Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: lockdown class
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <2911391.mirxchbQ87@liv>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <4f69f374-3a67-55a2-3704-5cafd3719bf0@ieee.org>
Date:   Mon, 14 Dec 2020 10:13:25 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.5.0
MIME-Version: 1.0
In-Reply-To: <2911391.mirxchbQ87@liv>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12/11/20 2:01 AM, Russell Coker wrote:
> allow systemd_modules_load_t systemd_modules_load_t:lockdown integrity;
> allow udev_t udev_t:lockdown confidentiality;
> 
> I've seen access that caused the above to be generated from audit2allow.
> 
> /var/log/audit/audit.log.1:type=AVC msg=audit(1607515838.132:56): avc:  denied
> { confidentiality } for  pid=253 comm="systemd-udevd" lockdown_reason="use of
> tracefs" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tclass=lockdown permissive=1
> 
> Above is the only log entry I've got for that from my previous testing (I
> haven't been able to reproduce whatever it was that caused the
> systemd_modules_load_t to get that audited).
> 
> https://www.paul-moore.com/blog/d/2020/03/linux_v56.html
> 
> I've read the above blog post and I'm still not sure exactly how we are to use
> it.  Do I allow this for systemd_modules_load_t because loading modules is an
> integrity issue?  Do I allow it for udev_t because changing device names etc
> allows universal MITM attacks?

The SELinux check mirrors the lockdown LSM checks but the policy's granularity, 
instead of the single granularity (system-wide)that lockdown LSM has.

If you had the lockdown LSM running too and set to the integrity level, the 
systemd_modules_load_t would have been denied by lockdown instead of getting to 
SELinux's check.  The udev access to tracefs in would be allowed by the lockdown 
LSM and go to SELinux's check.

Effectively you could reimplement the lockdown LSM in SELinux like this:

bool lockdown_integrity false;
bool lockdown_confidentiality false;

if (!lockdown_integrity && !lockdown_confidentiality) {
	allow domain self:lockdown integrity;
}

if (!lockdown_confidentiality) {
	allow domain self:lockdown confidentiality;
}


-- 
Chris PeBenito