscn1241.jpg"><img src="http://3.bp.blogspot.com/_YYeA-lwcHBA/SwWFK1GQMPI/AAAAAAAAAOk/EqhfjWtkbjQ/s320/dscn1241.jpg" alt="" id="BLOGGER_PHOTO_ID_5405873348826640626" border="0" /></a><br /><p>Good Evening,<br /></p><p>you may not have recognized it yet because of the bland climate (at least here in Germany) but X-MAS is approaching.</p><p><!-- BlogCounter Code START -->It is the time of beginning, looking ahead, family and wishes.</p><p>I am nipping hot tea from a big cup and want to hear about your wishes... the wishes from our openSUSE community, our SLES customers, the SUSE family if you like.</p><p>What should the SuSE Security-Team improve for you and your business in the future?</p><p><a href="http://www.suse.de/%7Ethomas/contact/index.html">Write me a mail</a> or leave me a comment!<br /></p><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-3484329159219895907?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-11-19T23:27:37+00:00 Thomas (noreply@blogger.com) http://thetoms-random-thoughts.blogspot.com/2009/11/common-vulnerability-scoring-system.html <p>Dear Readers,</p><p><!-- BlogCounter Code START -->you already may have recognized that we start using the CVSS v2 base score in our patch descriptions, security advisories and summary reports. If you want to know the details of CVSS, have a look at the <a href="http://www.first.org/cvss/cvss-guide.html">FIRST CVSS Guide</a>.</p><p>We should go away from our old and incomplete "Security Metric" which is a stupid^Wsimple metric I "invented" some years ago just to fill the gap.</p><p>CVSS is an industry standard which is used by other major vendors too. This allows our customers to rank the security updates we deliver and compare them to updates from other vendors that also use CVSS etc.</p><p>To not cause any additional work for us we use the base score as calculated by the people from the <a href="http://web.nvd.nist.gov/view/vuln/search?execution=e2s1">National Vulnerability Database</a> (NVD) and no additional scoring for our system configuration (which even could change from version to version, therefore each SLES/openSUSE version would need an own CVSS score).</p><p>HTH<br /></p><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-7811549643051986260?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-11-19T09:31:47+00:00 Thomas (noreply@blogger.com) http://etbe.coker.com.au/2009/11/17/debian-ssh-se-linux/ <p>I have just filed Debian bug report <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=556644">#556644</a> against the version of openssh-server in Debian/Unstable (Squeeze).  It has a patch that moves the code to set the SE Linux context for the child process before calling chroot. Without this a chroot environment on a SE Linux system can only work correctly if <b>/proc</b> and <b>/selinux</b> are mounted in the chroot environment.</p> <p><b>deb http://www.coker.com.au squeeze selinux</b></p> <p>I&#8217;ve created the above APT repository for Squeeze which has a package that fixes this bug. I will continue to use that repository for a variety of SE Linux patches to Squeeze packages, at the moment it&#8217;s packages from Unstable but I will also modify released packages as needed.</p> <p>The bug report <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498684">#498684</a> has a fix for a trivial uninitialised variable bug. The fix is also in my build.</p> <p>Also I filed the bug report <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=556648">#556648</a> about the internal version of sftp being<br /> incompatible with SE Linux (it doesn&#8217;t involve an exec so the context doesn&#8217;t change). The correct thing to do is for sshd to refuse to run an internal sftpd at least if the system is in enforcing mode, and probably even in permissive mode.</p> <p><b>deb http://www.coker.com.au lenny selinux</b></p> <p>Update: I&#8217;ve also backported my sshd changes to Lenny at the above APT repository.</p> 2009-11-17T12:38:45+00:00 etbe http://thetoms-random-thoughts.blogspot.com/2009/11/hdd-encryption-vs-secure-deleting.html <p>There are two ways to scramble private data on your hard-drive.</p><ol><li><!-- BlogCounter Code START -->encrypt the device</li><li>clean sensitive files securely</li></ol>In the past I used <span>secure delete</span> to remove browser caches+history, tmp files, image thumbnails for preview etc. while shutting down my system and periodically using <span>cron</span>.<br /><br />The pros of this method are:<br /><ul><li>better recovery of data in case of hardware failure</li><li>easy automatic backup</li><li>remote access to private data possible<br /></li><li>no performance impact</li><li>no crypto algorithm dependency</li><li>...<br /></li></ul>But because the tool overwrites the same file several times with random data without caching and without delays the HDDs crash very early in their life. After three completely destroyed HDDs I decided to switch to HDD encryption. ;-)<br /><br /><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-7009199857974381878?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-11-12T08:03:38+00:00 Thomas (noreply@blogger.com) http://thetoms-random-thoughts.blogspot.com/2009/11/command-line-tool-fuzzer.html <p>Yesterday Marcus reminded me that I have written a <a href="http://www.suse.de/%7Ethomas/projects/fuzz-cmdline/index.html">Fuzzer for command-line tools</a>... honestly I forgot this little PoC tool and it slept in my CVS repository for nearly 1.5 years. Until now, I put it <a href="http://www.suse.de/%7Ethomas/projects/fuzz-cmdline/index.html">online</a>. Beta-testers are welcome.<br /><!-- BlogCounter Code START --><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-3059150468917232562?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-11-10T23:52:42+00:00 Thomas (noreply@blogger.com) http://jczucco.blogspot.com/2009/10/secure-virtualization-with-selinux.html Apresentação feita por <a href="http://danwalsh.livejournal.com">Dan Walsh</a> no <a href="http://www.redhat.com/promo/summit/2009/highlights/">Red Hat Chicago Summit 2009</a>:<br /><br /><img border="0" width="0" height="0" src="http://counters.gigya.com/wildfire/IMP/CXNID=2000002.0NXC/bT*xJmx*PTEyNTcwMTY4MjM3NDQmcHQ9MTI1NzAxNjkzMDQxMCZwPTE5ODY4MSZkPWozbDBneDdqZGsmZz*yJm89YWZiNzJkM2Y*Y2U1NGVjY2E1Yjc*MzhhODI1ZWMzODkmb2Y9MA==.gif" /><br /> <br /> <br /> <br /> <br /> <br /> <br /> <a href="http://corp.kaltura.com">video platform</a><br /> <a href="http://corp.kaltura.com/technology/video_management">video management</a><br /> <a href="http://corp.kaltura.com/solutions/overview">video solutions</a><br /> <a href="http://corp.kaltura.com/technology/video_player">free video player</a><br /><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/15117118-3646008750328936619?l=jczucco.blogspot.com" alt="" /></div> 2009-10-31T18:28:50+00:00 Jeronimo Zucco (jczucco@gmail.com) http://etbe.coker.com.au/2009/10/28/new-play-machine/ <p><b>Update:<br /> Thanks to Sven Joachim and Andrew Pollock for informing me about /etc/init.d/mountoverflowtmp which exists to mount a tmpfs named overflow if /tmp is full at boot time. It appears that the system was not compromised. But regular reinstalls are always a good thing.</b></p> <p>On the 24th of August this year I noticed the following on my <a href="http://www.coker.com.au/selinux/play.html">SE Linux Play Machine [1]</a>:<br /> <b>root@play:/root# df<br /> Filesystem&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1K-blocks&nbsp; &nbsp; &nbsp; Used Available Use% Mounted on<br /> /dev/hda&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1032088&nbsp; &nbsp; 938648&nbsp; &nbsp; 41012&nbsp; 96% /<br /> tmpfs&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 51296&nbsp; &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; 51296&nbsp; 0% /lib/init/rw<br /> udev&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 10240&nbsp; &nbsp; &nbsp; &nbsp; 24&nbsp; &nbsp; 10216&nbsp; 1% /dev<br /> tmpfs&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 51296&nbsp; &nbsp; &nbsp; &nbsp; 4&nbsp; &nbsp; 51292&nbsp; 1% /dev/shm<br /> /dev/hdb&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 516040&nbsp; &nbsp; 17128&nbsp; &nbsp; 472700&nbsp; 4% /root<br /> /dev/hdc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1024&nbsp; &nbsp; &nbsp; &nbsp; 8&nbsp; &nbsp; &nbsp; 1016&nbsp; 1% /tmp<br /> overflow&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1024&nbsp; &nbsp; &nbsp; &nbsp; 8&nbsp; &nbsp; &nbsp; 1016&nbsp; 1% /tmp</b></p> <p>The kernel message log had the following:<br /> <b>[210511.546152] su[769]: segfault at 0 ip b7e324e3 sp bfa4b064<br /> error 4 in libc-2.7.so[b7dbb000+158000]<br /> [210561.527839] su[778]: segfault at 0 ip b7eb14e3 sp bfec84d4 error 4 in<br /> libc-2.7.so[b7e3a000+158000]<br /> [210585.270372] su[784]: segfault at 0 ip b7e044e3 sp bff1b534 error 4 in<br /> libc-2.7.so[b7d8d000+158000]<br /> [210595.855278] su[789]: segfault at 0 ip b7e014e3 sp bfd18324 error 4 in<br /> libc-2.7.so[b7d8a000+158000]<br /> [210639.496847] su[796]: segfault at 0 ip b7e874e3 sp bf99e7b4 error 4 in<br /> libc-2.7.so[b7e10000+158000]</b></p> <p>Naturally this doesn&#8217;t look good, the filesystem known as &#8220;<b>overflow</b>&#8221; indicates a real problem. It appears that the machine was compromised. So I&#8217;ve made archival copies of all the data and reinstalled it.</p> <p>As the weather here is becoming warmer I&#8217;ve used new hardware for my new Play Machine. The old system was a 1.8GHz Celeron with 1280M of RAM and two IDE disks in a RAID-1 array. The new system is a P3-800 with 256M of RAM and a single IDE disk. It&#8217;s a Compaq Evo which runs from a laptop PSU and is particularly energy efficient and quiet. The down-side is that there is no space for a second disk and only one RAM socket so I&#8217;m limited to 256M &#8211; that&#8217;s just enough to run a Xen server with a single DomU.</p> <p>I put the new play machine online on Friday the 23rd of October after almost two months of down-time.</p> <ul> <li>[1]<a href="http://www.coker.com.au/selinux/play.html"> http://www.coker.com.au/selinux/play.html</a></li> </ul> 2009-10-28T10:41:40+00:00 etbe http://securityblog.org/brindle/2009/10/24/the-selinux-documentation-project/ <p>One of the biggest complaints people have about SELinux is the lack of documentation. Indeed we had a nice group discussion with some users at Linux Plumbers Conference who once again brought this to our attention.</p> <p>The reason is simple. Most of us working on SELinux are developers. We don&#8217;t like writing documentation. We&#8217;d rather write blog entries explaining some aspect of SELinux instead of real documents. While this works when your primary audience are knowledgeable enough to find the blog entries, figure out how to apply the concepts to their problems and connect all the dots between here and there it isn&#8217;t useful for new users or users trying to solve a simple problem.</p> <p>It is unfortunate, and some people over the years have helped us out, such as with the <a title="Fedora SELinux User Guide" href="http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/" target="_blank">Fedora SELinux User Guide</a>, but unfortunately we&#8217;ve missed some users, particularly new ones, and we haven&#8217;t aggregated these documents onto a distribution agnostic place with good organization.</p> <p>With that in mind I volunteered to start the SELinux Documentation Project during LPC. Basically the goal is to make user-problem focused documentation available at the official <a title="selinux project site" href="http://selinuxproject.org" target="_blank">SELinux project site</a>. This will be a huge effort, writing original documentation, organizing it into consumable chunks and mining years of mail list posts, blog entries and other resources to deliver documents to users.</p> <p>I&#8217;ve already started putting up several pieces. One of the things I want to really focus on are SELinux &#8216;recipes&#8217;, short, to-the-point blurbs telling users how to do the things they want to do, like<a href="http://selinuxproject.org/page/ApacheRecipes#Allow_Apache_to_connect_to_your_database_server" target="_blank"> allowing apache to connect to their database server</a>, or  how to <a title="Adding a rule with audit2allow" href="http://selinuxproject.org/page/Audit2allowRecipe" target="_blank">easily add a rule to their policy</a>.</p> <p>We also need a place where potential developers can go to <a title="developer resources" href="http://selinuxproject.org/page/Developers" target="_blank">easily get resources on developing SELinux</a> so that our community can expand. Further a place where vendors can go to learn about what SELinux can do for their solution and how to get started using SELinux is a must.</p> <p>All that said, I can&#8217;t do this alone. I&#8217;ve started several pages and will continue doing so but if you are one of those strange souls with a propensity to document things, or you have recently gone through the pains of finding info in obscure places that you couldn&#8217;t find elsewhere we could really use your help in expanding, organizing and centralizing documentation on <a title="selinuxproject" href="http://selinuxproject.org" target="_blank">selinuxproject.org</a>. If you want to help you can email me at method at manicmethod.com or James Morris at jmorris at namei.org to get an account and start contributing.</p> 2009-10-24T19:58:16+00:00 Joshua Brindle http://securityblog.org/brindle/2009/10/24/selinux-and-rpm/ <div id="_mcePaste">Wow, I just noticed it&#8217;s been a year since I&#8217;ve blogged, that is not good.</div> <div id="_mcePaste">That doesn&#8217;t mean nothing has been going on though, we&#8217;ve been quite busy around here.</div> <div id="_mcePaste">First I&#8217;d like to talk about a couple projects we are working on. The first is better integration of SELinux policies into RPM. We&#8217;ve posted a patch set to the rpm-maint [1] mailing list and are awaiting feedback. To try out the patches yourself you can read the instructions on the project page at selinuxproject.org [2].</div> <div id="_mcePaste">The current patch set basically makes RPM actually do stuff with the %policy tag, which it never did before. We&#8217;ve also changed the %policy tag to be more flexible in allowing more information about the policies to be handled by RPM, such as policy modules that are being obsoleted. You can read the full description of the patches on the mail list postings [3].</div> <div id="_mcePaste">This is only the first step in a long term project we have to make RPM more robust and reduce the amount of trust necessary in the package manager. We have several ideas of how to proceed but we haven&#8217;t proven that they&#8217;ll work yet (or that the RPM community will be interested in them). Suffice to say we basically want to break RPM into smaller pieces, each of which has a dedicated job to do, which can be confined by SELinux. Each step would require less trust that the packages aren&#8217;t malicious and that the SELinux policy is correct and will enforce the security goals set forth by the packager. Once this is done we want to try running core parts of RPM in different security domains depending on different attributes about the package and who is running it, such as what certificates were used to sign the package, where the package came from, who is running RPM and so on.</div> <div id="_mcePaste">The culmination of this effort would be to be able to download a 3rd party package and install it knowing that it will only be able to add its files to /opt, and not modify anything in /usr, /lib, /etc, etc. Further the scriptlets should be confined so that they can&#8217;t add users to the system or any other security critical activities. This will be a truly exciting capability for Linux systems moving forward.</div> <div id="_mcePaste">I delivered a presentation on this project at Linux Plumbers Conference last month in Portland. The slides [4] and video recording [5] are published on the web for those who are interested.</div> <div id="_mcePaste">I&#8217;ll talk about another project we are working on in my next blog post, which should be coming pretty soon.</div> <div id="_mcePaste">[1] https://lists.rpm.org/mailman/listinfo/rpm-maint</div> <div id="_mcePaste">[2] http://selinuxproject.org/page/RPM</div> <div id="_mcePaste">[3] http://lists.rpm.org/pipermail/rpm-maint/2009-October/002561.html</div> <div id="_mcePaste">[4] http://linuxplumbersconf.org/2009/slides/brindle-selinux-distribution-lpc-slides.pdf</div> <div id="_mcePaste">[5] http://video.linuxfoundation.org/video/1569</div> <p>Wow, I just noticed it&#8217;s been a year since I&#8217;ve blogged, that is not good.</p> <p>That doesn&#8217;t mean nothing has been going on though, we&#8217;ve been quite busy around here.</p> <p>I&#8217;d like to talk about a couple projects we are working on. The first is better integration of SELinux policies into RPM. We&#8217;ve posted a patch set to the <a title="rpm-maint mailing list" href="https://lists.rpm.org/mailman/listinfo/rpm-maint" target="_blank">rpm-maint</a> mailing list and are awaiting feedback. To try out the patches yourself you can read the instructions on the <a title="RPM Project page" href="http://selinuxproject.org/page/RPM" target="_blank">project page at selinuxproject.org</a>.</p> <p>The current patch set basically makes RPM actually do stuff with the %policy tag, which it never did before. We&#8217;ve also changed the %policy tag to be more flexible in allowing more information about the policies to be handled by RPM, such as policy modules that are being obsoleted. You can read the full description of the patches on the<a href="http://lists.rpm.org/pipermail/rpm-maint/2009-October/002561.html" target="_blank"> mail list postings</a>.</p> <p>This is only the first step in a long term project we have to make RPM more robust and reduce the amount of trust necessary in the package manager. We have several ideas of how to proceed but we haven&#8217;t proven that they&#8217;ll work yet (or that the RPM community will be interested in them). Suffice to say we basically want to break RPM into smaller pieces, each of which has a dedicated job to do, which can be confined by SELinux. Each step would require less trust that the packages aren&#8217;t malicious and that the SELinux policy is correct and will enforce the security goals set forth by the packager. Once this is done we want to try running core parts of RPM in different security domains depending on different attributes about the package and who is running it, such as what certificates were used to sign the package, where the package came from, who is running RPM and so on.</p> <p>The culmination of this effort would be to be able to download a 3rd party package and install it knowing that it will only be able to add its files to /opt, and not modify anything in /usr, /lib, /etc, etc. Further the scriptlets should be confined so that they can&#8217;t add users to the system or any other security critical activities. This will be a truly exciting capability for Linux systems moving forward.</p> <p>I delivered a presentation on this project at Linux Plumbers Conference last month in Portland. The <a href="http://linuxplumbersconf.org/2009/slides/brindle-selinux-distribution-lpc-slides.pdf" target="_blank">slides</a> and <a title="video" href="http://video.linuxfoundation.org/video/1569" target="_blank">video recording</a> are published on the web for those who are interested.</p> <p>I&#8217;ll talk about another project we are working on in my next blog post, which should be coming pretty soon.</p> 2009-10-24T19:39:12+00:00 Joshua Brindle http://blog.namei.org/2009/10/24/selinux-sandbox-slides-available-et-cetera/ <p>I&#8217;ve just given a presentation on SELinux Sandboxing at <a href="http://foss.my/2009/">FOSS.my 2009</a> in Kuala Lumpur &#8212; the slides are available for download as a PDF file <a href="http://selinuxproject.org/~jmorris/selinux-sandboxing-fossmy2009.pdf">here</a>.</p> <p>The presentation was an overview of sandboxing as a concept; how we can enhance it with MAC security; and how it&#8217;s being implemented in Fedora 12 with SELinux. I also discussed the need for a standard security API for Linux, so that developers will be more inclined to incorporate enhanced security support in their software, and to generally increase security adoption via standardization. We&#8217;ve seen this work well thus far with sVirt, so it should be feasible </p> <p>The SELinux Sandbox stuff will be familiar if you&#8217;ve seen Dan Walsh&#8217;s recent talks on the topic, although in this case, I included his cell phone number in the presentation if people have detailed questions, seeing as he&#8217;s not here in person.</p> <p>It&#8217;s been yet another busy conference trip, with KS and JLS last week &#8212; I attended some of the JLS security talks and a Japanese Secure OS user group dinner. It was a very interesting and productive time.</p> <p>I dented this a few days ago, but got no answer (and also dragged DaveM to see it &#038; he couldn&#8217;t figure it out, either): does anyone know what this mystery object is?<br /> <center><a href="http://www.flickr.com/photos/x_jamesmorris/4028342077/" title="Mystery object by x_jamesmorris, on Flickr"><img src="http://farm3.static.flickr.com/2779/4028342077_572882990e_m.jpg" width="180" height="240" alt="Mystery object" border="0" /></a></center><br /> It&#8217;s a spinning, blue and white striped cone near the ceiling of an underground Tokyo subway entrance.</p> 2009-10-24T08:00:13+00:00 jamesm http://thetoms-random-thoughts.blogspot.com/2009/10/local-root-via-vboxnetadpctl.html <p>Our maintainer requested to set the sbit for <span>VBoxNetAdpCtl</span> but a quick code review revealed that the code is vulnerable to shell command injection via <span>popen(3) </span>and a possible buffer overflow. Both bugs were fixed <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1">upstream by Sun</a>.</p><p>Unfortunately there were no CVE-IDs assigned to this issues yet.</p><p>And to avoid confusions: We do not ship this tool setuid. :-)</p><p>Update:</p><pre class="bz_comment_text" id="comment_text_16">CVE-2009-3692 for popen()<br />CVE-2009-3704 for strncpy().<br /><br /></pre><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-1111704768328209545?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-10-22T08:31:40+00:00 Thomas (noreply@blogger.com) http://selinux-mac.blogspot.com/2009/10/git-daemon-selinux-and-fedora-12-beta.html <span><span>Recently i decided to redo my Git daemon domain and reinstall a Git daemon server.</span><br /><br /><span>This article will explain the issues i had to consider.</span><br /><br /><span>SELinux can be used to confined the Git daemon and Git Shell. I have not used SELinux in a optimal way here but i decided to implement a mix of MAC, DAC and Git ACL.</span><br /><br /><span>As for SELinux i have installed the following module:</span><br /><br /><span>gitd.te:<br /><br /></span><span>[code]</span><br /><br /><span>policy_module(gitd, 1.0.0)</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon global private declarations.</span><br /><span>#</span><br /><br /><span>attribute gitd_type;</span><br /><span>attribute gitd_content_type;</span><br /><br /><span>type gitd_exec_t;</span><br /><br /><span># FIXME</span><br /><span>type gitd_port_t;</span><br /><span>corenet_port(gitd_port_t)</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon system private declarations.</span><br /><span>#</span><br /><br /><span>## </span><br /><span>## <p></p></span><br /><span>## Allow Git-shell to modify and execute public files</span><br /><span>## used for public file transfer services. Directories/Files must</span><br /><span>## be labeled public_content_rw_t.</span><br /><span>## </span></span><br /><span>## </span><br /><span># gen_tunable(gitd_allow_anon_write, false)</span><br /><br /><span>## </span><br /><span>## <p></p></span><br /><span>## Allow Git daemon system to search home directories.</span><br /><span>## </span><br /><span>## </span><br /><span>gen_tunable(gitd_system_enable_homedirs, false)</span><br /><br /><span>## </span><br /><span>## <p></p></span><br /><span>## Allow Git daemon system to access cifs file systems.</span><br /><span>## </span><br /><span>## </span><br /><span>gen_tunable(gitd_system_use_cifs, false)</span><br /><br /><span>## </span><br /><span>## <p></p></span><br /><span>## Allow Git daemon system to access nfs file systems.</span><br /><span>## </span><br /><span>## </span><br /><span>gen_tunable(gitd_system_use_nfs, false)</span><br /><br /><span>type gitd_system_t, gitd_type;</span><br /><span>inetd_service_domain(gitd_system_t, gitd_exec_t)</span><br /><span>role system_r types gitd_system_t;</span><br /><br /><span>type gitd_shared_t, gitd_content_type;</span><br /><span>files_type(gitd_shared_t)</span><br /><br /><span># permissive gitd_system_t;</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git shell private declarations.</span><br /><span>#</span><br /><br /><span>gen_require(`</span><br /><span> attribute unpriv_userdomain, userdomain;</span><br /><span> class context contains;</span><br /><span>')</span><br /><br /><span>attribute gits_file_type;</span><br /><span>attribute gits_usertype;</span><br /><br /><span>type gits_t, userdomain, gits_usertype, unpriv_userdomain;</span><br /><span>domain_type(gits_t)</span><br /><br /><span>role gits_r types gits_t;</span><br /><span>allow system_r gits_r;</span><br /><br /><span>corecmd_shell_entry_type(gits_t)</span><br /><span>corecmd_bin_entry_type(gits_t)</span><br /><br /><span>domain_interactive_fd(gits_t)</span><br /><span>domain_user_exemption_target(gits_t)</span><br /><br /><span># permissive gits_t;</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon session session private declarations.</span><br /><span>#</span><br /><br /><span>## </span><br /><span>## <p></p></span><br /><span>## Allow Git daemon session to bind</span><br /><span>## tcp sockets to all unreserved ports.</span><br /><span>## </span><br /><span>## </span><br /><span>gen_tunable(gitd_session_bind_all_unreserved_ports, false)</span><br /><br /><span>type gitd_session_t, gitd_type;</span><br /><span>application_domain(gitd_session_t, gitd_exec_t)</span><br /><span>ubac_constrained(gitd_session_t)</span><br /><br /><span>type gitd_personal_t, gitd_content_type;</span><br /><span>userdom_user_home_content(gitd_personal_t)</span><br /><br /><span># permissive gitd_session_t;</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon global private policy.</span><br /><span>#</span><br /><br /><span>allow gitd_type self:fifo_file rw_fifo_file_perms;</span><br /><span>allow gitd_type self:netlink_route_socket { create_socket_perms nlmsg_read };</span><br /><span>allow gitd_type self:tcp_socket create_socket_perms;</span><br /><span>allow gitd_type self:udp_socket create_socket_perms;</span><br /><span>allow gitd_type self:unix_dgram_socket create_socket_perms;</span><br /><br /><span># FIXME</span><br /><span>allow gitd_type gitd_port_t:tcp_socket name_bind;</span><br /><br /><span>corenet_all_recvfrom_netlabel(gitd_type)</span><br /><span>corenet_all_recvfrom_unlabeled(gitd_type)</span><br /><br /><span>corenet_tcp_sendrecv_all_if(gitd_type)</span><br /><span>corenet_tcp_sendrecv_all_nodes(gitd_type)</span><br /><span>corenet_tcp_sendrecv_all_ports(gitd_type)</span><br /><br /><span>corenet_tcp_bind_all_nodes(gitd_type)</span><br /><br /><span>corecmd_exec_bin(gitd_type)</span><br /><br /><span>files_read_etc_files(gitd_type)</span><br /><span>files_read_usr_files(gitd_type)</span><br /><br /><span>fs_search_auto_mountpoints(gitd_type)</span><br /><br /><span>kernel_read_system_state(gitd_type)</span><br /><br /><span>logging_send_syslog_msg(gitd_type)</span><br /><br /><span>miscfiles_read_localization(gitd_type)</span><br /><br /><span>sysnet_read_config(gitd_type)</span><br /><br /><span>optional_policy(`</span><br /><span> nis_use_ypbind(gitd_type)</span><br /><span>')</span><br /><br /><span>optional_policy(`</span><br /><span> nscd_read_pid(gitd_type)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon system repository private policy.</span><br /><span>#</span><br /><br /><span>list_dirs_pattern(gitd_system_t, gitd_content_type, gitd_content_type)</span><br /><span>read_files_pattern(gitd_system_t, gitd_content_type, gitd_content_type)</span><br /><span>files_search_var(gitd_system_t)</span><br /><br /><span># This will not work since git-shell needs to execute gitd content thus public content files.</span><br /><span># There is currently no clean way to execute public content files.</span><br /><span># miscfiles_read_public_files(gitd_system_t)</span><br /><br /><span>tunable_policy(`gitd_system_enable_homedirs', `</span><br /><span> userdom_search_user_home_dirs(gitd_system_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_enable_homedirs &amp;&amp; use_nfs_home_dirs', `</span><br /><span> fs_list_nfs(gitd_system_t)</span><br /><span> fs_read_nfs_files(gitd_system_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_enable_homedirs &amp;&amp; use_samba_home_dirs', `</span><br /><span> fs_list_cifs(gitd_system_t)</span><br /><span> fs_read_cifs_files(gitd_system_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_use_cifs', `</span><br /><span> fs_list_cifs(gitd_system_t)</span><br /><span> fs_read_cifs_files(gitd_system_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_use_nfs', `</span><br /><span> fs_list_nfs(gitd_system_t)</span><br /><span> fs_read_nfs_files(gitd_system_t)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git shell private policy.</span><br /><span>#</span><br /><br /><span>allow gits_t self:context contains;</span><br /><span>allow gits_t self:fifo_file rw_fifo_file_perms;</span><br /><br /><span>corecmd_exec_bin(gits_t)</span><br /><br /><span>kernel_read_system_state(gits_t)</span><br /><br /><span>files_read_etc_files(gits_t)</span><br /><br /><span>files_search_home(gits_t)</span><br /><br /><span>gitd_execute_shared_files(gits_t)</span><br /><span>gitd_manage_shared_content(gits_t)</span><br /><br /><span>miscfiles_read_localization(gits_t)</span><br /><span># miscfiles_read_public_files(gits_t)</span><br /><br /><span>ssh_rw_stream_sockets(gits_t)</span><br /><br /><span># FIXME</span><br /><span># This will not work since git-shell needs to execute gitd content thus public content files.</span><br /><span># There is currently no clean way to execute public content files.</span><br /><span># tunable_policy(`gitd_allow_anon_write', `</span><br /><span> # miscfiles_exec_public_files(gits_t)</span><br /><span> # miscfiles_manage_public_files(gits_t)</span><br /><span># ')</span><br /><br /><span>tunable_policy(`gitd_system_enable_homedirs &amp;&amp; use_nfs_home_dirs', `</span><br /><span> fs_exec_nfs_files(gits_t)</span><br /><span> fs_manage_nfs_dirs(gits_t)</span><br /><span> fs_manage_nfs_files(gits_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_enable_homedirs &amp;&amp; use_samba_home_dirs', `</span><br /><span> fs_exec_cifs_files(gits_t)</span><br /><span> fs_manage_cifs_dirs(gits_t)</span><br /><span> fs_manage_cifs_files(gits_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_use_cifs', `</span><br /><span> fs_exec_cifs_files(gits_t)</span><br /><span> fs_manage_cifs_dirs(gits_t)</span><br /><span> fs_manage_cifs_files(gits_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`gitd_system_use_nfs', `</span><br /><span> fs_exec_nfs_files(gits_t)</span><br /><span> fs_manage_nfs_dirs(gits_t)</span><br /><span> fs_manage_nfs_files(gits_t)</span><br /><span>')</span><br /><br /><span>optional_policy(`</span><br /><span> nscd_read_pid(gits_t)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>#</span><br /><span># Git daemon session repository private policy.</span><br /><span>#</span><br /><br /><span>list_dirs_pattern(gitd_session_t, gitd_personal_t, gitd_personal_t)</span><br /><span>read_files_pattern(gitd_session_t, gitd_personal_t, gitd_personal_t)</span><br /><span>userdom_search_user_home_dirs(gitd_session_t)</span><br /><br /><span>userdom_use_user_terminals(gitd_session_t)</span><br /><br /><span>tunable_policy(`gitd_session_bind_all_unreserved_ports', `</span><br /><span> corenet_tcp_bind_all_unreserved_ports(gitd_session_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`use_nfs_home_dirs', `</span><br /><span> fs_list_nfs(gitd_session_t)</span><br /><span> fs_read_nfs_files(gitd_session_t)</span><br /><span>')</span><br /><br /><span>tunable_policy(`use_samba_home_dirs', `</span><br /><span> fs_list_cifs(gitd_session_t)</span><br /><span> fs_read_cifs_files(gitd_session_t)</span><br /><span>')</span><br /><span>[/code]</span><br /><br /><span>gitd.if</span><br /><span>[code]</span><br /><span>## Git daemon is a really simple server for Git repositories.</span><br /><span>## </span><br /><span>## <p></p></span><br /><span>## A really simple TCP git daemon that normally listens on</span><br /><span>## port DEFAULT_GIT_PORT aka 9418. It waits for a</span><br /><span>## connection asking for a service, and will serve that</span><br /><span>## service if it is enabled.</span><br /><span>## </span><br /><span>## <p></p></span><br /><span>## It verifies that the directory has the magic file</span><br /><span>## git-daemon-export-ok, and it will refuse to export any</span><br /><span>## git directory that has not explicitly been marked for</span><br /><span>## export this way (unless the --export-all parameter is</span><br /><span>## specified). If you pass some directory paths as</span><br /><span>## git-daemon arguments, you can further restrict the</span><br /><span>## offers to a whitelist comprising of those.</span><br /><span>## </span><br /><span>## <p></p></span><br /><span>## By default, only upload-pack service is enabled, which</span><br /><span>## serves git-fetch-pack and git-ls-remote clients, which</span><br /><span>## are invoked from git-fetch, git-pull, and git-clone.</span><br /><span>## </span><br /><span>## <p></p></span><br /><span>## This is ideally suited for read-only updates, i.e.,</span><br /><span>## pulling from git repositories.</span><br /><span>## </span><br /><span>## <p></p></span><br /><span>## An upload-archive also exists to serve git-archive.</span><br /><span>## </span><br /><span>## </span><br /><br /><span>#######################################</span><br /><span>## </span><br /><span>## Role access for Git daemon session.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Role allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## User domain for the role.</span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_session_role', `</span><br /><span> gen_require(`</span><br /><span> type gitd_session_t, gitd_exec_t, gitd_personal_t;</span><br /><span> ')</span><br /><br /><span> ########################################</span><br /><span> #</span><br /><span> # Git daemon session shared declarations.</span><br /><span> #</span><br /><br /><span> ## </span><br /><span> ## <p></p></span><br /><span> ## Allow transitions to the Git daemon</span><br /><span> ## session domain.</span><br /><span> ## </span><br /><span> ## </span><br /><span> gen_tunable(gitd_session_transition, false)</span><br /><br /><span> role $1 types gitd_session_t;</span><br /><br /><span> ########################################</span><br /><span> #</span><br /><span> # Git daemon session shared policy.</span><br /><span> #</span><br /><br /><span> tunable_policy(`gitd_session_transition', `</span><br /><span> domtrans_pattern($2, gitd_exec_t, gitd_session_t)</span><br /><span> ', `</span><br /><span> can_exec($2, gitd_exec_t)</span><br /><span> ')</span><br /><br /><span> allow $2 gitd_session_t:process { ptrace signal_perms };</span><br /><span> ps_process_pattern($2, gitd_session_t)</span><br /><br /><span> exec_files_pattern($2, gitd_personal_t, gitd_personal_t)</span><br /><span> manage_dirs_pattern($2, gitd_personal_t, gitd_personal_t)</span><br /><span> manage_files_pattern($2, gitd_personal_t, gitd_personal_t)</span><br /><br /><span> relabel_dirs_pattern($2, gitd_personal_t, gitd_personal_t)</span><br /><span> relabel_files_pattern($2, gitd_personal_t, gitd_personal_t)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to execute</span><br /><span>## Git daemon shared files.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_execute_shared_files', `</span><br /><span> gen_require(`</span><br /><span> type gitd_shared_t;</span><br /><span> ')</span><br /><br /><span> exec_files_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> files_search_var($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to manage</span><br /><span>## Git daemon shared content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_manage_shared_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_shared_t;</span><br /><span> ')</span><br /><br /><span> manage_dirs_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> manage_files_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> files_search_var($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to manage</span><br /><span>## Git daemon personal content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_manage_personal_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_personal_t;</span><br /><span> ')</span><br /><br /><span> manage_dirs_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> manage_files_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> files_search_home($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to read</span><br /><span>## Git daemon personal content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_read_personal_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_personal_t;</span><br /><span> ')</span><br /><br /><span> list_dirs_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> read_files_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> files_search_home($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to read</span><br /><span>## Git daemon shared content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_read_shared_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_shared_t;</span><br /><span> ')</span><br /><br /><span> list_dirs_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> read_files_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> files_search_var($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to relabel</span><br /><span>## Git daemon shared content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_relabel_shared_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_shared_t;</span><br /><span> ')</span><br /><br /><span> relabel_dirs_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> relabel_files_pattern($1, gitd_shared_t, gitd_shared_t)</span><br /><span> files_search_var($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## Allow the specified domain to relabel</span><br /><span>## Git daemon personal content.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_relabel_personal_content', `</span><br /><span> gen_require(`</span><br /><span> type gitd_personal_t;</span><br /><span> ')</span><br /><br /><span> relabel_dirs_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> relabel_files_pattern($1, gitd_personal_t, gitd_personal_t)</span><br /><span> files_search_home($1)</span><br /><span>')</span><br /><br /><span>########################################</span><br /><span>## </span><br /><span>## All of the rules required to administrate an</span><br /><span>## Git daemon system environment</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Prefix of the domain. Example, user would be</span><br /><span>## the prefix for the user_t domain.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## Domain allowed access.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>## The role to be allowed to manage the Git daemon domain.</span><br /><span>## </span><br /><span>## </span><br /><span>## </span><br /><span>#</span><br /><span>interface(`gitd_system_admin', `</span><br /><span> gen_require(`</span><br /><span> type gitd_system_t, gitd_exec_t;</span><br /><span> ')</span><br /><br /><span> allow $1 gitd_system_t:process { getattr ptrace signal_perms };</span><br /><br /><span> kernel_search_proc($1)</span><br /><span> allow $1 git_system_t:dir list_dir_perms;</span><br /><span> read_files_pattern($1, gitd_system_t, gitd_system_t)</span><br /><span> read_lnk_files_pattern($1, gitd_system_t, gitd_system_t)</span><br /><br /><span> manage_files_pattern($1, gitd_exec_t, gitd_exec_t)</span><br /><br /><span> # This will not work since git-shell needs to execute gitd content thus public content files.</span><br /><span> # There is currently no clean way to execute public content files.</span><br /><span> # miscfiles_manage_public_files($1)</span><br /><br /><span> gitd_manage_shared_content($1)</span><br /><span> gitd_relabel_shared_content($1)</span><br /><br /><span> seutil_domtrans_setfiles($1)</span><br /><span>')</span><br /><span>[/code]</span><br /><br /><span>gitd.fc</span><br /><span>[code]HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:gitd_personal_t, s0)</span><br /><span>HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:gitd_personal_t, s0)</span><br /><br /><span>/srv/git(/.*)? gen_context(system_u:object_r:gitd_shared_t, s0)</span><br /><br /><span>/usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t, s0)</span><br /><br /><span># Conflict with Fedora cgit fc spec.</span><br /><span># /var/lib/git(/.*)? gen_context(system_u:object_r:gitd_shared_t, s0)</span><br /><span>[/code]</span><br /><br /><span>I manually labelled tcp:9418 gitd_port_t</span><br /><span>[code]</span><br /><span>semanage port -a -t gitd_port_t -p tcp 9418</span><br /><span>[/code]</span><br /><br />I also manually added a SELinux user mapping:<br /><br />semanage user -a -L s0 -r s0 -R "gits_r" -P gits_u<br /><br />echo "system_r:sshd_t:s0 gits_r:gits_t:s0" > /etc/selinux/targeted/contexts/users/gits_u<br /><br /><span>I edited /etc/xinetd.d/git:</span><br /><span>[code]</span><br /><pre class="bz_comment_text" id="comment_text_0"><span><span># default: off</span><br /><span># description: The git dæmon allows git repositories to be exported using \</span><br /><span># the git:// protocol.</span><br /><br /><span>service git</span><br /><span>{</span><br /><span> disable = no</span><br /><span> socket_type = stream</span><br /><span> type = UNLISTED</span><br /><span> port = 9418</span><br /><span> wait = no</span><br /><span> user = nobody</span><br /><span># server = /usr/bin/git</span><br /><span># server_args = daemon --base-path=/srv/git --export-all</span><br /><span>--user-path=public_git --syslog --inetd --verbose</span><br /><span> server = /usr/libexec/git-core/git-daemon</span><br /><span> server_args = --base-path=/srv/git --export-all</span><br /><span>--user-path=public_git --syslog --inetd --verbose</span><br /><span> log_on_failure += USERID</span><br /><span># xinetd doesn't do this by default. </span><span class="bz_closed"><a href="https://bugzilla.redhat.com/show_bug.cgi?id=195265" title="CLOSED ERRATA - xinetd doesn't listen on IPv6 by default.">bug #195265</a></span><br /><span> flags = IPv6</span><br /><span>}</span><br /><span>[/code]</span><br /><br /><span>Basically the selinux policy has 3 parts. one part is for the gitd system inetd server. the second part is for running gitd as a unprivileged user, and the third part is policy for the system wide git-shell environment.<br />So we secure the system wide gitd process, gitd process that users run and the git-shell process that is used to push pull to shared repositories.<br /><br />When you compile git-daemon, configured it like above and install the selinux module, restore the contexts of the paths in gitd.fc. then start xinetd: youll notice that inetd_t is not allowed to bind to gitd_port_t.<br />You can simply use audit2allow with the -M option to allow inetd_t to bind to gitd_port on behalf of gitd_system_t<br /><br />I use DAC to give usergroups access to the particular repositories and i use git ACL to restrict access to branches, tags etc.<br /><br />I used this great web site do implement this:<br /><br />http://www.kernel.org/pub/software/scm/git/docs/everyday.html<br /><br />I wrote two simple scripts:<br /><br />1. to add new users<br />2. to add new repostiries<br /><br />create_repository:<br /><br />crepo.sh:<br />[code]<br />#!/bin/bash<br /><br /># crepo.sh <br /><br />groupadd $1 || exit 1;<br />usermod -a -G $1 badabing || exit 1;<br /><br />mkdir /srv/git/$1.git || exit 1;<br />chmod -R +t /srv/git/$1.git || exit 1;<br />cd /srv/git/$1.git &amp;&amp; git --bare init || exit 1;<br /><br />cp /home/dgrift/create_repository/update /srv/git/$1.git/hooks/ || exit 1;<br />cp /home/dgrift/create_repository/allowed-users /srv/git/$1.git/info/ || exit 1;<br /><br />chown -R nobody:$1 /srv/git/$1.git || exit 1;<br /><br />chmod -R g+s /srv/git/$1.git/branches || exit 1;<br />chmod -R g+s /srv/git/$1.git/hooks || exit 1;<br />chmod -R g+s /srv/git/$1.git/info || exit 1;<br />chmod -R g+s /srv/git/$1.git/objects || exit 1;<br />chmod -R g+s /srv/git/$1.git/refs || exit 1;<br />chmod -R g+w /srv/git/$1.git || exit 1;<br /><br />exit 0;<br /><br />#EOF<br />[/code]<br /><br />This script installs the git ACL files update and allowed-users:<br /><br />update:<br />[code]<br />http://www.kernel.org/pub/software/scm/git/docs/howto/update-hook-example.txt<br />[/code]<br /><br />allowed-users:<br />[code]<br />refs/heads/master badabing<br />+refs/heads/pu badabing<br />refs/heads/bw/.* badabing<br />refs/heads/tmp/.* .*<br />refs/tags/v[0-9].* badabing<br />[/code]<br /><br />I also created a script to do part of what is required to add new users (i havent tested this script yet:<br /><br />[code]<br />#!/bin/bash<br /><br /># agits.sh <br /><br />useradd -Z gits_u -s /usr/bin/git-shell $1 || exit 1;<br />usermod -a -G sshusers,$2 $1 || exit 1;<br /><br />echo "Do not forget to set a password!"<br />echo "Manually add entries for $1 in /etc/security/namespace.conf!"<br />echo "You may need to edit /srv/git/$2.git/info/allowed-users!"<br /><br /># TODO: usrquota<br /><br />exit 0;<br />[/code]<br /><br />By the way xinetd and selinux dont play nice so you may need to edit the xinetd init script:<br /><br />[code]<br />https://bugzilla.redhat.com/show_bug.cgi?id=529681<br />[/code]<br /><br />So that is basically it.<br />The SELinux policy for the git system service should work by default. Additionally there are some booleans to to toggle for example to allow the git system service to also host personal repositories in ~/public_git, allow git to use any unreserved port for mass git repostory hosting. enable disable transition to git_session_t which is the user daemon.<br />For this to work you must also enable git policy for users by creating a module:<br /><br />for example if you want unconfined users to transition to git domain if they run git daemon ...><br /><br />myunconfined.te:<br />[code]<br />policy_module(myunconfined, 0.0.1)<br />optional_policy(`<br />gen_require(`<br /> type unconfined_t;<br />')<br /><br />git_session_role(unconfined_r, unconfined_t)<br />[/code]<br /><br />build and install that:<br /><br />make -f /usr/share/selinux/devel/Makefile<br />sudo semodule -i myunconfined.pp<br /><br />That should work and make unconfined_t users transition to git_session_t when they run git daemon ...><br /><br />For me this setup works, but i have not thoroughly tested the git_session_t domain yet.<br /><br />Would be nice to get some feedback so that i can improve this.<br /><br /><br />The git selinux policy is malformed above use the command below to pull the current gitd policy from my git repository<br /><br />git clone git://</span></span><span id="ip"><span><span>82.197.205.60/selinux-modules.git</span><br /></span><br /></span></pre><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-1254384423721238855?l=selinux-mac.blogspot.com" alt="" /></div> 2009-10-21T04:03:07+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://jczucco.blogspot.com/2009/10/videos-sobre-selinux-da-linux-plumbers.html Li no blog do <a href="http://blog.namei.org/?p=221">James Morris</a> que foram disponibilizados vários vídeos sobre SELinux no <a href="http://video.linuxfoundation.org/">site de vídeos da Linux Foundation</a>. Seguem abaixo: <br /> <br /><br /><li><a href="http://linuxplumbersconf.org/ocw/proposals/79">Status of SELinux in Ubuntu</a> by Caleb Case [<a href="http://linuxplumbersconf.org/2009/slides/caleb-case-ubuntu.2009.3.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1563">video</a>] <br /></li> <br /> <br /><br /><li><a href="http://linuxplumbersconf.org/ocw/proposals/26">Introducing SELinux Sandbox</a> by Dan Walsh [<a href="http://linuxplumbersconf.org/2009/slides/dan-walsh-selinux-sandbox.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1565">video</a>] <br /></li> <br /> <br /><br /><li><a href="http://linuxplumbersconf.org/ocw/proposals/58">SELinux Policy Within Package Managers, Why Policy is Special</a> by Joshua Brindle [<a href="http://linuxplumbersconf.org/2009/slides/brindle-selinux-distribution-lpc-slides.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1569">video</a>] <br /></li> <br /> <br /><br /><li><a href="http://linuxplumbersconf.org/ocw/proposals/87">XACE Demonstration and Discussion</a> by Eamon Walsh [mostly demo][<a href="http://video.linuxfoundation.org/video/1566">video</a>] (meet the AVC cow!) <br /></li> <br /> <br /><br /><li><a href="http://linuxplumbersconf.org/ocw/proposals/43">Making SELinux Easier to Use</a> by Bryan Jacobson [<a href="http://linuxplumbersconf.org/2009/slides/Bryan-Jacobson-Debora-Velarde-Plumbers09_SELinux_docs.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1562">video</a>] <br /></li> <br /> <br /><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/15117118-126636015980316145?l=jczucco.blogspot.com" alt="" /></div> 2009-10-12T23:23:03+00:00 Jeronimo Zucco (jczucco@gmail.com) http://blog.namei.org/2009/10/12/videos-from-the-lpc-security-track/ <p>Several videos from the <a href="http://linuxplumbersconf.org/2009/">2009 Linux Plumbers Conference</a> security track have been published at the Linux Foundation <a href="http://video.linuxfoundation.org/">video site</a>.   Here&#8217;s a listing with the relevant slides:</p> <ul> <li><a href="http://linuxplumbersconf.org/ocw/proposals/72">Linux Kernel Crypto API</a> by Herbert Xu [<a href="http://linuxplumbersconf.org/2009/slides/herbert-xu-crypto-200909.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1567">video</a>]</li> <li><a href="http://linuxplumbersconf.org/ocw/proposals/79">Status of SELinux in Ubuntu</a> by Caleb Case [<a href="http://linuxplumbersconf.org/2009/slides/caleb-case-ubuntu.2009.3.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1563">video</a>]</li> <li><a href="http://linuxplumbersconf.org/ocw/proposals/26">Introducing SELinux Sandbox</a> by Dan Walsh [<a href="http://linuxplumbersconf.org/2009/slides/dan-walsh-selinux-sandbox.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1565">video</a>]</li> <li><a href="http://linuxplumbersconf.org/ocw/proposals/58">SELinux Policy Within Package Managers, Why Policy is Special</a> by Joshua Brindle [<a href="http://linuxplumbersconf.org/2009/slides/brindle-selinux-distribution-lpc-slides.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1569">video</a>]</li> <li><a href="http://linuxplumbersconf.org/ocw/proposals/87">XACE Demonstration and Discussion</a> by Eamon Walsh [mostly demo][<a href="http://video.linuxfoundation.org/video/1566">video</a>]  (meet the AVC cow!)</li> <li><a href="http://linuxplumbersconf.org/ocw/proposals/43">Making SELinux Easier to Use</a> by Bryan Jacobson [<a href="http://linuxplumbersconf.org/2009/slides/Bryan-Jacobson-Debora-Velarde-Plumbers09_SELinux_docs.pdf">slides</a>][<a href="http://video.linuxfoundation.org/video/1562">video</a>]</li> </ul> <p>Many thanks to the folk at LF and the LPC organizers, especially Niv (also for the HTML listing above).</p> <p>If you attended LPC, or make use of the videos or slide, please drop by <a href="http://lwn.net/Articles/356259/">this thread at LWN</a> to say thanks.   If you have any suggestions for improvements, feel <strong>very</strong> free to volunteer your time at the next event.</p> 2009-10-11T22:43:40+00:00 jamesm http://danwalsh.livejournal.com/32976.html I started writing a long blog last week on writing policy on Google Chromium Browser.&nbsp; Saved it for my eyes only.&nbsp; I finished writing it today and changed the date.&nbsp; I then made it public, but for some reason the planets/aggregators&nbsp; marked it as being written on Oct 2<br /><br />You might have missed it.<br /><br />Here is the link, if you are interested<br /><br /><a href="http://danwalsh.livejournal.com/32759.html">http://danwalsh.livejournal.com/32759.html</a><br /><br /><br /><br /> 2009-10-09T16:20:52+00:00 dwalsh@redhat.com http://selinux-mac.blogspot.com/2009/10/my-view-on-domains-domain-types-roles.html <span><span>A domain is an environment in which a process operates. That environment is defined by the access vectors where a particular process is the sources.</span><br /><br /><span>Sometimes people refer to types of processes as domains. This is technically incorrect. Types of processes are domain types.</span><br /><br /><span>A domain is a general term for process environments. Processes can have different natures or properties. For example a user process environment can be called a domain and a process of a program can also be called a domain.</span><br /><br /><span>In SELinux world we like to "label" everything. So instead of calling a user process environment a domain we call it a user domain. The type of a user process is called a user domain type although technically its a domain type since user processes are processes.</span><br /><br /><span>Besides user domains, there are more different domains. These domains are defined by who transitioned to them. For example, init daemons are started by init scripts. The init script process sandbox is called init script domain and process environments that init script domains transition to are called init daemon domains.</span><br /><br /><span>Examples of init daemon domains are the environment of the httpd_t init daemon domain type, or postgresql. The main property is that these processes are started by init scripts.</span><br /><br /><span>Process environments of programs that user process environments transition to are called application domains, and the type of such a process is called a application domain type.</span><br /><br /><span>It depends on what transitions to what, that defines what domain it is. A cgi webapp that operates in its own environment is called a apache daemon domain if the httpd_t init daemon domain transitions to the process environment of a cgi webapp.</span><br /><br /><span>There are many more such domains and they are defined by what domain transitioned to them.</span><br /><br /><span>Domain transitions occur upon entrypoints. An entrypoint is a defined path to usually a executable file. Types of executable files are called executable file types. They are important in entrypoints to domains.</span><br /><br /><span>For example:</span><br /><br /><span>apache init script has a executable file type called for example httpd_initrc_exec_t.</span><br /><span>When the init_t domain type executes the file with executable file type httpd_initrc_exec_t,</span><br /><span>the process of that executable file type will get the initrc_t domain type and the process will operate in the init script domain (init script process environment).</span><br /><br /><span>The entrypoint is:</span><br /><span>init_t -> httpd_initrc_exec_t</span><br /><br /><span>This entrypoint leads to the initrc_t process environment. (init script domain)</span><br /><br /><span>Now this starts all over again when the process that has domain type initrc_t runs the apache executable.</span><br /><br /><span>Assuming in this example that /usr/sbin/httpd is apaches executable file and that it has a executable file type of httpd_exec_t.</span><br /><br /><span>The entrypoint is:</span><br /><span>initrc_t -> httpd_exec_t</span><br /><br /><span>The init script domain type runs the apache executable file type. There is a rule that says:</span><br /><span>when initrc_t executes httpd_exec_t, then transition to the httpd_t process environment type.</span><br /><br /><span>initrc_t -> httpd_exec_t -> httpd_t</span><br /><br /><span>initrc_t is a (init script) domain type. policy where initrc_t is the source type is called a init script domain.</span><br /><br /><span>httpd_exec_t is a executable file type.</span><br /><span>initrc_t -> httpd_exec_t is the entrypoint to the httpd_t domain (type)</span><br /><span>httpd_t -> is a (init daemon) domain type. policy where httpd_t is the source type is called a init daemon domain.</span><br /><br /><span>There are api available that make transitioning to these types of domains easier.</span><br /><br /><span>For example you can simply call the init_daemon_domain() interface if your process is started by a init script. proper calling of this single interface will take care of some of the declarations that are required. it will also set up a domain transition pattern.</span><br /><br /><span>type myinitdaemondomaintype_t;</span><br /><span>type myinitdaemondomaintypeexecutablefiletype_t;</span><br /><span>init_daemon_domain(myinitdaemondomaintype_t, myinitdaemondomaintypeexecutablefiletype_t)</span><br /><br /><span>This will instruct SELinux to let processes that run in the initrc_t init script domain that execute files with executable file type myinitdaemondomaintypeexecutablefiletype_t, domain transition to the myinitdaemondomaintype_t process enviroment and give that process the init daemon domain type.</span><br /><br /><span>initrc_t -> myinitdaemondomaintypeexecutablefiletype_t -> myinitdaemondomaintype_t</span><br /><br /><span>This ofcourse requires that file files in question are labelled accordingly.</span><br /><br /><span>application domains are handled a bit differently. This is mainly because of RBAC.</span><br /><br /><span>Role based access control is a mechanism that allows a single user to operate in various environments (user domains)</span><br /><br /><span>This means that you must also define which role is allowed to use the target domain type.</span><br /><br /><span>user_t: user domain type</span><br /><span>userapp_exec_t: (application) executable file type of the application to transition to.</span><br /><span>userapp_t: application domain type</span><br /><br /><span>entrypoint:</span><br /><span>user_t -> userapp_exec_t</span><br /><br /><span>Target of the entry point:</span><br /><span>userapp_tRole of the user that this domain transition pattern is defined for:</span><br /><span>user_r</span><br /><br /><span>type user_t;</span><br /><span>type userapp_exec_t;</span><br /><span>application_domain(user_t, userapp_exec_t)</span><br /><span>role user_r types userapp_t;</span><br /><br /><span>domain_transition_pattern(user_t, userapp_exec_t, userapp_t)</span><br /><br /><span>Again same idea but its just a bit more complicated than the init daemon domain because users</span><br /><span>(and applications started by users) can have different roles.</span><br /><br /><span>Applications started by init (system) can only have one role(system_r), So that makes the init daemon domains less complicated.</span><br /><br /><span>Explained:</span><br /><span>When a user process that operates in the user_t user process environment runs a file with executable file type myapp_exec_t, then the process of that executable file type will run in the myapp_t application process environment (application domain).</span><br /><br /><span>Since users can have different roles we also define that particular role to have access to the application domain type.</span><br /><br /><span>We also manually define a domain transition pattern (user_t -> myapp_exec_t -> myapp_t)</span><br /><br /><span>Keep in mind that domains transitioned to by users also have to deal with roles, unlike domain transitioned to by system processes. processes where the role field in the context is system_r.</span><br /><br /><span>Your policy source has many example of the different domains. If you want to write policy for a init daemon than look up an example of a init daemon domain in the source policy, and see if that can get you started. Idem ditto for application domains, apache daemon domains, xinet service domains, dbus service domains and etcetera.</span><br /><br /><span>User domains are different. They arent started by other processes. instead a real person logs into the system and by running a tty or pts a new domain is initiated. These transtions are defined both in the user domain policy and selinux mappings, many of which can be defined with the semanage command.</span><br /><br /><span>for example:</span><br /><span>(real human) -> tty_device_t -> user_t</span><br /><br /><span>I wont go into much detail here but i want to touch on the different user domains to consider. Users can have different roles. Roles are mappings to domains. and as explained domain are environments in which processes operate, defined by the policy in which a domain type is a source.</span><br /><br /><span>There are two different classes of user domain to consider. user domains that need a login environment, and user domains that do not need a login enviroment. i refer to them as primary and secondary user domains.</span><br /><br /><span>An example of a primary login user domain is staff_t. A user can login to a system in the staff_t user domain.</span><br /><br /><span>An example of a secundary user domain is webadm_t.</span><br /><br /><span>A primary user domain can be allowed to domain transition via roles (RBAC) to this secondary user domain. Thus may not be required to login and have a home directory and etcetera. Secondary user domains are often used for environments that have super user privileges. Like for example the webadm_t environment allows a user process to manage the webserver environment.</span><br /><br /><span>Have a look at the different defined user domain in the source policy. look at both staff domain and webadm domain and keep in mind that the first is a primary domain and the latter a secondary domain. By mapping the webadm_r and staff_r roles to a selinux user and mapping this selinux user to a linux login you can make selinux allow users that operate in the staff_t user domain to use Role based access control to domain transition to the secondary webadm_t user domain via sudo or su in conjunction with newrole.</span><br /><br /><br /><br /></span><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-1511886773288714711?l=selinux-mac.blogspot.com" alt="" /></div> 2009-10-06T16:25:39+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://danwalsh.livejournal.com/32430.html <strong>Fedora 12 adds a command line interface to polgengui.</strong><br /><br />I wrote up polgengui a couple of years ago to make writing SELinux policy a little easier.&nbsp; polgengui is a template based policy framework,&nbsp; that ask the user a few questions, and then generate initial policy files to allow the policy writer to get started.<br /><br />Polgengui is not a policy editor, slide is available for that. <br /><br />polgengui asks questions like:<br /><br />What is the name of the application?&nbsp; What kind of application is it?&nbsp; What files/directories does your app need write access?&nbsp; Does it your app use Syslog?&nbsp;&nbsp;Etc.<br /><br />polgengui takes these answers and applies templates from /usr/share/system-config-selinux/templates to generate policy.&nbsp; These templates write policy that generates the types necessary to use with SELinux, and the common rules for interaction with these types.&nbsp; These templates allow you to write policy that can easily be massaged into something acceptable by upstream.<br /><br />When I start writing policy, usually I&nbsp;don't know that much about how the application runs or what files/directories it needs to write.&nbsp;&nbsp; I install the tool and run <strong>rpm -ql package </strong>on it to see what directories the package maintainer includes with the tool.&nbsp; I run the tool and look for files it created for example in /var/run if it is a daemon or /tmp.&nbsp; If the package has a directory like /var/run/package or /var/lib/package I add these directories&nbsp; as writing directories.&nbsp; Similarly If the rpm includes an initscript I add that to the policy. &nbsp;I also use tools like <strong>nm</strong> to see which functions the application calls.&nbsp; I look for common functions like syslog, and I know to check the syslog button.<br /><br />Being&nbsp; lazy, I did not like all the button clicking, I figured I&nbsp;can script all of this. &nbsp;So I have added sepolgen to Fedora 12.<br /><br />It is simply a command line tool used to generate the same policy as polgengui, but the policy writer does not need to answer any questions.<br /><br />sepolgen /usr/sbin/mydaemon<br /><br />Sepolgen does the following:<br /><ul><li>rpm -qlf /usr/sbin/mydaemon<br /><ul><li>sepolgen scans for paths like /var/lib, /var/run, /etc/init.d/rc.d/mydaemon and selects the appropriate templates.</li></ul></li><li>nm -D /usr/sbin/mydaemon <br /><ul><li>sepolgen scans for syslog, setuid, setgid, ... and adds the appropriate access.</li></ul></li><li>generate 4 files<br /><ul><li>mydaemon.te&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #&nbsp;All types and allow rules discovered for this daemon</li><li>mydaemon.if&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Interfaces to be used with the types generated for this daemon</li><li>mydaemon.fc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # File context mapping between types and paths on disk&nbsp;</li><li>mydaemon.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; #&nbsp;Helper shell script used to compile/install policy and then label the paths correctly</li></ul></li></ul>The policy writer then only needs to execute mydaemon.sh and the policy will be compiled installed and the daemon will be ready to start testing.&nbsp; <br /><br />begin:<br />service mydaemon start<br />run tests against mydaemon<br />check for avc's<br />if None<br />&nbsp;&nbsp;&nbsp; Break;<br />audit2allow -R&nbsp;&gt;&gt;&nbsp;mydaemon.te<br />Verify the policy is good or fix it.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #&nbsp;THis is the hard part :^(<br />./mydaemon.sh<br />goto begin<br /><br />Try it out.<br /><br /> 2009-10-01T14:48:32+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/32018.html Eamon Walsh (no relation) of the NSA&nbsp;presenting XAce at the Linux Plumbers Conference introduces the AVC&nbsp;Cow. &nbsp;Photo by James Morris. <br />And know we are not going to make sealert display farm animals when SELinux reports an error.&nbsp; :^)<br /><br /><img src="http://farm4.static.flickr.com/3433/3951228343_fa43782189_b.jpg" alt="" /><br /><br /><br /> 2009-09-30T12:42:20+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/31888.html Here is&nbsp; a talk from the Linux Plumbers Conference describing how sandbox -X&nbsp;works.<br /><br /><a href="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox.pdf">http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox.pdf</a> 2009-09-29T12:34:14+00:00 dwalsh@redhat.com http://blog.namei.org/2009/09/29/portland-roundup/ <p>Last week was a busy one in Portland, starting with the <a title="SELinux Developer Summit" href="http://selinuxproject.org/page/Developer_Summit_2009">SELinux Developer Summit</a> on Sunday the 20th, followed by <a title="LinuxCon" href="http://events.linuxfoundation.org/events/linuxcon">LinuxCon</a> proper, and the <a title="Linux Plumbers Conference 2009" href="http://linuxplumbersconf.org/2009/">Linux Plumbers Conference</a>.</p> <p>The SELinux event went very smoothly, with around twenty-five attendees from the core SELinux developer community.  Given tight travel budgets all-round, this level of attendance was very good to see.  I&#8217;d like to thank Angela Brown, Craig Ross and the rest of the Linux Foundation team for making everything work perfectly for us (this was a co-located event ahead of LinuxCon).</p> <p>The day was divided into <a href="http://selinuxproject.org/page/Developer_Summit_2009/Schedule">two sessions</a>: standard presentations in the morning, followed by a more open general session in the afternoon.  It was good to catch up on the latest development work and directions in the project, and also to bring the otherwise globally distributed team together in the same place.</p> <div class="wp-caption aligncenter"><a href="http://www.flickr.com/photos/x_jamesmorris/3951218075/"><img title="SELinux Developer Summit Lunch Track" src="http://farm3.static.flickr.com/2517/3951218075_c6307c5b80.jpg" alt="SELinux Developer Summit Lunch Track" width="500" height="375" /></a><p class="wp-caption-text">SELinux Developer Summit Lunch Track</p></div> <p>The inaugural LinuxCon then ran for three days, with an expansive programme.  I gave a talk on adding extended attribute support to Linux NFSv3 &#8212; the slides for which may be downloaded as <a href="http://namei.org/presentations/linuxcon09_nfsv3xattrs.pdf">PDF</a> or viewed on <a href="http://www.slideshare.net/jamesmorris/adding-extended-attribute-support-to-nfs">slideshare</a>.  I completed the initial code on the flight to the US and <a href="http://thread.gmane.org/gmane.linux.file-systems/35475">posted</a> it from the hotel.  Feedback so far has been positive, although I haven&#8217;t heard from the NFS maintainers yet (who are likely busy with the merge window).  The rationale and technical approach is similar the NFSv3 ACL support which was merged some time ago; and the implementation is based on a fielded IRIX version (released under the GPL) &#8212; both factors which I hope will help with upstream acceptance.</p> <p>Also at LinuxCon: Dan Walsh gave a talk on <a href="http://selinuxproject.org/page/SVirt">sVirt</a>, which I introduced earlier this year at LCA (and previewed of during a lightning talk last year at FOSS.MY).  It seems to have been well-received (see <a href="http://lwn.net/Articles/353970/">LWN coverage</a>), and it&#8217;s a good example of the high-level security abstractions which we can build once we have the underlying mechanisms in place.  In the case of sVirt, where we apply strong mandatory isolation to process-based virtualization (e.g. SELinux+KVM), there is zero configuration &#8212; it configures itself automatically depending on which security model you have enabled.  It should work with any label security scheme, such as <a href="http://www.schaufler-ca.com/">Smack</a>, and I&#8217;ve also heard that the AppArmor folk have it working (even though sVirt was not explicitly designed for pathname security).</p> <p> <div class="wp-caption aligncenter"><a href="http://www.flickr.com/photos/x_jamesmorris/3951209191/"><img class=" " title="Only in Oregon" src="http://farm3.static.flickr.com/2472/3951209191_f847d04df3.jpg" alt="Only in Oregon - Voodoo Donuts" width="500" height="375" /></a><p class="wp-caption-text">Only in Oregon - Voodoo Donuts</p></div> <p>Dan gave a LinuxCon lightning talk at Linux on yet another high-level security feature: <a href="http://lwn.net/Articles/353203/">Sandbox X</a>, which extends the <a href="http://blog.namei.org/2009/05/29/selinux-sandbox-and-ambient-authority/">SELinux sandbox</a> mechanism to the desktop by running applications in isolated X servers via <a href="http://www.freedesktop.org/wiki/Software/Xephyr">Xephyr</a>.  He gave a full talk on this the Linux Plumbers Conference, slides of which may be found <a href="http://selinuxproject.org/~jmorris/lpc09_security_microconf_slides/dan-walsh-selinux-sandbox.pdf">here</a>.</p> <p> <div class="wp-caption aligncenter"><a href="http://www.flickr.com/photos/x_jamesmorris/3951222035/in/set-72157622324246417"><img title="Dan Walsh - SELinux Sandbox" src="http://farm3.static.flickr.com/2656/3951222035_ae3a323583.jpg" alt="Dan Walsh - SELinux Sandbox" width="500" height="375" /></a><p class="wp-caption-text">Dan Walsh - SELinux Sandbox</p></div> <p>I don&#8217;t have the time to cover everything at LinuxCon &#8212; check the web site for videos and slides.  Also see my <a title="LinuxCon 2009" href="http://www.flickr.com/photos/x_jamesmorris/sets/72157622324246417/">flickr photo set</a>.  It was a very impressive first conference, with LCA-quality social events and catering (Angela Brown has been quietly studying LCA, in fact) and certainly sets a new standard for such events in North America.  LinuxCon will be held in Boston next year &#8212; I wonder what they&#8217;ll come up with to beat <a href="http://lwn.net/Articles/353898/">bacon-maple donuts</a> for breakfast.</p> <p>Following LinuxCon, the second Linux Plumbers Conference was held, and we were fortunate to get a double session for the <a href="http://linuxplumbersconf.org/ocw/events/2009/tracks/2">security</a> microconf (a special thanks to Nivedita Singhvi and team for making this possible).  We had talks on several Linux security projects, including Herbert Xu with an update on the kernel crypto API, Caleb Case on SELinux in Ubuntu, David Safford on IMA, and Casey Schaufler on the Smack application ecosystem (some high-end televisions will soon be shipping with Smack, to isolate the applications of competing content providers).</p> <p>The <a href="http://linuxplumbersconf.org/ocw/proposals/87">XACE talk</a> was very interesting, as we&#8217;re getting close to having workable support for MAC security inside X, which will allow the desktop to be locked down with fine-grained and comprehensive controls.  While typically envisaged for MLS use (e.g. having &#8220;secret&#8221; and &#8220;unclassified&#8221; desktop applications running on the same system), there are also many general purpose scenarios, such as separating your online banking session from your IRC chats.  It will be interesting to see what&#8217;s possible when combining XACE window labeling with Sandbox X &#8212; stay tuned.</p> <p> <div class="wp-caption aligncenter"><a href="http://www.flickr.com/photos/x_jamesmorris/3951228343/"><img title="XACE and AVC Cow - The future of the secure desktop" src="http://farm4.static.flickr.com/3433/3951228343_fa43782189.jpg" alt="XACE and AVC Cow - The future of the secure desktop" width="500" height="375" /></a><p class="wp-caption-text">XACE and AVC Cow - The future of the secure desktop</p></div> <p>Slides from the LPC microconf will be at the event web site soon, and I&#8217;ve also made all them available for download <a href="http://selinuxproject.org/~jmorris/lpc09_security_microconf_slides/">here</a>.</p> <p>It was a fairly intense week &#8212; three conferences plus the travel to and from Sydney, as well as the merge window opening a few days before.  I&#8217;ve got a few weeks to recover and then it&#8217;s Japan for the <a href="http://events.linuxfoundation.org/events/kernel-summit">Kernel Summit</a> and <a href="http://events.linuxfoundation.org/events/japan-linux-symposium/">Japan Linux Symposium</a>, stopping in Kuala Lumpur on the way back for <a href="http://foss.my/2009/">FOSS.MY</a> (where I&#8217;ll be covering the latest in SELinux Sandboxing).</p> <p>**</p> <p>Note that you can now follow my micro-updates on <a href="http://twitter.com/xjamesmorris">twitter</a>, which is bridged from my <a href="http://identi.ca/jamesm">identi.ca</a> account.</p></p></p></p> 2009-09-29T00:38:39+00:00 jamesm http://danwalsh.livejournal.com/31604.html <img border="0" width="0" height="0" src="http://counters.gigya.com/wildfire/IMP/CXNID=2000002.0NXC/bHQ9MTI1MzY3MDk*NTQzOCZwdD*xMjUzNjcxMTI4NDczJnA9MTk4NjgxJmQ9ajNsMGd4N2pkayZuPWxpdmVqb3VybmFsJmc9MiZvPTIxYjJmYTYzZDVjYjRiOWQ5NGM3Njc3ZTlmMmU4Yjk4Jm9mPTA=.gif" /> 2009-09-23T01:58:51+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/31247.html A couple of days ago I&nbsp;blogged about a cool new feature in Fedora 12 called <a href="http://danwalsh.livejournal.com/31146.html">sandbox -X.</a><br /><br />Today I want to write about how I&nbsp;can use it within Firefox.<br /><br /> You should not trust any data that I download from the internet.&nbsp; Even trustworthy sites have been hacked with <a href="http://it.slashdot.org/article.pl?sid=09/02/25/024211">acroread vulnerabilities</a>.<br /><br /><strong>How do you setup firefox to run sandbox -X evince on pdf files?</strong><br /><br />My first attempt failed.&nbsp; Firefox does not allow you to specify a full command string to run downloaded content in, I needed to create a simple shell script.<br /><br /><span>cat ~/bin/sandboxevince<br />#!/bin/sh<br />/usr/bin/sandbox -X evince $*</span><br /><br />When you create this, remember to <br /><span><br />chmod +x ~/bin/sandboxevince</span><br /><br />In Firefox:<ul><li>Select the Edit-&gt;Preferences menu item, which brings up the &quot;Firefox Preferences&quot; dialog.</li><li>Select &quot;Applications&quot; and entered pdf into the search dialog.&nbsp; This brought up evince as the default.&nbsp;</li><li>Select&nbsp; the &quot;use evince&quot; menu and select other.&nbsp;</li><li>Select ~/bin/sandboxevince</li><li>Save</li></ul><br />Now I go to my<a href="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/"> favorite site,&nbsp; </a>and select a presentation<br /><br />sandbox -X evince runs great !!!<br /><br />You can go back and change all your acroread settings to use sandboxevince.<br /><br />You can do the same for OpenOffice<br /><br /><span>cat ~/bin/sandboxooffice<br />#!/bin/sh<br />/usr/bin/sandbox -X ooffice $*<br /><br />chmod +x ~/bin/sandboxooffice</span><br /><br />I searched for doc and changed that to use sandboxooffice<br /><br />I did notice that some extensions were not in the list.&nbsp; I had to go to a page with a odf file on it and tell firefox to&nbsp; use sandboxooffice for this type for now on.<br /><br />BTW,&nbsp;&nbsp; Firefox leaks open file descriptors like a sieve, so I will need to add dontaudit policy to cover these up. Firefox developers know about the leaks but say &quot;they can not do much about the leaks,&nbsp; since plugins get added with leaks all the time.&quot;<br /><br />Now I can feel a little safer as I browse the web.<br /><br />It would be really great if firefox gave the ability to run all helper apps within a single command. <br /><br />Now off to do the same with thunderbird.<br /> 2009-09-18T16:11:44+00:00 dwalsh@redhat.com http://selinux-mac.blogspot.com/2009/09/avc-denials-example.html <span>SELinux logs policy violations to /var/log/audit/audit.log if audit is installed and enabled. If audit is<br />not installed or enabled, than SELinux sends policy violation notices to dmesg or /var/log/messages.<br /><br />The policy violations that SELinux logs are called AVC denials. AVC is an abbreviation for Access Vector<br />Cache. Which is the SELinux cache with Access Vectors. Access vectors are the rules that govern access.<br /><br />Reading AVC denials properly helps troubleshoot issues. In this article i will talk about, and highlight<br />some of the information you can retrieve from AVC denials. I will also touch on some of the tools that<br />assist in listing, parsing and translating SELinux Access Vector Cache denials.<br /><br />Example of a AVC denial:<br /><br />avc: denied { getattr } for pid=7604 comm="firefox" path="/usr/lib64/firefox-3.5.3/firefox" dev=dm-2 ino=1311607<br />scontext=dgrift_u:dgrift_r:gwibber_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_exec_t:s0 tclass=file<br /><br />The line above provides much information about what has been denied:<br /><br />1. What process was denied access.<br />2. What domain type did the source process operate in when it was denied access.<br />3. What object or subject was the source process denied access to.<br />4. What was the object/subject type of the target.<br />5. What permission was denied.<br />6. What is the class of the target.<br />7. What was the process identity of the source.<br />8. What was the inode number of the target object.<br />9. What happened.<br /><br />Security is about managing interaction. Interaction has a source and a target. Interaction involves atleast<br />a subject as a source (an interacting party) and a subject or object as a target. The target of the<br />interaction. Subjects are interacting entities, and object non-interacting entities. Subjects can interact<br />with object, but subjects can also interact with other subjects.<br /><br />The target class in a AVC denial tells us what the class (origin) of the target in an interaction is.<br />A source of a interaction is always a subject (interacting entity). Object can not interact and thus can<br />never be a source of an interaction.<br /><br />Lets try and connect the dots and see if we can make sense of the example AVC denial above. We will try to<br />answer each of our 9 questions in the check list:<br /><br />1. What process was denied access.<br /><br />comm="firefox" shows use the name of the command that was run. The firefox program was denied access.<br /><br />2. What domain type did the source<br />process operate in when it was denied access.<br /><br />scontext=dgrift_u:dgrift_r:gwibber_t:s0-s0:c0.c1023 shows that the source firefox was operating with the<br />gwibber_t domain type. The type is the third field in the security context tuple.<br /><br />3. What object or subject was the source process denied access to.<br /><br />path="/usr/lib64/firefox-3.5.3/firefox" Shows what the target of the source in this interaction was.<br /><br />4. What was the object/subject type of the target.<br /><br />tcontext=system_u:object_r:mozilla_exec_t:s0 shows the type of the target.<br /><br />5. What permission was denied.<br /><br />{ getattr } Shows the syscall (permission) that was denied.<br /><br />6. What is the class of the target.<br /><br />tclass=file shows that the class of the target in our interaction was file.<br /><br />7. What was the process identity of the source.<br /><br />pid=7604 shows that the process id of the source of our interaction was 7604<br /><br />8. What was the inode number of the target object.<br /><br />ino=131160 shows that the inode number of the target object in our interaction was 131160.<br /><br />9. What happened.<br /><br />denied shows that the particular Access Vector was denied.<br /><br />We have all the detail that we need to established *what* happend.<br /><br />1. The command /usr/bin/firefox was executed but some interacting entity.<br />2. This command was executed with the gwibber_t domain type.<br />3. The target of the source /usr/bin/firefox was /usr/lib64/firefox-3.5.3/firefox<br />4. The type of the target was mozilla_exec_t<br />5. The source /usr/bin/firefox that operated with the gwibber_t domain type was denied the "getattr"<br />syscall on the target /usr/lib64/firefox-3.5.3/firefox that had type mozilla_exec_t.<br />6. The class of the target /usr/lib64/firefox-3.5.3/firefox is a file (the target is a file object)<br />7. The process of /usr/bin/firefox had the process id of 7604 when this Access vector occured.<br />8. The inode number of the target file object is 131160<br />9. Access was denied.<br /><br />These are the SELinux facts:<br /><br />the /usr/bin/firefox command was denied to get the attributes of the /usr/lib64/firefox-3.5.3/firefox file<br />source domain type gwibber_t was denied get attribute of a file object with type mozilla_exec_t<br /><br />What this means is that there was no rule to allow this access, thus access was denied.<br /><br />From here on out things get less obvious:<br /><br />We know some facts but this has raised other questions:<br /><br />1. Are the types of the source and target correct?<br />2. We know what was denied but we dont know why.<br />3. Should we allow this access?<br />4. Does it signal intrusion?<br />5. If we allow it access what would be the best way to do it.<br />6. What are the problems if we do it the other way?<br /><br />The reason that these questions are harder to answer is because it depends on the policy that is created by<br />the policy author. But if you see an AVC denial we can usually narrow the cause down to:<br /><br />a. The source and/or the target is mislabelled (wrong type)<br />b. It is a bug in policy.<br />c. Intrusion was detected and prevented.<br /><br />So let's try to answer all these questions:<br /><br />1. Are the types of the source and target correct?<br /><br />This is the first thing we must verify. If the types are incorrect than we must correct them first to be able to learn the real reason<br />about what happend. Objects sometimes get mislabelled. For example if created the object whilst you had SELinux disabled and forgot to<br />restore the context. Another reason might be that you have moved the file from another location as opposed to copying it, and forgot<br />the restore the context.<br /><br />How do we determine whether the types are correct? Well the answer is that we have to dig into some of the properties of the policy.<br />We have to put ourselves into the shoes of the policy author.<br /><br />To verify whether the type of the source (gwibber_t) is correct we have to ask ourselves which policy module owns this type?<br />This is a hard question to answer. Really the only way to figure this out is to grep for the gwibber_t type in the source of the<br />policy. In this case there is a policy module installed called gwibber.<br /><br />For example:<br /><br />grep -r "type gwibber_t" Modules/<br /><br />We are looking for the declaration of the gwibber_t type. Types are usually declared in files with .te suffixes (type enforcement<br />source policy files)<br /><br />So we could narrow our grep a bit:<br /><br />grep -r "type gwibber_t" Modules/ | grep "\.te"<br /><br />Modules/gwibber.te:type gwibber_t;<br />Modules/gwibber.te:type gwibber_tmpfs_t;<br /><br />The type is declared in the gwibber.te source policy type enforcement file. We can now grep this file for the policy_module<br />declaration to figure out what the name of the module is:<br /><br />grep policy_module Modules/gwibber.te<br />policy_module(gwibber, 0.0.1)<br /><br />The policy module name is gwibber and the version number is 0.0.1, Now we can determine whether this module is installed:<br /><br />sudo /usr/sbin/semodule -l | grep gwibber<br />gwibber 0.0.1<br /><br />The module is installed, we know that the type gwibber_t is owned by the gwibber module.<br /><br />Now we should figure out what the type of the firefox command is. the firefox command is located in /usr/bin/firefox.<br />We can use ls -alZ /usr/sbin/firefox to determine the type of this command:<br /><br />-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/bin/firefox<br /><br />The type of the firefox command is bin_t. This type has a special property that is specific to the policy model. You could look up the<br />properties of this type the same way that we are currently looking up the properties of type gwibber_t.<br /><br />But to not overly complicate things i will explain the main property of the bin_t type.<br /><br />The bin_t type is a generic type for executable files in bin and sbin directories. These commands get run with the domain type of the<br />subject that executed the command. So if a process that was operating with the gwibber_t domain type executed a command with the bin_t<br />type, than that command would run with the gwibber_t domain type.<br /><br />With this in we have to figure out whether processes with the gwibber_t domain type are allowed to execute files with the bin_t type:<br /><br />sudo sesearch --allow -s gwibber_t -t bin_t -c file -p execute<br />Found 1 semantic av rules:<br /> allow gwibber_t bin_t : file { ioctl read getattr lock execute execute_no_trans open } ;<br /><br />The sesearch command queries the policy store and looks if there is a rule which allows the source gwibber_t domain type to execute<br />target objects of the files class with type bin_t.<br /><br />A line is returned confirming that this is allowed. This tells us that the source in our interaction is likely correclty labelled.<br />This is what happened. Some process that run with the gwibber_t domain type ran /usr/bin/firefox which has the bin_t type causing the<br />firefox command to run with the gwibber_t domain type.<br /><br />Now we need to determine whether the type of our target is correct. In our interaction that fortunatly is pretty easy.<br />We know the path of our target: /usr/lib64/firefox-3.5.3/firefox<br />We can run the matchpathcon command to see what type is defined for this location and if that defined type corresponds to the target<br />type in our avc denial: mozilla_exec_t.<br /><br />sudo /sbin/matchpathcon /usr/lib64/firefox-3.5.3/firefox<br />/usr/lib64/firefox-3.5.3/firefox system_u:object_r:mozilla_exec_t:s0<br /><br />This confirms that the labelling in the interaction is correct for both source and target.<br /><br />Sometimes however, the full path of the target is not shown in a avc denial. In that case you can use the inode number to find the<br />full path:<br /><br />find / -inum 131160<br />/usr/lib64/firefox-3.5.3/firefox<br /><br />2. We know what was denied but we dont know why.<br /><br />This is another hard question to solve. We are no psychics. We cannot read the mind of the policy author.<br />We can try:<br /><br />Should gwibber be able to run firefox? It should be able to run the default browser yes but in this case (the case where i am the<br />policy author of the gwibber policy module) it was decided to not allow this funcionality. It is obvious that the gwibber_t domain<br />type was not allowed the access/see (get attributes) the mozilla executable file with type mozilla_exec_t. So either that was done on<br />purpose or it is a bug in the policy.<br /><br />3. Should we allow this access?<br />3. Should we allow this access?<br />4. Does it signal intrusion?<br />5. If we allow it access what would be the best way to do it.<br />6. What are the problems if we do it the other way?<br /><br />Another tough question. if we allow gwibber_t to get attributes of files with type mozilla_exec_t it will probably want more after<br />that. Chances are that gwibber wants to execute the file (run firefox), since gwibber is designed to open pages in the default<br />browser.<br /><br />If we want gwibber to be able to open the browser, do we want to allow gwibber_t to run the browser with the gwibber_t type or should<br />we lets gwibber_t domain transition to the mozilla_t domain type? Well my personal opinion is to domain transition where ever possible<br />but it depends on the situation. In this case a domain transition from gwibber_t to mozilla_t via mozilla_exec_t would likely be the<br />best decision. However this requires that policy is written manually to make it do what we want it to do.<br /><br />But what if we just want to allow this single access vector? We could use the audit2allow tool to translate the avc denial into policy<br />language and to create a module. Than we could load the created policy module into the policy store with the semodule command.<br /><br />echo "avc: denied { getattr } for pid=7604 comm="firefox" path="/usr/lib64/firefox-3.5.3/firefox" dev=dm-2 ino=1311607<br />scontext=dgrift_u:dgrift_r:gwibber_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_exec_t:s0 tclass=file" | audit2allow -M<br />mygwibber; sudo semodule -i mygwibber.pp<br /><br />Or we could do it ourselves:<br />echo "policy_module(mygwibber, 0.0.1)" > mygwibber.te;<br />echo "require { type gwibber_t, mozilla_exec_t; }" >> mygwibber.te;<br />echo "allow gwibber.te mozilla_exec_t:file getattr;" >> mygwibber.te;<br />make -f /usr/share/selinux/devel/Makefile mygwibber.pp<br />sudo semodule -i mygwibber.pp<br /><br />So:<br /><br />a. The source and/or the target is mislabelled (wrong type)<br /><br />The types were correct.<br /><br />b. It is a bug in policy.<br /><br />It is a bug in policy because we determined that it is usually behaviour for gwibber to try to run the default browser to display<br />pages. Either we should allow it gwibber to run the browser (be it with the gwibber_t domain type or by domain transition with the<br />mozilla_t domain type) or we should make sure that no AVC denials are displayed when gwibber_t tries to access the mozilla executable<br />file with type mozilla_exec_t.<br /><br />The rule that i am going to implement is this:<br /><br />dontaudit gwibber_t mozilla_exec_t:file getattr;<br /><br />Which says if domain type gwibber_t tries to get attributes of files with type mozilla_exec_t than "dontaudit" which means do not<br />print an avc denials (e.g. silently deny this)<br /><br />That is just my personal preference. Its not something fixed. It is my security decision, whether good or bad.<br /><br />c. Intrusion was detected and prevented.<br /><br />No not really an intrusion since gwibber is designed to open pages in the default web browser which is firefox. So it is expected<br />behaviour. However i dont want to allow it. But i dont want to log the AVC denial when it happens either because its not important.<br /></span><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-9182037528389825455?l=selinux-mac.blogspot.com" alt="" /></div> 2009-09-17T06:47:46+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://selinux-mac.blogspot.com/2009/09/perspective-on-selinux.html <span><span>Many people think SELinux is complicated. SELinux is actually beautifully simple if you keep in mind that it </span><br /><span>allows you to manage security very granular in computer systems which are very complex.</span><br /><br /><span>In this article i will try to explain the basics of SELinux. The things you need to know to find your </span><br /><span>way around the SELinux environment.</span><br /><br /><span>SELinux can roughly be categorized in a few separate parts (ordered by importance):</span><br /><br /><span>1. The SELinux framework.</span><br /><span>* 2. The tools to manage SELinux.</span><br /><span>* 3. The policy.</span><br /><br /><span>In this article i will talk about The SELinux framework and the Type enforcement security model.</span><br /><br /><span>Knowledge of the SELinux framework is fundamental. If you are familiar with this it will enable you to </span><br /><span>find your way around the rest.</span><br /><br /><span>Knowledge of the different SELinux security models is also important in this part i will talk about how </span><br /><span>the Type enforcement security model fits into the SELinux Framework.</span><br /><br /><span>To learn about SELinux you have to know a bit about security and about computer systems.</span><br /><br /><span>What is security? Security is managing parties in an interaction. So for example if you want to secure a </span><br /><span>human sitting on a chair. You have to manage the human and the chair. The human interacts. this is </span><br /><span>called a subject, the chair does not interact and this is called an object. You could create policy that allows </span><br /><span>the human to sit on the chair but not stand on it. Standing on it may cause it to break.</span><br /><br /><span>How do computer systems work? Computer systems are similar. processes are like humans. We call them </span><br /><span>agents. A process therefore is a subject just like the human in my chair example. Processes interact. A </span><br /><span>file in a computer system does not interact. The subject interacts with it. A file is a object. In a </span><br /><span>computer system there are many classes of objects just like there are many kind of classes of object in </span><br /><span>real life. My example was a chair but it could have been a bed or a bike etc. In a computer system a </span><br /><span>object could be a file or a network port. Generally keep in mind that subjects interact and object get </span><br /><span>interacted with.</span><br /><br /><span>So simplified:</span><br /><span>Real life: human, chair, sit</span><br /><span>Computer system: process, file, read</span><br /><br /><span>Humans can be categorized in many classes, the most obvious is man and woman but there are many types of </span><br /><span>different humans. Processes in a computer system can also be categorized in many classes, for example a </span><br /><span>process of a user or a process of a program. </span><br /><br /><span>Chairs can also be categorized in many classes. Theres rocket chairs and theres oother chairs as well, </span><br /><span>but they are all chairs and objects. Objects in computer systems can also be categorized. There are </span><br /><span>files and directories etcetera.</span><br /><br /><span>If you want to manage all these subjects and objects than you will want to categorize them. So that you </span><br /><span>can create policy for each.</span><br /><br /><span>Subjects interact, objects dont. Lets look at some policy for the examples i gave.</span><br /><br /><span>real life:</span><br /><span>allow man chair:rocket_chair sit;</span><br /><span> </span><br /><span>computer system:</span><br /><span>allow user file:dir read;</span><br /><br /><span>So in the real life example we allow a subject: human of the type: man to sit on a chair that is of the </span><br /><span>class rocket_chair.</span><br /><br /><span>In the computer system example we allow a subject: process of the type user to read a file that is of </span><br /><span>the class dir.</span><br /><br /><span>Our rule start with allow to signal that we want to allow the rule that follows, than follow our source </span><br /><span>of the interaction. Which is always a subject since subject interact and object do not. Next is the </span><br /><span>target. targets can be either subject or objects. subjects can interact with other subjects. for example </span><br /><span>a man talking with a woman. Next is the class of the target. in our man/woman interaction the class </span><br /><span>would of the target human would be woman. The last part defines the permission. What interaction is </span><br /><span>allowed? in our man/chair example the man is allowed to site on a rocket_chair in our computer system </span><br /><span>example the user process is allowed to read a dir. In our recent man talks to woman example we allow a </span><br /><span>man to talk to a woman.</span><br /><br /><span>So back to SELinux. How does SELinux relates to all this. SELinux is for a large part in the kernel. It </span><br /><span>is a framework. That means that SELinux provides us with some attributes so that we can create policy to </span><br /><span>define what may and what may not. The attributes that SELinux provides are classes and permissions. </span><br /><span>SELinux knows the classes of the parties involved in interaction in a computer system. It knows </span><br /><span>subjects and the different classes of objects. SELinux also knows how subject interact with the </span><br /><span>different object. In the real life example: SELinux knows theres a human interacting with a chair. It </span><br /><span>knows the chair is a rocket chair and it know in what ways humans interact with chairs (sit for example)</span><br /><br /><span>So the framework provides us with the attributes to create rules. What it cannot do is make further </span><br /><span>destictions between different subjects and objects. And to be able to manage everything we must make </span><br /><span>distinctions as much as possible. This is what policy authors do. They make categorize sources and </span><br /><span>targets in an interaction. for example. SELinux knows a human wants to site in a chair. It even knows it </span><br /><span>is a rocket chair. But what if we want to make a destinction between a yellow rocket chair and a red </span><br /><span>rocket chair? We want to be able to allow the human to site in the red rocket chair but not the yellow </span><br /><span>one. SELinux framework does not know the color, we do. This is where types come in.</span><br /><br /><span>Policy authors assign types to subjects and objects. so in the real life example:</span><br /><br /><span>allow human chair:rocket_chair sit;</span><br /><br /><span>allow human_man_type red_chair_type:rocket_chair sit;</span><br /><br /><span>In the computer system:</span><br /><br /><span>allow process file:dir read;</span><br /><br /><span>allow user_process_type home_file_type:dir read;</span><br /><br /><span>Types allow us to further categorize the parties in an interaction.</span><br /><span> </span><br /><span>If sufficient for now to know that the SELinux framework provides us with the classes and permission </span><br /><span>attributes and that it allows us the further categorize the source and target in an interaction, be it </span><br /><span>subjects or objects.</span><br /><br /><span>Type enforcement is a model where policy is enforcement for interaction between the types of the parties </span><br /><span>involved. The types can be defined by the policy author and the best types depend on the environment. </span><br /><br /><span>In a computer environment you might want to make a destinction between a log file and a library file, a </span><br /><span>program or a user. In a real life environment you might want to make a destinction between man or woman, </span><br /><span>red rocket chair or yellow rocket chair. It depends on what colors rocket chairs exist in you </span><br /><span>environment. Types enable us to define the properties of our environment.</span><br /><br /><span>By default all interaction is forbidden. if we want to allow something we have define what is allowed. </span><br /><span>If there are many types and classes of parties in interaction in an environment you might be able to </span><br /><span>imagine to amount of rules required to manage all this. For now it is sufficient to know that there are </span><br /><span>also ways to group or tag different types.</span><br /><br /><span>If you want a human to be able to sit on all colored rocket chairs you could for example tag the </span><br /><span>red_chair_type and the yellow_chair_type to be colored_chair_types and use the tag to make one single </span><br /><span>rule for both colored chairs.</span><br /><br /><span>allow human_man_type colored_chair_types:rocket_chair sit;</span><br /><br /><span>So that is a very important thing to understand about SELinux and security in general. The enforcement </span><br /><span>of types is the most important security model of SELinux.</span><br /><br /><span>Besides the "allow source target:target_class permission;" rules, there is another thing to understand </span><br /><span>and that is called a type transition. You can make one type transition to another type.</span><br /><br /><span>For now it is suffice to know that subject and object types can be triggered to change. Subject types </span><br /><span>can change via rules that define what should happen if a process executes a file and object </span><br /><span>types can transition via rule that define what should happen if a file is created under a certain </span><br /><span>parents type.</span><br /><br /><span>Type transitions help you futher categorize parties which will let you define rule for types in certain scenarios.</span><br /><br /><span>This is the basics about SELinux. Types are configured by policy authors. The have special meanings and those meanings can vary per </span><br /><span>policy. So the only thing that really always applies are classes and permissions they stay the same. Types are defined by humans and </span><br /><span>to learn what a certail type is allowed you would have to reference the policy to determine that.</span><br /><br /><span>And that is want you we are often confronted with, types. rules that govern how one type can interact with another. What we dont know </span><br /><span>is what a certain type of a subject is supposed to be allowed to do to a certain type of a object.</span><br /><br /><span>These things can be figured out by referencing the policy and asking yourself the question what is the meaning of the type? what are </span><br /><span>its properties? This is what makes SELinux environments complex because policy is based on a policy authors vision on a system. And </span><br /><span>that vision may differ per policy model and environment. </span><br /><br /><span>SELinux itself is not complicated but if you want to manage a complex system you will have to create many different types and thats </span><br /><span>where SELinux gets complex. If you have a simple system to manage than SELinux will also be simpeler. If you have a simple security </span><br /><span>goal on a complex system you may also be able to implement a simpler policy that is targeted towards just reaching your simple </span><br /><span>security goal.</span><br /><br /><span>Eventually its all just subjects, objects, classes and permissions when it comes to the SELinux framework and the type enforcement </span><br /><span>security model. </span><br /><br /><span>The more granular the policy to govern how subject can interact with objects gets,the complexer selinux gets. But this is the strenght </span><br /><span>of SELinux: it allows you to define very granular what is allowed and what not in a system.</span><br /><br /><span>Blame the policy author and the policy for the complexity of managing your Security-Enhanced Linux ( i bet the policy author will </span><br /><span>blame Linux ;) )</span><br /><br /><span>A quick note about the tools:</span><br /><br /><span>What are the tools for:</span><br /><br /><span>labeling objects</span><br /><span>parsing access vector denials</span><br /><span>translating access vector denials to policy</span><br /><span>finding suggestions to solutions for access vector denials</span><br /><span>finding what type a object should have</span><br /><span>changing types of objects</span><br /><span>restoring types of objects</span><br /><span>searching rules in the policy database</span><br /><span>mapping linux logins to subject types</span><br /></span><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-5249869767884565499?l=selinux-mac.blogspot.com" alt="" /></div> 2009-09-16T15:41:49+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://danwalsh.livejournal.com/31146.html One of the downsides of working in security is that we seldom get to do cool things.&nbsp; The desktop engineers, VM engineers, even kernel engineers get to&nbsp; show off cool stuff.&nbsp; But security guys usually only ever get to show how we&nbsp; broke something, if that.&nbsp; Sometimes all we can do is say &quot;trust us, it's working.&quot; But I think I have something cool to show off which I'm calling&nbsp; <strong>sandbox -X</strong>.<br /><br /><strong>A little history.</strong><br /><br />Back in May, I&nbsp;wrote a blog entry describing the<a href="http://danwalsh.livejournal.com/28545.html"> &quot;SELinux Sandbox&quot;</a>, , which provides a way to run a filter-type program within a locked-down sandbox. This allows administrators to take untrusted content, run it through one or more filters, and be able to trust that the content can't cause the filter programs to do evil things.<br /><br /> As soon as I&nbsp;released it, I&nbsp;received email asking if It could be used to sandbox Acroread, and I had to say &quot;Sorry, it can't do that&quot;.&nbsp;&nbsp; <br /><br /><strong> But why can't it do that?</strong><br /><br /> Acroread and&nbsp; most other desktop applications use multiple communication channels, interacting not just with stdin and stdout, but accessing configuration files, directly or using interprocess calls as with GConf, the X server and other applications, and usually have full run of the user's home directory.&nbsp; A bug in a desktop application can be exploited to attack other processes on the system through any of these channels.&nbsp; Attempting to lock down access to these things usually just causes applications to break, or at least degrades the user experience.&nbsp; In a nutshell, there was no good,&nbsp; general-purpose way to lock down Acroread, or that matter, any other desktop application.<br /><br />Over the years several attempts have been made to lock down Desktop apps, most of which have failed. &nbsp;I&nbsp;have often discouraged policy writers from attempting to write policy to lock down Firefox.&nbsp; The main reason for this is the difficulty of locking down various information flows described above.&nbsp; Tools like firefox are expected to be able to read and write all over the homedir and need pretty full access to X.&nbsp; <br /><br /><strong>SELinux is all about defining security goals.&nbsp; </strong><br /><br />For example I might have a security goal that firefox application will not send email.&nbsp; So I can check if my policy prevents firefox from sending email.&nbsp; But my security goal can change depending on the content that I want to look at.&nbsp; For whatever reason, I might want to allow OpenOffice to have full access to everything in my homedir when I launch it from the start menu, but when it&nbsp; is launched from firefox on untrusted content, I only want OpenOffice to be able to display, print, or email that content, not my credit card data....<br /><br />I introduced xguest a year or so ago, and I've thought about why people liked the concept and the ways people were telling me they were using it.&nbsp; (Xguest is the least privileged user, his homedir is cleared on exit, and he is only able to connect to http ports).&nbsp; I have been told that some people use xguest to go to untrusted sites where they do not want to have bad data left behind. Others have told me they use xguest to run games, to make sure the downloaded games aren't allowed to do evil things.<br /><br /><strong>How could I build a usable &quot;xguest&quot; tool that did this on an app by app basis?</strong><br /><br /><strong>I started working on sandbox -X.&nbsp; </strong><br /><br />The first step was to create a new $HOMEDIR and new /tmp, and mount them over the real $HOMEDIR and /tmp.<ul><li>sandbox -X creates new empty directories in the $HOMEDIR and /tmp</li><li>It labels these sandbox_x_file_t:MCS where MCS&nbsp;is a randomly selected MCS&nbsp;label</li><li>it then execs seunshare, specifying the new HOMEDIR&nbsp;and new /tmp, as well as an SELinux context and the command to run</li><li>/usr/sbin/seunshare is a new setuid C Program<br /><ul><li>seunshare calls unshare (2) to&nbsp; disassociate mount names from the process execution context,</li><li>seunshare bind-mounts the sandbox HOMEDIR&nbsp;and /tmp these over the current $HOMEDIR&nbsp;and /tmp</li><li>seunshare then execs the shell under a sandbox_x_t:MCS context</li></ul></li><li>When seunshare exits, sandbox&nbsp; -X destroys the contents of the temporary $HOMEDIR&nbsp;and /tmp</li><li>sandbox_x_t policy prevents anything running in the sandbox from using the network, touching any user home content, allowing it to only read/write to sandox_x_file_t, basically locking it down.</li></ul><strong>But what about X?</strong><br /><ul><li>I&nbsp;decided not to use the X Access Control Extension (XAce) to provide separation since I&nbsp;could never achieve the separation I wanted using it.&nbsp;</li><li>I&nbsp;use Xephyr to start a whole new X server. &nbsp;This prevents XClients running within Xephyr from talking directly to the host X Server.</li><li>I&nbsp;also use a window manager Matchbox which maximizes the app to the size of the xserver.</li></ul>This gives me a fully locked down desktop session, in which I&nbsp;can run almost any X&nbsp;client application.<br /><br />Here are some examples<br /><br />&gt;&nbsp;<span>sandbox -X evince ~/Documents/RedHat/selinux_four_things.pdf</span><br /><br /> <img src="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox-evince.png" alt="" /><br /><br />This sandbox -X&nbsp;session is running evince inside of a sandbox.&nbsp; The sandbox tool actually copied the content into the new HOMEDIR&nbsp;so that evince could see it.<br /><br />&gt; <span>sandbox -X xterm<br /></span><br /><br /><img src="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox-xterm.png" alt="" /><br /><br />This example lets me explore the locked down environment sandbox -X provides. Note that while I am still running with my UID, I am no longer running under unconfined_t, but under sandbox_x_client_t:so:c17,c355.&nbsp; There are no files in my sandboxed home directory.&nbsp; When I try to run a privileged command like sudo I'm not allowed to, and if I try to ssh our or send email, I'll be denied. I do allow sandbox_x_t to connect to the printer ports to allow the evince example above to be able to print, but I do not allow it to connect to most other network ports.&nbsp; <br /><br /><strong>What if I want to use sandbox to confine my Firefox session?</strong><br /><br />You can specify an alternate SELinux type. For Fedora 12 the sandbox_web_t to allow you to run firefox. sandbox_net_t is also available, which allows full network access.<br /><br />&gt; <span>sandbox -X -t sandbox_web_t firefox danwalsh.livejournal.com</span><br /><br /><img src="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox-firefox.png" alt="" /><br /><br /><strong>You can even write your own policy, if you want.<br /></strong><br />sandbox_x_domain_template(sandbox_MYAPP)<br />allow sandbox_MYAPP_client_t self:tcp_socket create_socket_perms;<strong><br />....<br /><br />Now I think that is cool... What do you think?</strong><br /><br /><strong>How do I try it out?</strong><br /><br /> Install Raw Hide, or Fedora 12 when it comes out.&nbsp; Install the policycoreutils-sandbox package if it is not installed.&nbsp; (Sorry, but after you install the package you will need to reboot to set up the mount space sharing.)&nbsp; As a user, run: <span><br /><br />sandbox -X COMMAND<br /></span><br /><strong>There are some things I would like to see improved here.&nbsp; </strong><br /><ul><li>The main thing is that the Xephyr window is not resizable, so after the apps starts the app can not be resized.&nbsp; Maybe the X team will fix this, or provide a rootless X on X server, which would let us allow sandboxed applications to at least communicate with each other.</li><li>Cut and Paste does not work, But then, that's kind of the idea.</li><li>NFS&nbsp;home directories do not currently work since NFS&nbsp;does not support labeling.</li><li>This tool can generate lots of AVC's if you try to do evil stuff within your sandbox.</li></ul><strong>Future goals:</strong><br /><ul><li>We would like to have the sandbox tool prompt you if any of the input to the sandbox has changed, so the user could decide whether or not to save the input.&nbsp;</li><li>Maybe allow sandbox to specify only a shared subdirectory of the users homedir, where the sandbox would be allowed to write.&nbsp; You could say allow OpenOffice to save to ~/sandboxout</li></ul><strong>Other ideas welcome.</strong> 2009-09-15T13:17:36+00:00 dwalsh@redhat.com http://danwalsh.livejournal.com/30837.html I wrote this article a while ago to be posted in Red Hat Magazine. &nbsp;But I have been told to post it elsewhere, not sure how to go about getting articles in other on line magazines, but I will post here.<a href="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/selinux_four_things.pdf"><span><strong><br /><br />What is SELinux trying to tell me?<br /> The 4 key causes of SELinux errors.</strong></span></a><br /><br /><br />I&nbsp;also have a <a href="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/selinux4things.odp">slide deck</a> presentation I&nbsp;give that follows this paper.<br /><br /><br /><br /> 2009-09-14T20:15:40+00:00 dwalsh@redhat.com http://selinux-mac.blogspot.com/2009/09/some-selinux-experiences-that-i-want-to.html <span><span></span><br /><span>Disclaimer: I am just thinking out loud here, and i am sure that in some cases i do not fully understand the complexity or the underlying ideas of, and behind the issues that i am about to describe. </span><br /><br /><span>1. (not fedora specific)</span><br /><span>User space processes own files on tmpfs for pulseaudio. These user space processes want to read (and unlink) each others pulseaudio files on tmpfs. To facilitate this, it requires much policy and also by allowing a user space process to read another user space processes pulseaudio tmpfs files , you also give it access to the user space process non pulseaudio tmpfs files. which might not be desired.</span><br /><br /><span>maybe somehow we can implement a attribute for user space processes pulseaudio files on tmpfs. and/or create a generic interface for this interaction. </span><br /><br /><span>3. (fedora specific)</span><br /><span>xserver policy has been modified and xserver_user_x_domain_template and xserver_x_domain_template have been added. These templates could be used instead of xserver_user_client and xserver_common_app.</span><br /><br /><span>By calling these templates other xserver related policy in the domain that call it can for a large part also be removed. The interfaces mentioned above include most of the required xserver policy for user and application processes to function.</span><br /><br /><span>There are some notable exceptions:</span><br /><br /><span>xserver_rw_xdm_home_files</span><br /><br /><span>Also it appears that the interfaces mentioned above were designed with mls policy in mind. To be able to enable xserver object manager in a way that could benefit targeted policy i think a solution could be found so that xserver policy can be easily extended to provide a basic multi purpose useable policy for targeted as well ( maybe create interfaces for the various scenarios ) so that interfaces (or maybe tunable policy) can be called to make xserver object manager work in a basic form and/or specific form in targeted policy.</span><br /><br /><span>So that the admin can easily extend xserver policy for his custom needs without having to write local policy himself or having to implement his own custom interfaces, at least as much as possible.</span><br /><br /><span>An example of stuff that currently has no policy implemented but in many cases is required is for example the functionality to change mouse button (for left handed people) and the use of acceleration (3d)</span><br /><br /><span>Also we should keep in mind that there is a allow_write_xshm boolean that probably should be used where ever required instead of allowing access to this by adding fixed policy.</span><br /><br /><span>My point is that i think xserver object manager could at least to some extend be usable in a targeted policy, and that it could be extendible. Currently in fedora there is no easy way to make openoffice work nice with XACE. I cannot extend its policy due to 'not within scope issues' (user domain prefixes). The java SELinux implementation suffers similar issues.</span><br /><br /><span>3. (not fedora specific)</span><br /><span>This also brings me to staff and user domains. These domains do not have access to some devices (cannot rw to dri, cannot rw to wifi, webcam etc) maybe we should implement some booleans for this with a $1. e.g. userdom_$1_use_dri etc. or maybe create users domains that add this functionality. I think this is a requirement to makes confined domains acceptable for day-to-day GUI use. Also the allow_execmem boolean is a bit too coarse. Lets face it we are not close to a working none execmem/execstack environment yet. For example nautilus requires it, totem, etc. many of these apps run in the user domain. Setting allow_execmem would in my view be overkill to just allow a single user domain execmem permission. allow_$1_execmem, where $1 is a specific user domain would in my view be a reasonable temporary solution. In either case i do not think we should just ignore the issue.</span><br /><br /><span>The "easy" access to execmem and devices like dri are in my view important to help make confined user domains usable for the general public in a GUI environment.</span></span><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5024703430482213163-6304393634263861890?l=selinux-mac.blogspot.com" alt="" /></div> 2009-09-10T05:43:12+00:00 Dominick "domg472" Grift (noreply@blogger.com) http://etbe.coker.com.au/2009/09/04/ownership-laptops-work/ <p><a href="http://www.australianit.news.com.au/story/0,24897,26021336-15306,00.html">Jetstar has announced some new changes to the way they manage their IT infrastructure [1]</a>. Some parts of it are obvious things that people have been doing (or wanting to do) for a long time &#8211; such as using thin clients with no moving parts (not even cooling fans).</p> <p>But the really interesting part is their plan for managing laptops. They are using a virtual machine image on a flash storage device that can run on any system. So deploying a new system will only require installing the virtual machine software and inserting a storage device. Moving a user&#8217;s environment to a different system (EG due to hardware failure) will merely require inserting the storage device in a new system.</p> <p>That raises the issue of ownership of the device. It seems that Jetstar are considering using systems that are owned by employees, Stephen Tame said &#8220;<b>In two years&#8217; time a laptop should be a condition of employment, and this includes bringing your own laptop</b>&#8220;. When introducing that I expect there would be some resistance by employees who don&#8217;t want to spend the money. However<br /> <a href="http://etbe.coker.com.au/2008/06/16/cost-owning-car/">I have previously estimated the costs of running a car [2]</a> which works out to more than $1,650 per year for insurance, registration, basic maintenance, and the interest that would have been received if the car had not been purchased and the money had been invested. Laptops can be purchased for significantly less than $1000 (currently the EeePC 701 is on sale for $219) and can be expected to last for three years or more if you are careful to avoid damage and don&#8217;t run demanding software. So a job that demands ownership of a laptop is asking for a much smaller financial investment than one which demands ownership of a car. But I expect that many employees won&#8217;t see it that way.</p> <p>The up-side for employees to bring their own laptops is that they can choose a model that suits their preference. Everyone has preferences regarding the size of keys on a keyboard, the distance that they travel and the pressure required to register a key-press. For desktop machines it&#8217;s easy to swap keyboards but for laptops there is no such option. Then there&#8217;s the issue of the trade-off between physical size and weight vs display resolution, personal preferences in this regard will depend to some extent on the body mass and strength of the employee.</p> <p>Now there are a number of security issues related to personal laptop use. Obviously if the laptop has a Trojan-horse program installed then it could sniff any data that goes past on the network. The most trivial case of this could be addressed by running VPN software inside the emulated environment. This would force a Trojan to compromise the virtual environment (EG by modifying the address space) or to compromise the files on disk (insert a Trojan inside the filesystem for the virtual environment). The former would be tricky to get right while the latter would be trivial. Both attack methods have been used in the past and proven to work. This is why many companies prohibit their employees from connecting their own systems to the corporate network.</p> <p>One example of a system that is based around running virtual machines for all desktop operations is <a href="http://en.wikipedia.org/wiki/NetTop">the NSA NetTop project [3]</a>. NetTop involves a SE Linux system that runs multiple instances of VMWare for different desktop environments. Each VMWare instance runs at a particular sensitivity level and uses a VPN connection to a back-end network running at the same level. The aim of NetTop is to prevent applications in the different VMWare instances from communicating with each other. The significant difference between a typical NetTop installation and what JetStar might be doing is that NetTop runs on a secure base &#8211; it&#8217;s hardware that has been purchased and installed by a military organisation and is run in a secure facility. While personal laptops that are owned by employees can be expected to be infected with viruses and Trojan-horse programs.</p> <p><a href="http://etbe.coker.com.au/2009/02/01/employment-packages/">In the past I have suggested that an employment package for any skilled employee should include some budget for buying things that facilitate the work [4]</a>. It seems to me that a company like JetStar could best achieve their goals by assigning a budget to each new employee to buy a machine for their use. The employee then gets to choose a machine up to that budget &#8211; which would only be for work purposes. Then when the employee leaves or the machine becomes due for replacement it could be sold at auction. When considering all the costs involved in hiring a new person, spending something less than $1,000 to buy a laptop is nothing.</p> <p>Finally if buying machines for work purposes, you really don&#8217;t want employees using them for surfing porn. Porn sites tend to be particularly bad for malware distribution. To reduce the incidence of such problems I think that work machines should have their sound hardware disabled and laptops should not be purchased with overly large displays. There is no need to make work machines totally unsuitable for porn surfing (which would also make them less effective for work), but making them less suitable than a $500 budget PC should dramatically reduce the scope of the problem.</p> <ul> <li>[1]<a href="http://www.australianit.news.com.au/story/0,24897,26021336-15306,00.html"> http://www.australianit.news.com.au/story/0,24897,26021336-15306,00.html</a></li> <li>[2]<a href="http://etbe.coker.com.au/2008/06/16/cost-owning-car/"> http://etbe.coker.com.au/2008/06/16/cost-owning-car/</a></li> <li>[3]<a href="http://en.wikipedia.org/wiki/NetTop"> http://en.wikipedia.org/wiki/NetTop</a></li> <li>[4]<a href="http://etbe.coker.com.au/2009/02/01/employment-packages/"> http://etbe.coker.com.au/2009/02/01/employment-packages/</a></li> </ul> 2009-09-04T10:40:13+00:00 etbe http://paulmoore.livejournal.com/4969.html In a few weeks I'll be giving a <a href="http://events.linuxfoundation.org/lc09d3">presentation</a> and <a href="http://events.linuxfoundation.org/lc09td3">tutorial</a> on NetLabel at <a href="http://events.linuxfoundation.org/events/linuxcon">LinuxCon</a>. Both as a speaker and as a member of the audience I've always felt that the best presentations/tutorials are the ones that cover what the audience is really interested in hearing. The only problem is that in most cases the presentation material needs to be generated before the presenter ever meets the audience. With that in mind, I'd like to reach out to all of you reading this entry and ask two simple questions:<br /><br /> * What would you like to see in a NetLabel presentation?<br /> * What would you like to learn in a NetLabel tutorial? <br /><br />Don't be shy now ;) 2009-09-03T22:04:23+00:00 http://d.hatena.ne.jp/kaigai/20090902/1251897393 <div class="section"> <p>転載。</p> <p>10月21日〜23日に開催のJapan Linux SymposiumのEarly Registration期間が〜9/15まで延長になったようだ。</p> <p>特に学生さんは３日間通しのパスが$50USなので、この値段なら身銭切って申し込んでもいいと思う。</p> <p>内容は英語でプロ向けだけど、お仕事としてＯＳＳ開発をやっている人がどんな事をやっているのか見てくるのは悪くないと思う。</p> <blockquote> <p>==&#62;国際技術シンポジウム「第１回Japan Linux Symposium」、早期割引期間延長！</p> <p>早期割引の期間を２週間延長しました。9月15日までの登録者には、300USドルの参加料が200USドルになる割引特典が適用されます。</p> <p>ぜひお早めに登録を！</p> <p>(すでに登録をいただいている皆様、ご登録ありがとうございます。当日の参加をお待ちしております）</p> <p><a href="http://www.linuxfoundation.jp/news-media/announcements/2009/08/jls" target="_blank">http://www.linuxfoundation.jp/news-media/announcements/2009/08/jls</a></p> <br /> <p>==&#62;アカデミック割引を追加</p> <p>　Linuxの開発をより幅広く、特に学生の皆様に理解していただくために学生向けの特別参加料金を設定いたしました。学生の皆様、ぜひこの機会に登録ください。</p> <p>対象者：学生（高校・高専・大学・短大在籍）の方</p> <p>アカデミック割引参加料　$50</p> <p>登録の際にアカデミックDiscount code "JLS_50"を入力してください。</p> <p>なお、当日の受付で学生証などの提示をお願いいたします。</p> <p>==&#62;基調講演のみの登録は残りはわずか！</p> <p> お早めに登録いただくか、セッションの方に登録をお願いいたします。</p> <p>セッションに登録いただければ基調講演にもご参加いただけます。</p> </blockquote> <p>駄菓子菓子。今になってアカデミック向け$50USのディスカウントなんて出したら、申込み済みの学生さんがもしいたら怒らないだろうか？むむぅ。</p> </div> 2009-09-02T13:16:33+00:00 kaigai http://markelov.blogspot.com/2009/09/svirt-fedora-11rhel.html <div>Я уже <a href="http://markelov.blogspot.com/2009/02/svirt.html">рассказывал</a> в своем блоге о проекте sVirt, позволяющем изолировать при помощи мандатного контроля доступа гипервизор и отдельные виртуальные машины друг от друга. Если вы еще не знакомы с концепцией MAC, MLS и MSC, то вы можете почитать соответствующие<a href="http://markelov.blogspot.com/search/label/SELinux"> записи в моем блоге с меткой SELinux</a>. Не буду повторяться, а просто скажу, что уникальные преимущества в плане защищенности, доступные в операционных системах общего назначения с открытым исходным кодом уже можно живьем "пощупать" и в системах виртуализации (Fedora 11), а с выходом RHEL 5.4 и внедрить на предприятии.<br /><br />В изначально реализованной политике для RHEL5, xend_t - домен в котором работает процесс Xen, не мог обойтись без права писать/читать не только в файлы xen_image_t, но и в физические устройства fixed_disk_device_t, поскольку в промышленной среде использование образов дисков вместо отдельных разделов, например на LVM, имеет ряд недостатков. Таким образом, злоумышленник из процесса xend_t в случае компрометации одной из виртуальных машин в принципе мог бы получить доступ как к самому хосту, так и к другим виртуальным машинам.<br /><br />Данная проблема в целом распространяется и на другие системы виртуализации - от Microsoft, VMware и других вендоров. От "zero-day" уязвимости в ОС виртуальной машины и гипервизора одновременно не застрахован никто. Однако в случае Fedora (и в будующем RHEL) решениеп такой проблемы теперь есть. Одной частью решения в Fedora 11 стал появившийся в libvirt механизм подключаемых модулей. Теперь специальный plug-in динамически присваивает метки файлам\устройствам "на лету" и стартует виртуальные машины в соответствующем домене SELinux. По умолчанию в Fedora процессы виртуальных машин работают в доменах svirt_t, а фалы/устройства имеют тип svirt_image_t.<br /><br />Описанное выше позволит защитить только операционную систему хоста (гипервизор) от атаки осуществляемой изнутри скомпрометированной виртуальной машины. Для изоляции же виртуальных машин друг от друга разработчики используют поддержку мультикатигорийной безопасности (подмножество реализации многоуровневой безопасности с одним и тем-же уровнем безопасности s0). За подробностями опять-же отправляю к предыдущим постам в блоге. Соответствующие друг-другу контексты и домены виртуальных машин с совпадающими категориями (как я уже сказал уровень безопасности при этом используется один и тот же) присваиваются libvirt случайным образом. Однако, при необходимости, администратор может задать их и статически. Подробнее почитать про sVirt можно в <a href="http://danwalsh.livejournal.com/30565.html">блоге Дэна Уолша</a>, отвечающего в Red Hat за разработку SELinux.</div><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/7673377107942959487-7277917062087725929?l=markelov.blogspot.com" alt="" /></div> 2009-09-01T13:45:02+00:00 Andrey Markelov (noreply@blogger.com) http://d.hatena.ne.jp/kaigai/20090830/1251590757 <div class="section"> <p>虎ノ門、金沢工業大学のサテライトキャンパスをお借りして開催された、<a href="http://d.hatena.ne.jp/ripjyr/20090829/1249856252" target="_blank">まっちゃ445勉強会</a>に行ってきた。</p> <p>自分としてはあまり馴染みのない分野なので、結構よい勉強になった。</p> <p>体感的には、一日に100〜200通の迷惑メールを受け取っているような気がする。</p> <p>まぁ、OSSの開発などでメールアドレスを公開しているのでこの辺は仕方ない。</p> <p>本当にこんなのに引っ掛かる人が居るのかいな？と思うメールばかりだが、</p> <p>まぁ、100万通ばら撒けば、1万人に1人のバカが100人は釣れるというロングテール戦略なんだろう。</p> <p>浅見さんのS25Rと、佐藤さんのtaRgreyの話は、迷惑メールをばら撒くのに使われているボットネットワークの特性を活かした対策。</p> <p>確かに、IP逆引きが不可能、相手先MTAの再送要求に応えないとか、接続を10秒で切っちゃうとかは通常のメールサーバでは考えにくい実装なので、迷惑メール発信源の判定基準としては面白い。</p> <p>ただ、この辺の対策手法の寿命ってどれくらいだろうかとも考えてみた。</p> <p>IP逆引きの問題は置いておいても、SMTPを真面目に実装しているかどうかというのは誰かがライブラリを作ってしまえば終わるんじゃないの？とか、MTAからの応答を遅延させてもスレッドを100個作って同時に複数のメールサーバに接続すれば、ボットの目的である『短時間に大量のメール』は達成されそうな気がする。</p> <p>まぁ、一個の方法に頼らないというのはセキュリティの鉄則。</p> <p>須藤さんの milter manager の話は面白かった。</p> <p>というのも、迷惑メール対策ではなく、機密情報の漏えい対策として自分の考えていたアイデアに応用が効きそうだったので。</p> <p>不勉強にして知らなかったが、milterというのはMTAが受信したメールの処理を進める際に、背後で動いてメールをどう処理するか（DROPするとか、ヘッダを挿入するとか）の意思決定を行うモジュール。</p> <p>SELinuxの場合、getpeercon()というAPIにソケットのファイルディスクリプタを与えると、TCP/IP接続の相手先プロセスのセキュリティコンテキスト（ユーザ権限みたいなもの）を取得できる。</p> <p>セキュリティコンテキストというのは所詮文字列なので、一旦、OSの機能を使ってそれを取得すれば、あとはSELinuxのポリシーに基づいてメールの配送を許可するか否かという意思決定を行うだけになる。</p> <p>SELinuxのポリシーはファイルシステム等へのアクセス制御にも効いてくるので、、、</p> <ul> <li> 秘密情報にアクセスできるユーザは、メールに秘密情報が混じっている可能性があるので、外部へのメール送信を許可しない。</li> <li> 秘密情報にアクセスできないユーザは、メールに秘密情報が混じっている可能性はないので、外部へのメール送信を許可してもよい。</li> </ul> <p>というような判断を実装できそう。（アイデア自体は前から考えていたが）</p> <p>あとで聞いてみたところ、milter自体はMTAの外側で動作するので、MTA自身がgetpeercon()を呼んで、文字列としてセキュリティコンテキストをmilterに渡す拡張が必要っぽいが、こういう pluggable な仕組みがあると、思わぬところで使い道が出てきそうなものだ。</p> <p>懇親会。</p> <p>新橋のTAPAで注文用の情報端末をリセットして管理モードでブートさせる会。</p> <p>やっぱり、こういう面子の集まる会で、アルコールとガジェットを与えると、そうなりますねｗ</p> </div> 2009-08-30T00:05:57+00:00 kaigai http://etbe.coker.com.au/2009/08/29/free-k-12-text-books/ <p><a href="http://about.ck12.org/">The CK12 project is developing free (CC by SA) textbooks for the K-12 market (with a current focus on the early years of high school) [1]</a>. Their primary aim seems to be flex-books &#8211; text books that can be localised and modified to better suit the needs of the students. But of course there are many other benefits, <a href="http://etbe.coker.com.au/2008/05/24/school-bag-weight/">according to my best estimates storing text books on an ebook reader or one of the lighter NetBooks is necessary to avoid childhooh back injuries [2]</a>.</p> <p>Another major benefit of flexible text books is the possibility of teaching a wider range of subjects. A subject does not need the level of interest that is required to get a publishing contract (which generally means acceptance by the education department of a state) to have a text book. Independent schools and home-schoolers can select subjects that are not in the mainstream curriculum.</p> <p><a href="http://authors.ck12.org/wiki/">The information for potential authors of text books is here (they didn&#8217;t make it particularly easy to find) [3]</a>.</p> <p>One thing I would like to see is a text book about computer security. I really don&#8217;t think that this would be an overly difficult subject for an 11yo who is interested in computers. When I was 11 I read a text book on nuclear physics in the form of a comic book, I don&#8217;t think that computer security is inherently more difficult or harder to teach than nuclear physics. Naturally full coverage would require several texts aimed at different ages. But that&#8217;s possible too. It would probably be easiest to start with an age of ~16. Also as computer security is a subject that is both difficult at one end of the scale and essential at the other it would be necessary to have <b>A</b> and <b>B</b> streams (as is done with maths in the Australian education system).</p> <p>Please leave a comment if you are interested in participating in the development of computer security related text books. Incidentally it would be good to get a contributor who has had experience in teaching teenagers even if they don&#8217;t have any knowledge of computer security &#8211; I don&#8217;t expect to find someone with good technical skills and teaching experience.</p> <ul> <li>[1]<a href="http://about.ck12.org/"> http://about.ck12.org/</a></li> <li>[2]<a href="http://etbe.coker.com.au/2008/05/24/school-bag-weight/"> http://etbe.coker.com.au/2008/05/24/school-bag-weight/</a></li> <li>[3]<a href="http://authors.ck12.org/wiki/"> http://authors.ck12.org/wiki/</a></li> </ul> 2009-08-29T04:55:49+00:00 etbe http://eparis.livejournal.com/891.html So in the last article I talked about how SELinux systems provide stronger protections against mapping low memory regions for remote attacks, but are weaker against attacks from authenticated users running unconfined.&nbsp; The surprise to users that their SELinux enabled system could be weaker to some class of attacks was labeled CVE-2009-2695.<br /><br />After a bit of thought I've decided the best way to address this is for LSMs to abandon the mmap_min_addr tunable altogether.&nbsp; That tunable lets a root user disable protections.&nbsp; Why would an LSM want a root user to be able to control it's protections at all?&nbsp; What it protects should be defined entirely by the kernel and the policy.&nbsp; So, what I've done is to separate out the mmap_min_addr root vs. non-root check and the LSM check.&nbsp; There is a new hard coded at kernel compile time amount of memory protected by the LSM.&nbsp; This is unrelated to the /proc/sys/vm/mmap_min_addr file.&nbsp; You can set that to 0 and the LSM will still be able to protect low memory.<br /><br />So in upstream kernels (2.6.30-rc6ish and later) to map the 0 page you will need both CAP_SYS_RAWIO (root) and the SELinux memprotect/mmap_zero permission instead of only needing one or the other.&nbsp; If you set /proc/sys/vm/mmap_min_addr to 0 you will still need the SELinux mamprotect/mmap_zero permission.<br /><br />Hurray until the next time someone finds a way to map the 0 page and a null pointer bug in the kernel (lots of the latter as of late)<br /><br /><pre class="bz_comment_text"><a href="http://git.kernel.org/linus/9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3">http://git.kernel.org/linus/9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3</a> <a href="http://git.kernel.org/linus/8cf948e744e0218af604c32edecde10006dc8e9e">http://git.kernel.org/linus/8cf948e744e0218af604c32edecde10006dc8e9e</a> <a href="http://git.kernel.org/linus/788084aba2ab7348257597496befcbccabdc98a3">http://git.kernel.org/linus/788084aba2ab7348257597496befcbccabdc98a3</a> <a href="http://git.kernel.org/linus/1d9959734a1949ea4f2427bd2d8b21ede6b2441c">http://git.kernel.org/linus/1d9959734a1949ea4f2427bd2d8b21ede6b2441c</a></pre> 2009-08-26T14:29:33+00:00 http://danwalsh.livejournal.com/30565.html <br />Next week I will be at the <a href="http://www.redhat.com/promo/summit/2009/">Red Hat Summit</a> talking about SELinux, specifically <a href="http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/svirt.pdf">sVirt,&nbsp; Secure Virtualization.</a><br /><br />While virtualization seems to be next big thing, providing great opportunities in resource allocation, system management, savings on power and cooling, and the ability to grow and shrink resources depending on demand.&nbsp; <br /><br />But what about the security?&nbsp; <br /><br />What happens when a cracker breaks into a virtual machine and takes it over?&nbsp; What happens if there is a bug in the hypervisor?&nbsp; <br /><br />Before virtualization, we had isolated servers.&nbsp; A cracker taking over one server meant that he controlled just that server. The cracker would then have to launch network attacks against other servers in the environment.&nbsp; System administrators had lots of tools to defend against network attacks on machines: firewalls, network traffic analysis tools, intrusion detection tools, etc.&nbsp; <br /><br />After virtualization, we have multiple services running on the same host.&nbsp; If a virtual machine is broken into, the cracker just needs to break though the hypervisor.&nbsp; If a hypervisor vulnerability exists, the cracker can take over all of the virtual machines on the host.&nbsp; He can even write into any virtual host images that are accessible from the host machine.&nbsp; <br /><br />This is very scary stuff. The question is not &quot;if&quot;, but &quot;when&quot;.&nbsp; Hacker/cracker conventions are already examining hypervisor vulnerabilities.&nbsp; Crackers have already broken though the xen hypervisor, as I documented in one of my previous <a href="http://danwalsh.livejournal.com/25265.html">blogs</a>.<br /><br />Now let's examine libvirtd/qemu/kvm in Fedora 11.<br /><br />libvirtd starts all virtual machines.&nbsp; All virtual machines run as separate processes.&nbsp; Virtual images are stored as files or devices like logical volumes and iscsi targets.&nbsp; <br /><br />Hmmm, <br /><br />What is SELinux really good at?<br /><br />It is great at labeling processes, files, and devices.&nbsp; It is great at defining rules on how labeled processes interact with labeled processes, files, and devices. <br /><br />Seems like a nice match.&nbsp; SELinux can be used to mitigate the problems of a vulnerability in the hypervisor.&nbsp; <br /><br />But, you ask, &quot;Didn't we do this in Red Hat Enterprise Linux 5?&quot;&nbsp; Yes, but we were still vulnerable to the Xen breakout.<br /><br />If you read the Xen vulnerability document, it explains the mechanism used to thwart SELinux protection in RHEL5.&nbsp; The cracker realized that the xen process, labeled xend_t, was allowed to read/write all fixed disks labeled fixed_disk_device_t.&nbsp; This allowed the cracker to break out of&nbsp; the SELinux confinement by writing to the physical disk.&nbsp; When I was writing policy for Xen in RHEL5, I had initially required the administrator to label volume xen image devices as xen_image_t.&nbsp; The xen developers thought this was too difficult for the administrators to have to manage, and would cause too many failures.&nbsp; We ran out of time to make the management tool do this automatically.&nbsp; It was decided that usability was more important then security in this instance, and I had to allow this access.&nbsp; I won't make that mistake again. <br /><br />In Fedora 11, James Morris, Daniel Berrange, myself and others&nbsp; have added SELinux support to libvirt, in the form of <a href="http://selinuxproject.org/page/SVirt">sVirt</a>.&nbsp; We added a security plug-in architecture to libvirt that defaults to SELinux protection.&nbsp; Theoretically you can use other security architectures.&nbsp; libvirt dynamically labels the image files and starts the virtual machines with the correct labels.&nbsp; This allows us to avoid the problem of the administrator having to remember to set the correct label on the image files and devices.&nbsp; By default all virtual machines in F11 get labeled with the svirt_t type and all image files get the svirt_image_t type.<br /><br />SELinux policy has rules that allow the svirt_t processes to read/write svirt_image_t files and devices.<br /><br />This protection allows us to protect the host machine from any of its virtual machines.&nbsp; A virtual machine will only be able to interact with the files and devices with the correct labels.&nbsp; A compromised virtual machine would not be allowed to read my home directory, for example, even if the virtual machine is running as root.<br />However, this &quot;type&quot; protection does not prevent one virtual machine from attacking another virtual machine.&nbsp; We needed a way to label the domains and the image files with the same TYPES, but at the same time, stop virtual machine 1, running as svirt_t, attacking virtual machine 2,&nbsp; which would also be running as svirt_t.&nbsp;&nbsp;&nbsp; <br /><br />Multi Category Security (MCS) to the rescue!<br /><br />When we developed RHEL5 we added Multi Level Security (MLS) support.&nbsp;&nbsp; This involved adding a fourth field to the SELinux context.<br /><br />Originally in RHEL4 the SELinux context consisted of three fields (&quot;USER:ROLE:TYPE&quot;).&nbsp; In RHEL5 the SELinux context consists of four fields (&quot;USER:ROLE:TYPE:MLS&quot;).&nbsp; For example, files in the home directory could be labeled &quot;system_u:system_r:user_home_t:TopSecretRecipe&quot;.&nbsp; The MLS labels define a sensitivity level (s0-s15) and category of the data (c0.c1023), TopSecretRecipe in the example above is a human-readable translation of a field like s15:c0.c36.&nbsp; The MLS label allows MLS machines to not only label the file based on its use, user_home_t in this example, but also by the sensitivity and nature of its content, &quot;TopSecretRecipe&quot;.<br /><br />This field was only used in MLS policy.&nbsp; We attempted to make use of it in our default policy (&quot;targeted&quot;), by only defining a single sensitivity level (&quot;s0&quot;) and allowing administrators to define categories.&nbsp; We called this Multi Category Security (MCS).&nbsp; The goal was to allow administrators and users to label their files based on the nature of their contents.&nbsp; For example, system_u:object_r:database_t:PatientRecord could be a database which contained patient records.&nbsp; For multiple reasons, MCS has not been&nbsp; widely used.&nbsp; I believe you are still better off defining a new SELinux type patient_record_database_t -- MCS does not afford the richness of access control that you can express with standard SELinux types.&nbsp; <br /><br />When we were developing sVirt, though, we realized that we could use MCS to provide us separation between two virtual machines running with the same SELinux type, svirt_t.&nbsp; We designed libvirt to assign a different randomly-selected MCS label to each virtual machine and its associated virtual image.&nbsp; libvirt guarantees that the MCS fields it selects are unique.&nbsp; SELinux prevents different virtual machines&nbsp; running with different MCS fields from interacting with each other or any of their content.<br /><br />For example, libvirt creates two virtual machines with these labels:<br /><br /><table width="80%" height="88" cellspacing="1" cellpadding="1" border="1"><tbody><tr><td>Name</td><td>Virtual Machine Process label</td><td>Virtual Machine Image Label</td></tr><tr><td>Virtual Machine 1</td><td>system_u:system_r:svirt_t:s0:c0,c10</td><td>system_u:object_r:svirt_image_t:s0:c0,c10&nbsp;</td></tr><tr><td>Virtual Machine 2</td><td>system_u:system_r:svirt_t:s0:c101,c230</td><td>system_u:object_r:svirt_image_t:s0:c101,c230</td></tr></tbody></table><br /><br />SELinux prevents virtual machine 1 (system_u:system_r:svirt_t:s0:c0,c10) from accessing virtual machine 2's image file (system_u:object_r:svirt_image_t:s0:c101,c230) -- the virtual machines can not attack each other.<br /><br />These are the labels libvirt assigns.<br /><br /><table width="80%" height="215" cellspacing="1" cellpadding="1" border="1"><tbody><tr><td>Name</td><td>SELinux Context</td><td>Description</td></tr><tr><td>Virtual Machine Processes</td><td>system_u:system_r:svirt_t:MCS1</td><td>MCS1 is a randomly selected MCS field.&nbsp; Currently we support ~500,000 labels.</td></tr><tr><td>Virtual Machine Image</td><td>system_u:object_r:svirt_image_t:MCS1</td><td>Only svirt_t processes with the same MCS fields are able to read/write these image files and devices.</td></tr><tr><td>Virtual Machine Shared Read/Write content</td><td>system_u:object_r:svirt_image_t:s0</td><td>All svirt_t processes are allowed to write to the svirt_image_t:s0 files and devices.</td></tr><tr><td>Virtual Machine Shared Shared Read Only content</td><td>system_u:object_r:svirt_content_t:s0</td><td>All svirt_t processes are able to read files/devices with this label.</td></tr><tr><td>Virtual Machine images</td><td>system_u:object_r:virt_content_t:s0</td><td>When a virtual machine exits, its image file is relabeled to the system default, which usually is virt_content_t:s0,&nbsp; No svirt_t virtual processes are allowed to read files/devices with this label.</td></tr></tbody></table><br /> We also added the ability to do static labeling to sVirt.&nbsp; Static labels allow the administrator to select a particular label, including the MCS/MLS field,&nbsp; for a virtual machine.&nbsp; The virtual machine will always be started with that label.&nbsp; Administrator who run static virtual machines are responsible for setting the correct label on the image files.&nbsp; libvirt will never modify the label of a statically-labelled virtual machine's content. This allows the sVirt component to run in an MLS&nbsp;environment.&nbsp; You can run multiple virtual machines on a libvirt system at different sensitivity levels. <br /> 2009-08-24T19:37:11+00:00 dwalsh@redhat.com http://thetoms-random-thoughts.blogspot.com/2009/08/selinux-on-opensuse-112-milestone-6.html <p><br /><a href="http://en.opensuse.org/SELinux">SELinux can be enabled via YaST's bootloader module easily now</a>.</p><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-7134186085478035392?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-08-24T07:45:55+00:00 Thomas (noreply@blogger.com) http://d.hatena.ne.jp/kaigai/20090822/1250907751 <div class="section"> <p>修士論文のテーマが農業経済学だったので、最後にこれは付記しておきたい。</p> <p><span>民主党の所得保障政策は世紀の愚策で百害あって一利なし</span></p> <p>農地の流動化が中々進まないので道半ばであるものの、基本的に自民党は、大規模で意欲ある農業経営体（農家を含む）に生産を集中させる事で、国内の農業基盤を強化する事を主張している。</p> <p>一方、民主党は農家の赤字補填を基本とする『戸別所得保障制度』を打ち出している。アホか。</p> <p>日本の農業基盤が脆弱なのは、戦後GHQの農地改革によって農地が分割された結果、規模の零細な農業経営体が大量に生まれた事に起因する。加えて、農地の資産価値は市街化区域に対して低く抑えられているが、場合によっては転用が認められ、農家に莫大な利益をもたらす事になる。しかし、農地転用の基準が不透明であるために「利益はでないけどとりあえず持っておく」的な行動を誘発し、農業生産に絶対必要な農地の集約が進まなかった。</p> <p>（これに関しては、<a href="http://www.amazon.co.jp/exec/obidos/search-handle-url?%5Fencoding=UTF8&amp;search-type=ss&amp;index=books-jp&amp;field-author=%E7%A5%9E%E9%96%80%20%E5%96%84%E4%B9%85" target="_blank">明治学院大学・神門善久教授</a>の著作を参照されたい。）</p> <p>（ちなみに、数年前まで農地法の縛りで企業は農地を所有できなかった。小泉内閣の時にこれを緩和、一定要件の下で株式会社が農地を保有できるようになった。）</p> <p>そもそも、生産費用と販売価格の差額の補填なんて事をしたら、本来は淘汰されるべき水準の農家でさえも事業を継続できる事になり、一向に農地の集約が進まず、ますます高コストな農産物が生まれるのは目に見えている。</p> <p>日本の農家で所得が1,000万円を越えるような農家はわずか1.5%で、大半は、農業だけで食っていくのは難しいレベル。</p> <p>だが、選挙では数が多い方が強い。言い換えれば、これは農業政策ではなく選挙対策なんだろう。</p> <p>税金で総額2.6兆円の買収とはまったく恐れ入る。</p> <p>結局、税金と高価な農産物という事で、このコストは消費者が負担する事になるわけか。馬鹿馬鹿しい。</p> <p>あともう一つ。</p> <p>食料自給率という言葉に惑わされてはならない。</p> <p>仮に、カロリーベースで100%の自給率を達成できたとしても、その生産には機械を動かす必要がある。</p> <p>機械には石油が必要だが、日本では石油は出ない。牛や豚の飼育には飼料が必要だが、その原材料はどこから調達するのか？</p> <p>都営地下鉄の売店で売っている雑誌『WEDGE（９月号）』に面白い記事が載ってあった。ロシアの農場を使って日本の技術で農産物を生産するという話。これは読んでおいて損はない話しだと思う。</p> <p>兎に角、国内に目を向けるだけじゃなくって、友好国に日本資本で農業生産拠点を作るとか、色々と戦略的に取り組んでも良いと思うのだが…。</p> <p>一時の人気取りのために、先人の築いた財産を国民が白蟻のように食い潰すのは全くもってコリゴリだ。</p> </div> 2009-08-22T02:22:31+00:00 kaigai http://d.hatena.ne.jp/kaigai/20090822/1250907750 <div class="section"> <p>自民党は総花的だが、基本的には労働者の職業訓練および『70歳はつらつ現役プラン』が中心で、労働者の能力向上を通じた雇用機会の確保を狙っているように見える。</p> <p>一方、民主党は製造業派遣の禁止と、最低賃金の引き上げ（\1,000/時）を明記しており、より弱者救済の色合いが濃い。</p> <p>また、両党ともに、非正規労働者の正社員化を促進するとしている。</p> <p>私からすれば、余計な事をしないという点で自民党案の方がベターである。</p> <p>そもそも、労働市場にとってのここ20年間の最も大きな環境の変化といえば、中国・インドといった人口大国がグローバル市場に参入してきた事で、大きな流れとしては、これら地域の安価な労働力を使わなければ、各企業は価格競争力を維持できなくなったという事が挙げられる。</p> <p>一方、正社員に対する身分保障が強すぎる（解雇・賃下げなど）ために、企業は既に雇用した労働力を削減する事がなかなか難しい。そのため、若年層の雇用を絞ってグローバルな環境変化への対応を行おうとした。それが就職氷河期・ロストジェネレーションと呼ばれる世代である。</p> <p>そして、そういった環境の中で、日本国内での雇用機会を維持するためのアイデアが労働者派遣であった。</p> <p>つまり、問題の本質は正規雇用と非正規雇用の対立などではなく、正社員の身分保障という規制がグローバル環境の変化に対する企業の対応を阻害し、その結果、産業の空洞化を防ぐための回避策だったと考える事ができる。</p> <p>数年前に議論になりかけたが、解雇・賃下げルールの明確化を言っている政党が無いのがまったく残念である。</p> <p>非正規雇用者の待遇を正社員に近付ける努力も必要だが、一方で、正社員の"特権"を時代に即したものに変えていく必要もある。民主党を応援している労働組合などは基本的に正社員の利害を守るための組織だが、それで割を食っているのは若い世代なのだ。</p> <p>民主党がこの政策を実行したら、間違いなく失業者は増え、正社員一人あたりの負担は増えるだろう。</p> <p>ちなみに、最低賃金の \1,000/時 への引き上げはある方法を使えば雇用を損なう事なく可能と思われる。</p> <p>それは、物価水準を1.5倍にして、1ドル=150円にする事。</p> <p>ただし、円建て資産の価値を根本的に棄損する（が、国の借金は目減りする）ほか、</p> <p>年金生活者の生活を直撃する事になるだろう。</p> </div> 2009-08-22T02:22:30+00:00 kaigai http://d.hatena.ne.jp/kaigai/20090822/1250907749 <div class="section"> <p>自民党は『幼児教育費（３〜５歳）の無償化』、民主党は『年額31万2,000円の子供手当ての創設』を主張している。</p> <p>育児支援に対して幅広い支援が必要というのは、概ね全ての政党で合意している事だが、経済的支援にのみ注目している事に異議を唱えたい。</p> <p>というのも、可処分所得が増えても、インフラ（例：保育所、幼稚園）が不足しているために十分なサービスを供給する事ができず、結果として、小さな子供を抱えた両親が自分の時間を育児のために拘束されることになり、その間は（一般に母親は）仕事に就くことができない。</p> <p>両親の片方が仕事に出られない事の代替所得としては、民主党の『年額31万2,000円』ですら十分ではない。</p> <p>両党ともに、保育所の待機児童の問題を提起しているが、総合職でバリバリ働いているお母さんにとっては、保育所の営業時間内に子供を預けて迎えに行くというのは現実的ではなかろう。</p> <p>自分にとってはまだ将来の問題だが、『可処分所得』ではなく『可処分<span>時間</span>』に注目してもらいたいものだ。</p> <p>例えば、保育所の拡充と使い勝手の向上。仮に20万円/月の負担が必要だとしても、365日24時間預けられる保育園が利用できれば、有能な女性が子育てのためにキャリアを断念すると言った事もなくなるだろう（育児労働をアウトソーシングすると考えれば分かりやすい）。</p> <p>また、育児労働が家庭内で完結せずに市場化する事で、内需の押し上げ効果も期待できる。</p> </div> 2009-08-22T02:22:29+00:00 kaigai http://d.hatena.ne.jp/kaigai/20090822 <div class="section"> <p><a href="http://f.hatena.ne.jp/kaigai/20090822080038" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20090822/20090822080038.jpg" alt="f:id:kaigai:20090822080038j:image" title="f:id:kaigai:20090822080038j:image" class="hatena-fotolife" /></a></p> <p>衆議院総選挙も折り返し地点。各種世論調査によると民主党が300議席をうかがう勢いとかあるが、どうなる事やら…。</p> <p>私の住んでいる東京５区（目黒区・世田谷区の一部）で立候補しているのは以下の４名</p> <ul> <li> 佐藤ゆかり（自民・現）</li> <li> 手塚よしお（民主・元）</li> <li> 宮本栄（共産・新）</li> <li> 木下まこと（諸派・新）</li> </ul> <p>俺は麻生さん大好きっ子だし、<a href="http://mainichi.jp/select/seiji/09shuinsen/mai/kouji/area_meikan.php?mid=A13005004004" target="_blank">佐藤ゆかり氏の政策姿勢</a>にも賛同なので、選挙区は『佐藤ゆかり』、比例区は『自民党』と書くつもりだ。</p> <p>ただ、それでは面白くないので、一応、真面目に政策を考えてみる事にしたい。</p> <p>まず、大枠として自分は２つの軸を考えている。</p> <p>一つは、経済政策・社会福祉に対して政府がどれくらい関与すべきかという『大きな政府』か『小さな政府』かという軸。</p> <p>『大きな政府』になれば、社会福祉は充実し政府支出は増加（＝伝統的な景気対策）するが、一方で、国民負担が増加すると共に、規制の強化や課税の強化に伴ってイノベーションのダイナミズムは縮小する。</p> <p>逆に『小さな政府』になれば、経済に対する政府部門の関与は縮小し、規制緩和や減税に伴ってイノベーションが創出され、経済全体のパイが拡大すると共に、所得再分配機能の縮小に伴って格差の顕在化や、福祉に対する自助努力が求められる事になる。</p> <p>もう一つの軸は、価値観・国家感に対する『強い政府』か『弱い政府』かという軸。</p> <p>『強い政府』の極端なものが国家主義であり、『弱い政府』の極端なものが無政府主義である。</p> <p>これは、外交・安全保障に対して日本が国際社会の中でどの様な役割を果たすのかという論点であり、歴史観の問題や伝統的な保革イデオロギーの残滓とも言える。</p> <p><a href="http://f.hatena.ne.jp/kaigai/20090822081300" class="hatena-fotolife" target="_blank"><img src="http://f.hatena.ne.jp/images/fotolife/k/kaigai/20090822/20090822081300.jpg" alt="f:id:kaigai:20090822081300j:image" title="f:id:kaigai:20090822081300j:image" class="hatena-fotolife" /></a></p> <p>で、この図は俺の<span>印象</span>をマッピングしたもの。</p> <p>今回の選挙公約を見る限り、自民・民主ともに政府支出の拡大を掲げており、大きな政府・小さな政府という軸では大きな差は無い。ただ、傾向としては民主党の政策の方が政府支出を拡大させる方向にある（例：子供手当て、農家所得保障など）。自民党の政策では政府支出は経済の安定化装置であり、最終的には民間の活力による成長路線への回帰をうたっている。</p> <p>一方、価値観・国家感の軸では重複する面もあるものの、自民党は『やや強い政府』、民主党は『やや弱い政府』を中心に旧社会党メンバーらをはじめ『弱い政府』方向に広がっているように思える。</p> <p>印象的なのは、自民党党大会では国旗が掲揚されているにも関わらず、民主党の党大会にはそれが無い事。（鹿児島の集会では遺憾な形で掲げられていたようだが…。）</p> <p>僅か１年足らずの村山内閣時代の『村山談話』が未だに禍根を引きずっている事を考えると、４年以内に次の次の選挙があるとはいえ、これには不安を覚えざるを得ない。</p> <p>自分としては『徹底的に小さな政府』と『やや強い政府』あたりが希望なのだが…政党レベルでは受け皿がねぇｗｗｗ</p> <br /> <p>さて、いくつか関心のある政策イシューについて検討してみたい。</p> </div> 2009-08-22T00:00:00+00:00 kaigai http://danwalsh.livejournal.com/30335.html I&nbsp;have tried to encourage people to run SELinux with a more tightly run system,&nbsp; You can remove the unconifned module, and run almost all of your system as unconfined,&nbsp; And you can remove the unconfineduser module if you want to confine all of your users.&nbsp; But in order to have this work for many people, I have to see/fix whatever AVC's would happen with the packages removed. <br /><br />Temporarily in Rawhide I have changed the unconfined_domain()&nbsp;interface to set permissive rather then unconfined. &nbsp;This means that the &quot;uncoonfined&quot; domains will still be able to do everything they could before, but they will generate AVC's. &nbsp;<br /><br />How do you tell if they are a permissive domain, you can look at the avc SYSCALL&nbsp;record and if it has &quot;success=yes&quot;&nbsp; you have a pretty good idea this is a permissive domain. &nbsp;When the kernel says &quot;success=yes&quot; that means it did not block anything.<br /><br />setroubleshoot should also point this out.<br /><br />You can also see the list of permissive domains using seinfo --permissive<br /><br /><br />&nbsp;seinfo --permissive<br /><br />Permissive Types: 50<br />&nbsp;&nbsp; bootloader_t<br />&nbsp;&nbsp; devicekit_power_t<br />&nbsp;&nbsp; ModemManager_t<br />&nbsp;&nbsp; ldconfig_t<br />&nbsp;&nbsp; smoltclient_t<br />&nbsp;&nbsp; unconfined_cronjob_t<br />&nbsp;&nbsp; kdumpgui_t<br />&nbsp;&nbsp; sandbox_xserver_t<br />&nbsp;&nbsp; setfiles_mac_t<br />&nbsp;&nbsp; initrc_t<br />&nbsp;&nbsp; ada_t<br />&nbsp;&nbsp; fsadm_t<br />&nbsp;&nbsp; kudzu_t<br />&nbsp;&nbsp; lvm_t<br />&nbsp;&nbsp; mdadm_t<br />&nbsp;&nbsp; mono_t<br />&nbsp;&nbsp; wine_t<br />&nbsp;&nbsp; setroubleshoot_fixit_t<br />&nbsp;&nbsp; gconfdefaultsm_t<br />&nbsp;&nbsp; gnomesystemmm_t<br />&nbsp;&nbsp; prelink_t<br />&nbsp;&nbsp; anaconda_t<br />&nbsp;&nbsp; system_cronjob_t<br />&nbsp;&nbsp; tmpreaper_t<br />&nbsp;&nbsp; samba_unconfined_net_t<br />&nbsp;&nbsp; devicekit_disk_t<br />&nbsp;&nbsp; firstboot_t<br />&nbsp;&nbsp; samba_unconfined_script_t<br />&nbsp;&nbsp; httpd_unconfined_script_t<br />&nbsp;&nbsp; depmod_t<br />&nbsp;&nbsp; insmod_t<br />&nbsp;&nbsp; apmd_t<br />&nbsp;&nbsp; clvmd_t<br />&nbsp;&nbsp; crond_t<br />&nbsp;&nbsp; inetd_t<br />&nbsp;&nbsp; init_t<br />&nbsp;&nbsp; kdump_t<br />&nbsp;&nbsp; udev_t<br />&nbsp;&nbsp; virtd_t<br />&nbsp;&nbsp; xend_t<br />&nbsp;&nbsp; rtkit_daemon_t<br />&nbsp;&nbsp; devicekit_t<br />&nbsp;&nbsp; remote_login_t<br />&nbsp;&nbsp; inetd_child_t<br />&nbsp;&nbsp; unconfined_t<br />&nbsp;&nbsp; hddtemp_t<br />&nbsp;&nbsp; ricci_modcluster_t<br />&nbsp;&nbsp; ptchown_t<br />&nbsp;&nbsp; useradd_t<br />&nbsp;&nbsp; xserver_t<br /><br />As we get closer to release I&nbsp;will change the domains back to unconfined and remove most of the permissive flags.<br /><br />Thanks for your patients and keep send in the bug reports. 2009-08-20T13:58:51+00:00 dwalsh@redhat.com http://etbe.coker.com.au/2009/08/20/mail-server-security/ <p>I predict that over the course of the next 10 years there will be more security problems discovered in Sendmail than in Postfix and Qmail combined. I predict that the Sendmail problems will be greater in number and severity.</p> <p>I also predict that today&#8217;s versions of Postfix and Qmail will still be usable in 10 years time, there will be no remote security problems discovered other than DoS attacks.</p> <p>I&#8217;ve been having arguments about MTA security with Sendmail fans for over 10 years. I would appreciate it if the Sendmail fans would publish their own predictions, then we can wait 10 years and see who is more accurate.</p> <p>I don&#8217;t recommend using Qmail (Postfix is what I use). But I think he wrote code that is unlikely to be exploited.</p> 2009-08-20T04:23:47+00:00 etbe http://d.hatena.ne.jp/kaigai/20090818/1250596607 <div class="section"> <p>以下の日程で、４回目のセキュアOS塾を開催します。</p> <p>今回は、SELinuxを用いたデータベースのセキュリティ強化機能である SE-PostgreSQL と、Oracleで類似機能を提供する Oracle Label Security を比較しつつ、データベースにおける強制アクセス制御機能の紹介します。</p> <p> 日時：2009年9月4日(金) 19:00〜</p> <p> 場所：日本オラクル 青山センター 13階 S7セミナールーム</p> <p> テーマ：SE-PostgreSQL vs Oracle Label Security</p> <p>詳細は、下記のイベント紹介をご覧ください</p> <p><a href="http://www.secureos.jp/index.php?events/jsosjk04" target="_blank">http://www.secureos.jp/index.php?events/jsosjk04</a></p> <p>参加登録は下記のページよりお願いします</p> <p><a href="http://atnd.org/events/1299" target="_blank">http://atnd.org/events/1299</a></p> <p>（※ 登録には、はてな、mixi、Yahoo!、Livedoor、FlickrのいずれかのIDが必要です）</p> <h4> SE-PostgreSQL vs Oracle Label Security</h4> <p>（講師：海外 浩平、田口 裕也）</p> <p>SaaSやCloudといった言葉に代表されるように、情報システムの"所有"から"利用"という流れは、アウトソースされた巨大データベースへの情報資産の蓄積を加速させています。</p> <p>言うまでもなく、このような環境で利用されるデータベースに対しては、セキュリティの強化は最優先で検討されるべき事項の一つです。</p> <p>OSが"標準"のアクセス制御に加えて、より高度なセキュリティを実現するためSELinuxなどの強制アクセス制御を備えているのと同じように、幾つかのデータベース管理システム（RDBMS）では、SQLの仕様で定義されている"標準"のアクセス制御に加えて、独自の先進的なアクセス制御機構を備えているシステムが存在します。</p> <p>今回のセキュアOS塾で取り上げる、SE-PostgreSQLやOracle Label Securityはその代表格と言えるでしょう。共に、利用者のDBアクセスに対して強制アクセス制御を適用し、しかも行レベルの細粒度で制御を行う事もできます。</p> <p>今回のセキュアOS塾-04では、類似の機能を提供するSE-PostgreSQLとOracle Label Securityを比較する事で、互いのアクセス制御機構の特徴と強みを明らかにします。</p> <p>セキュリティという側面から見たとき、OSSのRDBMSはSaaS/Cloudの基盤になり得るでしょうか？乞うご期待。</p> </div> 2009-08-18T11:56:47+00:00 kaigai http://etbe.coker.com.au/2009/08/18/lack-of-browser-security/ <p>For a long time the use of <a href="http://en.wikipedia.org/wiki/HTTP_cookie">HTTP cookies [1]</a> for tracking the web browsing habits of users has been well known. But I am not aware of any good solution to the problem. A large part of the problem is the needless use of cookies, it seems that many blog servers use cookies even though they provide no benefit to the user. A major culprit in this regard is the Google Analytics service which sets a cookie with a two year expiry time when you first visit a web site. <a href="http://www.customizegoogle.com/block-google-analytics-cookies.html">The CustomizeGoogle.com Firefox plugin allows you to block the Google Analytics cookies [2]</a> and much more.</p> <p>It&#8217;s unfortunate that Firefox/Iceweasel seems to lack the cookie management functions of Konqueror. Konqueror (the KDE web browser) can be configured to prompt the user for the appropriate action when a cookie is offered, the options include once-only accept or reject and permanent accept or reject status for the site in question. Of course even this has some issues, when a web site is on the &#8220;permanently block cookies&#8221; list it is one that has obviously been viewed intensively on at least one occasion (IE many page views) or viewed on multiple occasions, in some situations this may be a fact that the user does not want revealed. An option to store a list of the hashes of the names of web sites which should be blocked would be useful. It&#8217;s also unfortunate that Konqueror (like most browsers) is unable to use Firefox plugins, so given a choice between Konqueror and Firefox I&#8217;m always going to lose some features.</p> <p><b>Update:</b> <a href="http://blog.andrew.net.au/2009/08/17#firefox_cookie_handling">Andrew Pollock points out that Firefox does allow you to control when cookies are accepted [5]</a>. It&#8217;s listed as &#8220;<b>Keep Until</b>&#8221; with the value of &#8220;<b>ask me every time</b>&#8220;.</p> <p>The next issue relates to the storage of cookies. It is a good security feature to have certain types of cookie expire after some period of time. Unfortunately the expiry process requires that the user run the web browser in question. So if for example my browser preferences were to change then I would probably end up with the cookies from the old browser remaining in my home directory for years after their planned expiry date. My home directory has the untouched configuration and data files of many programs that I have not used for four years or more. I&#8217;m not sure whether any of them include cookies from web browsers (I have used many web browsers over the years).</p> <p>I think that the best solution to this problem would be to have a common directory such as <b>~/.session-state</b> which has files with an MTIME indicating when they should expire. A program that wants to store such session data could create a subdirectory such as <b>~/.session-state/Firefox</b> and then use one file per cookie under that directory. Then the user could have a cron job which deletes all session state files that are older than the current date. Such a cron job would not need to know anything about the actual data in the files, it would just delete the files that are out of date. The exact format of the files would be determined by the application, so if there were thousands of cookies (which would lead to a performance problem on some systems if one file was used for each) then there could be one file for each week (if deleting the old cookies as much as 6 days too late is a serious problem then you are probably going to suffer anyway). Such a state directory could be used for any data which has a fixed expiry time, it would not need to be limited to cookies.</p> <p>This would be a minor misuse of the mtime field, but it&#8217;s the most reliable way of implementing this and making it difficult to mess it up (in terms of exposing private data). Note that the MTIME would not have to be the sole source of such data, an application such as Firefox could reset the MTIMEs on the files to values it considers appropriate (based on file name, file contents, or some metadata stored elsewhere). It is expected that certain backup/restore operations among other things can result in the timestamp data on files being lost.</p> <p>Now cookies are not the extent of the problem. <a href="http://www.schneier.com/blog/archives/2009/08/flash_cookies.html">It seems that Macromedia/Adobe have some similar functionality in the Flash player [3]</a>, but the insidious thing is that Flash cookies are used to respawn HTTP cookies if the user deletes them! After reading about that I discovered some Flash cookies that were stored on my laptop since 2005 (which was probably the last time I ran Flash). It seems that if you desire security you need to first avoid software from companies that are at best disinterested and sometimes seem overtly hostile towards the privacy needs of users &#8211; this is why I haven&#8217;t used Flash on machines that matter to me for many years. If I had a lot of spare time I would help out with the GNASH project.</p> <p>One thing I have been considering is to change my browsing habits to use a different account for untrusted content. The switch user functionality that has been in most Linux distributions for a few years seems to have the potential to alleviate this. I am considering setting up a system to allow me to ssh to a guest account to open a web browser window. Then I can switch to the X desktop that has untrusted web sites open and read them. It would be nice if I could extend a web browser to add an extra entry to the menu that is displayed when the secondary mouse button is pressed on a link, then I could make that run a script to launch the URL in a new window. I could also use that when I&#8217;m at home to launch the URL on a different system.</p> <p>One thing that I have to do is to get <a href="http://james-morris.livejournal.com/25640.html">XGuest (the SE Linux Kiosk Mode) [4]</a> running in Debian. It&#8217;s been in Fedora since version 8. With the XGuest used for untrusted browsing nothing gets stored.</p> <p>This is not the extent of security issues related to web browsing. It&#8217;s just a small set of issues that need to be fixed, we have to start somewhere.</p> <p><ul><li>[1]<a href="http://en.wikipedia.org/wiki/HTTP_cookie"> http://en.wikipedia.org/wiki/HTTP_cookie</a></li><li>[2]<a href="http://www.customizegoogle.com/block-google-analytics-cookies.html"> http://www.customizegoogle.com/block-google-analytics-cookies.html</a></li><li>[3]<a href="http://www.schneier.com/blog/archives/2009/08/flash_cookies.html"> http://www.schneier.com/blog/archives/2009/08/flash_cookies.html</a></li><li>[4]<a href="http://james-morris.livejournal.com/25640.html"> http://james-morris.livejournal.com/25640.html</a></li><li>[5]<a href="http://blog.andrew.net.au/2009/08/17#firefox_cookie_handling"> http://blog.andrew.net.au/2009/08/17#firefox_cookie_handling</a></li></ul></p> 2009-08-18T06:01:22+00:00 etbe http://etbe.coker.com.au/2009/08/17/maintain-old-urls/ <p>Below is a message from the <b>thanks</b> file on my <a href="http://www.coker.com.au/selinux/play.html">SE Linux play machine [1]</a>:</p> <p><b>Hello from San Juan, Puerto Rico!<br /> I just found out about this server by reading the SELinux book from O&#8217;Reilly. The book is pretty old (2004) and I&#8217;m glad to know the URL provided on the book still works!<br /> All the best,</b></p> <p>I had forgotten that the URL was included in the book.</p> <p><ul><br /> <li>[1]<a href="http://www.coker.com.au/selinux/play.html"> http://www.coker.com.au/selinux/play.html</a></li><br /> </ul></p> 2009-08-16T21:35:27+00:00 etbe http://d.hatena.ne.jp/himainu/20090812#1250086973 とあるアプリケーションに対して、SELinuxを使ったアクセス制御を適用できないかと思っており、調べている。 お、まさに↓の人と同じ悩みだ。参考になる。 http://sourceforge.jp/projects/jsosug/lists/archive/users/2008-October/000034.html ↓あたりを読めばなんとなく分かるのだろうか。。 How to Write a Userspace Object Manager http://www.engardelinux.or ... 2009-08-12T14:22:53+00:00 himainu http://jczucco.blogspot.com/2009/08/video-tchelinux-2009-caxias-do-sul.html Novo vídeo disponível no site <a href="http://videos.tchelinux.org">http://videos.tchelinux.org</a><br />Palestra: Entendendo o SELinux - Security Enhanced Linux<br />Palestrante: Jerônimo Zucco<br />Data: 13/06/2009<br /><br /><p><a href="http://vimeo.com/6023174">Tchelinux 2009 - Caxias do Sul - FTEC: Entendendo o SELinux - Security Enhanced Linux</a> from <a href="http://vimeo.com/user1676127">Douglas Schilling Landgraf</a> on <a href="http://vimeo.com">Vimeo</a>.</p><br /><br /><br />Apresentação: <a href="https://sites.google.com/site/zuccoweblog/EntendendooSELinux-SecurityEnhancedLinux.pdf">https://sites.google.com/site/zuccoweblog/EntendendooSELinux-SecurityEnhancedLinux.pdf</a><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/15117118-8595550265063210024?l=jczucco.blogspot.com" alt="" /></div> 2009-08-10T10:35:17+00:00 Jeronimo Zucco (jczucco@gmail.com) http://d.hatena.ne.jp/himainu/20090808#1249702662 2002年からの種IT開発のまとめとして、 USENIX LISA（AppArmorの論文とか出たところ）に論文出して採択されました。 論文書くのは超大変でした（というかまだ最終版の直し中…） 学術論文っぽい構成の仕方とかあるようで、思考法を変える必要があった。 LISA 09は、波地摩開催です。昔開催されたSELinux Symposiumと同じ場所。 新型インフルエンザにだけはかからないようにしたいけど、 前の週ぐらいに絶妙のタイミングでJapan Linux Symposiumがある… ... 2009-08-08T03:37:42+00:00 himainu http://d.hatena.ne.jp/himainu/20090808#1249702661 超久々の更新。 いつの間にやら、色々あった。 TOMOYO Linux TomoyoLinux on Android http://sourceforge.jp/projects/tomoyo/docs/Part1_CELF_Jamboree_28_TOMOYOLinuxOutline.pdf http://sourceforge.jp/projects/tomoyo/docs/Part2_CELF_Jamboree_28_TOMOYO_on_Android.pdf SMACK SMACK fo ... 2009-08-08T03:37:41+00:00 himainu http://etbe.coker.com.au/2009/07/29/new-lamps-for-old/ <p>A few weeks ago I had a guy from &#8220;enviro saver&#8221; visit my home to replace incandescent globes with CFLs.  The original plan was to deliver a water-saver shower head as well but he told me that because I have solar hot water there are no renewable energy certificates in installing a shower head so I couldn&#8217;t get one.</p> <p>The brochure they gave me at my local shopping center when I signed up for this claimed that they are &#8220;acting on a genuine concern about the<br /> environmental impact of our Australian lifestyle&#8221;.  But it seems that renewable energy certificates and up-selling of Photo-Voltaic systems is the real aim. I&#8217;ve been planning to get a PV system installed so I&#8217;ll be interested to see what they offer me.</p> <p>The CFLs that they gave me appeared to be very cheap ones.  They take about 500ms to start while the better ones appear to take less than 100ms. It seems to be a reasonable business model to give people a few dollar&#8217;s worth of cheap CFL lights in exchange for a good sales opportunity and some renewable energy certificates.</p> <p>This sort of thing has become popular enough that some thieves are copying the plan. According to the reports people will knock on your door offering free CFL lights, case your home while installing them (got to check every room for old incandescent lights), and then rob it the next week if it looks like there are good things in there.</p> <p>The companies that offer a legitimate service of replacing lights apparently don&#8217;t send people knocking on doors. They have the customers sign up for the service in advance.</p> <p>But the solution to such problems seems obvious. Firstly get the name of everyone who wants to enter your home. If you signed up for a service then make sure you know who you called. If someone appears on your doorstep then demand photo ID. Camera phones are good things, if someone refuses to adequately identify themself then take their picture, note the number of their car, and give the details to the police.</p> <p>Keep a log of everything that seems relevant to home security, thieves may attack your home weeks after casing it, so you can&#8217;t rely on your memory. Also keep a log in a place where it&#8217;s not likely to be stolen, storing it on a computer that is in your home would be a bad idea.</p> 2009-07-29T09:28:27+00:00 etbe http://thetoms-random-thoughts.blogspot.com/2009/07/opensuse-112-m4-and-selinux.html <p>This week was HackWeek, unfortunately I didn't had the time for hacking something because SELinux does not work in Milestone 4.</p><p>It looks like the new kernel in Milestone 4 for 11.2 needs some special switches to be pushed to enable SELinux.</p><p><!-- BlogCounter Code START -->The kernel config defines "apparmor" as the default security framework which denys loading the "selinuxfs" etc.</p><p>Therefore you need to add the following parameters to the kernel boot parameter: "security=selinux selinux=1 enforcing=0"</p><p>I started working on a yast module for SELinux but I doubt I will finish it... if somebody wants to take over, let me know! :-)</p><p>Additionally a new <span>libselinux</span> package was submitted that includes an updated <span>selinux-ready</span> script. Pavol also submitted a new <span>policycoreutils</span> package to fix a build failure.</p><p><br /></p><p><br /></p><p><a href="http://www.blogcounter.de/" id="bclink" title="kostenloser Counter fuer Weblogs"><span id="bccount">kostenloser Counter</span></a></p><p><a href="http://www.blogcounter.de/"><img alt="Weblog counter" src="http://track.blogcounter.de/log.php?id=thetom_blog" /></a> - </p><br /><!-- BlogCounter Code END --><div class="blogger-post-footer"><img width="1" height="1" src="https://blogger.googleusercontent.com/tracker/5240359826706545510-7494387305498081485?l=thetoms-random-thoughts.blogspot.com" alt="" /></div> 2009-07-24T13:21:57+00:00 Thomas (noreply@blogger.com) http://blog.namei.org/2009/07/24/2009-selinux-developer-summit-schedule-published/ <p>We&#8217;ve just published the <a title="SELinux developer summit 2009 schedule" href="http://selinuxproject.org/page/Developer_Summit_2009/Schedule">schedule</a> for this year&#8217;s <a title="SELinux developer summit 2009 home page" href="http://selinuxproject.org/page/Developer_Summit_2009">SELinux Developer Summit</a>.</p> <p>From the announcement:</p> <blockquote> <pre>This year's event will be divided into two main sessions. The first will be for traditional conference presentations which were accepted via the CfP: * Labeled NFS Community Involvement - Dave Quigley (NSA) * Update on Flask/TE Support for X - Eamon Walsh (NSA) * Work on a Higher-Level Policy Language - James Carter (NSA) * Video Streaming in Policy Confined Environments - Philip Tricca (USAF) * A New Policy Infrastructure for SELinux Joshua Brindle (Tresys) * Policy Distribution Joshua Brindle (Tresys) * Refpolicy and Userspace Joshua Brindle (Tresys) * Analysis of Flask Policies in VM Systems Trent Jaeger (PSU) Aside from Josh's talks (which are combined into one 60-minute slot), these are 30-minute slots. For speakers, the recommended format is 20-minutes of presenting and 10-minutes of Q&amp;A. The second main session, after lunch, is intended to be fully collaborative in that everyone in attendance may (and should) participate. This is divided into three sections: * Lightning talks, 5 minutes each. Any attendee may propose a lightning talk via the wiki or on the day. * Development sessions. This is a flexible format where developers can work in small self-organized groups on specific tasks, taking advantage of the fact that we're all in the same place for the day. We'll discuss this further on the event mailing list -- it's important to identify tasks, teams and goals beforehand, and also to make sure everyone is set up to get straight to work on the day. * General project discussion. We'll spend about an hour discussing project and development issues. Candidate agenda items should first be posted to the event mailing list, and the agenda will be finalized immediately prior to the event. For attendees who are yet to do so, ensure you are registered for LinuxCon, which is co-hosting the event for us: <a href="http://events.linuxfoundation.org/events/linuxcon">http://events.linuxfoundation.org/events/linuxcon</a> LinuxCon registration is a requirement for attending the SELinux Developer Summit. The current discounted registration rate ends on August 15th.</pre> </blockquote> <p>The development sessions idea comes from last year&#8217;s development-oriented <a title="foss.in web site" href="http://foss.in/">FOSS.IN</a>, which I wrote about <a title="foss.in 2008 wrap up" href="http://blog.namei.org/2008/12/06/fossin2008-wrapup/">here</a>.</p> <p>If you&#8217;re still considering whether to attend the SELinux Developer Summit, keep in mind that in addition to being part of <a title="LinuxCon 2009" href="http://events.linuxfoundation.org/events/linuxcon">LinuxCon</a>, there&#8217;s also <a title="Linux Plumbers Conference 2009" href="http://linuxplumbersconf.org/2009/">Linux Plumbers</a> directly following that at the same venue, which includes a general Linux <a href="http://lwn.net/Articles/341240/">security microconf</a>.  Travel budgets are tight for everyone this year, so hopefully the co-location of these events will help make a business case for people who are still working on travel approval.</p> <p>For those who can&#8217;t make it, we&#8217;ll try and ensure that all available materials and minutes from the event are published in a timely manner.   I&#8217;d encourage those who are able to attend to blog/dent/tweet anything related to the event that they feel might be useful to others.</p> 2009-07-24T02:05:53+00:00 jamesm http://danwalsh.livejournal.com/30084.html When we first designed targeted policy, we defined a domain that allowed users and administrators to login and have the same access privileges they would have had if SELinux was disabled.&nbsp; Similarly, we wanted to allow third party applications to be installed and run without requiring the administrator/user to write special policy rules for these applications.&nbsp;&nbsp; They would just work.<br /><br />We designed the unconfined domain for this.<br /><br />The unconfined domain originally was written as a rule like<br /><br />allow UNCONFINED_DOMAIN *:* *;<br /><br />meaning processes running as the unconfined_domain are allowed to do everything SELinux can deny.&nbsp; Unconfined domains are thus an exception to the way an SELinux system is usually written.<br /><br />Over time we have had requests to add exceptions to the &quot;unconfined can do anything&quot; rule.<br /><br />We confine the unconfined domain in a&nbsp; couple of different ways.<br /><br />One way to confine an unconfined domain is via process transitions.&nbsp; We can write rules to specify that an unconfined_domain will transition into a different, confined, domain when it executes a program with a certain label.<br /><br />On most targeted systems, the init scripts run as initrc_t, an unconfined domain.&nbsp; When an init script executes a file labeled httpd_exec_t, the process transitions to the httpd_t domain, a confined domain.&nbsp; Another process that transitions from an unconfined domain to a confined one is the unconfined_t domain, the domain used by unconfined users.&nbsp;&nbsp; For example, when the unconfined user tries to set up a vpn connection using vpnc, the vpnc program transitions to vpnc_t, a confined domain. Currently in Rawhide, I count around 50 transitions from the unconfined_t domain to other domains.<br /><br /># sesearch --allow -s unconfined_t -c process -p transition | wc -l<br />&nbsp;&nbsp;&nbsp;&nbsp; 50&nbsp;&nbsp; <br /><br />A second way to confine the unconfined domains is to wrap specific allow rules within a boolean.<br /><br />We have changed the line<br /><br />allow UNCONFINED_DOMAIN *:* *;<br /><br />to something like<br /><br />&nbsp;&nbsp;&nbsp; # Use any Linux capability.<br />&nbsp;&nbsp;&nbsp; allow $1 self:capability all_capabilities;<br />&nbsp;&nbsp;&nbsp; allow $1 self:fifo_file manage_fifo_file_perms;<br />&nbsp;&nbsp;&nbsp; # Userland object managers<br />&nbsp;&nbsp;&nbsp; allow $1 self:nscd all_nscd_perms;<br />&nbsp;&nbsp;&nbsp; allow $1 self:dbus all_dbus_perms;<br />&nbsp;&nbsp;&nbsp; allow $1 self:passwd all_passwd_perms;<br />&nbsp;&nbsp;&nbsp; allow $1 self:association all_association_perms;<br /><br />....<br />&nbsp;&nbsp;&nbsp; allow $1&nbsp; self:process ~{ transition dyntransition execmem execstack execheap };<br /><br />&nbsp;&nbsp;&nbsp; tunable_policy(`allow_execheap',`<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Allow making the stack executable via mprotect.<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow $1 self:process execheap;<br />&nbsp;&nbsp;&nbsp; ')<br /><br />&nbsp;&nbsp;&nbsp; tunable_policy(`allow_execmem',`<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Allow making anonymous memory executable, e.g.<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # for runtime-code generation or executable stack.<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow $1 self:process execmem;<br />&nbsp;&nbsp;&nbsp; ')<br /><br />...<br /><br />Wrapping the access within booleans gives the administrator the ability to decide whether or not to add limited confinement to the unconfined domains.&nbsp; <br /><br />For example, we restrict the unconfined users from executing memory that is both writable and executable at the same time.&nbsp; This access can be tuned using these booleans: allow_execheap, allow_execmem, allow_execstack, allow_execmod.<br /><br />Denying this access allows us to stop a lot of buffer overflows from being exploited.&nbsp; If a user downloads content that can cause applications like acroread or evince to overflow a buffer, these checks will prevent the execution of code in corrupted memory, protecting the user.&nbsp; Since the permission checks prevent the execution of random code, they help secure the system.<br /><br />I would like to point out that these checks are trying to protect a user who is not trying to crack the system from being cracked.&nbsp; These checks do nothing to prevent a cracker currently running as unconfined_t from attacking the system.<br /><br />Periodically we have added checks to try to harden the machine against broken or malicious applications running as unconfined_t from attacking the machine.&nbsp; Most of these preventions are the equivalent of putting a garden fence around the prison,&nbsp; i.e. they are easily gotten around.&nbsp;&nbsp; If a cracker gets into an SELinux box as unconfined_t, SELinux will prevent him from doing very little, since that is how unconfined_t is designed.&nbsp; It is up to DAC to protect the system.<br /><br />Last week, Brad Spengler&nbsp; revealed a vulnerability that allowed him to gain control of the kernel and in doing so is able to disable all security mechanisms including those of LSMs like SELinux.&nbsp; this is a whole new vulnerability, although it is in the same class of bugs as one he reported a couple of years back, and in that case he was also able to turn off SELinux policy enforcement.&nbsp; The mmap_zero check was added to the kernel to control whether or not applications would be allowed to map memory at the zero address.&nbsp; A decision was made to treat this differently on systems with or without SELinux enabled.&nbsp; On systems without SELinux, applications have to run as root or you need to disable the check on the entire system.&nbsp;&nbsp; On systems with SELinux enabled, this is decided by policy, and whether you are root or not is ignored.&nbsp; One application that requires mmap_zero is wine. If you want to run wine apps on an SELinux disabled machine, you need to disable this check, for the entire system.&nbsp; To run wine as a non-root user you need to<br />lessen the security of every single program on the machine.&nbsp; On a machine with SELinux enabled you can run wine as normal user, and still have the protection where all confined domains, even those running as root, can not subvirt the machine.&nbsp; The only confined applications that have the mmap_zero privilege in RHEL5 are vbetool, xdm, xserver and wine.&nbsp; In rawhide,&nbsp; only wine and vbetool have the privilege.&nbsp; All unconfined domains have a boolean, allow_unconfined_mmap_zero, wrapping the mmap_zero privilege.&nbsp; In RHEL5 the boolean is enabled by default for backwards compatibilitally, as mmap_min_addr was introduced during the lifetime of RHEL5, allowing all unconfined domains to mmap_zero.&nbsp; By default in Fedora 10, 11 and rawhide, the boolean is disabled, denying all unconfined domains the mmap_zero access.&nbsp; We are not planning on changing the default in RHEL5, to maintain backawards compatability.<br /><br />You can toggle the boolean off by executing <br /><br /># setsebool -P allow_unconfined_mmap_low=0<br /><br />Note:<br />&nbsp;&nbsp;&nbsp; There was a bug in policy in both Fedora and RHEL5 where unconfined_t, ignored the boolean.&nbsp; This means unconfined_t could mmap_zero, whether or not the boolean was turned on. We have decided to change the unconfined_t domain to follow the boolean in updates. Versions: selinux-policy-3.5.13-66.fc10, selinux-policy-3.6.12-66.fc11, selinux-policy-3.6.22-1.fc12.noarch, selinux-policy-2.4.6-253.el5, have the fix.<br /><br />Brad figured out that unconfined_t domain ignores the boolean and is always allowed to mmap_zero.&nbsp; The default logged in user on a targeted SELinux system has the ability to mmap_zero.&nbsp; <br /><br />But I question whether or not this is even worth doing.&nbsp; We are putting a speed bump in front of a determined cracker.&nbsp; If a cracker is logged in to a machine as the unconfined_t user he can easily compile the executable described by Brad, change its context to vbetool_exec_t, and then use runcon to execute the script with the mmap_zero privilege.<br /><br />$ /usr/sbin/getsebool allow_unconfined_mmap_low<br />allow_unconfined_mmap_low --&gt; off<br /><br />So the user downloads the cracker.<br /><br />$ ./cracker <br />mmap: Permission denied<br /><br />SELinux is working, but the unconfined_t user can label his cracker app as vbetool_exec_t, (a tool that needs mmap_zero).<br /><br />chcon -t vbetool_exec_t ./cracker<br /><br />$ ./cracker <br />mmap: Permission denied<br /><br />Notice that it still blew up.&nbsp; This is because it does not transition from unconfined_t to vbetool_t, automatically.<br /><br />But how about.<br /><br />$ runcon -t initrc_t -- sh -c ./a.out<br />got a NULL mapping...<br /><br />This succeeds because, there is a transition defined from unconfined_t to initrc_t, and also a transition from initrc_t to vbetool_t.<br /><br />In conclusion, this shows that the boolean preventing the unconfined_t domain or any other unconfined domains from performing mmap_zero is pretty useless in preventing a cracker from attacking the system.<br />If you use unconfined_t users and a cracker gets to login as one, SELinux can not prevent mmap_zero.<br />A cracker running as unconfined_t, can use just about any root exploit, just as if SELinux was disabled.<br /><br />In the future we need to better understand what it means to try to confine the unconfined user. 2009-07-21T18:37:27+00:00 dwalsh@redhat.com http://eparis.livejournal.com/606.html There has been a lot of conversation about the difference in how the mmap_min_addr proteciton is applied on SELinux vs. non-SELinux systems and how these differences made it easier to exploit a recent kernel BUG on SELinux systems.&nbsp; A number of people have claimed the SELinux made the system weaker.&nbsp; It did, but in other ways it was still stronger.&nbsp; I'm working to get the best of both worlds, but it isn't fair to claim a universal across the board weakening.<br /><br />We, the SELinux team, made a decision to not require CAP_SYS_RAWIO (non techies can think of this as root, or uid=0) for mapping the 0 page.&nbsp; Instead we have an SELinux policy specific permission for this operation, mmap_zero. We made the choice to not require one to be root because WINE needs to do this operation and (sadly) there are a number of users out there who run windows applications inside WINE.<br /><br />Recently a kernel exploit was posted which works by mapping the 0 page, putting crafty info on that page, tickling a bug in the kernel, and winning (It is brilliant, as usual from Brad.)&nbsp;&nbsp; To get that 0 page mapped on a non-SELinux system he had to find a busted suid application (he found pulseaudio) and get that to map the page for him.&nbsp; Since SELinux systems don't require root, he didn't need to find a busted suid application, he just had to map the 0 page and tickle the kernel bug.<br /><br />Now the claim comes out that SELinux systems are less secure than non-SELinux systems.&nbsp; It's true, SELinux systems are weaker against authenticated logged in local users in this case.&nbsp; But it's stronger against remote attacks.&nbsp; What?&nbsp; Yes, I agree completely that I need to strengthen the system against attacks from a malicious local user, but we do a much better job in this case if an attacker was trying to attack remotely.<br /><br />On a non-SELinux system if the attacker was able to subvert any network facing daemon they won.&nbsp; They just tickled do the same thing.&nbsp; Take over daemon remotely, use pulseaudio to map the page, tickle the kernel bug, win.&nbsp; But what happens on an SELinux system?&nbsp; It doesn't work!&nbsp; Take over the network facing daemon, try the pulseaudio trick, crap, didn't get the page.&nbsp; Try to map the zero page directly.&nbsp; Crap it didn't work.&nbsp; Now what?&nbsp; You win, they lose.&nbsp; SELinux is stronger than non-SELinux.<br /><br />This is because SELinux confines network facing daemons and doesn't give them permissions to map the 0 page.&nbsp; It's not about root or non-root.&nbsp; It's not about suid or non-suid.&nbsp; It's about the SELinux domain not allowing the daemon to map the 0 page.&nbsp; Yes, as an unconfined user you can map the page (and I'm looking at ways to fix that) but if your system is subverted remotely, you are likely much better protected with SELinux than without. 2009-07-21T17:00:24+00:00 http://blog.namei.org/2009/07/20/kca-slides-photos-and-videos/ <p>I was in Brisbane last week to talk about Linux Kernel Security at <a href="http://au.sun.com/sunnews/events/2009/kernel/index.jsp">Kernel Conference Australia</a> (KCA). </p> <p>The aims of the talk were to provide a general overview of security features in the Linux kernel, and to examine historical context around Unix security and how Linux is evolving to address modern security requirements.</p> <p>People may be interested in my slides. They&#8217;re available as a <a href="http://namei.org/presentations/linux-kernel-security-kca09.pdf">PDF</a> download and via <a href="http://www.slideshare.net/jamesmorris/linux-kernel-security-overview-kca-2009">Slideshare</a>. Note that full speaker notes are included in the slides, in the second half of the deck.</p> <p>The conference was streamed live online, and the video from my talk may be viewed <a href="http://www.ustream.tv/recorded/1814752">here</a>. I&#8217;m watching to see how the talk, and my speaking in general, might be improved. As painful as this may be, it seems very effective in understanding what worked and what didn&#8217;t. I think I can tighten this talk up for possible future use, and focus more on how our development process&mdash;not merely the technology&mdash;helps address evolving security requirements.</p> <p>I later participated in an OS security panel with Cristina Cifuentes and Fernando Gont, the video of which is also <a href="http://www.ustream.tv/recorded/1815405">online</a>.</p> <p>I&#8217;ve also uploaded a flickr <a href="http://www.flickr.com/photos/x_jamesmorris/sets/72157621587882679/">photo set</a>. Brisbane is a great location for a conference, especially in the southern hemisphere winter.</p> <p>It was unusual being the only Linux speaker at a conference. I hope the talk was useful, if at least to encourage more thinking about security in operating systems. </p> <p>The primary organizer of KCA, James MacPherson, has posted an <a href="http://blogs.sun.com/jmcp/entry/kca2009_winding_down_1">initial wrap-up</a> of the conference. If the conference continues&mdash;I hope it does; it has a lot of potential for the Australian kernel R&#038;D community&mdash;I think it would be highly advantageous to more actively seek speakers (and even organizers), from the broader community. One major local Linux kernel developer had a <a href="http://airlied.livejournal.com/67154.html">Linux kernel video talk rejected</a>, which seemed odd given that similar talks were accepted (e.g. the new OpenSolaris sound system), and that an additional OpenSolaris talk was added to the program after the CfP closed.</p> <p>I understand that organizing conferences is difficult, so I hope this is taken as constructive feedback. I&#8217;d certainly be interested in helping review papers or otherwise help out in the future if the conference is held again, and if it is aimed at the broader community.</p> 2009-07-20T03:35:33+00:00 jamesm http://etbe.coker.com.au/2009/07/19/drm-and-rogue-employees/ <p><a href="http://blogs.zdnet.com/hardware/?p=4944">ZDNet has an interesting article about Amazon unselling books to Kindle owners [1]</a>. Apparently the books Animal Farm and 1984 were added to the Kindle list by unauthorised people (<a href="http://www.engadget.com/2009/07/17/amazon-remotely-deletes-orwell-e-books-from-kindles-unpersons-r/">Engaget has the original story [2]</a>). So Amazon decided to just remove the books from the Kindles and refund the purchase price.</p> <p>Amazon has stated a plan to not unsell books in such situations in future &#8211; although they will apparently reserve the right to do so if they wish.</p> <p>It seems to me that Amazon management are amazingly stupid. One thing we need to consider is that Amazon employs a large number of people, some of whom will be criminals and some will act in irrational ways for various reasons. Of the Amazon employees who won&#8217;t consistently act in an honest and reliable way on behalf of their employer some will have access to the database which controls the content that is permitted on Kindles. <a href="http://www.quickonlinetips.com/archives/2009/01/journalspace-blogs-gone/">The Journalspace fiasco should be sufficient proof of this problem [3]</a>.</p> <p>If a rogue employee wiped the database of sales in progress it would really hurt the Amazon business model, but if a rogue employee also unsold the existing works (stole property from customers) then it would be much worse.</p> <p>The &#8220;features&#8221; of the Kindle would be useful to anyone who wants to make some money shorting Amazon stock. This should be of concern to the directors of Amazon.</p> <p><ul><br /> <li>[1]<a href="http://blogs.zdnet.com/hardware/?p=4944"> http://blogs.zdnet.com/hardware/?p=4944</a></li><br /> <li>[2]<a href="http://www.engadget.com/2009/07/17/amazon-remotely-deletes-orwell-e-books-from-kindles-unpersons-r/"> http://www.engadget.com/2009/07/17/amazon-remotely-deletes-orwell-e-books-from-kindles-unpersons-r/</a></li><br /> <li>[3]<a href="http://www.quickonlinetips.com/archives/2009/01/journalspace-blogs-gone/"> http://www.quickonlinetips.com/archives/2009/01/journalspace-blogs-gone/</a></li><br /> </ul></p> 2009-07-19T02:48:55+00:00 etbe http://blog.namei.org/2009/07/18/a-brief-note-on-the-2630-kernel-null-pointer-vulnerability/ <p>This is just to note that the Red Hat Security Response team have issued a preliminary comment on the <a href="http://lwn.net/Articles/341773/">2.6.30 kernel null pointer vulnerability</a>, as a comment in the associated <a href="https://bugzilla.redhat.com/show_bug.cgi?id=512284#c5">bugzilla entry</a>:</p> <blockquote> <pre><em>From<span class="vcard"> Eugene Teo (Security Response Team) 2009-07-17 07:23:57 EDT</span></em> The Red Hat Security Response Team is aware of the Linux kernel local privilege escalation exploit that is published in a number of security mailing lists and websites. The flaw identified by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1897">CVE-2009-1897</a> is a null pointer dereference vulnerability in the tun_chr_poll() function of the Linux kernel, introduced via the upstream git commit 33dccbb0. This flaw affects kernel versions between 2.6.30-rc1 and <s>2.6.30-rc3</s> 2.6.31-rc3 , and was addressed via the upstream git commit 3c8a9c63. The flaw affects only the Red Hat Enterprise Linux 5.4 beta kernel as the upstream git commit 33dccbb0 was backported to the kernel as a normal bug fix. We will be addressing this flaw in a future update to the beta kernel. It is also possible to mitigate this flaw by ensuring that the permissions for /dev/net/tun is restricted to root only. The default SELinux policy, in Red Hat Enterprise Linux 5, allows processes in the unconfined domains to map low memory in the kernel. The exploit did not bypass the null pointer dereference protection in the Linux kernel. However, we are updating the selinux-policy package to change this default configuration, so that it prevents the unconfined processes from being able to map the low memory. See <a title="ON_QA - selinux policy allows addr 0 mappings by default" href="https://bugzilla.redhat.com/show_bug.cgi?id=511143">bug 511143</a> for more information. This issue does not affect any other released kernel in any Red Hat product. In addition, future updates to Red Hat Enterprise Linux kernels may include the '-fno-delete-null-pointer-checks' gcc CFLAGS. See: <a href="http://git.kernel.org/linus/a3ca86aea507904148870946d599e07a340b39bf">http://git.kernel.org/linus/a3ca86aea507904148870946d599e07a340b39bf</a> We would like to thank Brad Spengler for bringing these issues to our attention.</pre> </blockquote> <p>Note that I&#8217;m not a member of the security response team: I&#8217;m cc&#8217;d on the bug and noticed the statement when it was posted.</p> <p>It is also worth highlighting that you should ensure that the permissions on <pre>/dev/net/tun</pre> <p> are correct.  It should look like this:</p> <blockquote><p><code><br /> # ls -l /dev/net/tun<br /> crw------- 1 root root 10, 200 2009-07-07 09:52 /dev/net/tun<br /> </code></p></blockquote> <p>It&#8217;s possible that some VPN package may change the permissions on this.</p> <p>In terms of the SELinux aspect of the exploit, I&#8217;ve posted a brief comment in the LWN thread <a href="http://lwn.net/Articles/341994/">here</a>.</p> <blockquote><p>Yes, there was a mistake in the SELinux policy, which allowed the unconfined user to bypass the mmap_min_addr check, which otherwise would have been enforced if the check was enabled (many disable it to get wine etc. working, btw, google <em>disable mmap_min_addr</em>).</p> <p>This is being fixed in the policy.</p> <p>The lesson learned here is that more careful review of policy changes needs to happen, and to ask the question as to whether the policy is capable of weakening default security.</p> <p>The LSM interface is theoretically designed to only allow further restriction of access, but this is a special case, where we are applying policy to a kernel compilation option which can also have its value set via a sysctl. It&#8217;s not a typical &#8220;access this resource or not?&#8221; decision.</p></blockquote> <p>The policy bug is now fixed in the<em> selinux-policy-2.4.6-252.el5</em> package.</p> <p>The challenge now is to try and ensure that we don&#8217;t see this class of problem crop up again, for unusual cases such as this where the normally &#8220;restrictive&#8221; mode of LSM (i.e. where permissions can only be further restricted) does not apply.  We may need to rethink how this is managed in the kernel to reduce the possibility of such issues in LSM module policy, as the LSM API here appears to be violating the <a href="http://ozlabs.org/~rusty/index.cgi/tech/2008-03-18.html">Hard to Misuse</a> design principle.</p></p> 2009-07-17T23:23:39+00:00 jamesm http://intrajp.no-ip.com/nucleus/?itemid=12 Fix segatex to relabel the system.<br /> Fix segatex policy to manage home_dir.<br /> Fix audit2allow.cpp to grep certain domain.<br /> Incorporate misc commands like df,du.<br /> Fix segatex policy to run rpm rightly. 2009-07-16T21:32:49+00:00 http://danwalsh.livejournal.com/29790.html A colleague or mine, Andrew, was baffled by SELinux,&nbsp; He ran<br /><br />sudo vpnc ./default.conf<br /><br />And an&nbsp; SELinux denial message about vpnc_t trying to read a file labeled user_home_t.&nbsp; He did not understand what was going on.<br /><br />Three people chimed in and gave him different ways to get around the SELinux denial.<br /><br />The first advised to label the file etc_t<br />.<br /><div><em>chcon -t etc_t ./default.conf</em></div><br />The second advised to build a custom policy using audit2allow. <br /><div><br /><em>grep vpnc /var/log/audit/audit.log | audit2allow -m myvpnc; semodule -i myvpnc.pp</em></div><br />The third advised the user to edit the file /etc/vpnc/default.conf instead of a local file in his home dir.<br /><br />Andrew found all solutions worked, lets examine what is going on, and figure out which is the best solution. <br /><br />When Andrew logs into the system, SELinux assigns him the default SELinux user unconfined_t.&nbsp; For the most part the unconfined user is allowed to do everything he can do if SELinux were disabled.&nbsp; Some commands that the unconfined_t user execute have transitions rules that say when the unconfined_t user executes programs labeled vpnc_exec_t they will transition to a label of vpnc_t.&nbsp; vpnc_t is a confined domain that is not allowed to read files in the users home directory, labeled user_home_t.&nbsp; Since ./defaults.conf was created in Andrews home directory, SELinux denies access. <br /><br />In the first solution Andrew changed the label of the ./defaults.conf to etc_t, default label for files in /etc,&nbsp; since vpnc_t is allowed to read files labeled etc_t, vpnc worked and Andrew has not changed the protection level on vpnc, application.&nbsp; However Andrew now has a file in his home directory labeled etc_t.&nbsp; The default rule for files created in the home directory is to label files user_home_t, so there is a reasonably good change that Andrew might mistakenly create a new default.conf file with the wrong label and get frustrated by SELinux in the future.<br /><br />The second solution was to use audit2allow to generate a new policy module to allow vpnc_t to read files labeled user_home_t.&nbsp; While this works, you have just lowered the security level of your system.&nbsp; By installing this policy you allow vpnc_t to read almost any file in your home directory.&nbsp; So if vpnc_t becomes compromised, the hacker will not be prevented by SELinux for reading most content in your home directory.<br /><br />The third solution was to edit the files in the default location /etc/vpnc/default.conf.&nbsp; The default label for these files are etc_t, and the containing directories label is etc_t, so an administrator editing files in this directory would create files by default labeled etc_t, so it is unlikely they will get mislabeled.&nbsp; This is the solution that I would suggest, as best.<br /><br />As I wrote in the blog<br /><br />http://danwalsh.livejournal.com/22347.html<br /><br />SELinux is all about labeling, and as long as the labelling is correct SELinux is happy, otherwise it will complain.&nbsp; <br /> 2009-07-15T12:44:14+00:00 dwalsh@redhat.com http://intrajp.no-ip.com/nucleus/?itemid=11 Added seinfo in semanage tab. 2009-07-15T05:04:16+00:00