3

Problem

A file that is assigned to a certain SELinux MCS (Multi Category Security) category can be read by a user who is not assigned to that category, indicating that MCS somehow does not work on my system (running CentOS7, with a minimal installation, SELinux enforcing in targeted policy ).

Background

I recently acquired a small vServer for myself which sparked me to dive into secure system setup and dealing with SELinux for the first time. I intend to separate applications I will run on the server by running them in docker containers (with the host itself operating on CentOS7). I was happy to learn that each docker container is (by default) assigned random SELinux MCS categories on startup to provide an additional security layer for the separation. To make myself familiar with how SELinux in general and MCS specifically works, I set up a VM on one of my home machines and played around a bit. Doing that, I noticed that MCS does not work as I would expect, so either I am missing something important or there is a configuration issue somewhere.

What I did

To test MCS I followed instructions in [0] and [1]. First, I made sure that SELinux is indeed running in enforcing mode and with the targeted policy using sestatus. Adhering to [0], I created a mcsuser_u SELinux user and CentOS users john, jane, johnjane, which I then mapped to mcsuser_u using semanage login. I also assigned the categories to users as listed in [0] and ended up with:

Login Name | SELinux User | MLS/MCS Range

john | mcsuser_u | s0-s0:c122
jane | mcsuser_u | s0-s0:c123
johnjane | mcsuser_u | s0-s0:c122,123

from semanage login -l and

mcsuser_u | MLS/MCS Level: s0 | MLS/MCS Range: s0-s0:c0.c1023 | SELinux Roles: user_r

from semanage user -l.

I made the home directory of user john world readable (chmod 707), logged in as john and created a text file johntext. I then assigned category c122 to that file (still logged in as john). I was also able to assign category c120 to the file, even though john is not categorized as c120 himself, which should not be possible according to [0] (I subsequently removed c120 again). ls -lZ johntext shows output

-rw-rw-r-- john john mcsuser_u:object_r:user_home_t:s0:c122 johntext

Following the above, I logged in as user jane, and tried to read the file johntext using the cat command, which I was able to do.

This, to me, clearly indicates that MCS is not working as I would expect (allowing access to objects of a certain category only if the user requesting the access has the same category).

Solutions?

I am somewhat confused now and don't know where the mistake resides, so I am turning to you folks for advice. It's probably just a misassumption or misunderstanding on my side, but I can't figure it out right now and it doesn't make sense to me. As I see it, there are the following possibilities:

1. I have to manually activate MCS checks or use a different policy

I did not find any information on whether I have to manually activate MCS support and thus assume that it just works if I assign labels (based on [1]). Other source [2] suggest that MCS is enabled in the targeted policy on (at least) Fedora and RHEL, from which I would expect that it is not different for CentOS.

2. There is a misconfiguration on my side

I might have made some mistake in setting up the user categories with semanage login or assigning categories to the file.

3. It's just broken

.. which would be bad

Referenced Links

0: https://selinux-mac.blogspot.de/2009/06/multi-category-security.html

1: https://www.centos.org/docs/5/html/Deployment_Guide-en-US/sec-mcs-getstarted.html

2: http://selinuxsymposium.org/2006/slides/08-mcs.pdf

Full sestatus output

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

[EDIT]:

I just tested the same steps on a VM running CentOS 6.9 where everything behaves as expected. Right now, I would thus assume that there is either some bug regarding MCS in SELinux on CentOS, or some undocumented changes to the policy/configuration that would be in need of tweaking. I'm still in doubt about what sensible next steps would be to get it working as expected.

2

Apparently there was a change in SELinux policies from CentOS6 to CentOS7 such that MCS constraints are not applied to all types anymore. For a given type to adhere to MCS, the mcs_constrained_type attribute has to be added to that type via a custom policy. More details on how to do that (and which types are MCS constrained by default (and why)) can be found in a blog post by Dan Walsh.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.