8 ms·
SELinux bypasses
- gnuser 2y agoGRSec is better imho but I’ve never convinced anybody to put it in prod so meh
- voxadam 2y agoI've never used Grsecurity but I seem to remember that the devs didn't play too well with mainline kernel devs.[0] [0] https://lwn.net/Articles/721848/ https://lwn.net/Articles/721848/
- rwmj 2y agoI'm a bit confused by this article. If you have a way to write arbitrarily into kernel structures can't you pretty much do anything already?
- DougMerritt 2y agoOn raw hardware, yes, but they're talking about running on a Samsung hypervisor.
- surajrmal 2y agoAre you familiar with techniques such as mseal? People are trying to take measures to make things in their namespace or address space immutable to protect against partial compromises. It's actually more useful than it seems however it would seem that vendors who are trying to protect selinux this way are not actually able to do it in a robust manner.
- wannacboatmovie 2y agoThe problem with SELinux is it's very fragile and basically broken outside RedHat distros. As an experiment I installed SELinux on Debian and while I was eventually able to get it stable and working after a lot of trial and error, a disk swap followed by an rsync broke it irreparably. Yes I rescanned the disk or whatever to have SEL relearn/reindex the objects, didn't work. The box was basically unbootable or it would boot and rejected all logins, including root directly to the console, something that should nearly never happen. Documentation is sparse or assumes you have RedHat and it 'just works'. After hours of troubleshooting the only thing that worked was switching it off and saying good riddance.
- totony 2y agoMost distros use https://github.com/SELinuxProject/refpolicy https://github.com/SELinuxProject/refpolicy while RHEL uses https://github.com/fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy It's also my experience that Fedora has better support for it, but Gentoo used to be good enough with hardened gentoo (they use https://gitweb.gentoo.org/proj/hardened-refpolicy.git/ https://gitweb.gentoo.org/proj/hardened-refpolicy.git/). Redhat and Gentoo are the only ones that officially support it afaik. I think hardened gentoo might have lost popularity since the fall of grsec, but I'm not sure how popular it is currently.
- vlovich123 2y agoFWIW Android also uses SELinux & I believe selinux-policy. Have no idea about the quality of the implementation.
- BSDobelix 2y ago>Android also uses SELinux Too bad you haven't even read a part of the article.
- vlovich123 2y agoI was responding to what OP wrote: > Redhat and Gentoo are the only ones that officially support it afaik
- kbolino 2y agoGentoo added some excellent and fairly distro-neutral documentation for SELinux a few years ago which makes it somewhat viable outside of Red Hat. It's also helpful for debugging issues even on Red Hat. https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux
- INTPenis 2y agoIt's unfortunately "broken" on purpose even on RHEL. Red Hat have made decisions to run init services in unrestricted context just to make it easier for their end clients to deploy their own services without needing SElinux modules. In my view all these compromimses only speak to the true security of SElinux. The fact that we need to have a website called https://stopdisablingselinux.com/ https://stopdisablingselinux.com/ means it's working! I am one of those weirdos who prefers to learn and adapt to SElinux instead of disabling it. The article in question takes a lot of liberties with complete FS access. It's not really applicable to real world server security. The focus is on smartphones.
- Animats 2y agoSELinux for Linux was never intended to be highly secure. When NSA created it [1], the intent was to get user software modified to work in a mandatory access control environment. Then, more secure operating systems for DoD use would be able to run available software. NSA used to do a lot of operating systems work, but no longer seems to do that. [1] https://www.nsa.gov/Research/NSA-Mission-Oriented-Research/LACR/ https://www.nsa.gov/Research/NSA-Mission-Oriented-Research/L...
- transpute 2y agoMAC for Zephyr was presented at Linux Security Summit (2019), https://www.youtube.com/watch?v=AKWFbxbsU3o https://www.youtube.com/watch?v=AKWFbxbsU3o .. a flexible MAC architecture was created and matured through a series of research systems. The work to bring this architecture to mainstream systems [and] experience with applying this architecture to mobile platforms is examined. The role of MAC in a larger system architecture is reviewed in the context of a secure virtualization system. The state of MAC in mainstream systems is compared before and after our work. Review of non-public STM for constraining SMM, https://www.platformsecuritysummit.com/2018/speaker/myers/ https://www.platformsecuritysummit.com/2018/speaker/myers/ We describe our work to demonstrate an enhanced SMI transfer monitor (STM) to provide protected execution services on the x86 platform. An STM is a hypervisor that executes in x86 system management mode (SMM) and functions as a peer to the hypervisor or operating system. The STM constrains the SMI handler, by hosting the handler in a virtual machine (VM). Otherwise, the SMI handler holds unconstrained access to the platform, which could undermine the assurance provided by DRTM or TXT. OSS STM contributed to coreboot, https://cyberscoop.com/nsa-firmware-open-source-coreboot-stm-pe-eugene-myers/ https://cyberscoop.com/nsa-firmware-open-source-coreboot-stm... & https://www.osfc.io/2019/talks/implementing-stm-support-for-coreboot/ https://www.osfc.io/2019/talks/implementing-stm-support-for-... Implementation of SMI transfer monitor (STM) support for Coreboot.
- ykonstant 2y agoI really wish they resume their (visible) work on Operating Systems; if nothing else, it signals the world that OS Security is "serious business" when the premier cyber-spy-security agency dedicates resources to it. I cannot believe they are strapped for money!
- chasil 2y agoIt seems to me that every new rhel release has more switches to throw to get my things installed and working. It's especially a bit extreme when systemd gets the syslog denial. How do we dial this back?
- wmf 2y agoLearn RHEL properly or use a different distro. RHEL isn't going to change its philosophy.
- ruthmarx 2y agoYou are being downvoted but this answer is exactly right. It's kind of like complaining about group policy in Windows.
- orbisvicis 2y agoThat's exactly right - RH is windozifying Linux.
- ruthmarx 2y agoSo is Ubuntu, so is any distro with systemd. The point though, was if you don't want to learn to use a complex system you shouldn't complain when you use it and don't understand it.
- orbisvicis 2y agoRH is doing a lot of good things like unifying the NetworkManager configuration for plugins. But some things give me pause, such as - and it's been a while so I don't quite remember - copying ssh key selection settings to a security policy file elsewhere such that those settings in the regular config would be ignored. These are ssh-specific settings that did not integrate into a global "policy", and which were placed in a nonstandard location - not ssh.d, which now that I think about it is probably another RH invention.
- iluvcommunism 2y agoI’ve had that POS SELinux block me from logging directly into the console with root (nothing wrong with the pwd). Thank VMware for snapshots. I hate SELinux. But the job requires it. As for people who seem to love it so much, they probably don’t have to deal with it all the time.
- ruthmarx 2y ago> As for people who seem to love it so much, they probably don’t have to deal with it all the time. Or they put in the time to learn it so they don't get frustrated when they get blocked by something, because they know how to resolve it.
- hooverd 2y agoI wish I had the hours to dedicate to every single technology I'm using, but alas...
- ruthmarx 2y agoThis is one of those technologies that people shouldn't be using if they didn't take the time to learn it. It's not like say, nginx or a linux distro, where you don't need to know the ins and outs to get it up and running.
- DrillShopper 2y agoThe problem is that when people don't know how to use it and instead turn it off they're immediately deluged from every side with pathetic nerds screaming that YOU DONT HAVE TO TURN IT OFF ANYMORE RUN THIS ARCANE SEQUENCE OF COMMADS THAT YOU DONT UNDERSTAND AS ROOT AND THAT WILL FIX THE ONE ISSUE YOU HAVE without understanding that not every computer system needs to be locked as tight as a server that's being shared with a bunch of untrusted users who are running god knows what.
- ruthmarx 2y ago
- AlienRobot 2y agoWhen I used Fedora for desktop, VS Code triggered warnings because of a SELinux configuration. Something about using writable memory as executable. The discussion on the topic was disappointing. Chrome does this, all Electron apps do this, VS Code does it. It was insisted that the warnings were fine because this is insecure and the developers should just fix their applications. I do not have the patience to waste two hours researching every single complicated solution that every single application uses to make things work just to personally decide whether it's safe enough to whitelist it. Long story short I'm using Mint now.
- Vilian 2y agoAll of that, because of some warnings? And now you're happy because you don't see the warnings so you have the false sensation of security
- worthless-trash 2y agoThis is the modern world we live in. Decisions like this drive life.
- josefx 2y agoPointless warning spam drowns out real issues in the logs all the time. You cannot expect an end user to fix chromium based applications or stop using them, so all you end up doing is making the system less usable and less secure.
- mroche 2y agoThere are two components to SELinux alerting mechanisms, both of which are documented. For GUI notifications open the sealert app and disable alerts. For journal/syslog reports disable the setroubleshoot daemon dispatch plugin for auditd: sed -i 's/active.=.yes/active = no/' /etc/audit/plugins.d/sedispatch.conf service auditd restart You can also uninstall the setroublshoot-server package completely, and all AVC denials will continue be reported separately outside of the journal.
- 2y ago
- Whatarethese 2y agoThe amount of times I've seen setenforce 1 is ridiculous, but not suprised.
- echoangle 2y agoWhere does the kwrite() come from? How do you get the privileges to write to arbitrary memory addresses?
- guenthert 2y agoThe article mentions hypervisors used by Samsung and Huawei Android phones which enforce read-only access to certain memory regions of the Linux kernel. Exists such a hypervisor as FOSS project? EDIT: a quick search found that Linux' KVM could potentially be used: https://lpc.events/event/17/contributions/1486/attachments/1306/2621/2023-11-14%20LPC%20-%20Heki.pdf https://lpc.events/event/17/contributions/1486/attachments/1...
- immibis 2y agoThe actual difference between Discretionary and Mandatory Access Control: in DAC, a user who owns a file can decide who has access to it (by their discretion). In MAC, the security policy comes from above (by a mandate). A MAC system can have a policy saying that users in the engineering group can't read files created by the accounting group, and there's nothing the users involved can do about it (besides trying to relay through someone they can both communicate with). In DAC the accountant could add the engineer to the file permissions if they want to. Users are fundamentally trusted in DAC and untrusted in MAC. Microsoft's implementation of MAC even provides a facility to log operations that are denied by policy, so the user who attempts to violate the policy can be punished. Additionally, it doesn't allow users to see the policy (unless explicitly granted that permission).