Hello,
I have been using network elements in RSBAC and have noticed some strange behaviours.
First, specifying a protocol for a NETTEMP when using the NETLINK address family is not taken into account, and the field remains on value ROUTE. For example, setting ANY for the protocol is not registered :
$ net_temp list_template 40016
ID: 40016 Name: NETLINK_TEMP Family: NETLINK Socket type: ANY Address: (addresses of family NETLINK not supported) Protocol: ROUTE Netdev: Ports:
$ net_temp get_protocol 40016 ROUTE $ net_temp set_protocol 40016 ANY $ net_temp get_protocol 40016 ROUTE
This also happens in rsbac_nettemp_def_menu. The same steps are working with INET as address family.
Also, some templates I have created and believe should be matched are not matched. In details, I have create a NETTEMP for each address family listed in rsbac_nettemp_def_menu. So, for the INET address family, it looks like :
$ net_temp new_template 40002 'INET_TEMP' $ net_temp set_name 40002 'INET_TEMP' $ net_temp set_address_family 40002 INET $ net_temp set_type 40002 ANY $ net_temp set_protocol 40002 ANY $ net_temp set_netdev 40002 ''
Then, I created a few NETOBJ RC types to go with the NETTEMPs :
# NETOBJ type for NETTEMPs where role 0 will have some rights $ rc_copy_type NETOBJ 0 40 $ rc_set_item TYPE 40 type_netobj_name "NET_autorized"
# NETOBJ type for NETTEMPs where role 0 will have no rights $ rc_copy_type NETOBJ 0 41 $ rc_set_item TYPE 41 type_netobj_name "NET_not_autor"
# NETOBJ type for default NETTEMPs except "ALL" $ rc_copy_type NETOBJ 0 50 $ rc_set_item TYPE 50 type_netobj_name "NET_defaults"
# NETOBJ type for "ALL" default NETTEMP $ rc_copy_type NETOBJ 0 51 $ rc_set_item TYPE 51 type_netobj_name "NET_all"
# Setting NETOBJ type for NETTEMPs $ attr_set_net NETTEMP rc_type 40 40002 # INET_TEMP $ attr_set_net NETTEMP rc_type 40 40010 # INET6_TEMP $ attr_set_net NETTEMP rc_type 40 40016 # NETLINK_TEMP
$ attr_set_net NETTEMP rc_type 41 40001 # UNIX_TEMP $ attr_set_net NETTEMP rc_type 41 40003 # AX25_TEMP $ attr_set_net NETTEMP rc_type 41 40004 # IPX_TEMP $ attr_set_net NETTEMP rc_type 41 40005 # APPLETALK_TEMP $ attr_set_net NETTEMP rc_type 41 40006 # NETROM_TEMP $ attr_set_net NETTEMP rc_type 41 40007 # BRIDGE_TEMP $ attr_set_net NETTEMP rc_type 41 40008 # ATMPVC_TEMP $ attr_set_net NETTEMP rc_type 41 40009 # X25_TEMP $ attr_set_net NETTEMP rc_type 41 40011 # ROSE_TEMP $ attr_set_net NETTEMP rc_type 41 40012 # DECnet_TEMP $ attr_set_net NETTEMP rc_type 41 40013 # NETBEUI_TEMP $ attr_set_net NETTEMP rc_type 41 40014 # SECURITY_TEMP $ attr_set_net NETTEMP rc_type 41 40015 # KEY_TEMP $ attr_set_net NETTEMP rc_type 41 40017 # PACKET_TEMP $ attr_set_net NETTEMP rc_type 41 40018 # ASH_TEMP $ attr_set_net NETTEMP rc_type 41 40019 # ECONET_TEMP $ attr_set_net NETTEMP rc_type 41 40020 # ATMSVC_TEMP $ attr_set_net NETTEMP rc_type 41 40022 # SNA_TEMP $ attr_set_net NETTEMP rc_type 41 40023 # IRDA_TEMP $ attr_set_net NETTEMP rc_type 41 40024 # PPPOX_TEMP $ attr_set_net NETTEMP rc_type 41 40025 # WANPIPE_TEMP $ attr_set_net NETTEMP rc_type 41 40031 # BLUETOOTH_TEMP
$ attr_set_net NETTEMP rc_type 50 100101 # Localnet $ attr_set_net NETTEMP rc_type 50 100102 # Internal_LAN $ attr_set_net NETTEMP rc_type 50 100105 # Auto-IPv4
$ attr_set_net NETTEMP rc_type 51 100110 # ALL
# Setting rights on type 40 $ rc_set_item -b ROLE 0 type_comp_netobj 40 0000000000000001000011111110010000000000000010110001100110000000
And now, when booting, some NETOBJs with types 0 and 50 are created and used, whereas they should be matched with NETTEMPs giving them NETOBJ type 40.
This one is created as NETOBJ type 0, while it should be 40 if matched with NETLINK_TEMP (but we have seen before that it is stuck with ROUTE as protocol so 51 should be the fallback) : 0000009832|check_comp_rc(): pid 720(dbus-daemon), owner 990, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009834|rsbac_adf_request(): request CREATE, pid 720, ppid 1, prog_name dbus-daemon, prog_file /usr/bin/dbus-daemon, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, attr sock_type, value RAW, result NOT_GRANTED (Softmode) by RC 0000009836|rsbac_adf_set_attr(): request CREATE, pid 720, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, new_target_type NONE, new_tid NONE, attr sock_type, value 3, error 0
These ones are created as NETOBJ type 0, while they should be 40 when matched with INET6_TEMP or INET_TEMP 0000009875|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009876|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009877|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0 and 0000009976|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request SEND -> NOT_GRANTED! 0000009977|rsbac_adf_request(): request SEND, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:5353 remote 224.0.0.251:5353, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC
And this one is created as NETOBJ type 50, while it should be 40 when matched with INET_TEMP 0000009844|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 50, request CREATE -> NOT_GRANTED! 0000009846|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009848|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0
Note that I don't have any NETTEMP that should create a type 0 NETOBJ : $ for NETTEMP_ID in `net_temp list_temp_nr`; do echo "NETOBJ RC type for NETTEMP ${NETTEMP_ID} : " $(attr_get_net RC NETTEMP rc_type $NETTEMP_ID); done NETOBJ RC type for NETTEMP 40001 : 41 NETOBJ RC type for NETTEMP 40002 : 40 NETOBJ RC type for NETTEMP 40003 : 41 NETOBJ RC type for NETTEMP 40004 : 41 NETOBJ RC type for NETTEMP 40005 : 41 NETOBJ RC type for NETTEMP 40006 : 41 NETOBJ RC type for NETTEMP 40007 : 41 NETOBJ RC type for NETTEMP 40008 : 41 NETOBJ RC type for NETTEMP 40009 : 41 NETOBJ RC type for NETTEMP 40010 : 40 NETOBJ RC type for NETTEMP 40011 : 41 NETOBJ RC type for NETTEMP 40012 : 41 NETOBJ RC type for NETTEMP 40013 : 41 NETOBJ RC type for NETTEMP 40014 : 41 NETOBJ RC type for NETTEMP 40015 : 41 NETOBJ RC type for NETTEMP 40016 : 40 NETOBJ RC type for NETTEMP 40017 : 41 NETOBJ RC type for NETTEMP 40018 : 41 NETOBJ RC type for NETTEMP 40019 : 41 NETOBJ RC type for NETTEMP 40020 : 41 NETOBJ RC type for NETTEMP 40022 : 41 NETOBJ RC type for NETTEMP 40023 : 41 NETOBJ RC type for NETTEMP 40024 : 41 NETOBJ RC type for NETTEMP 40025 : 41 NETOBJ RC type for NETTEMP 40031 : 41 NETOBJ RC type for NETTEMP 100101 : 50 NETOBJ RC type for NETTEMP 100102 : 50 NETOBJ RC type for NETTEMP 100105 : 50 NETOBJ RC type for NETTEMP 100110 : 51
Do you have some explanations on why my NETTEMPs are not matched ?
Terence Gomez
Am 08.07.26 um 17:28 schrieb Terence Gomez:
I have been using network elements in RSBAC and have noticed some strange behaviours.
First, specifying a protocol for a NETTEMP when using the NETLINK address family is not taken into account, and the field remains on value ROUTE. For example, setting ANY for the protocol is not registered :
$ net_temp list_template 40016
ID: 40016 Name: NETLINK_TEMP Family: NETLINK Socket type: ANY Address: (addresses of family NETLINK not supported) Protocol: ROUTE Netdev: Ports:
$ net_temp get_protocol 40016 ROUTE $ net_temp set_protocol 40016 ANY $ net_temp get_protocol 40016 ROUTE
This also happens in rsbac_nettemp_def_menu. The same steps are working with INET as address family.
The "ANY" name clash has just been fixed in the admin tools, commit is pushed and new packages uploaded to latestdiff.
Will check matching of templates later, this takes longer. Might not make it before my holidays.
Amon.
On 7/9/26 09:17, Amon Ott wrote:
Am 08.07.26 um 17:28 schrieb Terence Gomez:
I have been using network elements in RSBAC and have noticed some strange behaviours.
First, specifying a protocol for a NETTEMP when using the NETLINK address family is not taken into account, and the field remains on value ROUTE. For example, setting ANY for the protocol is not registered :
$ net_temp list_template 40016
ID: 40016 Name: NETLINK_TEMP Family: NETLINK Socket type: ANY Address: (addresses of family NETLINK not supported) Protocol: ROUTE Netdev: Ports:
$ net_temp get_protocol 40016 ROUTE $ net_temp set_protocol 40016 ANY $ net_temp get_protocol 40016 ROUTE
This also happens in rsbac_nettemp_def_menu. The same steps are working with INET as address family.
The "ANY" name clash has just been fixed in the admin tools, commit is pushed and new packages uploaded to latestdiff.
Will check matching of templates later, this takes longer. Might not make it before my holidays.
Thanks for the quick fix. Wishing you nice holidays !
Terence Gomez
Hello,
I took another look at this and solved some of my problems.
This one is created as NETOBJ type 0, while it should be 40 if matched with NETLINK_TEMP (but we have seen before that it is stuck with ROUTE as protocol so 51 should be the fallback) : 0000009832|check_comp_rc(): pid 720(dbus-daemon), owner 990, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009834|rsbac_adf_request(): request CREATE, pid 720, ppid 1, prog_name dbus-daemon, prog_file /usr/bin/dbus-daemon, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, attr sock_type, value RAW, result NOT_GRANTED (Softmode) by RC 0000009836|rsbac_adf_set_attr(): request CREATE, pid 720, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, new_target_type NONE, new_tid NONE, attr sock_type, value 3, error 0
In this first case, the problem came from the admin tool that did not account for changes on the protocol field when using the NETLINK address family. Using the same NETTEMP, it now matches correctly. However this does not explain why the fallback "ALL" NETTEMP was not matched.
These ones are created as NETOBJ type 0, while they should be 40 when matched with INET6_TEMP or INET_TEMP 0000009875|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009876|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009877|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0 and 0000009976|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request SEND -> NOT_GRANTED! 0000009977|rsbac_adf_request(): request SEND, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:5353 remote 224.0.0.251:5353, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC
For this second case, this is on my behalf, as I did not fill in the address field of the NETTEMP. I thought that leaving it empty would match every address, but I saw in rsbac_nettemp_def_menu that it was the opposite : an empty field never matches. So I used values "0.0.0.0/0" for INET_TEMP and "::/0" for INET6_TEMP to always match and it seems to work. But I still have no clue as to why the "ALL" NETTEMP was not matched.
And this one is created as NETOBJ type 50, while it should be 40 when matched with INET_TEMP 0000009844|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 50, request CREATE -> NOT_GRANTED! 0000009846|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009848|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0
This third case is also solved by using "0.0.0.0/0" as value for the address field. But curiously it was matched by one of the other default NETTEMP, though I can't figure out which one, as "Localnet" and "Internal LAN" don't match on the address field, and "Auto-IPv4" should also not match with its "/32" subnet mask in "0.0.0.0/32".
After that, remains the fact that the "ALL" NETTEMP does not matches everything. To test the behaviour, I set up a machine where this template is the only one (deleting the other default ones), and assigned it the NETOBJ type 51. For all roles, I removed all rights to NETOBJ type 51 and 0 (even if no NETTEMP exist to become a NETOBJ type 0). See the configuration : $ net_temp -b -a net_temp -V 66570 new_template 100110 "ALL" net_temp -V 66570 set_name 100110 "ALL" net_temp -V 66570 set_address_family 100110 ANY net_temp -V 66570 set_type 100110 ANY net_temp -V 66570 set_protocol 100110 ANY net_temp -V 66570 set_netdev 100110 "" $ attr_get_net RC NETTEMP rc_type 100110 51
Now, in the logs, I've got both NETOBJ type 51 and NETOBJ type 0. Moreover, the kind of connections that are 0 or 51 seem to be consistent. Based on the tid's in the log, NETOBJ type 0 is used with connections that have these characteristics : - NETLINK RAW KOBJECT_UEVENT - NETLINK RAW NETFILTER - NETLINK RAW AUDIT - NETLINK RAW GENERIC - INET DGRAM proto UDP - INET6 DGRAM proto UDP - INET STREAM proto TCP - INET6 STREAM proto TCP And NETOBJ type 51 is used with these ones : - PACKET DGRAM - NETLINK DGRAM ROUTE - NETLINK RAW ROUTE - DGRAM (The last case is when there are two white spaces between the tid number and "DGRAM", which I think is because the connection uses an address family that is not yet implemented in the RSBAC tools, so instead of "tid <number> <address_family> <socket_type>" there is "tid <number> <socket_type>".)
So, I don't have an explanation but clearly this "ALL" NETTEMP does not matches everything :) That would be great to be able to have a real fallback template.
Terence Gomez
-
Amon Ott -
Terence Gomez