Helsinki Security Meetup: SElinux presentation
Wednesday, August 20. 2014
Comments
Display comments as
(Linear | Threaded)
Add Comment
As promised, here are my presentation slides from Helsinki Security Meetup from August 20th 2014. I did redact my e-mail address to prevent spammers harvesting it. I get enough spam already.
In PDF-format: 2014HelsinkiSecurityMeetup.pdf
Here it is: backdoor.c
There is no makefile or anything, a simple gcc backdoor.c -o backdoor will do the trick.
In my demo, there was the insecure directory (run ls -Z to display the file contexts):
-rwxr-xr-x. root root unconfined_u:object_r:httpd_exec_t:s0 backdoor
-rwxr--r--. root root unconfined_u:object_r:admin_home_t:s0 start.backdoor-1.sh
-rwxr--r--. root root unconfined_u:object_r:initrc_exec_t:s0 start.backdoor-2.sh
and one secured directory:
-rwxr-xr-x. root root unconfined_u:object_r:backdoor_exec_t:s0 backdoor.secure
-rwxr--r--. root root unconfined_u:object_r:initrc_exec_t:s0 start.backdoor-3.sh
When running as httpd_t, remember to add the port into Apache allowed ports:
semanage port --add -t http_port_t -p tcp 8282
To (temporarily) change a file context, run a command like:
chcon -t backdoor_t backdoor
To permanantly change the file context,:
semanage fcontext -a -t backdoor_t /a_directory/backdoor
Now, the change will survive a restorecon-call.
To save system resources with one process, I changed the content of start-backdoor.sh scripts from:
#!/bin/bash
./backdoor.secure
to:
#!/bin/bash
exec ./backdoor.secure
I fixed the bug in fork child code mentioned during the presentation. Now a failing execvp() call does not leak processes. And while at it, I made failing more verbose. It will display the failure both on server and client ends.
During presentation, my backdoor-policy allowed binding the backdoor to any port. I added more security to that, and allow binding only to backdoor_port_t To get the secured backdoor running, you need to remove the TCP/8282 port from Apache, and add it to backdoor:
semanage port --delete -t http_port_t -p tcp 8282
semanage port --add -t backdoor_port_t -p tcp 8282
You can list the allowed ports with a command like:
semanage port -l | fgrep http_port_t
The package is: backdoor_policy.tar.bz2
Remember to add the package selinux-policy-devel for make to work. Install the newly created policy with following command:
semodule -i backdoor_policy.pp
The new module will survive a system reboot.
Lot of unnecessary permissions have been dropped. backdoor_t can bind only to backdoor_port_t, not all ports. I also enabled backdoor_t writing to stdout, it helps to see what's going on. It is not typical for daemons to be allowed that, but especially when execvp() fails, it is so much easier to visualize SElinux policy kicking in.
Any comments are welcome!
Mon | Tue | Wed | Thu | Fri | Sat | Sun |
---|---|---|---|---|---|---|
← Back | November '24 | |||||
1 | 2 | 3 | ||||
4 | 5 | 6 | 7 | 8 | 9 | 10 |
11 | 12 | 13 | 14 | 15 | 16 | 17 |
18 | 19 | 20 | 21 | 22 | 23 | 24 |
25 | 26 | 27 | 28 | 29 | 30 |