This document discusses using SELinux to restrict access when running untrusted code on a backend server. It provides an example policy that defines new types like myserver_t and convert_exec_t, sets domain transitions between them, uses policy macros to grant access to necessary files, and defines file contexts. The example policy restricts a PHP server and image conversion process while allowing them minimal access to perform their functions.

1. SELinux by Example
Miroslav Spousta <qiq@ucw.cz>

2. Example
Running untrusted code on the backend server

3. Example
Running untrusted code on the backend server
- WTF?

4. Example
Running untrusted code on the backend server
- export web page as PDF to send it by e-mail
- use headless browser (e.g. PhantomJS)
- based on (obsolete?) WebKit browser
- possibly running customer’s code (JavaScript)
- must restrict access to filesystem and network

5. How to Restrict Access?
Separate virtual machine for every export task?
- too heavy weight (setup, resources)
UNIX permissions and ACLs?
- coarse-grained, hard to manage, inflexible
SELinux seems to be a perfect fit here
- may be used to restrict all programs

6. SELinux?!
Available since ~2004 (Fedora 3), kernel 2.6
- everybody knows how to switch it off
MAC (Mandatory Access Control)
Too complicated? Not really!
Not explicitly allowed? => denied
- targeted policy - only restrict some programs

7. SELinux Labels
Label for files, processes, ports
- process is given access to files, ports

8. SELinux Labels
Label for files, processes, ports
- process is given access to files, ports
UNIX: almost everything is file

9. SELinux Labels
Label for files, processes, ports
- process is given access to files, ports
UNIX: almost everything is file
subject objects

10. SELinux Labels
Label for files, processes, ports
- process is given access to files, ports
Every process is running in some domain
- confined or unconfined
- transition from domain to another on exec(2)

11. How to Create Policy
1. create domain transition
2. run program in permissive mode, inspect log
3. add rules (use policy macros, if possible)
- audit2allow helps
- setenforce 1; setenforce 0 clears AVC cache
4. run program in enforcing mode

12. Example
… example policy for HTTP server running
image to PDF conversion service

13. Example
… example policy for HTTP server running
image to PDF conversion service
- policy consists of .fc, .if and .te files
- compile and load using Makefile provided

14. Example
- type definitions
# myserver.te
policy_module(myserver, 1.0.0)
# required types
gen_require(`
type unconfined_t;
type proc_t;
type sysfs_t;
type tmp_t;
')
# new types
type myserver_exec_t;
type myserver_t;
type convert_exec_t;
role unconfined_r types myserver_t;

15. Example
- type definitions
- domain transition
# force domain transition executing myserver_exec_t
domain_type(myserver_t)
domain_entry_file(myserver_t,myserver_exec_t)
domtrans_pattern(unconfined_t,myserver_exec_t,myserv
er_t)

16. Example
- type definitions
- domain transition
- macros
# allow read of /usr/bin/* files
corecmd_read_bin_files(myserver_t)
# allow read of e.g. /usr/share/* files
files_read_usr_files(myserver_t)
# localization
miscfiles_read_localization(myserver_t)

17. Example
- type definitions
- domain transition
- macros
- allow rules
# allow to listen on port 8080
allow myserver_t http_cache_port_t:tcp_socket
name_bind;
# allow to run convert
allow myserver_t convert_exec_t:file { read execute open
getattr execute_no_trans };
allow myserver_t node_t:tcp_socket node_bind;
allow myserver_t self:fifo_file { read write ioctl getattr };
allow myserver_t self:process getsched;
allow myserver_t self:tcp_socket { setopt read bind create
ioctl accept write getattr listen };

18. Example
- type definitions
- domain transition
- macros
- allow rules
- dontaudit rules
dontaudit myserver_t etc_t:file { read getattr open };
dontaudit myserver_t proc_t:file { read getattr open };
dontaudit myserver_t sysfs_t:dir search;
dontaudit myserver_t sysfs_t:file { read open };
dontaudit myserver_t user_devpts_t:chr_file { read write
ioctl };
dontaudit myserver_t user_home_dir_t:dir search;

19. Example
- type definitions
- domain transition
- macros
- allow rules
- dontaudit rules
- file contexts
# myserver.fc
/usr/bin/myserver.pl --
gen_context(system_u:object_r:myserver_exec_t,s0)
/usr/bin/convert --
gen_context(system_u:object_r:convert_exec_t,s0)

20. - make -f /usr/share/selinux/default/include/Makefile load
- semanage; sestatus; setenforce [0|1]
- ps -Z; ls -Z; id -Z
- chcon; restorecon; fixfiles
- audit2allow </var/log/audit/audit.log
- strace
Tooling