Tutorials

Writing a basic SELinux LPM

I couldn’t find a straight forward tutorial on how to create an LPM in SELinux. So, here goes. Notice that this is for educational purposes only and would only take you so far. You need to study the implications of LPMs and how SELinux works before you can actually use them.

Assumptions:

  1. You know what SELinux is.
  2. You know what types, attributes, macros etc are in SELinux.
  3. You have read about Loadable Policy Modules (LPMs) and want to use them.
  4. You don’t know how to write and compile/use an LPM.

Setup:

  1. Set SELinux to permissive. (Not enforcing. This isn’t a complete tutorial!)
  2. Get setools package (possibly from yum)
  3. Install selinux-policy-devel package (possibly from yum)

Operations: (su whenever you need to)

  1. Create a directory. I’m assuming /home/user/lpm
  2. cd into the directory and create a sample policy. (See below for policy where it will be explained). Let’s call it myapp.te
  3. Copy the LPM makefile from /usr/share/selinux/devel. (This comes with selinux-policy-devel)
  4. Run “make”  < compiles the .te file
  5. Run “semodule -i myapp.pp”< loads the LPM
  6. Run “cp /usr/bin/tail ./tt2” < copies the tail script here for testing purposes
  7. Run “touch myapplog.log” < create a dummy log file
  8. Run “chcon -t myapp_exec_t tt2” < Assign label to executable (see policy for description)
  9. Run “chcon -t myapp_log_t myapplog.log”  < Assign label to log file
  10. Run “seaudit”. Open log file “/var/log/messages” if you do not have auditd installed or “/var/log/audit/audit.log” if you do.
  11. Run “./tt2 myapplog.log” < Run the file.
  12. Take a look at the seaudit for auditting details. (See attached screenshots for details)
  13. Notice the denies. (tail requires many allows which we haven’t put in the LPM. You can continue to fix these to get rid of all the denies.)

The policy:

-----------------------|      myapp.te       |---------------------

policy_module(myapp,1.0.0)

# Adopted from /usr/share/selinux/devel/example.te

# Declarations

require{
type fs_t;
type unconfined_devpts_t;
}

type myapp_t;
type myapp_exec_t;
domain_type(myapp_t)
# myapp_t is a process (belongs to domain attribute)

domain_entry_file(myapp_t, myapp_exec_t)
# allow myapp_t to be transitioned to using myapp_exec_t

type myapp_log_t;
logging_log_file(myapp_log_t)

type myapp_tmp_t;
files_tmp_file(myapp_tmp_t)

domain_auto_trans(domain, myapp_exec_t, myapp_t)
# transition from 'domain' (any process) to myapp_t through myapp_exec_t executable

#
# Myapp local policy
#
allow myapp_exec_t fs_t:filesystem associate;

allow myapp_t unconfined_devpts_t : chr_file *;
# allow myapp_t access to the terminal

allow domain myapp_exec_t : file {execute read write} ;
# allow any process to run myapp_exec_t

auditallow myapp_t myapp_log_t:file ra_file_perms;
auditallow myapp_t myapp_log_t:file read;
# auditallow myapp_t to read myapp_log_t

allow myapp_t myapp_tmp_t:file manage_file_perms;
files_tmp_filetrans(myapp_t,myapp_tmp_t,file)

-----------------------------------------------------------

Screencaps:

  1. SETroubleshoot showing error message (denied access to terminal) [see here]
  2. SEAudit showing log with denies and grants [see here]

audit2allow:(updated)

If you want to generate allow rules automatically, use audit2allow:

audit2allow -i /var/log/audit/audit.log

This will show you the rules which need to be added to the .te file for the whole thing to work.

Advertisements
Announcements, Articles, Islam

“How should we react?”

[A Fatwa by Mufti Ibrahim Desai of South Africa]

Q: How should we react to the cartoon that has been made of the Prophet [sallallaahu alayhi wasallam]? What is the Sunnah way of acting in this situation?

A: The honour, greatness and love for Rasulullah [sallallaahu alayhi wasallam] is deeply entrenched in the heart of every Muslim and is the core of Islam. Rasulullah [sallallaahu alayhi wasallam] and every Prophet of Allah is Ma’soom (sinless). They are sent as guides for mankind and direct the people to the Oneness of Allah and His obedience. The Prophets of Allah possess the highest level of knowledge of Allah. They also possess the highest level of spirituality and sound character. Every Prophet of Allah condemned disrespect and violence. They condemned Kufr (disbelief) and Shirk (ascribing partners to Allah) in a dignified manner. In Islam, we revere every Prophet of Allah and we do not tolerate any disrespect to any Prophet of Allah. If a Muslim shows any disrespect to any Prophet of Allah and hurls disgraceful remarks against him, such a person comes out of the fold of Islam. In fact, according to many Fuqahaa, the apology of such a person will not be accepted. (Rasmul Mufti)

There are two angles in the printing and publishing of the cartoons of Rasulullah [sallallaahu alayhi wasallam], a) The image of Rasulullah [sallallaahu alayhi wasallam], and b) Disrespect

Rasulullah [sallallaahu alayhi wasallam] prohibited making pictures of animate objects. He even stated that the angels of mercy do not enter a house in which there are pictures of animate objects. (Bukhari). One of the reasons for the prohibition of making and taking pictures of animate objects is that it leads to idolatory. The desciples of Nooh (alayhimus salaam)were deeply revered and respected by their followers. After their demise, they made pictures of the desciples and placed them in their places of worship. Gradually over a period of time, the people started worshipping the disciples. Since the background of this was making pictures, and it has a potential of committing Shirk, Islam has prohibited anything that has to do with Shirk directly or indirectly. The Sahaaba [radhiallaahu anhu] should not take or draw pictures. There is no picture of Rasulullah [sallallaahu alayhi wasallam] or any Sahaabi [radhiallaahu anhu].

The second angle of the cartoon of Rasulullah [sallallaahu alayhi wasallam] is the utmost disrespect shown to Rasulullah in the name of ‘freedom of expression’. This has caused great pain and anger to every Muslim around the world. Every Muslim has a right to express his pain and anger. What else should Muslims do? Just feel the pain and keep quiet? This will lead to the enemies of Islam to continue such blasphemy. We cannot allow that. We do take cognisance of the fact that this act is carried out by just one or few individuals to stir up the anger of Muslims for whatever reason. It may not be appropriate for us to give in to the hands of our enemies and conduct ourselves as they want us to, but this issue does not fall in that category. We will have to stand up to such mischief and stop it.

Freedom of expression is not absolute. It has overarching principles. If freedom of expression is absolute, then freedom of religion in a democratic dispensation should also be absolute. Why does freedom of religion has overarching principles. Why are Muslims not allowed to fully practise on every aspect of Islam without any restriction whatsoever? The reason is obvious. The rights of others living as equal citizens must be considered. What then about freedom of expression and right of dignity and religious honour?

Nevertheless, Muslims living as Muslim minorities around the world should act in a responsible manner and the following is suggested:

  1. Consult with Ulama and responsible people before doing anything. Do not do anything by yourself. Shura and consultation is vital in such an issue.
  2. Express anger and disgust within the framework of the law of the country. Use the law of the country to its full capacity.
  3. Do not be violent in any way and do not burn buildings, cars, etc.
  4. Boycott all Danish products and products of anyone else who support Denmark in this issue or even sympathise with Denmark.
  5. Do not confine expression of anger to the cartoon issue. Use the opportunity to express the disgust on Islamophobia in general and highlight some pertinent issues.
  6. The most important in this is the issue of Da’awah. Use the opportunity to explain to the world the great personality of Rasulullah [sallallaahu alayhi wasallam]. His lifestyle and character should be printed and published all around the world. This will be an eye opener to many ignorant people and a means of guidance. Take out the positive aspects from a negative one and use the situation to our advantage. Every Muslim should say and write something about our beloved Rasul [sallallaahu alayhi wasallam].
  7. It is of utmost importance that we engage in lots of du’aa and Dhikr, Fasting and Sadaqaat. Make du’aa that Allah guide the Ummah in this trying times.
  8. Do not conduct ourselves with our fellow non-Muslim citizens in a way that offend them and look for an opportunity to get back at us. We will then be the cause of them showing disrespect to Islam and Islamic values. Always express good character and conduct to all.
  9. The most important issue in expressing our love and honour for Rasulullah [sallallaahu alayhi wasallam] is following his Sunnah. Expressing our anger at the disrespect to Rasulullah [sallallaahu alayhi wasallam] is important but it will be hypocritical if we do not emulate the outward appearance, beard, dressing, etc. and noble character of Rasulullah [sallallaahu alayhi wasallam]. Every one should obtain a kitaab on the Sunnats of Rasulullah [sallallaahu alayhi wasallam] and implement that in our lives and pass this over to others.
  10. Forward this email as wide as possible.

and Allah Ta’ala Knows Best
Mufti Ebrahim Desai

[Source: http://www.askimam.org/hadith/hadith.php?hid=22%5D