[DSE-Dev] [libsemanage] Also check for the uppoer bound on user ids in /etc/login.defs

Manoj Srivastava manoj.srivastava at stdc.com
Thu Jan 8 14:33:54 UTC 2009


Hi,

 [Trimming the patch and early discussion]

On Wed, Jan 07 2009, Daniel J Walsh wrote:
> Manoj Srivastava wrote:
>> On Wed, Jan 07 2009, Stephen Smalley wrote:
>>> As Dan pointed out, the UID_MAX value in login.defs is only used by
>>> useradd, and is not even strictly enforced (useradd -u 60002 john works
>>> just fine).  In an environment with a large number of users and a global
>>> user database, you can certainly exceed 60000 users or you may even
>>> happen to generate your uids in a manner that happens to put them all in
>>> the upper part of the uid space.  There are real systems with uids >
>>> 60000 for real users, yet the login.defs UID_MAX value has not been
>>> changed on such systems because it is irrelevant and it isn't enforced
>>> by anything.  So this patch would change behavior of libsemanage on such
>>> systems in an undesirable manner.  And it wouldn't help with cases like
>>> oracle where the pseudo user is added via useradd without any specified
>>> uid at all.

>>> I think Dan's earlier posting gets to more of the fundamental problems
>>> with genhomedircon's heuristics for finding home directory locations,
>>> and we need to address his points if we want it to work in general.

>>         Fair enough. In that case, I would like to point out that the
>>  current situation of only checking UID_MIN is causing actual problems
>>  right now on real user systems, and making genhomedircon to incorrectly
>>  guess where home directories exist.

>>         I'll treat this as an imperfect workaround until we fix
>>  semodule, and then I'll just revert the patch for Debian systems.

> What does the passwd entry that it is getting fooled by look like?  Does
> the account really need a real shell?  IE Do people actually login to
> the home directory?

        I do not have passwd data from the machine in question, though I
 can ask. What I do have are the results of fixfiles relabel / :

,----[ file contexts in /var ]
|  drwxr-xr-x 15 root root  system_u:object_r:home_root_t:s0    4096 Dec 29 13:35 .
|  drwxr-xr-x 21 root root  system_u:object_r:root_t:s0         4096 Dec 29 14:21 ..
|  drwxr-xr-x  2 root root  user_u:object_r:user_home_dir_t:s0  4096 May  7  2008 backups
|  drwxr-xr-x  7 root root  user_u:object_r:user_home_dir_t:s0  4096 Dec 29 14:17 cache
|  drwxr-xr-x 25 root root  user_u:object_r:user_home_dir_t:s0  4096 Dec 29 14:17 lib
|  drwxrwsr-x  2 root staff user_u:object_r:user_home_dir_t:s0  4096 Mar 11  2008 local
|  drwxrwxrwt  2 root root  user_u:object_r:user_home_dir_t:s0  4096 Dec 29 18:14 lock
|  drwxr-xr-x  6 root root  system_u:object_r:var_log_t:s0      4096 Dec 29 18:19 log
|  drwx------  2 root root  system_u:object_r:lost_found_t:s0  16384 May  5  2008 lost+found
|  drwxrwsr-x  2 root mail  user_u:object_r:user_home_dir_t:s0  4096 May  5  2008 mail
|  drwxr-xr-x  2 root root  user_u:object_r:user_home_dir_t:s0  4096 May  5  2008 opt
|  drwxr-xr-x  2 root qmail system_u:object_r:home_root_t:s0    4096 Dec 29 13:38 qmail
|  drwxr-xr-x  7 root root  system_u:object_r:var_run_t:s0      4096 Dec 29 18:14 run
|  drwxr-xr-x  5 root root  user_u:object_r:user_home_dir_t:s0  4096 Dec 29 14:17 spool
|  drwxrwxrwt  3 root root  system_u:object_r:tmp_t:s0          4096 Dec 29 18:06 tmp
`----

        Every time "semanage user" is run, we get:
,----[ contexts/files/file_contexts.homedirs ]
|  #
|  #
|  # User-specific file contexts, generated via libsemanage
|  # use semanage command to manage system users to change the file_context
|  #
|  #
|
|  #
|  # Home Context for user user_u
|  #
|
|  /home/[^/]*/.+  user_u:object_r:user_home_t:s0
|  /home/[^/]*/\.ssh(/.*)? user_u:object_r:user_home_ssh_t:s0
|  /home/[^/]*/\.gnupg(/.+)?       user_u:object_r:user_gpg_secret_t:s0
|  /home/[^/]*     -d      user_u:object_r:user_home_dir_t:s0
|  /home/lost\+found/.*    <<none>>
|  /home   -d      system_u:object_r:home_root_t:s0
|  /home/\.journal <<none>>
|  /home/lost\+found       -d      system_u:object_r:lost_found_t:s0
|
|
|  #
|  # Home Context for user user_u
|  #
|
|  /var/[^/]*/.+   user_u:object_r:user_home_t:s0
|  /var/[^/]*/\.ssh(/.*)?  user_u:object_r:user_home_ssh_t:s0
|  /var/[^/]*/\.gnupg(/.+)?        user_u:object_r:user_gpg_secret_t:s0
|  /var/[^/]*      -d      user_u:object_r:user_home_dir_t:s0
|  /var/lost\+found/.*     <<none>>
|  /var    -d      system_u:object_r:home_root_t:s0
|  /var/\.journal  <<none>>
|  /var/lost\+found        -d      system_u:object_r:lost_found_t:s0
|
|
|  #
|  # Home Context for user user_u
|  #
|
|  /var/qmail/[^/]*/.+     user_u:object_r:user_home_t:s0
|  /var/qmail/[^/]*/\.ssh(/.*)?    user_u:object_r:user_home_ssh_t:s0
|  /var/qmail/[^/]*/\.gnupg(/.+)?  user_u:object_r:user_gpg_secret_t:s0
|  /var/qmail/[^/]*        -d      user_u:object_r:user_home_dir_t:s0
|  /var/qmail/lost\+found/.*       <<none>>
|  /var/qmail      -d      system_u:object_r:home_root_t:s0
|  /var/qmail/\.journal    <<none>>
|  /var/qmail/lost\+found  -d      system_u:object_r:lost_found_t:s0
|  /tmp/gconfd-.*  -d      user_u:object_r:user_tmp_t:s0
|
|
|  #
|  # Home Context for user root
|  #
|
|  /root/.+        root:object_r:sysadm_home_t:s0
|  /root/\.ssh(/.*)?       root:object_r:sysadm_home_ssh_t:s0
|  /root/\.gnupg(/.+)?     root:object_r:sysadm_gpg_secret_t:s0
|  /root   -d      root:object_r:sysadm_home_dir_t:s0
|  /tmp/gconfd-root        -d      root:object_r:sysadm_tmp_t:s0
`----

        This makes the machine unusable when in enforcing mode.
 Additionally, when there was unconfined se-module loaded there were
 unconfined_u instead of user_u as the second and third "users" in this
 file (that is, qmail and whatever added /var/spool).

        You need to hand edit
 $POLICY/contexts/files/file_contexts.homedirs and
 $POLICY/modules/active/file_contexts.homedirs by removing invalid
 entries (mentioning /var).

,----[ semanage user -l ]
|  root            sysadm     s0         s0-s0:c0.c1023                 staff_r sysadm_r system_r
|  staff_u         staff      s0         s0-s0:c0.c1023                 staff_r sysadm_r
|  sysadm_u        sysadm     s0         s0-s0:c0.c1023                 sysadm_r
|  system_u        user       s0         s0-s0:c0.c1023                 system_r
|  unconfined_u    unconfined s0         s0-s0:c0.c1023                 system_r unconfined_r
|  user_u          user       s0         s0                             user_r
`----

,----[ semanage login -l ]
|  __default__               user_u                    s0
|  root                      root                      s0-s0:c0.c1023
|  system_u                  system_u                  s0-s0:c0.c1023
`----

,----[ semodule -l ]
|  dhcp    1.6.0
|  dmidecode       1.3.0
|  gpg     1.6.0
|  mysql   1.8.0
|  netutils        1.6.0
|  ssh     1.10.1
|  sudo    1.3.0
|  tcpd    1.3.0
|  tzdata  1.2.0
`----

        manoj
--
Manoj Srivastava <manoj.srivastava at stdc.com> <srivasta at acm.org>
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



More information about the SELinux-devel mailing list