grsecurity forums

by **timbgo** » Wed Apr 05, 2017 11:46 am

Initially I planned this first post (and I didn't know how many posts I would need to prepare), for topic:
RBAC policy for tcpdump
viewtopic.php?f=5&t=4301
because I figured out important little "tweak" (or what to call it) for the learning on role tcpdump, without which, as it appears to me, there are issues left, tcpdump doesn't work correctly under RBAC.

Then I thought it has too little to do with tcpdump, even though it contains the important "tweak", but rather should belong into the topic:

Libvirt virtualization policies
viewtopic.php?f=5&t=4675

But I actually leave the libvirt programs subject policies still under learning in the final today's policies...

The most it deals with is the Qemu. So I'll open a topic on:

title: Qemu RBAC policies (& libvirt & tcpdump...)

Code: Select all: # ls -l grsec_170[3][1-9][0-2,4-9]_g0n_[0-9][0-9] grsec_170[4][0-9][0-9]_g0n_[0-9][0-9] -rw------- 1 root root 171317 2017-03-08 18:46 grsec_170310_g0n_00 -rw------- 1 root root 171305 2017-03-19 22:10 grsec_170319_g0n_00 -rw------- 1 root root 171334 2017-03-22 11:56 grsec_170322_g0n_00 -rw------- 1 root root 171367 2017-03-25 12:52 grsec_170325_g0n_00 -rw------- 1 root root 171356 2017-04-01 22:43 grsec_170401_g0n_00 -rw------- 1 root root 171596 2017-04-03 14:24 grsec_170403_g0n_02 -rw------- 1 root root 171599 2017-04-04 19:21 grsec_170404_g0n_00

And so I gave that same argument to my diffing_script.sh, which you can find at:

Libvirt virtualization policies
viewtopic.php?f=5&t=4675&start=15#p17006

(
but first I changed the string, in the whole script:
from /Cmn/m/B/Virt_170405/ to /some/other/dir/
)

...

First, I had figured out the missing tweak in my tcpdump topic (link given above). The tcpdump role learning was missing!

And you can see it, if you peruse the actual changes btwn the versions above of my /etc/grsec/policy which I have prepared for posting.

So, I ran:

Code: Select all: # diffing_script.sh

and when asked, pasted in that string above:

Code: Select all: grsec_170[3][1-9][0-2,4-9]_g0n_[0-9][0-9] grsec_170[4][0-9][0-9]_g0n_[0-9][0-9]

, and below is what I got.

However, these posts also are related to my Libvirt topic (link given above), and they build on the explanations given there, to a large extent. E.g. the version grsec_170310_g0n_00 is one of the last versions of my /etc/grsec/policy that I explained in that topic how I attained it.

diff -u30 ./grsec_170310_g0n_00 ./grsec_170319_g0n_00

Code: Select all: --- ./grsec_170310_g0n_00 2017-03-08 18:46:35.138312762 +0100 +++ ./grsec_170319_g0n_00 2017-03-19 22:10:00.430783212 +0100 @@ -4519,109 +4519,109 @@ /proc/slabinfo r /proc/sys h /root rwcd /sbin r /usr /usr/arm-unknown-linux-gnueabi r /usr/bin r /usr/etc r /usr/lib64 rx /usr/libexec r /usr/local r /usr/sbin rx /usr/share r /usr/src h /usr/x86_64-pc-linux-gnu r /usr/arm-unknown-linux-gnueabi r /var /var/lib rwcd /var/spool h /var/spool/cron r /var/www r -CAP_ALL +CAP_DAC_OVERRIDE +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled # Role: root -subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/ar o +subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/ar o / h /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/lib64 h /usr/lib64/binutils/x86_64-pc-linux-gnu/2.25.1/libbfd-2.25.1.so rx /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/src h /usr/x86_64-pc-linux-gnu h - /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/ar x + /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/ar x -CAP_ALL bind disabled connect disabled # Role: root -subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/as o +subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/as o / h /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /tmp rw /usr h /usr/lib64 h /usr/lib64/binutils/x86_64-pc-linux-gnu/2.25.1/libbfd-2.25.1.so rx /usr/lib64/binutils/x86_64-pc-linux-gnu/2.25.1/libopcodes-2.25.1.so rx /usr/lib64/locale/locale-archive r /usr/share h /usr/share/locale r /usr/src rwcd /usr/x86_64-pc-linux-gnu h /usr/x86_64-pc-linux-gnu/binutils-bin x -CAP_ALL bind disabled connect disabled # Role: root -subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/ld o +subject /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/ld o / h /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /etc h /etc/ld.so.cache r /etc/ld.so.conf r /etc/ld.so.conf.d /etc/ld.so.conf.d/05binutils.conf r /etc/ld.so.conf.d/05gcc-x86_64-pc-linux-gnu.conf r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /tmp r /usr h /usr/lib64 rx /usr/share h /usr/share/locale r /usr/src rwcd /usr/x86_64-pc-linux-gnu h /usr/x86_64-pc-linux-gnu/binutils-bin x -CAP_ALL bind disabled connect disabled @@ -5052,61 +5052,61 @@ /sbin/openrc /sbin/xtables-multi /sys h /tmp rwcd /usr /usr/bin x /usr/bin/java rx /usr/bin/mplayer rx /usr/bin/mpv rx /usr/bin/qemu-system-x86_64 rx /usr/bin/ssh rx /usr/bin/xkbcomp rx /usr/bin/urxvt rx /usr/bin/tzap rx /usr/lib64 rx /usr/libexec rx /usr/local /usr/local/bin rwxc /usr/sbin h /usr/sbin/sendmail rx /usr/sbin/tcpdump x /usr/share h /usr/share/virt-manager x /usr/share/cvs/contrib/rcs2log /usr/share/doc r /usr/share/info r /usr/share/locale r /usr/share/terminfo r /usr/src rwxc # needed by youtube-dl - /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/objdump x + /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/objdump x /var /var/lib /var/lib/lurker rwcdl /var/log h /var/tmp rwcd /var/www /var/www/lurker* rwcd /var/www/localhost /var/www/localhost/htdocs rwcd -CAP_ALL bind disabled connect disabled sock_allow_family all # Role: miro subject /bin/cat o / h /Cmn r /Cmn/MyVideos rwcdl /Cmn/ls-ABRgo* rwcdl /Cmn/dLo* rwcdl /bin h /bin/cat rx /dev h /dev/dvb r /dev/dvb/adapter? r /dev/dvb/adapter?/dvr? r /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r @@ -6474,62 +6474,62 @@ /proc/sys h /sys h /tmp r /usr h /usr/bin h $gpg_programs /usr/lib64 rx /usr/share r /var/log h /var/www/localhost/htdocs rwc -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/gpgconf o / h /dev/null rw /etc h /etc/ld.so.cache r /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /usr h /usr/bin $gpg_programs /usr/share/locale r - /usr/lib64/libgcrypt.so.20.1.5 rx - /usr/lib64/libgpg-error.so.0.21.0 rx + /usr/lib64/libgcrypt.so.20.1.6 rx + /usr/lib64/libgpg-error.so.0.22.0 rx /usr/lib64/locale/locale-archive r -CAP_ALL bind disabled connect disabled ## Role: miro #subject /usr/bin/gpgparsemail ol # / h # -CAP_ALL # bind disabled # connect disabled ## Role: miro #subject /usr/bin/gpgscm ol # / h # -CAP_ALL # bind disabled # connect disabled ## Role: miro #subject /usr/bin/gpgsm ol # / h # -CAP_ALL # bind disabled # connect disabled ## Role: miro #subject /usr/bin/gpgtar ol # / h # -CAP_ALL @@ -8212,61 +8212,61 @@ sock_allow_family unix inet # Role: miro subject /usr/libexec/gcc/x86_64-pc-linux-gnu o / h /Cmn /Cmn/mr* rwc /Cmn/Kaff rwc /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/urandom r /etc h /etc/ld.so.cache r /home /home/miro rwcd /lib64 rx /lib64/modules h /proc h /proc/meminfo r /tmp rwcdl /usr /usr/include r /usr/lib64 rx /usr/libexec h /usr/libexec/gcc x - /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/ld x + /usr/x86_64-pc-linux-gnu/binutils-bin/2.27/ld x /usr/share h /usr/share/locale r /usr/src rwxc -CAP_ALL +CAP_IPC_LOCK +CAP_SYS_RAWIO bind disabled connect disabled # Role: miro subject /usr/libexec/git-core o / h /Cmn r /Cmn/src* rwcdl /bin x /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h

diff -u30 ./grsec_170319_g0n_00 ./grsec_170322_g0n_00

Code: Select all: --- ./grsec_170319_g0n_00 2017-03-19 22:10:00.430783212 +0100 +++ ./grsec_170322_g0n_00 2017-03-22 11:56:18.000000000 +0100 @@ -8588,94 +8588,95 @@ /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /tmp rwcd /usr /usr/bin /usr/bin/maildrop x /usr/bin/python* x /usr/lib64 rx /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32 dgram udp connect 195.29.150.9/32:995 dgram udp connect 195.29.150.8/32:995 stream dgram tcp udp connect 178.218.165.68/32:993 stream tcp connect 192.168.1.1/32:53 dgram udp sock_allow_family netlink # Role: miro subject /usr/lib64/palemoon/palemoon o / r /Cmn rw /mnt/CD r - /Cmn/dLo rwc + /Cmn/dLo rwcd /boot h /bin/wc x /dev /dev/dri h /dev/dri/card0 rw /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/snd rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro rw /home/miro/.cache rwcd /home/miro/.config /home/miro/.config/gtk-2.0 rwcd /home/miro/.local /home/miro/.local/share rwcd "/home/miro/.moonchild productions" rwcd # "/home/miro/.moonchild productions/pale moon" r # "/home/miro/.moonchild productions/pale moon/sre1mcun.default" rwcd /home/miro/.mozilla /home/miro/.sslkey.log w /home/miro/Desktop rwcd + /home/miro/Downloads rwcd /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/self r /proc/slabinfo h /proc/sys h /run /sys h /sys/devices/system/cpu/online r /sys/devices/system/cpu/present r /tmp rwcd /usr /usr/bin/mutt rx /usr/bin/qpdfview x /usr/bin/vlc x /usr/lib64 rx /usr/local /usr/share r /usr/src h /var h /var/cache h /var/cache/fontconfig r /var/tmp rwcd -CAP_ALL bind 0.0.0.0/32:0 dgram ip

diff -u30 ./grsec_170322_g0n_00 ./grsec_170325_g0n_00

Code: Select all: --- ./grsec_170322_g0n_00 2017-03-22 11:56:18.000000000 +0100 +++ ./grsec_170325_g0n_00 2017-03-25 12:52:06.000000000 +0100 @@ -6982,61 +6982,61 @@ /proc/slabinfo h /proc/sys h /sys h /sys/devices/system/cpu /usr h /usr/bin h /usr/bin/mplayer rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r /var/www h /var/www/localhost h /var/www/localhost/htdocs r /var/www/localhost/htdocs/CroatiaFidelis r /var/www/localhost/htdocs/CroatiaFidelis/foss r /var/www/localhost/htdocs/CroatiaFidelis/foss/cap rwc -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 192.168.2.0/24:80 stream tcp connect 127.0.0.1/32:53 dgram udp sock_allow_family ipv6 # Role: miro subject /usr/bin/mpv o / h /Cmn r /Cmn/Kaff rwc /Cmn/dLo rwc - /Cmn/mr rwc + /Cmn/mr* rwc /dev h /dev/dri h /dev/dri/card0 rw /dev/null r /dev/snd rw /dev/urandom r /dev/zero rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro rwc /lib64 rx /lib64/modules h /mnt h /mnt/sd?1 r /mnt/g* r /mnt/H* r /mnt/sr* r /proc /proc/bus h /proc/cpuinfo r /proc/kallsyms h @@ -8517,60 +8517,61 @@ /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro rwcd /home/miro/.cache rwcdl /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /sys h /sys/devices/system/cpu/online r /tmp rwcd /usr /usr/bin /usr/bin/xdg-open x /usr/lib64 rxwc /usr/share r /usr/src h /var h /var/cache/fontconfig rw + /var/www/localhost/htdocs rwcd -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/lib64/node_modules/npm/bin/npm-cli.js o / h /bin h /bin/env x /etc h /etc/ld.so.cache r /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /usr h /usr/bin/env x /usr/bin/node x /usr/lib64/locale/locale-archive r /usr/lib64/node_modules/npm/bin/npm-cli.js rx -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/lib64/python-exec/python2.7/getmail o / h /dev h /dev/tty rw

diff -u30 ./grsec_170325_g0n_00 ./grsec_170401_g0n_00

Code: Select all: --- ./grsec_170325_g0n_00 2017-03-25 12:52:06.000000000 +0100 +++ ./grsec_170401_g0n_00 2017-04-01 22:43:14.760275379 +0200 @@ -642,61 +642,60 @@ /Cmn/gX* rwxcd /Cmn/m* rwxcd /bin rx /sbin rx /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /dev/urandom r /etc rx /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /export h /export/data /export/home /home h /home/miro rx /lib64 rx /lib64/firmware h /lib64/firmware/radeon /lib64/modules h /mnt r - /mnt r /mnt/g* rwxcd /mnt/H* rwxcd /opt /opt/icedtea-bin-*/bin/java x /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /root rxcdl /run rd /run/dhcpcd r /sys /sys/fs/cgroup /tmp rwcd /usr /usr/bin rx /usr/include r /usr/lib64 rx /usr/libexec rx /usr/local r /usr/local/bin rx /usr/sbin rx /usr/share r /usr/src rx /usr/x86_64-pc-linux-gnu /usr/x86_64-pc-linux-gnu/binutils-bin x /usr/x86_64-pc-linux-gnu/gcc-bin x

diff -u30 ./grsec_170401_g0n_00 ./grsec_170403_g0n_02

Code: Select all: --- ./grsec_170401_g0n_00 2017-04-01 22:43:14.760275379 +0200 +++ ./grsec_170403_g0n_02 2017-04-03 14:24:12.713483680 +0200 @@ -2942,61 +2942,62 @@ / h /bin x /dev r /dev/null w /dev/tty rw /etc h /etc/X11 /etc/X11/xinit rx /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /root /tmp rwcd /usr h /usr/bin rx /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/share /usr/share/locale/locale.alias r -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/bin/sudo o -group_transition_allow nobody root +#user_transition_allow root nobody +group_transition_allow root nobody / h /bin h /bin/bash xwcd /bin/touch rwc /bin/mkdir x /dev h /dev/console /dev/log rw /dev/pts /dev/tty rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow- h /etc/passwd r /etc/ssh h /etc/sudoers r /etc/sudoers.d r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run rwcd /usr h @@ -4449,63 +4450,64 @@ sock_allow_family unix inet # Role: root subject /usr/sbin/tcpdump o user_transition_allow root tcpdump nobody miro group_transition_allow root tcpdump nobody miro / h /Cmn rwc /etc h /etc/ld.so.cache r /etc/localtime r /etc/nsswitch.conf r /etc/passwd r /etc/services r /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /sys h /sys/class h /sys/class/net /sys/devices h /sys/devices/pci0000:00 h /sys/devices/pci0000:00/0000:00:15.0/0000:05:00.0/net/eth0/ifindex /sys/devices/pci0000:00/0000:00:15.1/0000:06:00.0/net/eth1/ifindex /sys/devices/virtual h - /sys/devices/virtual/net/dummy0/ifindex - /sys/devices/virtual/net/lo/ifindex - /sys/devices/virtual/net/sit0/ifindex + /sys/devices/virtual/net r +# /sys/devices/virtual/net/dummy0/ifindex +# /sys/devices/virtual/net/lo/ifindex +# /sys/devices/virtual/net/sit0/ifindex /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/tcpdump rx -CAP_ALL +CAP_SETGID +CAP_SETUID +CAP_SETPCAP +CAP_NET_ADMIN +CAP_NET_RAW bind disabled connect disabled sock_allow_family unix inet netlink # Role: root subject /usr/sbin/tripwire o user_transition_allow root group_transition_allow root / /boot r /bin rx /dev /dev/grsec h /dev/kmem h /dev/log rw /dev/port h /etc r /home /home/miro rwcd /lib rx @@ -4828,95 +4830,96 @@ -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: postfix subject /usr/sbin/postsuper o user_transition_allow root group_transition_allow root / h /var/spool/postfix wd -CAP_ALL bind disabled connect disabled role qemu ul user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role qemu gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -role tcpdump u -subject / o - / h - -CAP_ALL - bind disabled - connect disabled - -# Role: tcpdump -subject /usr/sbin/tcpdump o -user_transition_allow miro root nobody tcpdump -group_transition_allow miro root nobody tcpdump - / h - /Cmn rwc - /etc h - /etc/host.conf r - /etc/hosts r - /etc/ld.so.cache r - /etc/resolv.conf r - /lib64 h - /lib64/libnss_dns-2.23.so rx - /lib64/libresolv-2.23.so rx - /lib64/libresolv.so.2 rx - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /usr h - /usr/sbin/tcpdump rx - -CAP_ALL - +CAP_DAC_OVERRIDE - bind 0.0.0.0/32:0 dgram ip - connect 127.0.0.1/32:53 dgram udp +role tcpdump ul +user_transition_allow root nobody tcpdump miro +group_transition_allow root nobody tcpdump miro + +role tcpdump gl +user_transition_allow root nobody tcpdump miro +group_transition_allow root nobody tcpdump miro + +## Role: tcpdump +#subject /usr/sbin/tcpdump o +#user_transition_allow root nobody tcpdump miro +#group_transition_allow root nobody tcpdump miro +# / h +# /Cmn rwc +# /etc h +# /etc/host.conf r +# /etc/hosts r +# /etc/ld.so.cache r +# /etc/resolv.conf r +# /lib64 h +# /lib64/libnss_dns-2.23.so rx +# /lib64/libresolv-2.23.so rx +# /lib64/libresolv.so.2 rx +# /proc r +# /proc/bus h +# /proc/kallsyms h +# /proc/kcore h +# /proc/modules h +# /proc/slabinfo h +# /proc/sys h +# /usr h +# /usr/sbin/tcpdump rx +# -CAP_ALL +# +CAP_DAC_OVERRIDE +# bind 0.0.0.0/32:0 dgram ip +# connect 127.0.0.1/32:53 dgram udp role miro u user_transition_allow qemu group_transition_allow kvm libvirt qemu role_allow_ip 0.0.0.0/32 # Role: miro subject / / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcd /Cmn/m* rwxcd /Cmn/src* rwxcd /bin rx /boot h /dev /dev/grsec h /dev/kmem h /dev/kvm r /dev/log h /dev/mapper h /dev/mapper/Msy /dev/mem h /dev/net r /dev/net/tun rwx /dev/null rw /dev/port h /dev/ptmx rw

diff -u30 ./grsec_170403_g0n_02 ./grsec_170404_g0n_00

Code: Select all: --- ./grsec_170403_g0n_02 2017-04-03 14:24:12.713483680 +0200 +++ ./grsec_170404_g0n_00 2017-04-04 19:21:56.000000000 +0200 @@ -541,61 +541,61 @@ bind disabled connect disabled role portage u role_allow_ip 0.0.0.0/32 # Role: portage subject / / h /bin/bash x /usr/bin/wget x -CAP_ALL bind disabled connect disabled # Role: portage subject /bin/bash o / /Cmn /Cmn/Kaff rwxcd /bin x # /bin/bash x # /bin/rm x /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null w /dev/port h /dev/tty rw - /etc h + /etc r /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /root /usr h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/portage wc /usr/share/info r -CAP_ALL bind disabled connect disabled # Role: portage subject /bin/rm o / h /bin h /bin/rm x /etc h /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /usr h /usr/lib64/locale/locale-archive r /usr/portage wd -CAP_ALL bind disabled @@ -706,64 +706,64 @@ /var/spool /var/spool/postfix r -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_DAC_READ_SEARCH +CAP_FOWNER +CAP_KILL bind disabled connect disabled # Role: root subject /bin/bash o / /Cmn wc /Cmn/gX* rwxcdl /Cmn/Kaff rwxcd /bin x /boot h /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /etc r /etc/X11 r /etc/X11/chooser.sh x - /etc/bash h - /etc/bash/bash_logout r - /etc/bash/bashrc r - /etc/bash/bashrc.d + /etc/bash r +# /etc/bash/bash_logout r +# /etc/bash/bashrc r +# /etc/bash/bashrc.d /etc/cron.hourly /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/init.d rwx /etc/java-config-2 h /etc/java-config-2/current-system-vm rx /etc/mactab w /etc/postfix wc /etc/profile.d /etc/profile.d/java-config-2.sh r /etc/shadow h /etc/shadow- h /etc/ssh h /etc/terminfo /etc/terminfo/l/linux r /etc/terminfo/r/rxvt-unicode r /export rwxcd /home /home/miro rw /lib64 rx /lib64/modules h /mnt /opt /opt/cin x /opt/icedtea-bin-* rx /proc r /proc/bus h /proc/kallsyms h /proc/kcore h

In the next post, after I have done a number of tcpdump network traces, I will give what grsecurity learned from those, along with the diff with the new tcpdump-learned policy.

I'll post it regardless that this issue was now solved, or that this issue still remained open.

by **timbgo** » Wed Apr 05, 2017 11:49 am

So, I copied over the learning.logs:

Code: Select all: # ls -ltr /etc/grsec/learning.logs -rw------- 1 root root 2612964 2017-04-05 06:35 /etc/grsec/learning.logs #

(it's huge, because I still have the libvirt programs at learning, I have only partly solved Libvirt virtualization policies)

Code: Select all: # ls -ltrh /etc/grsec/learning.logs -rw------- 1 root root 2.5M 2017-04-05 06:35 /etc/grsec/learning.logs #

And:

Code: Select all: # cp -iav /etc/grsec/learning.logs learning.logs_$(date +%y%m%d_%H%M) '/etc/grsec/learning.logs' -> 'learning.logs_170405_1326' #

And now:

Code: Select all: # gradm -D Password: #

And:

Code: Select all: # gradm -L /etc/grsec/learning.logs -O /etc/grsec/policy

Here's the output:

Code: Select all: Beginning full learning object reduction for subject /usr/sbin/tcpdump...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-i386...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-arm...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /usr/sbin/virtlogd...done. Beginning full learning object reduction for subject /usr/sbin/libvirtd...done. Beginning full learning object reduction for subject /usr/libexec/libvirt_leaseshelper...done. Beginning full learning object reduction for subject /usr/bin/virsh...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /usr/sbin/libvirtd...done. Beginning full learning object reduction for subject /usr/bin/virt-install...done. Beginning full learning object reduction for subject /usr/bin/virsh...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/python2.7...done. Beginning full learning object reduction for subject /usr/bin/gpg-connect-agent...done.

And here's what was added to the learning.logs, with the no-switches diff, and a very simple sed manipulation:

Code: Select all: # ls -l learning.logs_170405_1326 learning.logs_170405_1346 -rw------- 1 root root 2612964 2017-04-05 06:35 learning.logs_170405_1326 -rw------- 1 root root 2618379 2017-04-05 13:33 learning.logs_170405_1346 g0n ~ # diff learning.logs_170405_1326 learning.logs_170405_1346 | grep -v '> ' 23561a23562,23615 g0n ~ # diff learning.logs_170405_1326 learning.logs_170405_1346 | grep -v '< ' | wc -l 55 g0n ~ # diff learning.logs_170405_1326 learning.logs_170405_1346 | grep '> ' | sed 's/> //' > learning.logs_170405_1346.diff g0n ~ # wc -l learning.logs_170405_1346.diff 54 learning.logs_170405_1346.diff g0n ~ # wc -l learning.logs_170405_1346.diff

And here are those 55 lines that were written:

Code: Select all: miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/ld-2.23.so 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/ld-2.23.so 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /etc/ld.so.cache 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /etc/ld.so.cache 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libassuan.so.0.7.3 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libassuan.so.0.7.3 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libassuan.so.0.7.3 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgpg-error.so.0.22.0 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgpg-error.so.0.22.0 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgpg-error.so.0.22.0 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgcrypt.so.20.1.6 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgcrypt.so.20.1.6 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/libgcrypt.so.20.1.6 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libreadline.so.7.0 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libreadline.so.7.0 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libreadline.so.7.0 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libc-2.23.so 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libc-2.23.so 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libc-2.23.so 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libncurses.so.6.0 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libncurses.so.6.0 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libncurses.so.6.0 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libdl-2.23.so 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libdl-2.23.so 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /lib64/libdl-2.23.so 8 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/locale/locale-archive 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/lib64/locale/locale-archive 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/share/locale 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /usr/share/locale 17 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /mnt/sdd1/.gnupg/S.gpg-agent 16 0.0.0.0 miro 1 1000 1000 /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent 1 1 /mnt/sdd1/.gnupg/S.gpg-agent 5 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /proc 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /proc 17 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 0 0 1 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0637_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0637_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0643_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0643_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0650_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0650_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0651_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0651_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0652_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_0652_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1017_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1017_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1025_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1025_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1027_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1027_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1236_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1236_g0n.pcap 16 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1252_g0n.pcap 132 0.0.0.0 tcpdump 129 110 993 /usr/sbin/tcpdump / 1 1 /Cmn/mr/dump_170405_1252_g0n.pcap 16 0.0.0.0

I bet some readers figured out here that I like suspense and I don't like fiction or incompleteness (when I can). All of this is from real life. Later there will be, only for purposes of explanation, a few grsec policy files that weren't run, but the final "product" to show is always to do with real life.

I really don't know if I got good and functioning results in the /etc/grsec/policy learned from those...

You can see from the learning.logs that it may have been sufficiently long learning: from:

Code: Select all: .../Cmn/mr/dump_170405_0637_g0n.pcap

to

Code: Select all: /Cmn/mr/dump_170405_1252_g0n.pcap

, that's 20 traces made...

But only comparing what was written at the bottom of the /etc/grsec/policy, and afterwords running with complete tcpdump policy will we know if this issue is solved.

In the next post. (sweat, sweat, sweat)

by **timbgo** » Wed Apr 05, 2017 11:52 am

I'll use the diffing_script.sh again.

And I can simply give it to read, when it asks me at the start:

Code: Select all: grsec_170404_g0n_00 grsec_170405_g0n_00-L

And here's what it gave me:

diff -u30 ./grsec_170404_g0n_00 ./grsec_170405_g0n_00-L

Code: Select all: --- ./grsec_170404_g0n_00 2017-04-04 19:21:56.000000000 +0200 +++ ./grsec_170405_g0n_00-L 2017-04-05 13:45:14.109089983 +0200 @@ -8878,30 +8878,652 @@ # Role: miro subject /usr/sbin/sendmail o / h /dev h /dev/log rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/postfix h /etc/postfix/main.cf r /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/postdrop x /usr/sbin/sendmail x /var h /var/spool/postfix -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all +role tcpdump u +role_allow_ip 0.0.0.0/32 +# Role: tcpdump +subject / o { + / h + -CAP_ALL + bind disabled + connect disabled +} + +# Role: tcpdump +subject /usr/sbin/tcpdump o { + / h + /Cmn h + /Cmn/mr wc + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + -CAP_ALL + +CAP_DAC_OVERRIDE + bind disabled + connect disabled +} + + +role qemu u +role_allow_ip 0.0.0.0/32 +# Role: qemu +subject / o { + / h + /dev h + /dev/kvm + /home h + /home/miro/tails_Q05.img + /home/miro/tails_Q06.img + /home/miro/tails_Q07.img + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /usr h + /usr/bin/qemu-system-arm x + /usr/bin/qemu-system-i386 x + /usr/bin/qemu-system-x86_64 x + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { + / h + /proc rw + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /usr h + /usr/lib64/gconv/gconv-modules.cache r + /var h + /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd + /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd + /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd + /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /usr/bin/qemu-system-x86_64 o { + / + /boot h + /dev h + /dev/kvm rw + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc rw + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-x86_64 x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + /var/lib/libvirt/qemu/domain-17-tails_Q07/monitor.sock wd + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /usr/bin/qemu-system-i386 o { + / + /boot h + /dev h + /dev/kvm rw + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-i386 x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /usr/bin/qemu-system-arm o { + / + /boot h + /dev h + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-arm x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + -CAP_ALL + bind disabled + connect disabled +} + + +### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "root" ### +# Role: root +subject /usr/sbin/virtlogd oO { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / h + /etc h + /etc/group r + /etc/passwd r + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /run h + /run/virtlogd.pid wd + /usr h + /usr/sbin/virtlogd rx + /usr/share/locale r + /var h + /var/log h + /var/log/libvirt h + /var/log/libvirt/qemu a + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: root +subject /usr/sbin/libvirtd oO { +user_transition_allow qemu nobody +group_transition_allow qemu nobody kvm libvirt + + / + /boot h + /dev h + /dev/kvm r + /dev/net/tun rw + /dev/null rw + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/libvirt h + /etc/libvirt/libvirt.conf r + /etc/libvirt/qemu wd + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /home + /home/miro rwd + /lib/modules h + /lib64/modules h + /mnt h + /mnt/sdd1/.gnupg + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /run rwcd + /sbin h + /sbin/iptables + /sbin/xtables-multi x + /sys r + /sys/fs h + /sys/fs/cgroup/memory/machine wd + /sys/fs/cgroup/memory/machine/qemu-18-tailsQ06.libvirt-qemu rwc + /sys/kernel h + /sys/kernel/iommu_groups + /sys/kernel/mm/hugepages + /sys/kernel/mm/hugepages/hugepages-2048kB/free_hugepages r + /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages r + /usr h + /usr/bin/qemu-system-arm + /usr/bin/qemu-system-i386 + /usr/bin/qemu-system-x86_64 + /usr/sbin/libvirtd rx + /var h + /var/cache/libvirt/qemu/capabilities + /var/cache/libvirt/qemu/capabilities/87ec9299b933cd6b566ae822928e0c2effac281ced4939efcabd4bb8e6aa643b.xml rwcd + /var/cache/libvirt/qemu/capabilities/926803a9278e445ec919c2b6cbd8c1c449c75b26dcb1686b774314180376c725.xml rwcd + /var/cache/libvirt/qemu/capabilities/f11008721aacc79c97e592178e61264d75be551864cd79cc41fe820e31262f27.xml rwcd + /var/lib/libvirt/dnsmasq/virbr0.status r + /var/lib/libvirt/qemu rwcd + /var/log/libvirt/qemu + -CAP_ALL + +CAP_CHOWN + +CAP_DAC_OVERRIDE + +CAP_DAC_READ_SEARCH + +CAP_KILL + +CAP_SETGID + +CAP_SETUID + +CAP_NET_ADMIN + +CAP_NET_RAW + bind 0.0.0.0/32:5901 stream dgram ip tcp + bind 0.0.0.0/32:5902 stream dgram ip tcp + bind 0.0.0.0/32:0 stream dgram ip tcp + bind 0.0.0.0/32:5900 stream dgram ip tcp + connect 192.168.2.2/32:0 dgram udp + connect 127.0.0.1/32:0 dgram udp + sock_allow_family ipv6 netlink packet +} + +# Role: root +subject /usr/libexec/libvirt_leaseshelper oO { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / h + /etc h + /etc/ld.so.cache r + /lib64 rx + /lib64/modules h + /run h + /run/leaseshelper.pid wcd + /usr h + /usr/lib64 rx + /usr/libexec h + /usr/libexec/libvirt_leaseshelper rx + /var h + /var/lib/libvirt/dnsmasq/virbr0.status rwcd + /var/lib/libvirt/dnsmasq/virbr0.status.new rwcd + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: root +subject /usr/bin/virsh o { +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + + / h + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/libvirt h + /etc/libvirt/libvirt.conf r + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /etc/ssl h + /etc/ssl/openssl.cnf r + /lib64 rx + /lib64/modules h + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /root h + /root/.cache/libvirt/virsh + /root/.cache/libvirt/virsh/history rwcd + /root/.cache/libvirt/virsh/history-07198.tmp rwcd + /root/.cache/libvirt/virsh/history-19280.tmp rwcd + /root/.cache/libvirt/virsh/history-28893.tmp rwcd + /run h + /run/libvirt/libvirt-sock rw + /usr h + /usr/bin h + /usr/bin/virsh rx + /usr/lib64 rx + /usr/share h + /usr/share/locale r + /usr/share/terminfo r + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet ipv6 +} + + +### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "miro" ### +# Role: miro +subject /usr/sbin/libvirtd oO { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / + /boot h + /dev h + /dev/kvm + /dev/log rw + /dev/null rw + /dev/urandom r + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /home + /home/miro r + /home/miro/.cache r + /home/miro/.cache/libvirt rwcd + /home/miro/.cache/libvirt/qemu rwc + /home/miro/.cache/libvirt/qemu/cache rwc + /home/miro/.cache/libvirt/storage rwcd + /home/miro/.config rwcd + /lib/modules h + /lib64 rx + /lib64/modules h + /mnt h + /mnt/sdd1/.gnupg + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /sys r + /usr h + /usr/bin x + /usr/lib64 rx + /usr/sbin h + /usr/sbin/dnsmasq x + /usr/sbin/libvirtd rx + /usr/sbin/virtlogd x + /usr/share h + /usr/share/libvirt/cpu_map.xml r + /var/log h + -CAP_ALL + bind 0.0.0.0/32:0 stream dgram ip tcp + bind 0.0.0.0/32:5900 stream dgram ip tcp + connect 192.168.2.2/32:0 dgram udp + connect 127.0.0.1/32:0 dgram udp + sock_allow_family ipv6 netlink +} + +# Role: miro +subject /usr/bin/virt-install oO { +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + + / h + /Cmn h + /Cmn/src/gnunet + /bin h + /bin/bash x + /dev h + /dev/tty rw + /etc h + /etc/ld.so.cache r + /home + /lib64 rx + /lib64/modules h + /usr h + /usr/bin/virt-install rx + /usr/lib64/gconv/gconv-modules.cache r + /usr/lib64/locale/locale-archive r + /usr/share/virt-manager/virt-install x + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: miro +subject /usr/bin/virsh o { +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + + / + /boot h + /dev h + /dev/null rw + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /etc/ssl h + /etc/ssl/openssl.cnf r + /home h + /home/miro/.cache/libvirt + /home/miro/.cache/libvirt/libvirt-sock rw + /home/miro/.cache/libvirt/libvirtd.lock rwcd + /home/miro/.cache/libvirt/virsh/history r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /sys h + /usr h + /usr/bin h + /usr/bin/virsh rx + /usr/lib64 rx + /usr/sbin h + /usr/sbin/libvirtd x + /usr/share h + /usr/share/locale r + /usr/share/terminfo r + /var/log h + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet ipv6 +} + +# Role: miro +subject /usr/bin/qemu-system-x86_64 o { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / + /boot h + /dev h + /dev/kvm rw + /dev/null rw + /etc h + /etc/ld.so.cache r + /home h + /home/miro/.config/libvirt/qemu/lib/capabilities.monitor.sock wc + /home/miro/.config/libvirt/qemu/lib/capabilities.pidfile rwc + /lib/modules h + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-x86_64 rx + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var/log h + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: miro +subject /usr/bin/python2.7 o { + / + /boot h + /dev h + /dev/null rw + /dev/urandom r + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /etc/ssl h + /etc/ssl/certs/ca-certificates.crt + /etc/ssl/openssl.cnf r + /home + /home/miro + /home/miro/.cache + /home/miro/.cache/libvirt rwcd + /home/miro/.cache/virt-manager wc + /home/miro/tails-i386-2.10.iso r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /run h + /run/libvirt/libvirt-sock rw + /sbin h + /sbin/ldconfig x + /sys h + /usr + /usr/bin + /usr/bin/python2.7 rx + /usr/bin/virt-viewer x + /usr/lib64 rx + /usr/sbin h + /usr/sbin/libvirtd x + /usr/share r + /usr/src h + /var/log h + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet ipv6 +} + +# Role: miro +subject /usr/bin/gpg-connect-agent o { + / h + /etc h + /etc/ld.so.cache r + /lib64 rx + /lib64/modules h + /mnt h + /mnt/sdd1/.gnupg/S.gpg-agent rw + /usr h + /usr/bin h + /usr/bin/gpg-connect-agent rx + /usr/lib64 rx + /usr/share h + /usr/share/locale r + -CAP_ALL + bind disabled + connect disabled + sock_allow_family unix inet +} + +

It dawned at me that I forgot to do one particular thing, right in the previous post when I noticed there were only 20 traces made that grsecurity logged for learning.

In fact, in that dir I have:

Code: Select all: # ls -l /Cmn/mr/dump_170*.pcap|wc -l 68

that's 68 traces made, but I had a crash, and I simply fit in another same cloned system hard disk [1], updated it with newly gotten stuff from the internet (that's always relatively a lot of work; cloning itself is simple, but getting again at the same place in your interactions with the internet in the cloned system, that's what spends the most of your time)...

So, I [updated it with newly gotten stuff from the internet], but it various stuff, and you're bound to forget some... And I did forget to update exactly that guy: the /etc/grsec/learning.logs.

But I can remedy. I have the previous, crash system's dd dumped partitions.

And I'll do an experiment.

I recovered from the dd dumped system, now inexistent, frozen in dd for some more time JIC ([J]ust [I]n [C]ase), that's the older one:

Code: Select all: # ls -l learning.logs_170405_1346 learning.logs_170403_1340 -rw------- 1 root root 2647754 2017-04-03 13:40 learning.logs_170403_1340 -rw------- 1 root root 2618379 2017-04-05 13:33 learning.logs_170405_1346

And the experiemnt will consist in joining the two logs. And producing the policy afterwards... I'm not absolutely confident that can be done, but I hope it can.

And, I think I am simply going to try and add the new stuff of the latest system's learning.logs to the untouched previous system's learning.logs.

In the next post.
---
[1]
Air-Gapped Gentoo Install, Tentative
https://forums.gentoo.org/viewtopic-t-987268.html

Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion
https://forums.gentoo.org/viewtopic-t-9 ... ml#7613044

by **timbgo** » Wed Apr 05, 2017 11:54 am

[...add the new stuff of the latest system's learning.logs to the untouched previous system's learning.logs], and place it in /etc/grsec/learning.logs, and then disable grsec, and do the learning output.

So, there is the common, identical part, of the learning.logs of both the new and the previous (the crashed) system. It is identical in both, because both of them are clones of the same master, my Air-Gapped that never sees any internet. And I'll simply add the additions of the old, and of the new to it.

Indeed:

Code: Select all: # head -23148 learning.logs_170403_1340 > learning.logs_170403_1340_common ; head -23148 learning.logs_170405_1346 > learning.logs_170405_1346_common # ls -l learning.logs_170403_1340_common learning.logs_170405_1346_common -rw-r--r-- 1 root root 2569607 2017-04-05 14:57 learning.logs_170403_1340_common -rw-r--r-- 1 root root 2569607 2017-04-05 14:57 learning.logs_170405_1346_common # diff learning.logs_170403_1340_common learning.logs_170405_1346_common #

Some work:

Code: Select all: # diff learning.logs_170403_1340 learning.logs_170403_1340_common | grep '< '|sed 's/< //' > learning.logs_170403_1340_new # diff learning.logs_170405_1346 learning.logs_170405_1346_common | grep '< '|sed 's/< //' > learning.logs_170405_1346_new # ls -l learning.logs_17040?_13??_new -rw-r--r-- 1 root root 78147 2017-04-05 14:59 learning.logs_170403_1340_new -rw-r--r-- 1 root root 48772 2017-04-05 15:00 learning.logs_170405_1346_new # view learning.logs_170403_1340_common learning.logs_17040?_13??_new 3 files to edit # view -p learning.logs_170403_1340_common learning.logs_17040?_13??_new 3 files to edit # ls -l learning.logs_170403_1340_common learning.logs_17040?_13??_new -rw-r--r-- 1 root root 2569607 2017-04-05 14:57 learning.logs_170403_1340_common -rw-r--r-- 1 root root 78147 2017-04-05 14:59 learning.logs_170403_1340_new -rw-r--r-- 1 root root 48772 2017-04-05 15:00 learning.logs_170405_1346_new # cat learning.logs_170403_1340_common learning.logs_170403_1340_new learning.logs_170405_1346_new > learning.logs_$(date +%y%m%d_%H%M) # ls -l learning.logs_170403_1340_common learning.logs_170403_1340_new learning.logs_170405_1346_new learning.logs_170405_1501 -rw-r--r-- 1 root root 2569607 2017-04-05 14:57 learning.logs_170403_1340_common -rw-r--r-- 1 root root 78147 2017-04-05 14:59 learning.logs_170403_1340_new -rw-r--r-- 1 root root 48772 2017-04-05 15:00 learning.logs_170405_1346_new -rw-r--r-- 1 root root 2696526 2017-04-05 15:01 learning.logs_170405_1501 # echo 2696526-48772-78147|bc 2569607 #

And let's place that in /etc/grsec/learning.logs and do the usual procedure...

Just before we do it, look it up, that's a huge difference:

Code: Select all: # ls -l learning.logs_170405_1501 /etc/grsec/learning.logs -rw------- 1 root root 2618379 2017-04-05 13:33 /etc/grsec/learning.logs -rw-r--r-- 1 root root 2696526 2017-04-05 15:01 learning.logs_170405_1501

Code: Select all: # cat learning.logs_170405_1501 > /etc/grsec/learning.logs # ls -l learning.logs_170405_1501 /etc/grsec/learning.logs -rw------- 1 root root 2696526 2017-04-05 15:07 /etc/grsec/learning.logs -rw-r--r-- 1 root root 2696526 2017-04-05 15:01 learning.logs_170405_1501 #

And there's one important thing I must not forget to do now. Revert the /etc/grsec/policy to previous state, before I gave gradm the command to output the policies to it.

Code: Select all: # ls -tlr grsec_170404_g0n_00 /etc/grsec/policy -rw------- 1 root root 171599 2017-04-04 19:21 grsec_170404_g0n_00 -rw------- 1 root root 183705 2017-04-05 13:45 /etc/grsec/policy # cat grsec_170404_g0n_00 > /etc/grsec/policy # ls -tlr grsec_170404_g0n_00 /etc/grsec/policy -rw------- 1 root root 171599 2017-04-04 19:21 grsec_170404_g0n_00 -rw------- 1 root root 171599 2017-04-05 15:09 /etc/grsec/policy

And now, give gradm the command to output the policies:

Code: Select all: # grep RBAC /proc/$$/status # gradm -L /etc/grsec/learning.logs -O /etc/grsec/policy Beginning full learning object reduction for subject /usr/sbin/tcpdump...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-i386...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-arm...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /usr/sbin/virtlogd...done. Beginning full learning object reduction for subject /usr/sbin/libvirtd...done. Beginning full learning object reduction for subject /usr/libexec/libvirt_leaseshelper...done. Beginning full learning object reduction for subject /usr/bin/virsh...done. Beginning full learning object reduction for subject /...done. Beginning full learning object reduction for subject /usr/sbin/libvirtd...done. Beginning full learning object reduction for subject /usr/libexec/qemu-bridge-helper...done. Beginning full learning object reduction for subject /usr/bin/virt-install...done. Beginning full learning object reduction for subject /usr/bin/virsh...done. Beginning full learning object reduction for subject /usr/bin/qemu-system-x86_64...done. Beginning full learning object reduction for subject /usr/bin/python2.7...done. Beginning full learning object reduction for subject /usr/bin/gpg-connect-agent...done. #

What did we get? I'm as courious as the reader who had the stamina to reach here ;-)

.

Code: Select all: # ls -l grsec_170405_g0n_00-L /etc/grsec/policy -rw------- 1 root root 184710 2017-04-05 15:10 /etc/grsec/policy -rw------- 1 root root 183705 2017-04-05 13:45 grsec_170405_g0n_00-L # cp -iav /etc/grsec/policy grsec_170405_g0n_01-L '/etc/grsec/policy' -> 'grsec_170405_g0n_01-L' # ls -l grsec_170405_g0n_0?-L -rw------- 1 root root 183705 2017-04-05 13:45 grsec_170405_g0n_00-L -rw------- 1 root root 184710 2017-04-05 15:10 grsec_170405_g0n_01-L #

Could it be the best to show the difference btwn the two learned policies? ...

# diff -u35 grsec_170405_g0n_0?-L

Code: Select all: --- grsec_170405_g0n_00-L 2017-04-05 13:45:14.109089983 +0200 +++ grsec_170405_g0n_01-L 2017-04-05 15:10:13.787402379 +0200 @@ -9301,70 +9301,102 @@ /home/miro/.cache/libvirt/qemu rwc /home/miro/.cache/libvirt/qemu/cache rwc /home/miro/.cache/libvirt/storage rwcd /home/miro/.config rwcd /lib/modules h /lib64 rx /lib64/modules h /mnt h /mnt/sdd1/.gnupg /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /sys r /usr h /usr/bin x /usr/lib64 rx /usr/sbin h /usr/sbin/dnsmasq x /usr/sbin/libvirtd rx /usr/sbin/virtlogd x /usr/share h /usr/share/libvirt/cpu_map.xml r /var/log h -CAP_ALL bind 0.0.0.0/32:0 stream dgram ip tcp bind 0.0.0.0/32:5900 stream dgram ip tcp connect 192.168.2.2/32:0 dgram udp connect 127.0.0.1/32:0 dgram udp sock_allow_family ipv6 netlink } # Role: miro +subject /usr/libexec/qemu-bridge-helper o { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / h + /dev h + /dev/net/tun rw + /etc h + /etc/ld.so.cache r + /etc/qemu/bridge.conf r + /etc/qemu/miro.conf r + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /usr h + /usr/lib64/libcap-ng.so.0.0.0 rx + /usr/lib64/libglib-2.0.so.0.5000.3 rx + /usr/libexec/qemu-bridge-helper rx + -CAP_ALL + +CAP_NET_ADMIN + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: miro subject /usr/bin/virt-install oO { user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / h /Cmn h /Cmn/src/gnunet /bin h /bin/bash x /dev h /dev/tty rw /etc h /etc/ld.so.cache r /home /lib64 rx /lib64/modules h /usr h /usr/bin/virt-install rx /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/share/virt-manager/virt-install x -CAP_ALL bind disabled connect disabled sock_allow_family unix inet } # Role: miro subject /usr/bin/virsh o { user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / /boot h /dev h @@ -9387,99 +9419,117 @@ /home/miro/.cache/libvirt/virsh/history r /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /sys h /usr h /usr/bin h /usr/bin/virsh rx /usr/lib64 rx /usr/sbin h /usr/sbin/libvirtd x /usr/share h /usr/share/locale r /usr/share/terminfo r /var/log h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet ipv6 } # Role: miro subject /usr/bin/qemu-system-x86_64 o { user_transition_allow qemu group_transition_allow kvm libvirt qemu / /boot h /dev h + /dev/bus/usb + /dev/bus/usb/001/003 rw /dev/kvm rw /dev/null rw - /etc h - /etc/ld.so.cache r + /dev/urandom r + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/passwd h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h /home h + /home/miro h + /home/miro/.Xauthority r + /home/miro/.config h /home/miro/.config/libvirt/qemu/lib/capabilities.monitor.sock wc /home/miro/.config/libvirt/qemu/lib/capabilities.pidfile rwc + /home/miro/heads-0.1-amd64-live.iso r + /home/miro/usb_disk.img rw /lib/modules h /lib64 rx /lib64/modules h - /proc + /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h - /proc/sys h - /sys h + /sys r /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx - /usr/share h - /usr/share/qemu - /var/log h + /usr/libexec h + /usr/libexec/qemu-bridge-helper x + /usr/share r + /var h + /var/cache h + /var/cache/fontconfig r -CAP_ALL bind disabled connect disabled - sock_allow_family unix inet + sock_allow_family unix inet netlink } # Role: miro subject /usr/bin/python2.7 o { / /boot h /dev h /dev/null rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt /etc/ssl/openssl.cnf r /home /home/miro /home/miro/.cache /home/miro/.cache/libvirt rwcd /home/miro/.cache/virt-manager wc /home/miro/tails-i386-2.10.iso r /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h

Oh, yes! That could be a lot of difference. Some of it wouldn't allow VMs to run, I'm pretty sure!

But still more work there remains to do.

by **timbgo** » Wed Apr 05, 2017 11:55 am

[Still more work] remaining because I haven't fully deployed libvirt protected under grsecurity's protection, and I don't know whether to leave its programs subjects under learning, because I've been running mostly pure Qemu since days now... With apparently no issues (the crash I think was related to virtualization, but there wasn't much in the logs at all, and I didn't investigate)...

There I two goals that I set to accomplish with these last five posts (this is 5th post today in this topic): get the learned tcpdump policies done, and get just qemu related programs' learned policies done.

I think, but I don't know for sure, that I should post these posts in the topic on Libvirt virtualization policies, because it builds mostly on matters solve in that topic, and just link to Libvirt virtualization topic from the tcpdump topic.

Because I hope tcpdump will now start working correctly under grsecurity. (Did I forget to say it would lose packets, and that I turned to using dumpcap instead... I think I forgot... But, yes, that was the case, and I never found time to investigate why, but it probably is because of the user and group not having been learned.)

The more work, however, consists in editing the policies that grsecurity automatically made.

Which is next, now.

Code: Select all: # cp -iav grsec_170405_g0n_07 /etc/grsec/policy cp: overwrite '/etc/grsec/policy'? y 'grsec_170405_g0n_07' -> '/etc/grsec/policy' #

is the end result. But esp. the less advanced will have difficulty uderstanding even what I prepared, let alone if I posted:

Code: Select all: # diff grsec_170405_g0n_01-L grsec_170405_g0n_07 | wc -l 1032

And I couldn't do it without getting frustrated at too many repetitive pasting and tying without the diffing_script.sh...

So, the argument to it...

Code: Select all: # ls -l grsec_170405_g0n_01-L grsec_170405_g0n_0[0-7] -rw------- 1 root root 184710 2017-04-05 15:10 grsec_170405_g0n_01-L -rw------- 1 root root 178029 2017-04-05 15:49 grsec_170405_g0n_02 -rw------- 1 root root 177540 2017-04-05 15:55 grsec_170405_g0n_03 -rw------- 1 root root 177539 2017-04-05 15:58 grsec_170405_g0n_04 -rw------- 1 root root 176729 2017-04-05 16:02 grsec_170405_g0n_05 -rw------- 1 root root 176307 2017-04-05 16:08 grsec_170405_g0n_06 -rw------- 1 root root 176131 2017-04-05 16:12 grsec_170405_g0n_07

...is:

Code: Select all: grsec_170405_g0n_01-L grsec_170405_g0n_0[0-7]

, and the result is...

The result is almost 45k, needs a post of its own.

by **timbgo** » Wed Apr 05, 2017 12:01 pm

diff -u30 ./grsec_170405_g0n_01-L ./grsec_170405_g0n_02

Code: Select all: --- ./grsec_170405_g0n_01-L 2017-04-05 15:10:13.787402379 +0200 +++ ./grsec_170405_g0n_02 2017-04-05 15:49:26.699546514 +0200 @@ -8878,60 +8878,61 @@ # Role: miro subject /usr/sbin/sendmail o / h /dev h /dev/log rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/postfix h /etc/postfix/main.cf r /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/postdrop x /usr/sbin/sendmail x /var h /var/spool/postfix -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all + role tcpdump u role_allow_ip 0.0.0.0/32 # Role: tcpdump subject / o { / h -CAP_ALL bind disabled connect disabled } # Role: tcpdump subject /usr/sbin/tcpdump o { / h /Cmn h /Cmn/mr wc /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled } role qemu u @@ -9060,417 +9061,96 @@ /dev/null rw /etc h /etc/ld.so.cache r /lib/modules h /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h /usr/bin/qemu-system-arm x /usr/lib64 rx /usr/share h /usr/share/qemu /var h /var/lib/libvirt/qemu/capabilities.monitor.sock wc /var/lib/libvirt/qemu/capabilities.pidfile rwc -CAP_ALL bind disabled connect disabled } ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "root" ### -# Role: root -subject /usr/sbin/virtlogd oO { -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - - / h - /etc h - /etc/group r - /etc/passwd r - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /run h - /run/virtlogd.pid wd - /usr h - /usr/sbin/virtlogd rx - /usr/share/locale r - /var h - /var/log h - /var/log/libvirt h - /var/log/libvirt/qemu a - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet -} - -# Role: root -subject /usr/sbin/libvirtd oO { -user_transition_allow qemu nobody -group_transition_allow qemu nobody kvm libvirt - - / - /boot h - /dev h - /dev/kvm r - /dev/net/tun rw - /dev/null rw - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/libvirt h - /etc/libvirt/libvirt.conf r - /etc/libvirt/qemu wd - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /home - /home/miro rwd - /lib/modules h - /lib64/modules h - /mnt h - /mnt/sdd1/.gnupg - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /run rwcd - /sbin h - /sbin/iptables - /sbin/xtables-multi x - /sys r - /sys/fs h - /sys/fs/cgroup/memory/machine wd - /sys/fs/cgroup/memory/machine/qemu-18-tailsQ06.libvirt-qemu rwc - /sys/kernel h - /sys/kernel/iommu_groups - /sys/kernel/mm/hugepages - /sys/kernel/mm/hugepages/hugepages-2048kB/free_hugepages r - /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages r - /usr h - /usr/bin/qemu-system-arm - /usr/bin/qemu-system-i386 - /usr/bin/qemu-system-x86_64 - /usr/sbin/libvirtd rx - /var h - /var/cache/libvirt/qemu/capabilities - /var/cache/libvirt/qemu/capabilities/87ec9299b933cd6b566ae822928e0c2effac281ced4939efcabd4bb8e6aa643b.xml rwcd - /var/cache/libvirt/qemu/capabilities/926803a9278e445ec919c2b6cbd8c1c449c75b26dcb1686b774314180376c725.xml rwcd - /var/cache/libvirt/qemu/capabilities/f11008721aacc79c97e592178e61264d75be551864cd79cc41fe820e31262f27.xml rwcd - /var/lib/libvirt/dnsmasq/virbr0.status r - /var/lib/libvirt/qemu rwcd - /var/log/libvirt/qemu - -CAP_ALL - +CAP_CHOWN - +CAP_DAC_OVERRIDE - +CAP_DAC_READ_SEARCH - +CAP_KILL - +CAP_SETGID - +CAP_SETUID - +CAP_NET_ADMIN - +CAP_NET_RAW - bind 0.0.0.0/32:5901 stream dgram ip tcp - bind 0.0.0.0/32:5902 stream dgram ip tcp - bind 0.0.0.0/32:0 stream dgram ip tcp - bind 0.0.0.0/32:5900 stream dgram ip tcp - connect 192.168.2.2/32:0 dgram udp - connect 127.0.0.1/32:0 dgram udp - sock_allow_family ipv6 netlink packet -} - -# Role: root -subject /usr/libexec/libvirt_leaseshelper oO { -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - - / h - /etc h - /etc/ld.so.cache r - /lib64 rx - /lib64/modules h - /run h - /run/leaseshelper.pid wcd - /usr h - /usr/lib64 rx - /usr/libexec h - /usr/libexec/libvirt_leaseshelper rx - /var h - /var/lib/libvirt/dnsmasq/virbr0.status rwcd - /var/lib/libvirt/dnsmasq/virbr0.status.new rwcd - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet -} - -# Role: root -subject /usr/bin/virsh o { -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu - - / h - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/libvirt h - /etc/libvirt/libvirt.conf r - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /etc/ssl h - /etc/ssl/openssl.cnf r - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /root h - /root/.cache/libvirt/virsh - /root/.cache/libvirt/virsh/history rwcd - /root/.cache/libvirt/virsh/history-07198.tmp rwcd - /root/.cache/libvirt/virsh/history-19280.tmp rwcd - /root/.cache/libvirt/virsh/history-28893.tmp rwcd - /run h - /run/libvirt/libvirt-sock rw - /usr h - /usr/bin h - /usr/bin/virsh rx - /usr/lib64 rx - /usr/share h - /usr/share/locale r - /usr/share/terminfo r - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet ipv6 -} - ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "miro" ### -# Role: miro -subject /usr/sbin/libvirtd oO { -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - - / - /boot h - /dev h - /dev/kvm - /dev/log rw - /dev/null rw - /dev/urandom r - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /home - /home/miro r - /home/miro/.cache r - /home/miro/.cache/libvirt rwcd - /home/miro/.cache/libvirt/qemu rwc - /home/miro/.cache/libvirt/qemu/cache rwc - /home/miro/.cache/libvirt/storage rwcd - /home/miro/.config rwcd - /lib/modules h - /lib64 rx - /lib64/modules h - /mnt h - /mnt/sdd1/.gnupg - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /sys r - /usr h - /usr/bin x - /usr/lib64 rx - /usr/sbin h - /usr/sbin/dnsmasq x - /usr/sbin/libvirtd rx - /usr/sbin/virtlogd x - /usr/share h - /usr/share/libvirt/cpu_map.xml r - /var/log h - -CAP_ALL - bind 0.0.0.0/32:0 stream dgram ip tcp - bind 0.0.0.0/32:5900 stream dgram ip tcp - connect 192.168.2.2/32:0 dgram udp - connect 127.0.0.1/32:0 dgram udp - sock_allow_family ipv6 netlink -} # Role: miro subject /usr/libexec/qemu-bridge-helper o { user_transition_allow qemu group_transition_allow kvm libvirt qemu / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.5000.3 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet } # Role: miro -subject /usr/bin/virt-install oO { -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu - - / h - /Cmn h - /Cmn/src/gnunet - /bin h - /bin/bash x - /dev h - /dev/tty rw - /etc h - /etc/ld.so.cache r - /home - /lib64 rx - /lib64/modules h - /usr h - /usr/bin/virt-install rx - /usr/lib64/gconv/gconv-modules.cache r - /usr/lib64/locale/locale-archive r - /usr/share/virt-manager/virt-install x - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet -} - -# Role: miro -subject /usr/bin/virsh o { -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu - - / - /boot h - /dev h - /dev/null rw - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /etc/ssl h - /etc/ssl/openssl.cnf r - /home h - /home/miro/.cache/libvirt - /home/miro/.cache/libvirt/libvirt-sock rw - /home/miro/.cache/libvirt/libvirtd.lock rwcd - /home/miro/.cache/libvirt/virsh/history r - /lib/modules h - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /sys h - /usr h - /usr/bin h - /usr/bin/virsh rx - /usr/lib64 rx - /usr/sbin h - /usr/sbin/libvirtd x - /usr/share h - /usr/share/locale r - /usr/share/terminfo r - /var/log h - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet ipv6 -} - -# Role: miro subject /usr/bin/qemu-system-x86_64 o { user_transition_allow qemu group_transition_allow kvm libvirt qemu / /boot h /dev h /dev/bus/usb /dev/bus/usb/001/003 rw /dev/kvm rw /dev/null rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro h /home/miro/.Xauthority r /home/miro/.config h /home/miro/.config/libvirt/qemu/lib/capabilities.monitor.sock wc /home/miro/.config/libvirt/qemu/lib/capabilities.pidfile rwc /home/miro/heads-0.1-amd64-live.iso r /home/miro/usb_disk.img rw @@ -9548,32 +9228,30 @@ /usr/sbin/libvirtd x /usr/share r /usr/src h /var/log h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet ipv6 } # Role: miro subject /usr/bin/gpg-connect-agent o { / h /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /mnt h /mnt/sdd1/.gnupg/S.gpg-agent rw /usr h /usr/bin h /usr/bin/gpg-connect-agent rx /usr/lib64 rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet } - -

Perusing the above, you can see that I just added one blank line before:

Code: Select all: + role tcpdump u

added by gradm at the very end of the /etc/grsec/policy which I installed right before running the outputting of the learned policies.

And I also removed all the libvirt subjects whatsoever. Still not working, remains under learning. What else to do... Currently not using libvirt... Only pure Qemu.

Next change... (Oh, pls. bear in mind that these are step changes for purposes of explanation. These would not be functional on their own! If I weren't posting (and posting with newbies in mind ;-)

), I would have done all of these changes in one go.
diff -u30 ./grsec_170405_g0n_02 ./grsec_170405_g0n_03

Code: Select all: --- ./grsec_170405_g0n_02 2017-04-05 15:49:26.699546514 +0200 +++ ./grsec_170405_g0n_03 2017-04-05 15:55:07.239567375 +0200 @@ -4822,76 +4822,60 @@ /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: postfix subject /usr/sbin/postsuper o user_transition_allow root group_transition_allow root / h /var/spool/postfix wd -CAP_ALL bind disabled connect disabled -role qemu ul -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu - -role qemu gl -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu - -role tcpdump ul -user_transition_allow root nobody tcpdump miro -group_transition_allow root nobody tcpdump miro - -role tcpdump gl -user_transition_allow root nobody tcpdump miro -group_transition_allow root nobody tcpdump miro - ## Role: tcpdump #subject /usr/sbin/tcpdump o #user_transition_allow root nobody tcpdump miro #group_transition_allow root nobody tcpdump miro # / h # /Cmn rwc # /etc h # /etc/host.conf r # /etc/hosts r # /etc/ld.so.cache r # /etc/resolv.conf r # /lib64 h # /lib64/libnss_dns-2.23.so rx # /lib64/libresolv-2.23.so rx # /lib64/libresolv.so.2 rx # /proc r # /proc/bus h # /proc/kallsyms h # /proc/kcore h # /proc/modules h # /proc/slabinfo h # /proc/sys h # /usr h # /usr/sbin/tcpdump rx # -CAP_ALL # +CAP_DAC_OVERRIDE # bind 0.0.0.0/32:0 dgram ip # connect 127.0.0.1/32:53 dgram udp role miro u @@ -6406,65 +6390,79 @@ # /mnt/sdd1/.gnupg/S.gpg-agent.browser wcd # /mnt/sdd1/.gnupg/S.gpg-agent.extra wcd # /mnt/sdd1/.gnupg/S.gpg-agent.ssh wcd # /mnt/sdd1/.gnupg/private-keys-v1.d rwc # /mnt/sdd1/.gnupg/private-keys-v1.d/61D5243CD1CF616EBE7F2BEE3E830811B6BDCF85.key r # /mnt/sdd1/.gnupg/private-keys-v1.d/69DCB3F7DFF03B916BFADC92F522F46A64565D92.key /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h $gpg_programs /usr/lib64 rx /usr/share h /usr/share/locale r /var/log h /var/www/localhost/htdocs rwc -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet # Role: miro -subject /usr/bin/gpg-connect-agent ol +subject /usr/bin/gpg-connect-agent o { / h + /etc h + /etc/ld.so.cache r + /lib64 rx + /lib64/modules h + /mnt h + /mnt/sdd1/.gnupg/S.gpg-agent rw + /usr h + /usr/bin h + /usr/bin/gpg-connect-agent rx + /usr/lib64 rx + /usr/share h + /usr/share/locale r -CAP_ALL bind disabled connect disabled + sock_allow_family unix inet +} # Role: miro subject /usr/bin/gpg2 o / /Cmn h /Cmn/dLo rwc /Cmn/m* rwc /Cmn/src* rwc /boot h /dev h /dev/null rw /dev/pts /dev/random /dev/tty rw /dev/urandom r /etc h /etc/inputrc r /etc/ld.so.cache r /etc/localtime r /etc/terminfo /home h /home/miro rwcdl /home/miro/.gnupg rwcdl /lib/modules h /lib64 rx /lib64/modules h /mnt r /mnt/sdd1 rwcdl /mnt/sdd1/.gnupg rwcdl /proc @@ -8907,109 +8905,108 @@ sock_allow_family all role tcpdump u role_allow_ip 0.0.0.0/32 # Role: tcpdump subject / o { / h -CAP_ALL bind disabled connect disabled } # Role: tcpdump subject /usr/sbin/tcpdump o { / h /Cmn h /Cmn/mr wc /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled } - role qemu u role_allow_ip 0.0.0.0/32 # Role: qemu subject / o { / h /dev h /dev/kvm /home h /home/miro/tails_Q05.img /home/miro/tails_Q06.img /home/miro/tails_Q07.img /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin/qemu-system-arm x /usr/bin/qemu-system-i386 x /usr/bin/qemu-system-x86_64 x -CAP_ALL bind disabled connect disabled } -# Role: qemu -subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { - / h - /proc rw - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /usr h - /usr/lib64/gconv/gconv-modules.cache r - /var h - /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd - /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd - /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd - /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd - -CAP_ALL - bind disabled - connect disabled -} +## Role: qemu +#subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { +# / h +# /proc rw +# /proc/bus h +# /proc/kallsyms h +# /proc/kcore h +# /proc/modules h +# /proc/slabinfo h +# /proc/sys h +# /usr h +# /usr/lib64/gconv/gconv-modules.cache r +# /var h +# /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd +# /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd +# /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd +# /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd +# -CAP_ALL +# bind disabled +# connect disabled +#} # Role: qemu subject /usr/bin/qemu-system-x86_64 o { / /boot h /dev h /dev/kvm rw /dev/null rw /etc h /etc/ld.so.cache r /lib/modules h /lib64 rx /lib64/modules h /proc rw /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 x /usr/lib64 rx /usr/share h /usr/share/qemu /var h /var/lib/libvirt/qemu/capabilities.monitor.sock wc /var/lib/libvirt/qemu/capabilities.pidfile rwc @@ -9207,51 +9204,30 @@ /home/miro/tails-i386-2.10.iso r /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /run h /run/libvirt/libvirt-sock rw /sbin h /sbin/ldconfig x /sys h /usr /usr/bin /usr/bin/python2.7 rx /usr/bin/virt-viewer x /usr/lib64 rx /usr/sbin h /usr/sbin/libvirtd x /usr/share r /usr/src h /var/log h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet ipv6 } - -# Role: miro -subject /usr/bin/gpg-connect-agent o { - / h - /etc h - /etc/ld.so.cache r - /lib64 rx - /lib64/modules h - /mnt h - /mnt/sdd1/.gnupg/S.gpg-agent rw - /usr h - /usr/bin h - /usr/bin/gpg-connect-agent rx - /usr/lib64 rx - /usr/share h - /usr/share/locale r - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet -}

In the above you can see I removed qemu and tcpdump user and group set into learning more around lines 4822. Those I will be replacing with full no-more-under-learning policies.

And I also replaced the "subject /usr/bin/gpg-connect-agent ol" with the full policy.

Next...
diff -u30 ./grsec_170405_g0n_03 ./grsec_170405_g0n_04

Code: Select all: --- ./grsec_170405_g0n_03 2017-04-05 15:55:07.239567375 +0200 +++ ./grsec_170405_g0n_04 2017-04-05 15:58:30.397579820 +0200 @@ -4822,60 +4822,211 @@ /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: postfix subject /usr/sbin/postsuper o user_transition_allow root group_transition_allow root / h /var/spool/postfix wd -CAP_ALL bind disabled connect disabled +role qemu u +role_allow_ip 0.0.0.0/32 +# Role: qemu +subject / o { + / h + /dev h + /dev/kvm + /home h + /home/miro/tails_Q05.img + /home/miro/tails_Q06.img + /home/miro/tails_Q07.img + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /usr h + /usr/bin/qemu-system-arm x + /usr/bin/qemu-system-i386 x + /usr/bin/qemu-system-x86_64 x + -CAP_ALL + bind disabled + connect disabled +} + +## Role: qemu +#subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { +# / h +# /proc rw +# /proc/bus h +# /proc/kallsyms h +# /proc/kcore h +# /proc/modules h +# /proc/slabinfo h +# /proc/sys h +# /usr h +# /usr/lib64/gconv/gconv-modules.cache r +# /var h +# /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd +# /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd +# /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd +# /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd +# -CAP_ALL +# bind disabled +# connect disabled +#} + +# Role: qemu +subject /usr/bin/qemu-system-x86_64 o { + / + /boot h + /dev h + /dev/kvm rw + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc rw + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-x86_64 x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + /var/lib/libvirt/qemu/domain-17-tails_Q07/monitor.sock wd + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /usr/bin/qemu-system-i386 o { + / + /boot h + /dev h + /dev/kvm rw + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-i386 x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + -CAP_ALL + bind disabled + connect disabled +} + +# Role: qemu +subject /usr/bin/qemu-system-arm o { + / + /boot h + /dev h + /dev/null rw + /etc h + /etc/ld.so.cache r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /sys h + /usr h + /usr/bin h + /usr/bin/qemu-system-arm x + /usr/lib64 rx + /usr/share h + /usr/share/qemu + /var h + /var/lib/libvirt/qemu/capabilities.monitor.sock wc + /var/lib/libvirt/qemu/capabilities.pidfile rwc + -CAP_ALL + bind disabled + connect disabled +} + ## Role: tcpdump #subject /usr/sbin/tcpdump o #user_transition_allow root nobody tcpdump miro #group_transition_allow root nobody tcpdump miro # / h # /Cmn rwc # /etc h # /etc/host.conf r # /etc/hosts r # /etc/ld.so.cache r # /etc/resolv.conf r # /lib64 h # /lib64/libnss_dns-2.23.so rx # /lib64/libresolv-2.23.so rx # /lib64/libresolv.so.2 rx # /proc r # /proc/bus h # /proc/kallsyms h # /proc/kcore h # /proc/modules h # /proc/slabinfo h # /proc/sys h # /usr h # /usr/sbin/tcpdump rx # -CAP_ALL # +CAP_DAC_OVERRIDE # bind 0.0.0.0/32:0 dgram ip # connect 127.0.0.1/32:53 dgram udp role miro u @@ -8905,212 +9056,60 @@ sock_allow_family all role tcpdump u role_allow_ip 0.0.0.0/32 # Role: tcpdump subject / o { / h -CAP_ALL bind disabled connect disabled } # Role: tcpdump subject /usr/sbin/tcpdump o { / h /Cmn h /Cmn/mr wc /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled } -role qemu u -role_allow_ip 0.0.0.0/32 -# Role: qemu -subject / o { - / h - /dev h - /dev/kvm - /home h - /home/miro/tails_Q05.img - /home/miro/tails_Q06.img - /home/miro/tails_Q07.img - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /usr h - /usr/bin/qemu-system-arm x - /usr/bin/qemu-system-i386 x - /usr/bin/qemu-system-x86_64 x - -CAP_ALL - bind disabled - connect disabled -} - -## Role: qemu -#subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { -# / h -# /proc rw -# /proc/bus h -# /proc/kallsyms h -# /proc/kcore h -# /proc/modules h -# /proc/slabinfo h -# /proc/sys h -# /usr h -# /usr/lib64/gconv/gconv-modules.cache r -# /var h -# /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd -# /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd -# /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd -# /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd -# -CAP_ALL -# bind disabled -# connect disabled -#} - -# Role: qemu -subject /usr/bin/qemu-system-x86_64 o { - / - /boot h - /dev h - /dev/kvm rw - /dev/null rw - /etc h - /etc/ld.so.cache r - /lib/modules h - /lib64 rx - /lib64/modules h - /proc rw - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /sys h - /usr h - /usr/bin h - /usr/bin/qemu-system-x86_64 x - /usr/lib64 rx - /usr/share h - /usr/share/qemu - /var h - /var/lib/libvirt/qemu/capabilities.monitor.sock wc - /var/lib/libvirt/qemu/capabilities.pidfile rwc - /var/lib/libvirt/qemu/domain-17-tails_Q07/monitor.sock wd - -CAP_ALL - bind disabled - connect disabled -} - -# Role: qemu -subject /usr/bin/qemu-system-i386 o { - / - /boot h - /dev h - /dev/kvm rw - /dev/null rw - /etc h - /etc/ld.so.cache r - /lib/modules h - /lib64 rx - /lib64/modules h - /proc - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /sys h - /usr h - /usr/bin h - /usr/bin/qemu-system-i386 x - /usr/lib64 rx - /usr/share h - /usr/share/qemu - /var h - /var/lib/libvirt/qemu/capabilities.monitor.sock wc - /var/lib/libvirt/qemu/capabilities.pidfile rwc - -CAP_ALL - bind disabled - connect disabled -} - -# Role: qemu -subject /usr/bin/qemu-system-arm o { - / - /boot h - /dev h - /dev/null rw - /etc h - /etc/ld.so.cache r - /lib/modules h - /lib64 rx - /lib64/modules h - /proc - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /sys h - /usr h - /usr/bin h - /usr/bin/qemu-system-arm x - /usr/lib64 rx - /usr/share h - /usr/share/qemu - /var h - /var/lib/libvirt/qemu/capabilities.monitor.sock wc - /var/lib/libvirt/qemu/capabilities.pidfile rwc - -CAP_ALL - bind disabled - connect disabled -} - - ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "root" ### ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "miro" ### # Role: miro subject /usr/libexec/qemu-bridge-helper o { user_transition_allow qemu group_transition_allow kvm libvirt qemu / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.5000.3 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL

role qemu is set in place above.
Also I commented out the:

Code: Select all: subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o

(and I removed it in the next diff), because that subject is plain wrong... That's temporary install during building of qemu... Maybe that partly expains similar subjects that I had in connection with port 80 and port 0 denied lines...

php-cgi and nonexisting connections to udp/80 (and udp/0)?
viewtopic.php?f=3&t=2951&start=15#p16324

( but I wasn't able to find the reference to /var/tmp/... there. Pls. forgo this remark above for now... And I'll mark it with:
LINK here
in case I do find out where I had such /var/tmp/portage/ ... stuff
)

Next:
diff -u30 ./grsec_170405_g0n_04 ./grsec_170405_g0n_05

Code: Select all: --- ./grsec_170405_g0n_04 2017-04-05 15:58:30.397579820 +0200 +++ ./grsec_170405_g0n_05 2017-04-05 16:02:26.452594280 +0200 @@ -4849,82 +4849,60 @@ bind disabled connect disabled role qemu u role_allow_ip 0.0.0.0/32 # Role: qemu subject / o { / h /dev h /dev/kvm /home h /home/miro/tails_Q05.img /home/miro/tails_Q06.img /home/miro/tails_Q07.img /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin/qemu-system-arm x /usr/bin/qemu-system-i386 x /usr/bin/qemu-system-x86_64 x -CAP_ALL bind disabled connect disabled } -## Role: qemu -#subject /var/tmp/portage/app-emulation/qemu-2.8.0-r3/image/usr/bin/qemu-system-x86_64 o { -# / h -# /proc rw -# /proc/bus h -# /proc/kallsyms h -# /proc/kcore h -# /proc/modules h -# /proc/slabinfo h -# /proc/sys h -# /usr h -# /usr/lib64/gconv/gconv-modules.cache r -# /var h -# /var/lib/libvirt/qemu/domain-12-tails_Q06/monitor.sock wd -# /var/lib/libvirt/qemu/domain-2-demo/monitor.sock wd -# /var/lib/libvirt/qemu/domain-4-tails_demo/monitor.sock wd -# /var/lib/libvirt/qemu/domain-5-tails_Q02/monitor.sock wd -# -CAP_ALL -# bind disabled -# connect disabled -#} - # Role: qemu subject /usr/bin/qemu-system-x86_64 o { / /boot h /dev h /dev/kvm rw /dev/null rw /etc h /etc/ld.so.cache r /lib/modules h /lib64 rx /lib64/modules h /proc rw /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 x /usr/lib64 rx /usr/share h /usr/share/qemu /var h /var/lib/libvirt/qemu/capabilities.monitor.sock wc /var/lib/libvirt/qemu/capabilities.pidfile rwc /var/lib/libvirt/qemu/domain-17-tails_Q07/monitor.sock wd @@ -7433,67 +7411,146 @@ connect disabled # Role: miro subject /usr/libexec/libvirt-guests.sh oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/libvirt_iohelper oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/libvirt_leaseshelper oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro -subject /usr/libexec/qemu-bridge-helper ol +subject /usr/libexec/qemu-bridge-helper o { user_transition_allow qemu group_transition_allow kvm libvirt qemu - / h + + / h + /dev h + /dev/net/tun rw + /etc h + /etc/ld.so.cache r + /etc/qemu/bridge.conf r + /etc/qemu/miro.conf r + /lib64 rx + /lib64/modules h + /proc + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + /usr h + /usr/lib64/libcap-ng.so.0.0.0 rx + /usr/lib64/libglib-2.0.so.0.5000.3 rx + /usr/libexec/qemu-bridge-helper rx + -CAP_ALL + +CAP_NET_ADMIN + bind disabled + connect disabled + sock_allow_family unix inet +} + +# Role: miro +subject /usr/bin/qemu-system-x86_64 o { +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + + / + /boot h + /dev h + /dev/bus/usb + /dev/bus/usb/001/003 rw + /dev/kvm rw + /dev/null rw + /dev/urandom r + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/passwd h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /home h + /home/miro r + /home/miro/.Xauthority r + /home/miro/.config h + /home/miro/.config/libvirt/qemu/lib/capabilities.monitor.sock wc + /home/miro/.config/libvirt/qemu/lib/capabilities.pidfile rwc + /home/miro/*.img rw + /lib/modules h + /lib64 rx + /lib64/modules h + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /sys r + /usr h + /usr/bin h + /usr/bin/qemu-system-x86_64 rx + /usr/lib64 rx + /usr/libexec h + /usr/libexec/qemu-bridge-helper x + /usr/share r + /var h + /var/cache h + /var/cache/fontconfig r -CAP_ALL bind disabled connect disabled + sock_allow_family unix inet netlink +} # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h /Cmn/Kaff wc /Cmn/dLo wc /Cmn/MyVideos rwc /Cmn/gX* wc /Cmn/naibdX wc /Cmn/m* wc /dev h /dev/sg0 rw /etc h /etc/default/cdrecord r /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /lib64/libcap.so.2.25 rx /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h @@ -9061,149 +9118,60 @@ subject / o { / h -CAP_ALL bind disabled connect disabled } # Role: tcpdump subject /usr/sbin/tcpdump o { / h /Cmn h /Cmn/mr wc /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled } ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "root" ### ### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "miro" ### # Role: miro -subject /usr/libexec/qemu-bridge-helper o { -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - - / h - /dev h - /dev/net/tun rw - /etc h - /etc/ld.so.cache r - /etc/qemu/bridge.conf r - /etc/qemu/miro.conf r - /lib64 rx - /lib64/modules h - /proc - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /usr h - /usr/lib64/libcap-ng.so.0.0.0 rx - /usr/lib64/libglib-2.0.so.0.5000.3 rx - /usr/libexec/qemu-bridge-helper rx - -CAP_ALL - +CAP_NET_ADMIN - bind disabled - connect disabled - sock_allow_family unix inet -} - -# Role: miro -subject /usr/bin/qemu-system-x86_64 o { -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - - / - /boot h - /dev h - /dev/bus/usb - /dev/bus/usb/001/003 rw - /dev/kvm rw - /dev/null rw - /dev/urandom r - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/passwd h - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /home h - /home/miro h - /home/miro/.Xauthority r - /home/miro/.config h - /home/miro/.config/libvirt/qemu/lib/capabilities.monitor.sock wc - /home/miro/.config/libvirt/qemu/lib/capabilities.pidfile rwc - /home/miro/heads-0.1-amd64-live.iso r - /home/miro/usb_disk.img rw - /lib/modules h - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /sys r - /usr h - /usr/bin h - /usr/bin/qemu-system-x86_64 rx - /usr/lib64 rx - /usr/libexec h - /usr/libexec/qemu-bridge-helper x - /usr/share r - /var h - /var/cache h - /var/cache/fontconfig r - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet netlink -} - -# Role: miro subject /usr/bin/python2.7 o { / /boot h /dev h /dev/null rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt /etc/ssl/openssl.cnf r /home /home/miro /home/miro/.cache /home/miro/.cache/libvirt rwcd /home/miro/.cache/virt-manager wc /home/miro/tails-i386-2.10.iso r /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h

Some more qemu binaries are put in place in the diff above.

Next:
diff -u30 ./grsec_170405_g0n_05 ./grsec_170405_g0n_06

Code: Select all: --- ./grsec_170405_g0n_05 2017-04-05 16:02:26.452594280 +0200 +++ ./grsec_170405_g0n_06 2017-04-05 16:08:06.463615108 +0200 @@ -4951,60 +4951,88 @@ /boot h /dev h /dev/null rw /etc h /etc/ld.so.cache r /lib/modules h /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h /usr/bin/qemu-system-arm x /usr/lib64 rx /usr/share h /usr/share/qemu /var h /var/lib/libvirt/qemu/capabilities.monitor.sock wc /var/lib/libvirt/qemu/capabilities.pidfile rwc -CAP_ALL bind disabled connect disabled } +role tcpdump u +role_allow_ip 0.0.0.0/32 +# Role: tcpdump +subject / o { + / h + -CAP_ALL + bind disabled + connect disabled +} + +# Role: tcpdump +subject /usr/sbin/tcpdump o { + / h + /Cmn h + /Cmn/mr wc + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /proc/sys h + -CAP_ALL + +CAP_DAC_OVERRIDE + bind disabled + connect disabled +} + ## Role: tcpdump #subject /usr/sbin/tcpdump o #user_transition_allow root nobody tcpdump miro #group_transition_allow root nobody tcpdump miro # / h # /Cmn rwc # /etc h # /etc/host.conf r # /etc/hosts r # /etc/ld.so.cache r # /etc/resolv.conf r # /lib64 h # /lib64/libnss_dns-2.23.so rx # /lib64/libresolv-2.23.so rx # /lib64/libresolv.so.2 rx # /proc r # /proc/bus h # /proc/kallsyms h # /proc/kcore h # /proc/modules h # /proc/slabinfo h # /proc/sys h # /usr h # /usr/sbin/tcpdump rx # -CAP_ALL # +CAP_DAC_OVERRIDE # bind 0.0.0.0/32:0 dgram ip # connect 127.0.0.1/32:53 dgram udp role miro u @@ -7306,65 +7334,113 @@ /etc/ssl h /etc/ssl/openssl.cnf r /home h /home/miro rw /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/openssl rx /usr/lib64 h /usr/lib64/libcrypto.so.1.* rx /usr/lib64/libssl.so.1.* rx /usr/share r -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 192.168.3.0/24:443 stream tcp connect 0.0.0.0/0:443 stream tcp connect 0.0.0.0/0:993 stream tcp connect 0.0.0.0/0:995 stream tcp connect 192.168.1.1/32:53 dgram udp # Role: miro -subject /usr/bin/python2.7 ol - / h +subject /usr/bin/python2.7 o { + / + /boot h + /dev h + /dev/null rw + /dev/urandom r + /etc r + /etc/grsec h + /etc/gshadow h + /etc/gshadow- h + /etc/ppp h + /etc/samba/smbpasswd h + /etc/shadow h + /etc/shadow- h + /etc/ssh h + /etc/ssl h + /etc/ssl/certs/ca-certificates.crt + /etc/ssl/openssl.cnf r + /home + /home/miro + /home/miro/.cache + /home/miro/.cache/libvirt rwcd + /home/miro/.cache/virt-manager wc + /home/miro/*.iso r + /lib/modules h + /lib64 rx + /lib64/modules h + /proc r + /proc/bus h + /proc/kallsyms h + /proc/kcore h + /proc/modules h + /proc/slabinfo h + /run h + /run/libvirt/libvirt-sock rw + /sbin h + /sbin/ldconfig x + /sys h + /usr + /usr/bin + /usr/bin/python2.7 rx + /usr/bin/virt-viewer x + /usr/lib64 rx + /usr/sbin h + /usr/sbin/libvirtd x + /usr/share r + /usr/src h + /var/log h -CAP_ALL bind disabled connect disabled + sock_allow_family unix inet ipv6 +} # Role: miro subject /usr/bin/python3.4m o / h /Cmn h /Cmn/Kaff rwcd /bin h /bin/bash x /dev h /dev/null rw /dev/urandom r /etc h /etc/hosts r /etc/ld.so.cache r /etc/localtime r /etc/mime.types r /etc/resolv.conf /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sbin h /sbin/ldconfig x /tmp rwcd /usr @@ -7375,69 +7451,60 @@ /usr/lib64/locale h /usr/lib64/locale/locale-archive r /usr/lib64/python3.4 r /usr/lib64/python3.4/collections h /usr/lib64/python3.4/collections/__init__.py /usr/lib64/python3.4/collections/__pycache__/__init__.cpython-34.pyc r /usr/lib64/python3.4/ctypes /usr/lib64/python3.4/ctypes/__pycache__ r /usr/lib64/python3.4/encodings /usr/lib64/python3.4/encodings/__pycache__ r /usr/lib64/python3.4/html /usr/lib64/python3.4/html/__pycache__ r /usr/lib64/python3.4/json /usr/lib64/python3.4/json/__pycache__ r /usr/lib64/python3.4/lib-dynload rx /usr/lib64/python3.4/site-packages r /usr/lib64/python3.4/site-packages/youtube_dl r /usr/lib64/python3.4/site-packages/youtube_dl/__pycache__ rwc /usr/lib64/python3.4/xml r /usr/lib64/python3.4/xml/etree /usr/lib64/python3.4/xml/etree/__pycache__ r /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro -subject /usr/bin/qemu-system-x86_64 ol -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - / h - -CAP_ALL - bind disabled - connect disabled - -# Role: miro subject /usr/libexec/libvirt-guests.sh oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/libvirt_iohelper oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/libvirt_leaseshelper oOl user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/qemu-bridge-helper o { user_transition_allow qemu group_transition_allow kvm libvirt qemu @@ -9084,117 +9151,30 @@ # Role: miro subject /usr/sbin/sendmail o / h /dev h /dev/log rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/postfix h /etc/postfix/main.cf r /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/postdrop x /usr/sbin/sendmail x /var h /var/spool/postfix -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all - -role tcpdump u -role_allow_ip 0.0.0.0/32 -# Role: tcpdump -subject / o { - / h - -CAP_ALL - bind disabled - connect disabled -} - -# Role: tcpdump -subject /usr/sbin/tcpdump o { - / h - /Cmn h - /Cmn/mr wc - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - -CAP_ALL - +CAP_DAC_OVERRIDE - bind disabled - connect disabled -} - -### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "root" ### - -### THE BELOW SUBJECT(S) SHOULD BE ADDED TO THE USER ROLE "miro" ### - -# Role: miro -subject /usr/bin/python2.7 o { - / - /boot h - /dev h - /dev/null rw - /dev/urandom r - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/ppp h - /etc/samba/smbpasswd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /etc/ssl h - /etc/ssl/certs/ca-certificates.crt - /etc/ssl/openssl.cnf r - /home - /home/miro - /home/miro/.cache - /home/miro/.cache/libvirt rwcd - /home/miro/.cache/virt-manager wc - /home/miro/tails-i386-2.10.iso r - /lib/modules h - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /run h - /run/libvirt/libvirt-sock rw - /sbin h - /sbin/ldconfig x - /sys h - /usr - /usr/bin - /usr/bin/python2.7 rx - /usr/bin/virt-viewer x - /usr/lib64 rx - /usr/sbin h - /usr/sbin/libvirtd x - /usr/share r - /usr/src h - /var/log h - -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet ipv6 -}

More program subjects are put in place, qemu and pyhon2.7, and more learning settings removed.

The last of this batch:
diff -u30 ./grsec_170405_g0n_06 ./grsec_170405_g0n_07

Code: Select all: --- ./grsec_170405_g0n_06 2017-04-05 16:08:06.463615108 +0200 +++ ./grsec_170405_g0n_07 2017-04-05 16:12:38.024631744 +0200 @@ -3786,69 +3786,60 @@ /home/miro /home/miro/Maildir rwcdl /lib64 rx /lib64/modules h /proc h /proc/sys/kernel/ngroups_max r /root /root/Maildir rwcdl /sys h /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: root -subject /usr/libexec/qemu-bridge-helper ol -user_transition_allow qemu -group_transition_allow kvm libvirt qemu - / h - -CAP_ALL - bind disabled - connect disabled - -# Role: root subject /usr/sbin/apache2 o user_transition_allow apache group_transition_allow apache / h /etc h /etc/group r /proc h /proc/sys/kernel/ngroups_max r /run h /run/apache2.pid wd /run/cgisock* wd /usr h /usr/sbin/apache2 rx /var/log/apache2/cgi.log w -CAP_ALL +CAP_KILL +CAP_SETGID +CAP_SETUID bind disabled connect disabled sock_allow_family all # Role: root subject /usr/sbin/conntrackd o / h /etc /etc/localtime r /run/conntrackd.ctl wd /run/lock /run/lock/conntrack.lock wd

I removed the qemu-bridge-helper learning setting for root, because I don't run qemu as root.

And there's one more change:

diff -u grsec_170405_g0n_07 grsec_170405_g0n_08

Code: Select all: --- grsec_170405_g0n_07 2017-04-05 16:12:38.024631744 +0200 +++ grsec_170405_g0n_08 2017-04-05 16:46:40.675756872 +0200 @@ -4848,9 +4848,7 @@ /dev h /dev/kvm /home h - /home/miro/tails_Q05.img - /home/miro/tails_Q06.img - /home/miro/tails_Q07.img + /home/miro/*.img r /proc r /proc/bus h /proc/kallsyms h

and now I will:

Code: Select all: # cp -iav grsec_170405_g0n_08 /etc/grsec/policy cp: overwrite '/etc/grsec/policy'? y 'grsec_170405_g0n_08' -> '/etc/grsec/policy' #

So, next is trying and enable gradm, and use those programs under RBAC rules.

by **timbgo** » Wed Apr 05, 2017 12:04 pm

I still have these unsolved (or commented out, the gnupg programs) under
learning:

Code: Select all: # grep -B1 -E ' ol| oOl' grsec_170405_g0n_08 # Role: root subject /usr/bin/virsh ol -- # Role: root subject /usr/bin/virt-install oOl -- # Role: root subject /usr/bin/virt-viewer oOl -- # Role: root subject /usr/libexec/libvirt-guests.sh oOl -- # Role: root subject /usr/libexec/libvirt_iohelper oOl -- # Role: root subject /usr/libexec/libvirt_leaseshelper oOl -- # Role: root subject /usr/sbin/libvirtd oOl -- # Role: root subject /usr/sbin/virtlockd oOl -- # Role: root subject /usr/sbin/virtlogd oOl -- ## Role: miro #subject /usr/bin/gpgparsemail ol -- ## Role: miro #subject /usr/bin/gpgscm ol -- ## Role: miro #subject /usr/bin/gpgsm ol -- ## Role: miro #subject /usr/bin/gpgtar ol -- ## Role: miro #subject /usr/bin/gpgv2 ol -- # Role: miro subject /usr/libexec/libvirt-guests.sh oOl -- # Role: miro subject /usr/libexec/libvirt_iohelper oOl -- # Role: miro subject /usr/libexec/libvirt_leaseshelper oOl -- # Role: miro subject /usr/bin/virsh ol -- # Role: miro subject /usr/bin/virt-install oOl -- # Role: miro subject /usr/bin/virt-viewer oOl -- # Role: miro subject /usr/sbin/libvirtd oOl -- # Role: miro subject /usr/sbin/virtlockd oOl -- # Role: miro subject /usr/sbin/virtlogd oOl

So:

Code: Select all: # gradm -L /etc/grsec/learning.logs -E

is in order. What shall happen?...

Code: Select all: Error on line 4851 of /etc/grsec/policy: Object /home/miro needs to be specified in the same subject as globbed object /home/miro/*.img. The RBAC system will not be allowed to be enabled until this error is corrected.

That's not much... And I knew that, just forgot to apply it...

Code: Select all: # cp -aiv grsec_170405_g0n_08 grsec_170405_g0n_09 'grsec_170405_g0n_08' -> 'grsec_170405_g0n_09' #

# diff -u grsec_170405_g0n_08 grsec_170405_g0n_09

Code: Select all: --- grsec_170405_g0n_08 2017-04-05 14:46:40.675756872 +0000 +++ grsec_170405_g0n_09 2017-04-05 14:55:11.592788170 +0000 @@ -4848,6 +4848,7 @@ /dev h /dev/kvm /home h + /home/miro /home/miro/*.img r /proc r /proc/bus h

and:

Code: Select all: # cp -iav grsec_170405_g0n_09 /etc/grsec/policy cp: overwrite '/etc/grsec/policy'? y 'grsec_170405_g0n_09' -> '/etc/grsec/policy' g0n ~ # ls -l grsec_170405_g0n_09 /etc/grsec/policy -rw------- 1 root root 176082 2017-04-05 16:55 /etc/grsec/policy -rw------- 1 root root 176082 2017-04-05 16:55 grsec_170405_g0n_09 #

And now:

Code: Select all: # gradm -L /etc/grsec/learning.logs -E #

Passed. I don't say that tcpdump will now work (only: it is likely it will), and that there remain no issues, but maybe some of them are now solved.

If I'm not back sooner rather than later, probably it goes as expected. I trace all the time, and also like to play with Qemu, so I'll know pretty soon. Again, if I'm not back sooner than later, it likely works.

Regards!
---
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr
Try refute: rootkit hooks in kernel,
linux capabilities for intrusion? (Linus?)

grsecurity forums

Qemu RBAC policies (& libvirt & tcpdump...)

Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)

Re: Qemu RBAC policies (& libvirt & tcpdump...)