| 1 |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> |
| 2 |
<html lang="en-US"> |
| 3 |
<head> |
| 4 |
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> |
| 5 |
<meta http-equiv="Content-Style-Type" content="text/css"> |
| 6 |
<title>TOMOYO Linux Install manual</title> |
| 7 |
<link rel="stylesheet" href="http://tomoyo.sourceforge.jp/tomoyo.css" media="all" type="text/css"> |
| 8 |
</head> |
| 9 |
<body> |
| 10 |
<p style="text-align:right;"><a href="learning.html.ja">Japanese Page</a></p> |
| 11 |
<p style="text-align:right;">Last modified: $Date$</p> |
| 12 |
<h1>Phase 3: Learning your system's behavior.</h1> |
| 13 |
|
| 14 |
<p>This page describes how to use TOMOYO Linux's learning mode.</p> |
| 15 |
|
| 16 |
<hr> |
| 17 |
|
| 18 |
<h2>Step 1: Creating domains</h2> |
| 19 |
|
| 20 |
<p>After you rebooted the system with TOMOYO Linux kernels, login as root.</p> |
| 21 |
|
| 22 |
<p>Decide what application to analyze/protect.</p> |
| 23 |
|
| 24 |
<p>Below procedure is a case of Apache in CentOS 5.5 environment.</p> |
| 25 |
|
| 26 |
<p>Start the target application.</p> |
| 27 |
|
| 28 |
<table border="1"> |
| 29 |
<tr><td> |
| 30 |
[root@tomoyo ~]# service httpd start |
| 31 |
</td></tr> |
| 32 |
</table> |
| 33 |
|
| 34 |
<p>Let's start TOMOYO Linux's policy editor. Please note that this time, you don't need to pass /etc/ccs/ to the command line, for we directly edits TOMOYO Linux's policy currently used by the kernel.</p> |
| 35 |
|
| 36 |
<p>In the CentOS 5.5 , Apache's program's location is /usr/sbin/httpd .<br> |
| 37 |
Scroll the cursor using arrow-keys and/or Home/End/PageUp/PageDown keys to find the line /usr/sbin/httpd . In this picture, it is line 416.</p> |
| 38 |
|
| 39 |
<p><img src="editpolicy-httpd-profile0.png" width="720" height="400"></p> |
| 40 |
|
| 41 |
<p>If /usr/sbin/httpd is registered with "initialize_domain", a domain named "<kernel> /usr/sbin/httpd" is created by invoking /usr/sbin/httpd . If not registered, a child domain of invoker domain (for example, if you invoked from "<kernel> /usr/sbin/mingetty /bin/login /bin/bash", it is "<kernel> /usr/sbin/mingetty /bin/login /bin/bash /usr/sbin/httpd") is created. This manual assumes that /usr/sbin/httpd is registered with "initialize_domain".</p> |
| 42 |
|
| 43 |
<p>Press 's' key and enter '1' and press 'Enter' key.</p> |
| 44 |
|
| 45 |
<p><img src="editpolicy-httpd-set-profile1.png" width="720" height="400"></p> |
| 46 |
|
| 47 |
<p>Now the profile number of the /usr/sbin/httpd has changed to 1.</p> |
| 48 |
|
| 49 |
<p><img src="editpolicy-httpd-profile1.png" width="720" height="400"></p> |
| 50 |
|
| 51 |
<p>Press '@' key to switch to process list. Verify that /usr/sbin/httpd processes are assigned profile number 1.</p> |
| 52 |
|
| 53 |
<p><img src="editpolicy-httpd-process1.png" width="720" height="400"></p> |
| 54 |
|
| 55 |
<p>Press 'q' key to quit the policy editor.</p> |
| 56 |
|
| 57 |
<hr> |
| 58 |
|
| 59 |
<h2>Step 2: Gathering necessary permissions</h2> |
| 60 |
|
| 61 |
<p>Restart the Apache in order to learn necessary permissions for starting/finishing the Apache.</p> |
| 62 |
|
| 63 |
<table border="1"> |
| 64 |
<tr><td> |
| 65 |
[root@tomoyo ~]# service httpd restart |
| 66 |
</td></tr> |
| 67 |
</table> |
| 68 |
|
| 69 |
<p>Run TOMOYO Linux's policy editor again and go to the /usr/sbin/httpd line. (Line number may be changed because new domains are added by programs executed by you and the system.)</p> |
| 70 |
|
| 71 |
<p>Press 'Enter' key to browse the permissions gathered by now.</p> |
| 72 |
|
| 73 |
<p><img src="editpolicy-httpd-acl1.png" width="720" height="400"></p> |
| 74 |
|
| 75 |
<p>Press 'q' key to quit the policy editor. Do whatever you want to allow Apache.</p> |
| 76 |
|
| 77 |
<p><img src="operation-learning.png" width="688" height="933"></p> |
| 78 |
|
| 79 |
<p>Be sure to sometimes save policy, for necessary permissions are accumulated on only kernel memory. If you reboot the system, all gathered permissions will be lost.</p> |
| 80 |
|
| 81 |
<p>To save the policy currently in the kernel onto the disk, use "ccs-savepolicy" command.</p> |
| 82 |
|
| 83 |
<table border="1"> |
| 84 |
<tr><td> |
| 85 |
[root@tomoyo ~]# /usr/sbin/ccs-savepolicy |
| 86 |
</td></tr> |
| 87 |
</table> |
| 88 |
|
| 89 |
<p>By executing "ccs-savepolicy", two files ("exception_policy.conf", "domain_policy.conf") are created in the /etc/ccs/ directory. To be accurate, they are symbolic links to text files whose filenames contain the creation time.</p> |
| 90 |
|
| 91 |
<p>To load the policy currently on the disk into the kernel, use "ccs-loadpolicy" command.</p> |
| 92 |
|
| 93 |
<table border="1"> |
| 94 |
<tr><td> |
| 95 |
[root@tomoyo ~]# /usr/sbin/ccs-loadpolicy af |
| 96 |
</td></tr> |
| 97 |
</table> |
| 98 |
|
| 99 |
<p>The "a" option means load two files ("exception_policy.conf", "domain_policy.conf"). The "f" option means erase the policy currently in the kernel before loading the policy currently on the disk. If "f" is not given, the policy currently on the disk will be added to the policy currently in the kernel.</p> |
| 100 |
|
| 101 |
<hr> |
| 102 |
|
| 103 |
<h2>Step 3: Reviewing gathered permissions</h2> |
| 104 |
|
| 105 |
<p>After you came to think you have done roughly everything you want to allow Apache to do, run the policy editor and change the profile number to 2. Note that Apache may have executed some external programs (e.g. /bin/sh , /usr/bin/perl , /usr/lib/sendmail) and thus has descendant domains. Be sure to change the profile number for descendant domains if any as well as the /usr/sbin/httpd domain.</p> |
| 106 |
|
| 107 |
<p>Choose target domains and press 's' key and enter '2' and press 'Enter' key.</p> |
| 108 |
|
| 109 |
<p><img src="editpolicy-httpd-set-profile2.png" width="720" height="400"></p> |
| 110 |
|
| 111 |
<p>Now the profile number of the /usr/sbin/httpd and descendant has changed to 2.</p> |
| 112 |
|
| 113 |
<p><img src="editpolicy-httpd-profile2.png" width="720" height="400"></p> |
| 114 |
|
| 115 |
<p>Press 'q' key to quit the policy editor. Redo whatever you want to allow Apache to do.</p> |
| 116 |
|
| 117 |
<p>If the profile is configured as "PREFERENCE::permissive={ verbose=yes }" (this is default), the "WARNING:" messages will be printed to the console when policy violation occurs.</p> |
| 118 |
|
| 119 |
<p><img src="operation-permissive.png" width="688" height="622"></p> |
| 120 |
|
| 121 |
<p><img src="permissive-warning.png" width="720" height="400"></p> |
| 122 |
|
| 123 |
<p>If you have configured audit logs at <a href="initialize.html.en#configure_audit_daemon">Phase 2: Initializing TOMOYO Linux.</a>, you can pick up necessary permissions from audit logs using "grep".</p> |
| 124 |
|
| 125 |
<table border="1"> |
| 126 |
<tr><td> |
| 127 |
[root@tomoyo ~]# grep -A 3 -F 'profile=2 mode=permissive' /var/log/tomoyo/reject_log.conf<br> |
| 128 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=3039) task={ pid=3039 ppid=3034 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler }<br> |
| 129 |
<kernel> /usr/sbin/httpd<br> |
| 130 |
network inet stream accept 0:0:0:0:0:ffff:c0a8:801 1507<br> |
| 131 |
<br> |
| 132 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 133 |
<kernel> /usr/sbin/httpd /bin/sh<br> |
| 134 |
file execute /usr/bin/id<br> |
| 135 |
<br> |
| 136 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 137 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 138 |
misc env TERM<br> |
| 139 |
<br> |
| 140 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 141 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 142 |
misc env PATH<br> |
| 143 |
<br> |
| 144 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 145 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 146 |
misc env PWD<br> |
| 147 |
<br> |
| 148 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 149 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 150 |
misc env LANG<br> |
| 151 |
<br> |
| 152 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 153 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 154 |
misc env SHLVL<br> |
| 155 |
<br> |
| 156 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 157 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 158 |
misc env LANGUAGE<br> |
| 159 |
<br> |
| 160 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 161 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 162 |
misc env _<br> |
| 163 |
<br> |
| 164 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=328251 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327965 perm=0755 }<br> |
| 165 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 166 |
file read /etc/selinux/config<br> |
| 167 |
<br> |
| 168 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=12 major=0 minor=15 perm=0444 type=file } path1.parent={ uid=0 gid=0 ino=463 perm=0755 }<br> |
| 169 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 170 |
file read /selinux/mls<br> |
| 171 |
<br> |
| 172 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=4026531844 major=0 minor=3 perm=0444 type=file } path1.parent={ uid=0 gid=0 ino=1 perm=0555 }<br> |
| 173 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 174 |
file read /proc/filesystems<br> |
| 175 |
<br> |
| 176 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=605586 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=589842 perm=0755 }<br> |
| 177 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 178 |
file read /usr/lib/locale/locale-archive<br> |
| 179 |
<br> |
| 180 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=329303 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 181 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 182 |
file read /etc/nsswitch.conf<br> |
| 183 |
<br> |
| 184 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=330197 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 185 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 186 |
file read /etc/passwd<br> |
| 187 |
<br> |
| 188 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=330196 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 189 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 190 |
file read /etc/group<br> |
| 191 |
<br> |
| 192 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=330196 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 193 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 194 |
file read /etc/group |
| 195 |
</td></tr> |
| 196 |
</table> |
| 197 |
|
| 198 |
<p>You can compress these logs using "ccs-sortpolicy" command.</p> |
| 199 |
|
| 200 |
<table border="1"> |
| 201 |
<tr><td> |
| 202 |
[root@tomoyo ~]# grep -A 3 -F 'profile=2 mode=permissive' /var/log/tomoyo/reject_log.conf | /usr/sbin/ccs-sortpolicy<br> |
| 203 |
<kernel> /usr/sbin/httpd<br> |
| 204 |
<br> |
| 205 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 206 |
network inet stream accept 0:0:0:0:0:ffff:c0a8:801 1507<br> |
| 207 |
<br> |
| 208 |
<kernel> /usr/sbin/httpd /bin/sh<br> |
| 209 |
<br> |
| 210 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 211 |
file execute /usr/bin/id<br> |
| 212 |
<br> |
| 213 |
<kernel> /usr/sbin/httpd /bin/sh /usr/bin/id<br> |
| 214 |
<br> |
| 215 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=12 major=0 minor=15 perm=0444 type=file } path1.parent={ uid=0 gid=0 ino=463 perm=0755 }<br> |
| 216 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=328251 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327965 perm=0755 }<br> |
| 217 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=329303 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 218 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=330196 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 219 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=330197 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=327681 perm=0755 }<br> |
| 220 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=4026531844 major=0 minor=3 perm=0444 type=file } path1.parent={ uid=0 gid=0 ino=1 perm=0555 }<br> |
| 221 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=603159 major=8 minor=1 perm=0755 type=file } path1.parent={ uid=0 gid=0 ino=589834 perm=0755 } exec={ realpath="/usr/bin/id" argc=1 envc=7 argv[]={ "id" } envp[]={ "TERM=linux" "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PWD=/usr/share/horde/admin" "LANG=en_US.UTF-8" "SHLVL=3" "LANGUAGE=en_US.UTF-8" "_=/usr/bin/id" } }<br> |
| 222 |
#2010-01-12 16:11:32# profile=2 mode=permissive (global-pid=4641) task={ pid=4641 ppid=4637 uid=48 gid=48 euid=48 egid=48 suid=48 sgid=48 fsuid=48 fsgid=48 type!=execute_handler } path1={ uid=0 gid=0 ino=605586 major=8 minor=1 perm=0644 type=file } path1.parent={ uid=0 gid=0 ino=589842 perm=0755 }<br> |
| 223 |
misc env LANG<br> |
| 224 |
misc env LANGUAGE<br> |
| 225 |
misc env PATH<br> |
| 226 |
misc env PWD<br> |
| 227 |
misc env SHLVL<br> |
| 228 |
misc env TERM<br> |
| 229 |
misc env _<br> |
| 230 |
file read /etc/group<br> |
| 231 |
file read /etc/nsswitch.conf<br> |
| 232 |
file read /etc/passwd<br> |
| 233 |
file read /etc/selinux/config<br> |
| 234 |
file read /proc/filesystems<br> |
| 235 |
file read /selinux/mls<br> |
| 236 |
file read /usr/lib/locale/locale-archive |
| 237 |
</td></tr> |
| 238 |
</table> |
| 239 |
|
| 240 |
<p>You can save the compressed logs into a temporary file. Then, you can edit as you need and append to currently used policy in the kernel using "ccs-loadpolicy". ccs-loadpolicy's "-" option means read from stdin, "d" option means domain_policy.conf .</p> |
| 241 |
|
| 242 |
<table border="1"> |
| 243 |
<tr><td> |
| 244 |
[root@tomoyo ~]# grep -A 3 -F 'profile=2 mode=permissive' /var/log/tomoyo/reject_log.conf | /usr/sbin/ccs-sortpolicy > ~/rejected.log<br> |
| 245 |
[root@tomoyo ~]# emacs ~/rejected.log<br> |
| 246 |
[root@tomoyo ~]# /usr/sbin/ccs-loadpolicy -d < ~/rejected.log |
| 247 |
</td></tr> |
| 248 |
</table> |
| 249 |
|
| 250 |
<hr> |
| 251 |
|
| 252 |
<h2>Step 4: Handling temporary files</h2> |
| 253 |
|
| 254 |
<p>You can not handle temporary files by simply using "learning mode" and "permissive mode". You need to interactively handle temporary files according to <a href="tool-editpolicy.html.en#acl_editor">To remove redundant ACL entries</a>.<br> |
| 255 |
But if you want to convert temporary files into patterns non-interactively, you can do it as shown below.</p> |
| 256 |
|
| 257 |
<p>List up pathnames that can be temporary files.</p> |
| 258 |
|
| 259 |
<table border="1"> |
| 260 |
<tr><td> |
| 261 |
[root@tomoyo ~]# /usr/sbin/ccs-findtemp < /proc/ccs/domain_policy<br> |
| 262 |
/etc/mtab.tmp<br> |
| 263 |
/etc/mtab~<br> |
| 264 |
/etc/mtab~2302<br> |
| 265 |
/etc/mtab~2328<br> |
| 266 |
/etc/mtab~2329<br> |
| 267 |
/etc/mtab~2330<br> |
| 268 |
/etc/mtab~2331<br> |
| 269 |
/etc/mtab~2332<br> |
| 270 |
/etc/mtab~2339<br> |
| 271 |
/etc/mtab~2383<br> |
| 272 |
/halt<br> |
| 273 |
/selinux/disable<br> |
| 274 |
/selinux/enforce<br> |
| 275 |
/selinux/policyvers<br> |
| 276 |
/tmp/sh-thd-1163110572<br> |
| 277 |
/tmp/sh-thd-1163113704<br> |
| 278 |
/var/cache/samba/browse.dat.<br> |
| 279 |
/var/lib/nfs/etab.tmp<br> |
| 280 |
/var/lib/nfs/xtab.tmp<br> |
| 281 |
/var/lock/mrtg/mrtg_l<br> |
| 282 |
</td></tr> |
| 283 |
</table> |
| 284 |
|
| 285 |
<p>We can consider that "/etc/mtab~numeric" and "/tmp/sh-thd-numeric" are temporary files, thus we make patterns for these pathnames. First, we need to consider what patterns to use. In these examples, numeric seems decimal digits. Thus, we use \$ pattern which matches one or more repetitions of decimal digits.</p> |
| 286 |
|
| 287 |
<p>Append patterns to the exception policy.</p> |
| 288 |
|
| 289 |
<table border="1"> |
| 290 |
<tr><td> |
| 291 |
[root@tomoyo ~]# echo 'file_pattern /etc/mtab~\$' | /usr/sbin/ccs-loadpolicy -e<br> |
| 292 |
[root@tomoyo ~]# echo 'file_pattern /tmp/sh-thd-\$' | /usr/sbin/ccs-loadpolicy -e |
| 293 |
</td></tr> |
| 294 |
</table> |
| 295 |
|
| 296 |
<p>Replace "/etc/mtab~numeric" and "/tmp/sh-thd-numeric" in the domain policy with '/etc/mtab~\$' and '/tmp/sh-thd-\$'</p> |
| 297 |
|
| 298 |
<table border="1"> |
| 299 |
<tr><td> |
| 300 |
[root@tomoyo ~]# /usr/sbin/savepolicy -d | /usr/sbin/ccs-patternize '/etc/mtab~\$' '/tmp/sh-thd-\$' | /usr/sbin/loadpolicy -d |
| 301 |
</td></tr> |
| 302 |
</table> |
| 303 |
|
| 304 |
<p>Since you are editing policy currently loaded into the kernel, changes will be lost if you shutdown the system without saving. Save exception_policy.conf and domain_poilicy.conf using "ccs-savepolicy" command.</p> |
| 305 |
|
| 306 |
<table border="1"> |
| 307 |
<tr><td> |
| 308 |
[root@tomoyo ~]# /usr/sbin/savepolicy a |
| 309 |
</td></tr> |
| 310 |
</table> |
| 311 |
|
| 312 |
<p>If the "WARNING:" messages are no longer printed after you have likely done everything you want Apache to allow, proceed to the next step. (You can ignore "Access TCP accept" warnings against /usr/sbin/httpd , for you will make the address and port number patterns at next phase.)</p> |
| 313 |
|
| 314 |
<p>If your purpose of using TOMOYO Linux is for just analysis, this point is the goal of this procedure.</p> |
| 315 |
|
| 316 |
<p>If your purpose of using TOMOYO Linux is for protection, proceed to next phase.</p> |
| 317 |
|
| 318 |
<hr> |
| 319 |
|
| 320 |
<p><a href="index.html.en">Return to index page.</a></p> |
| 321 |
<p><a href="http://sourceforge.jp/"><img src="http://sourceforge.jp/sflogo.php?group_id=1973" width="96" height="31" alt="SourceForge.jp"></a></p> |
| 322 |
</body> |
| 323 |
</html> |
TOMOYO
Parent Directory
Revision Log