Hello,
I have been using network elements in RSBAC and have noticed some
strange behaviours.
First, specifying a protocol for a NETTEMP when using the NETLINK
address family is not taken into account, and the field remains on value
ROUTE.
For example, setting ANY for the protocol is not registered :
$ net_temp list_template 40016
ID: 40016
Name: NETLINK_TEMP
Family: NETLINK
Socket type: ANY
Address: (addresses of family NETLINK not supported)
Protocol: ROUTE
Netdev:
Ports:
$ net_temp get_protocol 40016
ROUTE
$ net_temp set_protocol 40016 ANY
$ net_temp get_protocol 40016
ROUTE
This also happens in rsbac_nettemp_def_menu.
The same steps are working with INET as address family.
Also, some templates I have created and believe should be matched are
not matched.
In details, I have create a NETTEMP for each address family listed in
rsbac_nettemp_def_menu.
So, for the INET address family, it looks like :
$ net_temp new_template 40002 'INET_TEMP'
$ net_temp set_name 40002 'INET_TEMP'
$ net_temp set_address_family 40002 INET
$ net_temp set_type 40002 ANY
$ net_temp set_protocol 40002 ANY
$ net_temp set_netdev 40002 ''
Then, I created a few NETOBJ RC types to go with the NETTEMPs :
# NETOBJ type for NETTEMPs where role 0 will have some rights
$ rc_copy_type NETOBJ 0 40
$ rc_set_item TYPE 40 type_netobj_name "NET_autorized"
# NETOBJ type for NETTEMPs where role 0 will have no rights
$ rc_copy_type NETOBJ 0 41
$ rc_set_item TYPE 41 type_netobj_name "NET_not_autor"
# NETOBJ type for default NETTEMPs except "ALL"
$ rc_copy_type NETOBJ 0 50
$ rc_set_item TYPE 50 type_netobj_name "NET_defaults"
# NETOBJ type for "ALL" default NETTEMP
$ rc_copy_type NETOBJ 0 51
$ rc_set_item TYPE 51 type_netobj_name "NET_all"
# Setting NETOBJ type for NETTEMPs
$ attr_set_net NETTEMP rc_type 40 40002 # INET_TEMP
$ attr_set_net NETTEMP rc_type 40 40010 # INET6_TEMP
$ attr_set_net NETTEMP rc_type 40 40016 # NETLINK_TEMP
$ attr_set_net NETTEMP rc_type 41 40001 # UNIX_TEMP
$ attr_set_net NETTEMP rc_type 41 40003 # AX25_TEMP
$ attr_set_net NETTEMP rc_type 41 40004 # IPX_TEMP
$ attr_set_net NETTEMP rc_type 41 40005 # APPLETALK_TEMP
$ attr_set_net NETTEMP rc_type 41 40006 # NETROM_TEMP
$ attr_set_net NETTEMP rc_type 41 40007 # BRIDGE_TEMP
$ attr_set_net NETTEMP rc_type 41 40008 # ATMPVC_TEMP
$ attr_set_net NETTEMP rc_type 41 40009 # X25_TEMP
$ attr_set_net NETTEMP rc_type 41 40011 # ROSE_TEMP
$ attr_set_net NETTEMP rc_type 41 40012 # DECnet_TEMP
$ attr_set_net NETTEMP rc_type 41 40013 # NETBEUI_TEMP
$ attr_set_net NETTEMP rc_type 41 40014 # SECURITY_TEMP
$ attr_set_net NETTEMP rc_type 41 40015 # KEY_TEMP
$ attr_set_net NETTEMP rc_type 41 40017 # PACKET_TEMP
$ attr_set_net NETTEMP rc_type 41 40018 # ASH_TEMP
$ attr_set_net NETTEMP rc_type 41 40019 # ECONET_TEMP
$ attr_set_net NETTEMP rc_type 41 40020 # ATMSVC_TEMP
$ attr_set_net NETTEMP rc_type 41 40022 # SNA_TEMP
$ attr_set_net NETTEMP rc_type 41 40023 # IRDA_TEMP
$ attr_set_net NETTEMP rc_type 41 40024 # PPPOX_TEMP
$ attr_set_net NETTEMP rc_type 41 40025 # WANPIPE_TEMP
$ attr_set_net NETTEMP rc_type 41 40031 # BLUETOOTH_TEMP
$ attr_set_net NETTEMP rc_type 50 100101 # Localnet
$ attr_set_net NETTEMP rc_type 50 100102 # Internal_LAN
$ attr_set_net NETTEMP rc_type 50 100105 # Auto-IPv4
$ attr_set_net NETTEMP rc_type 51 100110 # ALL
# Setting rights on type 40
$ rc_set_item -b ROLE 0 type_comp_netobj 40
0000000000000001000011111110010000000000000010110001100110000000
And now, when booting, some NETOBJs with types 0 and 50 are created and
used, whereas they should be matched with NETTEMPs giving them NETOBJ
type 40.
This one is created as NETOBJ type 0, while it should be 40 if matched
with NETLINK_TEMP (but we have seen before that it is stuck with ROUTE
as protocol so 51 should be the fallback) :
0000009832|check_comp_rc(): pid 720(dbus-daemon), owner 990, rc_role 0,
NETOBJ rc_type 0, request CREATE -> NOT_GRANTED!
0000009834|rsbac_adf_request(): request CREATE, pid 720, ppid 1,
prog_name dbus-daemon, prog_file /usr/bin/dbus-daemon, uid 990, audit
uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT,
attr sock_type, value RAW, result NOT_GRANTED (Softmode) by RC
0000009836|rsbac_adf_set_attr(): request CREATE, pid 720, uid 990, audit
uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT,
new_target_type NONE, new_tid NONE, attr sock_type, value 3, error 0
These ones are created as NETOBJ type 0, while they should be 40 when
matched with INET6_TEMP or INET_TEMP
0000009875|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0,
NETOBJ rc_type 0, request CREATE -> NOT_GRANTED!
0000009876|rsbac_adf_request(): request CREATE, pid 717, ppid 1,
prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102,
target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local
[::]:0 remote [::]:0, attr sock_type, value DGRAM, result NOT_GRANTED
(Softmode) by RC
0000009877|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102,
target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local
[::]:0 remote [::]:0, new_target_type NONE, new_tid NONE, attr
sock_type, value 2, error 0
and
0000009976|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0,
NETOBJ rc_type 0, request SEND -> NOT_GRANTED!
0000009977|rsbac_adf_request(): request SEND, pid 717, ppid 1, prog_name
avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type
NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:5353
remote 224.0.0.251:5353, attr sock_type, value DGRAM, result NOT_GRANTED
(Softmode) by RC
And this one is created as NETOBJ type 50, while it should be 40 when
matched with INET_TEMP
0000009844|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0,
NETOBJ rc_type 50, request CREATE -> NOT_GRANTED!
0000009846|rsbac_adf_request(): request CREATE, pid 717, ppid 1,
prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102,
target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local
0.0.0.0:0 remote 0.0.0.0:0, attr sock_type, value DGRAM, result
NOT_GRANTED (Softmode) by RC
0000009848|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102,
target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local
0.0.0.0:0 remote 0.0.0.0:0, new_target_type NONE, new_tid NONE, attr
sock_type, value 2, error 0
Note that I don't have any NETTEMP that should create a type 0 NETOBJ :
$ for NETTEMP_ID in `net_temp list_temp_nr`; do echo "NETOBJ RC type for
NETTEMP ${NETTEMP_ID} : " $(attr_get_net RC NETTEMP rc_type
$NETTEMP_ID); done
NETOBJ RC type for NETTEMP 40001 : 41
NETOBJ RC type for NETTEMP 40002 : 40
NETOBJ RC type for NETTEMP 40003 : 41
NETOBJ RC type for NETTEMP 40004 : 41
NETOBJ RC type for NETTEMP 40005 : 41
NETOBJ RC type for NETTEMP 40006 : 41
NETOBJ RC type for NETTEMP 40007 : 41
NETOBJ RC type for NETTEMP 40008 : 41
NETOBJ RC type for NETTEMP 40009 : 41
NETOBJ RC type for NETTEMP 40010 : 40
NETOBJ RC type for NETTEMP 40011 : 41
NETOBJ RC type for NETTEMP 40012 : 41
NETOBJ RC type for NETTEMP 40013 : 41
NETOBJ RC type for NETTEMP 40014 : 41
NETOBJ RC type for NETTEMP 40015 : 41
NETOBJ RC type for NETTEMP 40016 : 40
NETOBJ RC type for NETTEMP 40017 : 41
NETOBJ RC type for NETTEMP 40018 : 41
NETOBJ RC type for NETTEMP 40019 : 41
NETOBJ RC type for NETTEMP 40020 : 41
NETOBJ RC type for NETTEMP 40022 : 41
NETOBJ RC type for NETTEMP 40023 : 41
NETOBJ RC type for NETTEMP 40024 : 41
NETOBJ RC type for NETTEMP 40025 : 41
NETOBJ RC type for NETTEMP 40031 : 41
NETOBJ RC type for NETTEMP 100101 : 50
NETOBJ RC type for NETTEMP 100102 : 50
NETOBJ RC type for NETTEMP 100105 : 50
NETOBJ RC type for NETTEMP 100110 : 51
Do you have some explanations on why my NETTEMPs are not matched ?
Terence Gomez
