grsecurity forums

Title (added "Not really!" at 2016-02-01 17:59+01:00):
subject /usr/bin/pythonX.X needed in policy? Not really!
(and made shorter, as was too long)

I think I need to debug Getmail, to be able to see if I can decrypt the SSL session when it fetches mail from my IMAPS or POP3S mail hubs (at my hoster and at my providers, respectively).

Pls. see on Gentoo Forums:

How to Decrypt Getmail IMAPS/POP3S sessions?
https://forums.gentoo.org/viewtopic-t-1 ... ml#7874704

In any elders are around, I have deliberately llinked to the second post of mine that I posted there, because there is the Grsecurity permission issue for me to solve.

Reproducing that part here, for more clarity and more ease:

Code: Select all

Feb  1 06:25:45 g0n kernel: [353942.599063] grsec: (miro:U:/) exec of /usr/bin/python2.7 (/usr/bin/python ) by /usr/bin/python2.7[python:27668] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:3163] uid/euid:1000/1000 gid/egid:1000/1000
...
Feb  1 06:26:38 g0n kernel: [353995.006352] grsec: (miro:U:/) denied socket(inet,stream,tcp) by /usr/bin/python2.7[python:27668] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:3163] uid/euid:1000/1000 gid/egid:1000/1000


And the python is started at the command line. I will be starting it (probably after I set... I know this by heart by now:

Code: Select all

subject /usr/bin/python2.7 ol {
   /            h
    -CAP_ALL
    bind    disabled
    connect disabled

}

and start grsec learning), in the fashion explained on pages like:

https://marc.info/?l=getmail&m=144502725016279&w=2

Code: Select all

$ python2 -m pdb $(which getmail)
(Pdb) import imaplib
(Pdb) imaplib.Debug = 4
(Pdb) c


because that appears to give complete debugging in Getmail.

I am a little perplexed, because this is the biggest change so far, in my gradm policy.

And so I'm posting this if there be any advanced users to advise me on this.

I do think that the grsec learning is in the order of the day, so I will be going that way. I have such a backup system in place that I am able to roll back very easily my complete system, so it's not worth for me to wait but rather give it a try even if I need to roll back later.
Will be back to either see if any advice was given, or post my new policy.

Regards!.
Miroslav Rovis
http://www.CroatiaFidelis.hr

No, I don't think this is normal, whichever the cause of it. Pls. see the Gentoo Forums topic already linked, but this post:

https://forums.gentoo.org/viewtopic-t-1 ... ml#7874746

In short, it's either a bug (Gentoo has had some rought times lately, and I'm on ~amd64, which is the testing mode), or I did something wrong, or, don't know.

Because the python command should give the interface just find, without any learning, IIUC...

Just to confirm that it is an RBAC policiy issue. If I disable gradm, then, I can normally use the python command:

Code: Select all

$ python2 -m pdb $(which getmail)
> /usr/bin/getmail(11)<module>()
-> from __future__ import with_statement
(Pdb)


I think I understood the problem sufficiently to solve it. I now have a working python2 interface, as needed for getmail debugging.

The change was, apparently (at least after that change it now works), needed in the root subject /bin/bash, which looked like this:

Code: Select all

# Role: root
subject /bin/bash o {
   /            
   /Cmn            wc
   /Cmn/gX*            rwxcdl
   /Cmn/Kaff         rwxcd
   /bin            x
   /boot            h
   /dev            
   /dev/grsec         h
   /dev/kmem         h
   /dev/log         h
   /dev/mem         h
   /dev/null         w
   /dev/port         h
   /dev/tty         rw
   /etc            r
   /etc/bash         h
   /etc/bash/bash_logout      r
   /etc/bash/bashrc      r
   /etc/bash/bashrc.d      
   /etc/cron.hourly      
   /etc/grsec         h
   /etc/gshadow         h
   /etc/gshadow-         h
   /etc/init.d         
   /etc/java-config-2      h
   /etc/java-config-2/current-system-vm   
   /etc/mactab         w
   /etc/postfix         wc
   /etc/profile.d         
   /etc/profile.d/java-config-2.sh   r
   /etc/shadow         h
   /etc/shadow-         h
   /etc/ssh         h
   /etc/terminfo         
   /etc/terminfo/l/linux      r
   /etc/terminfo/r/rxvt-unicode   r
   /export            rwxcd
   /home            
   /home/miro         rw
   /lib64            rx
   /lib64/modules         h
   /mnt            
   /proc            r
   /proc/bus         h
   /proc/kallsyms         h
   /proc/kcore         h
   /proc/modules         h
   /proc/slabinfo         h
   /proc/sys         
   /proc/sys/kernel      
   /proc/sys/kernel/grsecurity      w
#   /proc/sys/kernel/grsecurity/audit_chdir   w
#   /proc/sys/kernel/grsecurity/exec_logging   w
   /proc/sys/net/netfilter      w
#   /proc/sys/net/netfilter/nf_conntrack_timestamp   w
   /root            rwcdl
   /run            
   /sbin            x
   /sys            h
   /tmp            rwcd
   /usr            
   /usr/bin         x
   /usr/lib64         h
   /usr/lib64/gconv/gconv-modules.cache   r
   /usr/lib64/locale/locale-archive   r
   /usr/lib64/python-exec/python-exec2   x
   /usr/libexec/eselect-java/run-java-tool.bash   r
   /usr/local         r   
   /usr/local/bin      rx   
   /usr/sbin         x
   /usr/sbin/sendmail   rx
   /usr/share         h
   /usr/share/info      r
   /usr/share/locale      r
   /usr/share/terminfo      r
   /usr/src         rwxc
   /usr/x86_64-pc-linux-gnu   
   /usr/x86_64-pc-linux-gnu/binutils-bin   h
   /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1   x
   /usr/x86_64-pc-linux-gnu/gcc-bin   
   /var            
   /var/lib         
   /var/lib/clamav         
   /var/lib/portage      
   /var/spool         
   -CAP_ALL
   +CAP_CHOWN
   +CAP_DAC_OVERRIDE
   +CAP_DAC_READ_SEARCH
   +CAP_FOWNER
   +CAP_KILL
   +CAP_SYS_ADMIN
   bind   disabled
   connect   disabled
}


and the change that just got it working is:

Code: Select all

# diff grsec_160201_g0n_00 grsec_160201_g0n_01
682a683
>    /usr/lib64/python-exec/python-exec2-c   x


In other words, that line was missing previously.

How I arrived at that solution? I read the old policy for the subjects that featured the binaries of this story, and figured out what was missing...

My /etc/grsec/policy, even though by this time it differs in ever more details, from then, is still based on what I posted here:

A no-poetterware desktop RBAC policy
viewtopic.php?f=5&t=4153

when I first installed it,

I can now dedicate to try and get those getmail SSL sessions decrypted for my eyes only .

Regards!
Miroslav Rovis
http://www.CroatiaFidelis.hr