SELinux - Heise Workshop Juni 2024

Date: <2024-06-07 Fri> · enforcing

dnf install audit audispd-plugins

$EDITOR /etc/audit/auditd.conf

systemctl enable --now auditd
systemctl status auditd
journalctl -u auditd

pkill -HUP auditd

service auditd stop
service auditd start

autrace /bin/ping -c 4 8.8.8.8

ausearch -i -p <audit-id>

ausearch -i -p <audit-id> | grep type=SYSCALL | cut -f 6 -d ' ' | sort | uniq -c | sort -n

rm /etc/audit/rules.d/audit.rules

cp /usr/share/audit/sample-rules/10-base-config.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/11-loginuid.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/30-stig.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/32-power-abuse.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/42-injection.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/43-module-load.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/70-einval.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/71-networking.rules /etc/audit/rules.d/
cp /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/

cd /etc/audit/rules.d/
find /bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' > 31-privileged.rules
find /sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> 31-privileged.rules
find /usr/bin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> 31-privileged.rules
find /usr/sbin -type f -perm -04000 2>/dev/null | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $1 }' >> 31-privileged.rules
filecap /bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> 31-privileged.rules
filecap /sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> 31-privileged.rules
filecap /usr/bin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> 31-privileged.rules
filecap /usr/sbin 2>/dev/null | sed '1d' | awk '{ printf "-a always,exit -F path=%s -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged\n", $2 }' >> 31-privileged.rules

less /etc/audit/audit.rules

augenrules --check

augenrules --load

less /etc/audit/audit.rules

auditctl -l

# auditctl -s
enabled 2
failure 1
pid 12901
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
backlog_wait_time 0
loginuid_immutable 0 unlocked

ausearch -i -x sudo

ausearch -m USER_AUTH,USER_ACCT --success no

ausearch -ua 1000 -i

ausearch --start yesterday --end now -m SYSCALL -sv no -i

[...]
# Systemd Konfiguration
-w /etc/systemd/journald.conf -p wa -k systemd
-w /etc/systemd/logind.conf -p wa -k systemd
-w /etc/systemd/networkd.conf -p wa -k systemd
-w /etc/systemd/resolved.conf -p wa -k systemd
-w /etc/systemd/sleep.conf -p wa -k systemd
-w /etc/systemd/system.conf -p wa -k systemd
-w /etc/systemd/timesyncd.conf -p wa -k systemd
-w /etc/systemd/user.conf -p wa -k systemd
[...]

ausearch -i -k systemd

dnf install policycoreutils setools libselinux-utils selinux-policy-doc setools-console
dnf install policycoreutils-python3 selinux-policy-devel policycoreutils-newrole

ls -lZ <pfad>

# ls -lZ /etc | grep system_conf_t
-rw-r--r--.  1 root root   system_u:object_r:system_conf_t:s0           449 Jan 23 20:06 sysctl.conf
drwxr-xr-x.  2 root root   system_u:object_r:system_conf_t:s0           124 Dec 13 06:15 yum.repos.d

[root@selinux016 user]# touch /home/user/test
[root@selinux016 user]# ls -lZ /home/user/test
-rw-r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Jan 31 07:39 /home/user/test

ls -lZ /usr/sbin/ | cut -f 3 -d ':' | sort | uniq -c | sort -n

ps -auxZ

ps -efZ | cut -d ':' -f 3 | sort | uniq | wc -l

# id -Z

sestatus

sestatus -v

getenforce

semodule -l | less

ls -lh /etc/selinux/targeted/policy/

# avcstat
   lookups       hits        misses     allocs   reclaims      frees
   797921406     797847473   73933      73933    71040         73429

setenforce 1

dnf install httpd
systemctl enable --now httpd

$EDITOR /var/www/html/index.html

<html>
<body>
<h1>Apache Webserver</h1>
</body>
</html>

ls -lZ /var/www/html/index.html

# firewall-cmd --zone=public --add-service=http --permanent
# firewall-cmd --reload

rm /var/www/html/index.html
$EDITOR /root/index.html
mv /root/index.html /var/www/html/index.html
ls -lZ /var/www/html/index.html

ausearch -m avc -ts recent -c httpd -i

matchpathcon -V /var/www/html/index.html

sesearch --allow --source httpd_t --target httpd_sys_content_t --class file

chcon --type httpd_sys_content_t /var/www/html/index.html

restorecon -v /var/www/html/index.html

# dnf install bind

# systemctl enable --now named

% mkdir -p /srv/bind/zones/primary

$ttl 3600
@      IN SOA selinuxNNN.linux-sicherheit.org.  .  1001  2h 1h 40d 1h
       IN NS  selinuxNNN.linux-sicherheit.org.
       IN A   1.2.3.4

zone "example.net" {
  type master;
  file "/srv/bind/zones/primary/example.net";
};

% named-checkconf -z
% rndc reload
% rndc zonestatus example.net

% journalctl -eu named
% ausearch -m avc -x /usr/sbin/named -i

sesearch --allow --source named_t --class file

% semanage fcontext -a -t named_zone_t --ftype f "/srv/bind/zones(/.*)?"
% semanage fcontext -a -t named_zone_t --ftype d "/srv/bind/zones(/.*)?"

% restorecon -rv /srv/bind/zones/
Relabeled /srv/bind/zones from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:named_zone_t:s0
Relabeled /srv/bind/zones/primary from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:named_zone_t:s0
Relabeled /srv/bind/zones/primary/example.net from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:named_zone_t:s0

systemctl restart named

rndc zonestatus example.net

# dnf install bind

# systemctl enable --now named

statistics-channels {
      inet * port 8053 allow { any; };
};

# named-checkconf
# systemctl restart named

# journalctl -u named
[...]
Oct 17 18:08:45 selinux22 named[34204]: /etc/named.conf:11: couldn't allocate statistics channel 0.0.0.0#8053: permission denied

 # ausearch -m avc -ts recent  -i
----
type=PROCTITLE msg=audit(09/17/2021 04:06:05.836:2278) : proctitle=/usr/sbin/named -u named -c /etc/nam
type=SYSCALL msg=audit(09/17/2021 04:06:05.836:2278) : arch=x86_64 syscall=bind success=no
    exit=EACCES(Permission denied) a0=0x15 a1=0x7f5183d24660 a2=0x10 a3=0x7f5183d244fc
    items=0 ppid=111613 pid=111615 auid=unset uid=named gid=named euid=named suid=named
    fsuid=named egid=named sgid=named fsgid=named tty=(none) ses=unset
    comm=isc-worker0000 exe=/usr/sbin/named subj=system_u:system_r:named_t:s0 key=(null)
type=AVC msg=audit(09/17/2021 04:06:05.836:2278) : avc:  denied  { name_bind } for  pid=111615
    comm=isc-worker0000 src=8053 scontext=system_u:system_r:named_t:s0
    tcontext=system_u:object_r:unreserved_port_t:s0
    tclass=tcp_socket permissive=0

# sesearch --allow --source named_t --class tcp_socket

# setsebool named_tcp_bind_http_port=on

# semanage port -l | grep http_port_t
http_port_t tcp     80, 81, 443, 488, 8008, 8009, 8443, 9000

statistics-channels {
  inet * port 8008 allow { any; };
};

# semanage port -a -t http_port_t -p tcp 8053
# semanage port -l | grep http_port_t
http_port_t                    tcp  8053, 80, 81, 443, 488, 8008, 8009, 8443, 9000

systemctl restart named

$ttl 3600
@      IN SOA selinuxNNN.linux-sicherheit.org.  .  1001  2h 1h 40d 1h
       IN NS  selinuxNNN.linux-sicherheit.org.
       IN A   1.2.3.4

% ls -Z /var/named/example.org
unconfined_u:object_r:named_zone_t:s0 /var/named/example.org

zone "example.org" {
     type master;
     file "example.org";
};

% named-checkconf -z
% rndc reconfig
% rndc zonestatus example.org

zone "example.org" {
     type master;
     file "example.org";
     update-policy local;
     };

% nsupdate -l
> ttl 3600
> add example.org in aaaa 2001:db8::1
> send
> quit

# rndc sync

% journalctl -eu named

% ausearch -m avc -x /usr/sbin/named -i

% mv example.org dynamic/
% chown named: dynamic/example.org
% restorecon -vr dynamic/
Relabeled /var/named/dynamic/example.org from unconfined_u:object_r:named_zone_t:s0 to unconfined_u:object_r:named_cache_t:s0

zone "example.org" {
     type master;
     file "dynamic/example.org";
     update-policy local;
     };

% setsebool named_write_master_zones=on

# dnf install httpd
# systemctl enable --now httpd
# systemctl status httpd

ausearch -i -m avc -c httpd

semanage port -l | grep http_port_t

# firewall-cmd --zone=public --add-port=1235/tcp --permanent
# firewall-cmd --reload

curl  http://selinuxNNN.linux-sicherheit.org:1235/

$EDITOR /etc/httpd/conf/httpd.conf

ausearch -m avc -c httpd -ts recent -i

semanage port -a -t http_port_t -p tcp 1235

semanage port -l | grep http_port_t

systemctl restart httpd

firewall-cmd --zone=public  --add-port=1235/tcp --permanent
firewall-cmd --reload

# This file is auto-generated by libsemanage
# Do not edit directly.

portcon tcp 1235 system_u:object_r:http_port_t:s0

# semanage login -l

# semanage user -l

semanage login -a -s user_u user

# cat /etc/selinux/targeted/seusers

$EDITOR /home/user/hello.sh
chmod +x /home/user/hello.sh

#!/bin/sh
echo "Hallo!"

# /home/cas/hello.sh
Hallo!

semanage login -m -s guest_u user
getsebool allow_guest_exec_content
setsebool allow_guest_exec_content off

ausearch -m avc -ts recent

# /bin/bash /home/cas/hello.sh
Hello!

# . ./hello.sh
# source ./hello.sh

systemctl stop firewalld
systemctl stop httpd

dnf install gcc

dnf install policycoreutils-python3 selinux-policy-devel

ls -l /usr/share/selinux/devel/
ls -l /usr/share/selinux/devel/include/contrib/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <err.h>

char response[] = "HTTP/1.1 200 OK\r\n"
"Content-Type: text/html; charset=UTF-8\r\n\r\n"
"<!DOCTYPE html><html><head><title>Bye-bye baby bye-bye</title>"
"<style>body { background-color: #111 }"
"h1 { font-size:4cm; text-align: center; color: black;"
" text-shadow: 0 0 2mm red}</style></head>"
  "<body><h1>Goodbye, world!</h1></body></html>\r\n";

int main()
{
  int one = 1, client_fd;
  struct sockaddr_in svr_addr, cli_addr;
  socklen_t sin_len = sizeof(cli_addr);

  int sock = socket(AF_INET, SOCK_STREAM, 0);
  if (sock < 0)
    err(1, "can't open socket");

  setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(int));
  int port = 8080;
  svr_addr.sin_family = AF_INET;
  svr_addr.sin_addr.s_addr = INADDR_ANY;
  svr_addr.sin_port = htons(port);

  if (bind(sock, (struct sockaddr *) &svr_addr, sizeof(svr_addr)) == -1) {
    close(sock);
    err(1, "Can't bind");
  }

  listen(sock, 5);
  while (1) {
    client_fd = accept(sock, (struct sockaddr *) &cli_addr, &sin_len);
    printf("got connection\n");

    if (client_fd == -1) {
      perror("Can't accept");
      continue;
    }

    write(client_fd, response, sizeof(response) - 1); /*-1:'\0'*/
    close(client_fd);
  }
}


mkdir ~/src
cd ~/src
$EDITOR simple-server1.c

gcc -o simple-server simple-server1.c

cp simple-server /usr/local/bin

simple-server &

ps -eZ | grep simple
ls -lZ /usr/local/bin/simple-server

mkdir ~/selinux-src
cd ~/selinux-src

sepolicy generate -n simple-server --init /usr/local/bin/simple-server

less simple-server.te
less simple-server.fc
less simple-server.if

dnf -y install rpm-build
sh simple-server.sh
ls -l

semodule -i simple-server.pp

pkill simple-server

$EDITOR /etc/systemd/system/simple-server.service

[Unit]
Description=a simple http server
After=syslog.target network.target

[Service]
ExecStart=/usr/local/bin/simple-server

[Install]
WantedBy=multi-user.target

restorecon -R -v /etc/systemd/system/simple-server.service

systemctl daemon-reload
systemctl start simple-server
systemctl enable simple-server
systemctl status simple-server

ausearch -m avc -ts recent -c simple-server

journalctl | grep setroubleshoot

ausearch -m avc -ts today -c simple-server | audit2why  | less

sepolgen-ifgen -v
ausearch -m avc -ts today -c simple-server | audit2allow -R
require {
        type simple-server_t;
        class tcp_socket { bind create setopt accept listen };
}

#============= simple-server_t ==============
allow simple-server_t self:tcp_socket { bind create setopt accept listen };
corenet_tcp_bind_generic_node(simple-server_t)
corenet_tcp_bind_http_cache_port(simple-server_t)

semodule -r simple-server
sh ./simple-server.sh
semodule -i simple-server.pp
systemctl restart simple-server

ausearch -m avc -ts recent -c httpd -i
<no matches>

# semodule -DB

# semodule -B

--- simple-server1.c    2022-10-25 09:22:06.684216579 +0000
+++ simple-server2.c    2022-10-26 08:53:33.319698944 +0000
@@ -19,6 +19,13 @@
  int main()
  {
    int one = 1, client_fd;
+   FILE *f = fopen("/var/log/simple-server.log", "a");
+   if (f == NULL)
+   {
+       printf("Error opening file!\n");
+       exit(1);
+   }
+
    struct sockaddr_in svr_addr, cli_addr;
    socklen_t sin_len = sizeof(cli_addr);

@@ -40,7 +47,8 @@
    listen(sock, 5);
    while (1) {
      client_fd = accept(sock, (struct sockaddr *) &cli_addr, &sin_len);
-     printf("got connection\n");
+     fputs("got connection\n",f);
+     fflush(f);

      if (client_fd == -1) {
        perror("Can't accept");

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <err.h>

char response[] = "HTTP/1.1 200 OK\r\n"
"Content-Type: text/html; charset=UTF-8\r\n\r\n"
"<!DOCTYPE html><html><head><title>Bye-bye baby bye-bye</title>"
"<style>body { background-color: #111 }"
"h1 { font-size:4cm; text-align: center; color: black;"
" text-shadow: 0 0 2mm red}</style></head>"
  "<body><h1>Goodbye, world!</h1></body></html>\r\n";

int main()
{
  int one = 1, client_fd;
  FILE *f = fopen("/var/log/simple-server.log", "a");
  if (f == NULL)
  {
      printf("Error opening file!\n");
      exit(1);
  }

  struct sockaddr_in svr_addr, cli_addr;
  socklen_t sin_len = sizeof(cli_addr);

  int sock = socket(AF_INET, SOCK_STREAM, 0);
  if (sock < 0)
    err(1, "can't open socket");

  setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(int));
  int port = 8080;
  svr_addr.sin_family = AF_INET;
  svr_addr.sin_addr.s_addr = INADDR_ANY;
  svr_addr.sin_port = htons(port);

  if (bind(sock, (struct sockaddr *) &svr_addr, sizeof(svr_addr)) == -1) {
    close(sock);
    err(1, "Can't bind");
  }

  listen(sock, 5);
  while (1) {
    client_fd = accept(sock, (struct sockaddr *) &cli_addr, &sin_len);
    fprintf(f,"got connection\n");
    fflush(f);

    if (client_fd == -1) {
      perror("Can't accept");
      continue;
    }

    write(client_fd, response, sizeof(response) - 1); /*-1:'\0'*/
    close(client_fd);
  }
}

/var/log/simple-server.log       --             gen_context(system_u:object_r:var_log_t,s0)

gcc -o simple-server simple-server2.c
systemctl stop simple-server
cp simple-server /usr/local/bin
restorecon -R -v /usr/local/bin/simple-server
systemctl start simple-server

# ausearch -m avc -ts recent -c simple-server
----
time->Wed Aug 24 21:17:34 2016
type=SYSCALL msg=audit(1472073454.717:1390): arch=c000003e syscall=2 success=yes exit=3 a0=400ae2 a1=441 a2=1b6 a3=21000 items=0 ppid=1 pid=7869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="simple-server" exe="/usr/local/bin/simple-server" subj=system_u:system_r:simple-server_t:s0 key=(null)
type=AVC msg=audit(1472073454.717:1390): avc:  denied  { open } for  pid=7869 comm="simple-server" path="/var/log/simple-server.log" dev="vda1" ino=268256 scontext=system_u:system_r:simple-server_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
type=AVC msg=audit(1472073454.717:1390): avc:  denied  { create } for  pid=7869 comm="simple-server" name="simple-server.log" scontext=system_u:system_r:simple-server_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
type=AVC msg=audit(1472073454.717:1390): avc:  denied  { add_name } for  pid=7869 comm="simple-server" name="simple-server.log" scontext=system_u:system_r:simple-server_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir
type=AVC msg=audit(1472073454.717:1390): avc:  denied  { write } for  pid=7869 comm="simple-server" name="log" dev="vda1" ino=258603 scontext=system_u:system_r:simple-server_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir

 # ausearch -m avc -ts recent -c simple-server | audit2allow -R


require {
        type simple-server_t;
}

#============= simple-server_t ==============
auth_log_filetrans_login_records(simple-server_t)
logging_manage_generic_logs(simple-server_t)

require {
        type simple-server_t;
        type var_log_t;
        class tcp_socket { bind create setopt accept listen shutdown write };
        class file { create open write };
        class dir { write add_name };
}

allow simple-server_t var_log_t:file { create open write };
allow simple-server_t var_log_t:dir { write add_name };

logging_rw_generic_log_dirs(simple-server_t)

policy_module(simple-server, 1.1.0)

########################################
#
# Declarations
#

type simple-server_t;
type simple-server_exec_t;
init_daemon_domain(simple-server_t, simple-server_exec_t)

require {
        type simple-server_t;
        type var_log_t;
        class tcp_socket { accept bind create listen setopt shutdown write };
        class file { create open write };
        class dir { write add_name };
}

#permissive simple-server_t;

########################################
#
# simple-server local policy
#
allow simple-server_t self:fifo_file rw_fifo_file_perms;
allow simple-server_t self:unix_stream_socket create_stream_socket_perms;

allow simple-server_t self:tcp_socket { accept bind create listen setopt shutdown write };
allow simple-server_t var_log_t:file { create open write };
allow simple-server_t var_log_t:dir { create write add_name };

corenet_tcp_bind_generic_node(simple-server_t)
corenet_tcp_bind_http_cache_port(simple-server_t)
domain_use_interactive_fds(simple-server_t)

files_read_etc_files(simple-server_t)

miscfiles_read_localization(simple-server_t)
logging_manage_generic_logs(simple-server_t)
logging_rw_generic_log_dirs(simple-server_t)

# nm /usr/local/bin/simple-server | grep @GLIBC
                U accept@GLIBC_2.2.5
                U bind@GLIBC_2.2.5
                U close@GLIBC_2.2.5
                U err@GLIBC_2.2.5
                U htons@GLIBC_2.2.5
                U __libc_start_main@GLIBC_2.34
                U listen@GLIBC_2.2.5
                U perror@GLIBC_2.2.5
                U puts@GLIBC_2.2.5
                U setsockopt@GLIBC_2.2.5
                U socket@GLIBC_2.2.5
                U write@GLIBC_2.2.5

tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_ports = 1024-65535
tcp_client_max_idle = 0

  # dnf install lsof
  # lsof -Poni :60
COMMAND   PID USER   FD   TYPE DEVICE OFFSET NODE NAME
auditd  60599 root   12u  IPv6 417339    0t0  TCP *:60 (LISTEN)

# dnf install audispd-plugins

# This file controls the audispd data path to the
# remote event logger. This plugin will send events to
# a remote machine (Central Logger).

active = yes
direction = out
path = /sbin/audisp-remote
type = always
#args =
format = string

#
# This file controls the configuration of the audit remote
# logging subsystem, audisp-remote.
#

remote_server =
port = 60
##local_port =
transport = tcp
queue_file = /var/spool/audit/remote.log
mode = immediate
queue_depth = 10240
format = managed
network_retry_time = 1
max_tries_per_record = 3
max_time_per_record = 5
heartbeat_timeout = 0

network_failure_action = stop
disk_low_action = ignore
disk_full_action = warn_once
disk_error_action = warn_once
remote_ending_action = reconnect
generic_error_action = syslog
generic_warning_action = syslog
queue_error_action = stop
overflow_action = syslog
startup_failure_action = warn_once_continue

##krb5_principal =
##krb5_client_name = auditd
##krb5_key_file = /etc/audisp/audisp-remote.key


# tcpdump -d port 53 and host 1.1.1.1
Warning: assuming Ethernet
(000) ldh      [12]
(001) jeq      #0x86dd          jt 19   jf 2
(002) jeq      #0x800           jt 3    jf 19
(003) ldb      [23]
(004) jeq      #0x84            jt 7    jf 5
(005) jeq      #0x6             jt 7    jf 6
(006) jeq      #0x11            jt 7    jf 19
(007) ldh      [20]
(008) jset     #0x1fff          jt 19   jf 9
(009) ldxb     4*([14]&0xf)
(010) ldh      [x + 14]
(011) jeq      #0x35            jt 14   jf 12
(012) ldh      [x + 16]
(013) jeq      #0x35            jt 14   jf 19
(014) ld       [26]
(015) jeq      #0x1010101       jt 18   jf 16
(016) ld       [30]
(017) jeq      #0x1010101       jt 18   jf 19
(018) ret      #262144
(019) ret      #0

# syscount-bpfcc -p `pgrep named` -i 10
Tracing syscalls, printing top 10... Ctrl+C to quit.
[07:34:19]
SYSCALL                   COUNT
futex                       547
getpid                      121
sendto                      113
read                         56
write                        31
epoll_wait                   31
openat                       23
close                        20
epoll_ctl                    20
recvmsg                      20

# capable-bpfcc | grep named
07:36:17  0      29378  (named)          24   CAP_SYS_RESOURCE     1
07:36:17  0      29378  (named)          24   CAP_SYS_RESOURCE     1
07:36:17  0      29378  (named)          12   CAP_NET_ADMIN        1
07:36:17  0      29378  (named)          21   CAP_SYS_ADMIN        1
07:36:17  0      29378  named            6    CAP_SETGID           1
07:36:17  0      29378  named            6    CAP_SETGID           1
07:36:17  0      29378  named            7    CAP_SETUID           1
07:36:17  109    29378  named            24   CAP_SYS_RESOURCE     1

# gethostlatency-bpfcc
TIME      PID    COMM                  LATms HOST
10:21:58  19183  ping                 143.22 example.org
10:22:18  19184  ssh                    0.03 host.example.de
10:22:18  19184  ssh                   60.59 host.example.de
10:22:35  19185  ping                  23.44 isc.org
10:22:49  19186  ping                4459.72 yahoo.co.kr

% dnf install bpftool

% bpftool prog list
306: cgroup_device  tag ca8e50a3c7fb034b  gpl
        loaded_at 2023-02-09T21:16:16+0000  uid 0
        xlated 496B  jited 307B  memlock 4096B
        pids systemd(1)
307: cgroup_skb  tag 6deef7357e7b4530  gpl
        loaded_at 2023-02-09T21:16:16+0000  uid 0
        xlated 64B  jited 54B  memlock 4096B
        pids systemd(1)
308: cgroup_skb  tag 6deef7357e7b4530  gpl
        loaded_at 2023-02-09T21:16:16+0000  uid 0
[...]

% sysctl kernel.bpf_stats_enabled
kernel.bpf_stats_enabled = 0

% sysctl -w kernel.bpf_stats_enabled=1

% # bpftool prog dump xlated id 317
   0: (bf) r6 = r1
   1: (69) r7 = *(u16 *)(r6 +176)
   2: (b4) w8 = 0
   3: (44) w8 |= 2
   4: (b7) r0 = 1
   5: (55) if r8 != 0x2 goto pc+1
   6: (b7) r0 = 0
   7: (95) exit

% bpftool prog dump jited tag tag 6deef7357e7b4530
317: cgroup_skb  tag 6deef7357e7b4530  gpl                                                                                                      [6/723]
0xffffffffc0af90d0:
   0:   nopl   0x0(%rax,%rax,1)
   5:   xchg   %ax,%ax
   7:   push   %rbp
   8:   mov    %rsp,%rbp
   b:   push   %rbx
   c:   push   %r13
   e:   push   %r14
  10:   mov    %rdi,%rbx
  13:   movzwq 0xb0(%rbx),%r13
[...]

% dnf install bind
% systemctl enable --now named

% dnf install bpftrace

% echo "nameserver 127.0.0.1" > /etc/resolv.conf

% bpftrace -e "k:udp*_sendmsg,k:udp*_recvmsg { @[func, pid, comm] = count(); }"

% bpftrace -e "kr:udp_recvmsg /pid == $(pgrep named)/ { @recv_bytes = hist(retval); }"

% bpftrace -e "kprobe:udp_sendmsg /pid == $(pgrep named)/ { @size = hist(arg2); }"

% bpftrace -e 'uprobe:named:named_server_status { print("rndc status executed") }'

% bpftrace -e "uprobe:/usr/sbin/named:named_server_flushcache / pid == $(pgrep named) /{ @start[tid] = nsecs; }
    uretprobe:/usr/sbin/named:named_server_flushcache /@start[tid]/ { print(nsecs - @start[tid]); delete(@start[tid]); }"

% bpftrace -e 'uprobe:/usr/lib64/libdns-9.16.23-RH.so:dns_cache* { print(func) }'

zone "isc.org" {
  type forward;
  forwarders { 9.9.9.9; };
};

dnf install bpftrace

#!/usr/bin/bpftrace

struct dns_name {
        unsigned int   magic;
        unsigned char *ndata;
        unsigned int   length;
        unsigned int   labels;
        unsigned int   attributes;
        unsigned char *offsets;
//      isc_buffer_t  *buffer;
//      ISC_LINK(dns_name_t) link;
//      ISC_LIST(dns_rdataset_t) list;
};

BEGIN
{
  print("Waiting for forward decision...\n");
}
uprobe:/usr/lib64/libdns-9.16.23-RH.so:dns_fwdtable_find
{
  @dns_name[tid] = ((struct dns_name *)arg1)->ndata
}

uretprobe:/usr/lib64/libdns-9.16.23-RH.so:dns_fwdtable_find
{
 if (retval == 0) {
    printf("Forwarded domain name: %s\n", str(@dns_name[tid]));
 }
 delete(@dns_name[tid]);
}

% chmod +x forward-trace.bt

% ./forward-trace.bt

% dig @localhost isc.org

bpftool prog list | tail
        xlated 64B  jited 54B  memlock 4096B
        pids systemd(1)
383: kprobe  name uretprobe__dns_  tag 30ca488d1d146cd7  gpl run_time_ns 297757 run_cnt 115
        loaded_at 2023-02-09T21:46:24+0000  uid 0
        xlated 536B  jited 314B  memlock 4096B  map_ids 25,26
        pids forward-trace.b(34273)
384: kprobe  name uprobe__dns_fwd  tag c30da15c9fd45317  gpl run_time_ns 116583 run_cnt 115
        loaded_at 2023-02-09T21:46:24+0000  uid 0
        xlated 176B  jited 105B  memlock 4096B  map_ids 25
        pids forward-trace.b(34273)

% dnf install kernel-headers-$(uname -r)

#define KBUILD_MODNAME "filter"
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/udp.h>

int udpfilter(struct xdp_md *ctx) {
  bpf_trace_printk("got a packet\n");
  void *data = (void *)(long)ctx->data;
  void *data_end = (void *)(long)ctx->data_end;
  struct ethhdr *eth = data;
  if ((void*)eth + sizeof(*eth) <= data_end) {
    struct iphdr *ip = data + sizeof(*eth);
    if ((void*)ip + sizeof(*ip) <= data_end) {
      if (ip->protocol == IPPROTO_UDP) {
        struct udphdr *udp = (void*)ip + sizeof(*ip);
        if ((void*)udp + sizeof(*udp) <= data_end) {
          if ((udp->dest != ntohs(53)) && (udp->source != ntohs(53))) {
            if (udp->dest != udp->source) {
              bpf_trace_printk("drop udp src/dest port %d/%d\n", ntohs(udp->source), ntohs(udp->dest));
              return XDP_DROP;
            }
          }
        }
      }
    }
  }
  return XDP_PASS;
}

#!/usr/bin/env python3

from bcc import BPF
import time

device = "lo"
b = BPF(src_file="drop-non-dns-udp.c")
fn = b.load_func("udpfilter", BPF.XDP)
b.attach_xdp(device, fn, 0)

try:
  b.trace_print()
except KeyboardInterrupt:
  pass

b.remove_xdp(device, 0)

% chmod +x drop-non-dns-udp.py

% ./drop-non-dns-udp.py

% dig @localhost isc.org

% dig -p 5353 @localhost isc.org


Benutzernummer	SSH-Zugriff	Web-Zugriff
001	selinux001.linux-sicherheit.org	https://selinux001.linux-sicherheit.org
002	selinux002.linux-sicherheit.org	https://selinux002.linux-sicherheit.org
003	selinux003.linux-sicherheit.org	https://selinux003.linux-sicherheit.org
004	selinux004.linux-sicherheit.org	https://selinux004.linux-sicherheit.org
005	selinux005.linux-sicherheit.org	https://selinux005.linux-sicherheit.org
006	selinux006.linux-sicherheit.org	https://selinux006.linux-sicherheit.org
007	selinux007.linux-sicherheit.org	https://selinux007.linux-sicherheit.org
008	selinux008.linux-sicherheit.org	https://selinux008.linux-sicherheit.org
009	selinux009.linux-sicherheit.org	https://selinux009.linux-sicherheit.org
010	selinux010.linux-sicherheit.org	https://selinux010.linux-sicherheit.org
011	selinux011.linux-sicherheit.org	https://selinux011.linux-sicherheit.org
012	selinux012.linux-sicherheit.org	https://selinux012.linux-sicherheit.org
013	selinux013.linux-sicherheit.org	https://selinux013.linux-sicherheit.org

SELinux - Heise Workshop Juni 2024

1 Agenda und Folien

1.1 SELinux Workshop Agenda

1.1.1 Tag 1

1.1.2 Tag 2

2 Allgemeine Informationen

3 Hostnamen, Benutzer und Passwörter

4 Linux Security Modules und SELinux

5 Audit Subsystem

5.1 Audit Log-Daemon Installation

5.2 Konfiguration

5.3 Ad-Hoc Trace von Programmen

5.4 Richtlinien-Dateien

5.5 Beispiele für Audit-Abfragen

5.6 Aufgabe:

5.7 Beispiel-Lösung

6 SELinux

6.1 SELinux erkunden

6.1.1 SELinux Label auf Dateien

6.1.2 SELinux Label auf Prozessen

6.1.3 SELinux Label auf dem aktuellen Benutzer anzeigen

6.1.4 SELinux Status abfragen

6.2 SELinux Policy Konfiguration anpassen

6.3 SELinux Funktions-Beispiel

6.3.1 Ein SELinux-Problem für den Apache Webserver erzeugen

6.3.2 Das SELinux Problem mit dem Apache Webserver lösen

6.4 Aufgabe: BIND 9 Zonendatei in ungewöhnlichem Verzeichnis

6.4.1 Lösung

6.5 SELinux Richtlinien über Schalter konfigurieren am Beispiel BIND 9

6.5.1 Setzen des Boolean, um BIND 9 den Zugriff auf die http-Ports zu erlauben

6.6 Aufgabe: Eine dynamische DNS Zone

6.6.1 Lösung 1

6.6.2 Lösung 2

6.7 Aufgabe: Apache auf einem anderen Port als 80 oder 443

6.8 SELinux und Benutzer

6.8.1 SELinux Benutzer zuweisen

6.9 SELinux - Policy Development

6.9.1 SELinux Policy erstellen

6.9.2 Ein einfacher Web-Server

6.9.3 Initiales SELinux Policy Modul

6.9.4 Die "DoNotAudit" Regeln ausschalten

6.10 Eine Änderung an einer SELinux Policy

6.10.1 Lösung - Finale Policy-Datei für "simple-server"

6.11 Hilfsmittel zur Erstellung von SELinux-Policy Regelwerken

7 Netzwerk-Logging im Audit-Daemon

8 SELinux Ressources

8.1 Audit Subsystem

8.2 SELinux

8.3 Books

9 eBPF (Bonus Inhalt)

9.1 Was ist eBPF, XDP und BCC?

9.2 Die eBPF Idee

9.3 eBPF

9.4 eBPF Einsatzgebiete

9.5 eBPF Verfügbarkeit

9.6 Die Wurzeln von BPF

9.7 BPF am Beispiel von tcpdump

9.8 BPF am Beispiel von tcpdump

9.9 eBPF vs. BPF

9.10 eBPF und der Linux Kernel

9.11 Die eBPF Architektur

9.11.1 Die eBPF virtuelle Maschine

9.11.2 XDP - Express Data Path

9.11.3 XDP / eBPF Hardware Offloading

9.11.4 XDP / eBPF Ausführungs-Ebenen

9.11.5 XDP Funktionen

9.11.6 XDP vs DDoS Angriffe

9.12 eBPF "Real-World" Anwendungen

9.12.1 eBPF/XDP Support in DNS Software

9.12.2 eBPF Programme zur Analyse des Laufzeitverhalten von Linux-Systemen

9.12.3 Beispiel: eBPF Syscall Auswertung

9.12.4 Beispiel: eBPF Prozess Capabilities

9.12.5 Beispiel: gethostlatency

9.12.6 Sicherheitsanwendungen

9.12.7 Sicherheitsanwendungen

9.12.8 Sicherheitsanwendungen: Tetragon

9.12.9 Sicherheitsanwendungen: Falco

9.12.10 Sicherheitsanwendungen: tracee

9.13 Quis custodiet ipsos custodes?

9.13.1 Backdoors

9.14.2 KPROBE_OVERRIDE im Kernel

9.17.1 Discover eBPF programs with `bpftool`