From Fedora Project Wiki

Line 40: Line 40:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** <code>scp</code> files to home directory and <code>public_html</code> directory.
+
*# <code>scp</code> files to home directory and <code>public_html</code> directory.
** Copy files to <code>public_html</code> directory.
+
*# Copy files to <code>public_html</code> directory.
** Verify that the content is viewable via '''Apache'''.
+
*# Verify that the content is viewable via '''Apache'''.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
+
*# Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
  
 
=== xguest_u ===
 
=== xguest_u ===
Line 61: Line 61:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify that flash works.
+
*# Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify that flash works.
** Plug in USB disk and make sure <code>xguest_u</code> user can read/write the disk.
+
*# Plug in USB disk and make sure <code>xguest_u</code> user can read/write the disk.
** Plug in USB camera and make sure it works.
+
*# Plug in USB camera and make sure it works.
** Plug in other USB devices.
+
*# Plug in other USB devices.
** Verify '''Network Manager''' works.
+
*# Verify '''Network Manager''' works.
** Verify printing from '''Firefox''' and from the desktop works.
+
*# Verify printing from '''Firefox''' and from the desktop works.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
+
*# Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
  
 
=== user_u ===
 
=== user_u ===
Line 85: Line 85:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory
+
*# Edit files in home directory
** Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
+
*# Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
** Verify other network protocols work (aol, ssh, mail etc.)
+
*# Verify other network protocols work (aol, ssh, mail etc.)
** Plug in USB disk and make sure <code>user_u</code> user can read/write disk.
+
*# Plug in USB disk and make sure <code>user_u</code> user can read/write disk.
** Plug in USB camera and make sure it works.
+
*# Plug in USB camera and make sure it works.
** Plug in other USB devices.
+
*# Plug in other USB devices.
** Verify '''Network Manager''' works.
+
*# Verify '''Network Manager''' works.
** Verify printing from '''Firefox''' and from the desktop works.
+
*# Verify printing from '''Firefox''' and from the desktop works.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Try to break into the root account via <code>su</code>, <code>sudo</code>.
+
*# Try to break into the root account via <code>su</code>, <code>sudo</code>.
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
  
 
=== staff_u ===
 
=== staff_u ===
Line 110: Line 110:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
+
*# Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
** Verify other network protocols work (aol, ssh, mail etc.)
+
*# Verify other network protocols work (aol, ssh, mail etc.)
** Plug in USB disk and make sure <code>staff_u</code> user can read/write disk.
+
*# Plug in USB disk and make sure <code>staff_u</code> user can read/write disk.
** Plug in USB camera and make sure it works.
+
*# Plug in USB camera and make sure it works.
** Plug in other USB devices.
+
*# Plug in other USB devices.
** Verify '''Network Manager''' works.
+
*# Verify '''Network Manager''' works.
** Verify printing from '''Firefox''' and from the desktop works.
+
*# Verify printing from '''Firefox''' and from the desktop works.
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Set up <code>sudo</code> and SELinux to allow <code>staff_t</code> to become <code>unconfined_t</code> via <code>sudo</code>.
+
*# Set up <code>sudo</code> and SELinux to allow <code>staff_t</code> to become <code>unconfined_t</code> via <code>sudo</code>.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to break into the root account via <code>sudo</code>.
+
*# Try to break into the root account via <code>sudo</code>.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
  
 
=== Kiosk user ===
 
=== Kiosk user ===
Line 136: Line 136:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
+
*# Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
** Plug in USB disk and make sure the kiosk user can read/write the disk.
+
*# Plug in USB disk and make sure the kiosk user can read/write the disk.
** Plug in USB camera and make sure it works.
+
*# Plug in USB camera and make sure it works.
** Plug in other USB devices.
+
*# Plug in other USB devices.
** Verify that '''Network Manager''' works.
+
*# Verify that '''Network Manager''' works.
** Verify printing from '''Firefox''' and from the desktop works.
+
*# Verify printing from '''Firefox''' and from the desktop works.
** Logout and login to verify that home directory disappeared.
+
*# Logout and login to verify that home directory disappeared.
** Verify that password is not required.
+
*# Verify that password is not required.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Try any network protocol, try to get off the machine (ssh, sendmail, telnet, rsh etc.)
+
*# Try any network protocol, try to get off the machine (ssh, sendmail, telnet, rsh etc.)
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
** Verify that you can not <code>ssh</code> into the machine as <code>xguest_u</code>.
+
*# Verify that you can not <code>ssh</code> into the machine as <code>xguest_u</code>.
  
 
=== Confined administrator ===
 
=== Confined administrator ===
Line 163: Line 163:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
+
*# Verify '''Firefox''' works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
** Verify other network protocols work (aol, ssh, mail etc.)
+
*# Verify other network protocols work (aol, ssh, mail etc.)
** Plug in USB disk and make sure the confined administrator can read/write the disk.
+
*# Plug in USB disk and make sure the confined administrator can read/write the disk.
** Plug in USB camera and make sure it works.
+
*# Plug in USB camera and make sure it works.
** Plug in other USB devices.
+
*# Plug in other USB devices.
** Verify '''Network Manager''' works.
+
*# Verify '''Network Manager''' works.
** Verify printing from '''Firefox''' and from the desktop works.
+
*# Verify printing from '''Firefox''' and from the desktop works.
** Try to <code>ping</code> off the machine.
+
*# Try to <code>ping</code> off the machine.
** Copy an executable into home directory and try to execute it.
+
*# Copy an executable into home directory and try to execute it.
** Set up <code>sudo</code> and SELinux to allow <code>staff_t</code> to become <code>unconfined_t</code> via <code>sudo</code>.
+
*# Set up <code>sudo</code> and SELinux to allow <code>staff_t</code> to become <code>unconfined_t</code> via <code>sudo</code>.
** Execute <code>sudo sh</code> and make sure you end up as <code>web_db_adm_t</code>.
+
*# Execute <code>sudo sh</code> and make sure you end up as <code>web_db_adm_t</code>.
** Try to edit <code>/var/www/html</code> directory and some of the '''MySQL''' directories.
+
*# Try to edit <code>/var/www/html</code> directory and some of the '''MySQL''' directories.
** Try to start/stop '''MySQL''' and '''Apache'''.
+
*# Try to start/stop '''MySQL''' and '''Apache'''.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to break into the root account via <code>su</code>.
+
*# Try to break into the root account via <code>su</code>.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
** As <code>web_db_adm_t</code> try to add an user, modify files in <code>/usr/share</code>.
+
*# As <code>web_db_adm_t</code> try to add an user, modify files in <code>/usr/share</code>.
  
 
=== Guest user that can send an email ===
 
=== Guest user that can send an email ===
Line 191: Line 191:
  
 
* Good Test - try to behave correctly
 
* Good Test - try to behave correctly
** Edit files in home directory.
+
*# Edit files in home directory.
** Verify you can send a mail as this user.
+
*# Verify you can send a mail as this user.
  
 
* Bad Test - try to do evil
 
* Bad Test - try to do evil
** Try to break into the root account via <code>sudo</code>.
+
*# Try to break into the root account via <code>sudo</code>.
** Try to read a file in the <code>/secrets</code> directory.
+
*# Try to read a file in the <code>/secrets</code> directory.
** Try to read the '''MySQL''' database.
+
*# Try to read the '''MySQL''' database.
  
 
== Links ==
 
== Links ==

Revision as of 14:33, 16 October 2009

Confined Users Test Day

  • Devel contact: dwalsh, mgrepl
  • QE contact: mmalik, ebenes
  • IRC channel: #fedora-test-day on irc.freenode.net

What to Test?

Today's Fedora Test Day will focus on Confined SELinux Users. We want to write a policy confining a user by assigning the user an SELinux role where the policy controls what the user can do/access on the system. Current confined SELinux user types with their purpose of use are:

  • guest_u – Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory.
  • xguest_u – X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory.
  • user_u – X Windows login and terminal login, nosetuid, noexec in home directory.
  • staff_u – X Windows login and terminal login, nosetuid except sudo.

The purpose of test day is to test these SELinux users on your desktop and in specific cases. So for example like xguest_u, user_u or staff_u try to login to X Windows, try to start Firefox, IM, try to run terminal, ping, sudo and so on.

What's Needed to Be Able to Test

You will need a Rawhide or Fedora 12 machine. You will need following packages on the machine:

  • selinux-policy-targeted
  • policycoreutils-gui
  • setroubleshoot
  • xguest

How to Test

The main goal is to test chosen users and to do things which are usual for you with these SELinux users. For example if you log as xguest_u and try to run ping or sudo in your favourite terminal you won't be able to run it. But if you won't be able to run Firefox then probably this is a bug.

Test Cases

guest_u

Note.png
User capabilities
Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory

As root set up a server only machine, with Apache service. Configure Apache in such a way that user home directories are accessible. Add an user which can log in as guest_u (useradd -Z guest_u USERNAME). Create a directory named /secrets, and install MySQL. Make sure the database is world readable.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. scp files to home directory and public_html directory.
    3. Copy files to public_html directory.
    4. Verify that the content is viewable via Apache.
  • Bad Test - try to do evil
    1. Try to ping off the machine.
    2. Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
    3. Copy an executable into home directory and try to execute it.
    4. Try to read a file in the /secrets directory.
    5. Try to read the MySQL database.

xguest_u

Note.png
User capabilities
X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory

As root set up a client machine, with network access. Add an user which can log in as xguest_u (useradd -Z xguest_u USERNAME). Create a directory named /secrets, and install MySQL. Make sure the database is world readable.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. Verify Firefox works and can access the network. Try to load several sites like http://www.ford.com to verify that flash works.
    3. Plug in USB disk and make sure xguest_u user can read/write the disk.
    4. Plug in USB camera and make sure it works.
    5. Plug in other USB devices.
    6. Verify Network Manager works.
    7. Verify printing from Firefox and from the desktop works.
  • Bad Test - try to do evil
    1. Try to ping off the machine.
    2. Try any network protocol, try to get off the machine (ssh, sendmail, rsh, telnet etc.)
    3. Copy an executable into home directory and try to execute it.
    4. Try to read a file in the /secrets directory.
    5. Try to read the MySQL database.

user_u

Note.png
User capabilities
X Windows login and terminal login, nosetuid, noexec in home directory

As root set up a client machine, with network access. Add an user which can log in as user_u (useradd -Z user_u USERNAME). Create a directory named /secrets, and install MySQL. Make sure the database is world readable.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory
    2. Verify Firefox works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
    3. Verify other network protocols work (aol, ssh, mail etc.)
    4. Plug in USB disk and make sure user_u user can read/write disk.
    5. Plug in USB camera and make sure it works.
    6. Plug in other USB devices.
    7. Verify Network Manager works.
    8. Verify printing from Firefox and from the desktop works.
  • Bad Test - try to do evil
    1. Try to ping off the machine.
    2. Try to break into the root account via su, sudo.
    3. Copy an executable into home directory and try to execute it.
    4. Try to read a file in the /secrets directory.
    5. Try to read the MySQL database.

staff_u

Note.png
User capabilities
X Windows login and terminal login, nosetuid except sudo

As root set up a client machine, with network access. Add an user which can log in as staff_u (useradd -Z staff_u USERNAME). Create a directory named /secrets, and install MySQL. Make sure the database is world readable.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. Verify Firefox works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
    3. Verify other network protocols work (aol, ssh, mail etc.)
    4. Plug in USB disk and make sure staff_u user can read/write disk.
    5. Plug in USB camera and make sure it works.
    6. Plug in other USB devices.
    7. Verify Network Manager works.
    8. Verify printing from Firefox and from the desktop works.
    9. Try to ping off the machine.
    10. Copy an executable into home directory and try to execute it.
    11. Set up sudo and SELinux to allow staff_t to become unconfined_t via sudo.
  • Bad Test - try to do evil
    1. Try to break into the root account via sudo.
    2. Try to read a file in the /secrets directory.
    3. Try to read the MySQL database.

Kiosk user

Note.png
User capabilities
X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory. NO password required. Home directory and /tmp get destroyed on logout.

As root set up a client machine, with network access. Install xguest package.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. Verify Firefox works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
    3. Plug in USB disk and make sure the kiosk user can read/write the disk.
    4. Plug in USB camera and make sure it works.
    5. Plug in other USB devices.
    6. Verify that Network Manager works.
    7. Verify printing from Firefox and from the desktop works.
    8. Logout and login to verify that home directory disappeared.
    9. Verify that password is not required.
  • Bad Test - try to do evil
    1. Try to ping off the machine.
    2. Try any network protocol, try to get off the machine (ssh, sendmail, telnet, rsh etc.)
    3. Copy an executable into home directory and try to execute it.
    4. Try to read a file in the /secrets directory.
    5. Try to read the MySQL database.
    6. Verify that you can not ssh into the machine as xguest_u.

Confined administrator

Note.png
User capabilities
Administrator that can manage MySQL and Apache

As root set up a client machine, with network access. Build policy for web_db_admin_t. Add an user which can log in as staff_u (useradd -Z staff_u USERNAME). Set up a transition from staff_t to web_db_admin_t. Set up sudo to make this happen automatically. Create a directory named /secrets and install MySQL. Make sure the database is world readable.

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. Verify Firefox works and can access the network. Try to load several sites like http://www.ford.com to verify flash works.
    3. Verify other network protocols work (aol, ssh, mail etc.)
    4. Plug in USB disk and make sure the confined administrator can read/write the disk.
    5. Plug in USB camera and make sure it works.
    6. Plug in other USB devices.
    7. Verify Network Manager works.
    8. Verify printing from Firefox and from the desktop works.
    9. Try to ping off the machine.
    10. Copy an executable into home directory and try to execute it.
    11. Set up sudo and SELinux to allow staff_t to become unconfined_t via sudo.
    12. Execute sudo sh and make sure you end up as web_db_adm_t.
    13. Try to edit /var/www/html directory and some of the MySQL directories.
    14. Try to start/stop MySQL and Apache.
  • Bad Test - try to do evil
    1. Try to break into the root account via su.
    2. Try to read a file in the /secrets directory.
    3. Try to read the MySQL database.
    4. As web_db_adm_t try to add an user, modify files in /usr/share.

Guest user that can send an email

As root set up a server machine, with network access. Build policy for sendmail_user_t. Add an user which can log in as sendmail_user_u (useradd -Z sendmail_user_u USERNAME).

Log in to the machine and try the following:

  • Good Test - try to behave correctly
    1. Edit files in home directory.
    2. Verify you can send a mail as this user.
  • Bad Test - try to do evil
    1. Try to break into the root account via sudo.
    2. Try to read a file in the /secrets directory.
    3. Try to read the MySQL database.

Links

  1. http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html
  2. http://magazine.redhat.com/2008/07/02/writing-policy-for-confined-selinux-users/
  3. http://www.linuxtopia.org/online_books/fedora_selinux_guides/fedora_10_selinux_user_guide/fedora_10_selinux_sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html
  4. http://selinux-mac.blogspot.com/2009/06/selinux-lockdown-part-one-confined.html