Lorenzo Marcantonio | 27 Mar 2012 16:07

Problem with sockets and ACL

I've just upgraded from 1.4.4 to 1.4.6 (using the 3.1.5 prepatched kernel)

Most of the things work, except an issue with sockets (both udevd and
dbus-daemon trigger it, other programs like syslog-ng, dont);

udevd says: error initializing udevd socket and logs in this way:

Tue Mar 27 15:57:13 2012 :<6>0000000513|rsbac_adf_request(): request BIND, pid 30317, ppid 28618,
prog_name udevd, prog_file /sbin/udevd, uid 0, audit uid 1000, target_type IPC, tid AnonUnix-ID 72455,
attr sock_type, value DGRAM, result NOT_GRANTED by ACL

dbus-daemon instead goes this way: Failed to start message bus: Failed to bind socket
"/tmp/dbus-4gAhH9BkiE": Operation not permitted

Tue Mar 27 15:58:23 2012 :<6>0000000514|rsbac_adf_request(): request BIND, pid 30557, ppid 30556,
prog_name dbus-daemon, prog_file /usr/stow/dbus-1.4.1/bin/dbus-daemon, uid 1000, target_type
IPC, tid AnonUnix-ID 66250, attr sock_type, value STREAM, result NOT_GRANTED by ACL

The strange thing is that I never touched IPC ACL and other socket based
applications work... even syslog-ng (which uses /dev/log)

A strace of udev gives:

socket(PF_FILE, SOCK_DGRAM, 0)          = 5
fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
fcntl64(5, F_GETFD)                     = 0
fcntl64(5, F_SETFD, FD_CLOEXEC)         = 0
capget(0x20080522, 0, NULL)             = 0
capget(0x20080522, 0, {CAP_SYS_ADMIN,
(Continue reading)

Picon

Re: Problem with sockets and ACL


I think it goes to a NETOBJ destination, not IPC.

On 27/03/12 16:07, Lorenzo Marcantonio wrote:
> I've just upgraded from 1.4.4 to 1.4.6 (using the 3.1.5 prepatched kernel)
> 
> Most of the things work, except an issue with sockets (both udevd and
> dbus-daemon trigger it, other programs like syslog-ng, dont);
> 
> udevd says: error initializing udevd socket and logs in this way:
> 
> Tue Mar 27 15:57:13 2012 :<6>0000000513|rsbac_adf_request(): request BIND, pid 30317, ppid 28618,
prog_name udevd, prog_file /sbin/udevd, uid 0, audit uid 1000, target_type IPC, tid AnonUnix-ID 72455,
attr sock_type, value DGRAM, result NOT_GRANTED by ACL
> 
> dbus-daemon instead goes this way: Failed to start message bus: Failed to bind socket
"/tmp/dbus-4gAhH9BkiE": Operation not permitted
> 
> Tue Mar 27 15:58:23 2012 :<6>0000000514|rsbac_adf_request(): request BIND, pid 30557, ppid 30556,
prog_name dbus-daemon, prog_file /usr/stow/dbus-1.4.1/bin/dbus-daemon, uid 1000, target_type
IPC, tid AnonUnix-ID 66250, attr sock_type, value STREAM, result NOT_GRANTED by ACL
> 
> The strange thing is that I never touched IPC ACL and other socket based
> applications work... even syslog-ng (which uses /dev/log)
> 
> A strace of udev gives:
> 
> socket(PF_FILE, SOCK_DGRAM, 0)          = 5
> fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
> fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
(Continue reading)

Picon

Re: Problem with sockets and ACL


I think it goes to a NETOBJ destination, not IPC.

On 27/03/12 16:07, Lorenzo Marcantonio wrote:
> I've just upgraded from 1.4.4 to 1.4.6 (using the 3.1.5 prepatched kernel)
> 
> Most of the things work, except an issue with sockets (both udevd and
> dbus-daemon trigger it, other programs like syslog-ng, dont);
> 
> udevd says: error initializing udevd socket and logs in this way:
> 
> Tue Mar 27 15:57:13 2012 :<6>0000000513|rsbac_adf_request(): request BIND, pid 30317, ppid 28618,
prog_name udevd, prog_file /sbin/udevd, uid 0, audit uid 1000, target_type IPC, tid AnonUnix-ID 72455,
attr sock_type, value DGRAM, result NOT_GRANTED by ACL
> 
> dbus-daemon instead goes this way: Failed to start message bus: Failed to bind socket
"/tmp/dbus-4gAhH9BkiE": Operation not permitted
> 
> Tue Mar 27 15:58:23 2012 :<6>0000000514|rsbac_adf_request(): request BIND, pid 30557, ppid 30556,
prog_name dbus-daemon, prog_file /usr/stow/dbus-1.4.1/bin/dbus-daemon, uid 1000, target_type
IPC, tid AnonUnix-ID 66250, attr sock_type, value STREAM, result NOT_GRANTED by ACL
> 
> The strange thing is that I never touched IPC ACL and other socket based
> applications work... even syslog-ng (which uses /dev/log)
> 
> A strace of udev gives:
> 
> socket(PF_FILE, SOCK_DGRAM, 0)          = 5
> fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
> fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
(Continue reading)

Picon

Re: Problem with sockets and ACL


I have just seen that bind(IPC) is controlled by READ_WRITE_OPEN, did
you grant this?

On 27/03/12 16:07, Lorenzo Marcantonio wrote:
> I've just upgraded from 1.4.4 to 1.4.6 (using the 3.1.5 prepatched kernel)
> 
> Most of the things work, except an issue with sockets (both udevd and
> dbus-daemon trigger it, other programs like syslog-ng, dont);
> 
> udevd says: error initializing udevd socket and logs in this way:
> 
> Tue Mar 27 15:57:13 2012 :<6>0000000513|rsbac_adf_request(): request BIND, pid 30317, ppid 28618,
prog_name udevd, prog_file /sbin/udevd, uid 0, audit uid 1000, target_type IPC, tid AnonUnix-ID 72455,
attr sock_type, value DGRAM, result NOT_GRANTED by ACL
> 
> dbus-daemon instead goes this way: Failed to start message bus: Failed to bind socket
"/tmp/dbus-4gAhH9BkiE": Operation not permitted
> 
> Tue Mar 27 15:58:23 2012 :<6>0000000514|rsbac_adf_request(): request BIND, pid 30557, ppid 30556,
prog_name dbus-daemon, prog_file /usr/stow/dbus-1.4.1/bin/dbus-daemon, uid 1000, target_type
IPC, tid AnonUnix-ID 66250, attr sock_type, value STREAM, result NOT_GRANTED by ACL
> 
> The strange thing is that I never touched IPC ACL and other socket based
> applications work... even syslog-ng (which uses /dev/log)
> 
> A strace of udev gives:
> 
> socket(PF_FILE, SOCK_DGRAM, 0)          = 5
> fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
(Continue reading)

Lorenzo Marcantonio | 27 Mar 2012 16:53

Re: Problem with sockets and ACL

On Tue, Mar 27, 2012 at 04:51:33PM +0200, Javier Juan Martínez Cabezón wrote:

> I have just seen that bind(IPC) is controlled by READ_WRITE_OPEN, did
> you grant this?

I *never* touched the default IPC or network lists, only FD and user
stuff... anyway I checked, the default is granted. And I don't get why
syslog-ng can open /dev/log while udev cannot open its socket...

--

-- 
Lorenzo Marcantonio
Logos Srl
_______________________________________________
rsbac mailing list
rsbac <at> rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac

Gmane