1

I have a daemon running as unconfined_service_t SELinux type, on Redhat Enterprise Linux 8:

# ps -eZ | grep savd
system_u:system_r:unconfined_service_t:s0 693 ? 00:00:00 savd

It is trying to load a Linux kernel module using insmod.

SELinux (in enforcing mode) is blocking it:

type=AVC msg=audit(1566572669.301:24): avc:  denied  { module_load } for  pid=815 comm="insmod" path="/opt/sophos-av/talpa/current/talpa_syscallhook.ko" dev="xvda2" ino=48087622 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=system permissive=0

I've tried to set domain_kernel_load_modules to allow all domains to load kernel modules:

 setsebool -P domain_kernel_load_modules 1

Just in case I had misunderstood, I tried 0 as well, and rebooting, but loading kernel modules was blocked either way.

audit2allow suggests creating a rule for it, but I thought domain_kernel_load_modules would allow all processes to load kernel modules, so I don't understand why it isn't working?

Can I get unconfined services to be able to load kernel modules without creating an additional policy?

The is an AWS instance VM if that matters.

Improve this question

1 Answer 1

Reset to default
2

Your file containing the kernel module has the security context system_u:object_r:usr_t:s0. This is not the expected type for a kernel module. This makes me think that something went wrong with your installation, as the Sophos should have set the correct security context when it was installed. It could be a bug.

Anyway, the correct type is modules_object_t. You can try changing the type of the file as a workaround, until Sophos fixes the problem. (Which you should also report to them.)

chcon -t modules_object_t /opt/sophos-av/talpa/current/talpa_syscallhook.ko
Improve this answer
6
  • That sounds promising, unfortunately the talpa modules are unpacked from a tarfile, just before being loaded. Maybe directory permissions will be replicated down? I can't find any documentation for modules_object_t - do you know where it might be?
    – Douglas Leeder
    Aug 27, 2019 at 9:00
  • Who knows about documentation? I just looked at the type on a running system. Based on your description, I expect you probably ought to be yelling at the vendor.
    – Michael Hampton
    Aug 27, 2019 at 9:03
  • Thanks. I've verified it works - you can set the whole /opt/sophos-av/talpa directory to be modules_object_t, and then it can load Talpa up.
    – Douglas Leeder
    Aug 27, 2019 at 9:43
  • 1
    You can configure that SELinux type for the files using: semanage fcontext -a -t modules_object_t /opt/sophos-av/talpa(/.*)?. See SELinux Contexts — Labeling Files for more information about that.
    – filbranden
    Aug 28, 2019 at 4:25
  • @filbranden Yes, this will work, but also Sophos should be doing this.
    – Michael Hampton
    Aug 28, 2019 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .