A way to trigger an SELinux policy violation?

Question

I'm studying the basic workings of SELinux and would find it useful to trigger a denial. My test machine is running CentOS 7, it's a basic server install without any extra services, and getenforce states 'Enforcing'. So I felt sure that making /root world-readable, and attempting to read files from there as an unprivileged user would do the trick. But no luck! Can anyone suggest some quick tests? Trying to access paths, or open ports, etc.

Ideally I'm looking for straightforward shell commands that a DAC wouldn't have restricted, but a MAC will notice and deny. As such I'm not looking to compile bespoke programs, or install specific services (like a web-server) to achieve this. This is valuable as it provides a generic and clear way to see SELinux in action.

我对修改 DAC（即文件系统权限）以使其限制性低于默认情况下作为测试的一部分没有问题。

Answer 1

为了演示 SELinux 在第三方/您自己的开发人员代码的错误检测中的实用性，这里有一个内存保护测试（修改此处的第一个代码示例）：

#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>

int main (void) {
  // open file read-write, get a memory-mapped pointer with private access, write permission
  int fd = open ("file_to_test", O_RDWR);
  char *p = mmap (NULL, 42, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);

  p[0] = 'a';   // put something

  // Update protection mode; SELinux response depends on sebool: allow_execmod
  int r = mprotect (p, 42, PROT_READ | PROT_EXEC);

  // Display mprotect result
  printf ("mprotect = %d\n", r);

  close(fd);
  return 0;
}

编译并显示默认值（未捕获）

$ echo "test data" > file_to_test
$ gcc execmod.c 

$ ./a.out 
mprotect = 0

$ sudo aureport -a

AVC Report
========================================================
# date time comm subj syscall class permission obj event
========================================================
<no events of interest were found>

更改布尔值以捕获问题：

$ sudo getsebool allow_execmod
allow_execmod --> on

$ sudo setsebool allow_execmod 0
$ ./a.out 
mprotect = -1

$ sudo aureport -a

AVC Report
========================================================
# date time comm subj syscall class permission obj event
========================================================
1. 04/30/2015 12:26:41 a.out unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 10 file execmod unconfined_u:object_r:user_home_t:s0 denied 3612

Answer 2

这清楚地表明了 MAC 策略，在 CentOS 7 的基本安装上可以绕过等效的 DAC。

1. 默认情况下（在撰写本文时在 CentOS 中）无特权的非系统用户以“unconfined_u”角色登录。但是，我们可以更改系统，以便将非特权用户“alice”置于“user_u”角色中。只需少量的额外配置，即可通过默认策略明确限制此角色。

   [root]# echo "alice:user_u:s0-s0:c0.c1023" >> /etc/selinux/targeted/seusers
   

2. 现在关闭这些用户执行位于其主目录和 /tmp 中的文件的能力。再次强调，默认设置是允许这种行为的。该命令可能需要一些时间才能完成。

   [root]# setsebool -P user_exec_content off
   

3. 现在（使用我们的非特权用户）我们可以登录并尝试在这些禁止区域之一执行某些操作。正如你所看到的，我们被拒绝了。

   [alice]$ cp /bin/ls /tmp/
   [alice]$ /tmp/ls
   -bash: /tmp/ls: Permission denied
   

4. 最后，我们可以查看 AVC 日志来查看我们的 SELinux 拒绝情况。

   [root]# aureport -a
   
   AVC Report
   ========================================================
   # date time comm subj syscall class permission obj event
   ========================================================
   1. 02/05/15 21:08:33 bash user_u:user_r:user_t:s0 59 file execute user_u:object_r:user_tmp_t:s0 denied 693