From Fedora Project Wiki

No edit summary
No edit summary
Line 1: Line 1:
= Confined Users Test Day =
= Confined Users Test Day =
* '''Devel contact:''' dwalsh, mgrepl
* '''Devel contact:''' dwalsh, mgrepl
* '''QE contact:''' mmalik, ebenes
* '''QE contact:''' mmalik, ebenes
Line 15: Line 16:


== What's Needed to Be Able to Test ==
== What's Needed to Be Able to Test ==
You will need following packages on your system:
You will need following packages on your system:
* selinux-policy-targeted
* selinux-policy-targeted
Line 23: Line 25:


== How to Test ==
== How to Test ==
The main goal is testing of chosen users and to do usual things for you with these SELinux users.
The main goal is testing of chosen users and to do usual things for you with these SELinux users.


Line 30: Line 33:


=== guest_u ===
=== guest_u ===
* Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory.
* Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory.


Line 36: Line 40:
Add an user account. Ssh to the box and try the following:
Add an user account. Ssh to the box and try the following:


* Good Test - Try to do expected behaviour
* Good Test - Try to do expected behaviour
  * Edit files in home directory.
** Edit files in home directory.
  * scp files to home directory and public_html directory.
** scp files to home directory and public_html directory.
  * Copy files to public_html directory.
** Copy files to public_html directory.
  * Verify content is viewable via apache.
** Verify content is viewable via apache.
* Bad Test - Try to do evil
 
  * Try to ping off the box.
* Bad Test - Try to do evil
  * Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
** Try to ping off the box.
  * Copy an executable into home directory and try to execute it.
** Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
  * Try to read a file in the /secrets directory.
** Copy an executable into home directory and try to execute it.
  * Try to read the mysql database.
** Try to read a file in the /secrets directory.
** Try to read the mysql database.


=== xguest_u ===
=== xguest_u ===
. – X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory.  
 
* X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory.  


Set up a client machine, with network access. Change default login to xguest_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.
Set up a client machine, with network access. Change default login to xguest_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.
Line 55: Line 61:
Add an user account.
Add an user account.


* Good Test - Try to do expected behaviour
* Good Test - Try to do expected behaviour
  * Edit files in home directory.
** Edit files in home directory.
  * Verify firefox works and can access the network. Try it on several sites like www.ford.com to verify flash works.
** Verify firefox works and can access the network. Try it on several sites like www.ford.com to verify flash works.
  * Plug in USB disk and make sure xguest_u user can read/write the disk.
** Plug in USB disk and make sure xguest_u user can read/write the disk.
  * Plug in USB camera and make sure it works.
** Plug in USB camera and make sure it works.
  * Plug in other USB devices.
** Plug in other USB devices.
  * Verify [[NetworkManager|Network Manager]] works.
** Verify [[NetworkManager|Network Manager]] works.
  * Verify printing from Firefox and from the desktop works.
** Verify printing from Firefox and from the desktop works.


* Bad Test - Try to do evil
* Bad Test - Try to do evil
  * Try to ping off the box.
** Try to ping off the box.
  * Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
** Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
  * Copy an executable into home directory and try to execute it.
** Copy an executable into home directory and try to execute it.
  * Try to read a file in the /secrets directory.
** Try to read a file in the /secrets directory.
  * Try to read the mysql database.
** Try to read the mysql database.


=== user_u ===
=== user_u ===
. – X Windows Login and terminal login, nosetuid, noexec in home directory
 
* X Windows Login and terminal login, nosetuid, noexec in home directory


Setup a client machine, with network access. Change default login to user_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.
Setup a client machine, with network access. Change default login to user_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.
Line 96: Line 103:


=== staff_u ===
=== staff_u ===
. – X Windows Login and terminal login, nosetuid except sudo
 
* X Windows Login and terminal login, nosetuid except sudo


Setup a client machine, with network access. Change default login to user_u.  Create a directory named /secrets, and install mysql, make sure the database is world readable.
Setup a client machine, with network access. Change default login to user_u.  Create a directory named /secrets, and install mysql, make sure the database is world readable.


Add user account.  Login to the box
Add an user account.  Login to the box


  * Good Test - Try to do expected behaviour
  * Good Test - Try to do expected behaviour
Line 121: Line 129:


=== Kiosk user ===
=== Kiosk user ===
* X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory - NO password required. Home directory and /tmp get destroyed on logout.
* X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory - NO password required. Home directory and /tmp get destroyed on logout.


Line 145: Line 154:


=== Confined administrator ===
=== Confined administrator ===
Let's set up an administrator that can manage '''MySQL''' and '''Apache'''.
Let's set up an administrator that can manage '''MySQL''' and '''Apache'''.



Revision as of 14:47, 14 October 2009

Confined Users Test Day

  • Devel contact: dwalsh, mgrepl
  • QE contact: mmalik, ebenes

What to Test?

Today's Fedora Test Day will focus on Confined SELinux Users. We want to write a policy confining a user by assigning the user an SELinux role where the policy controls what the user can do/access on the system. Current confined SELinux user types with their purpose of use are:

  • guest_u – Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory.
  • xguest_u – X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory.
  • user_u – X Windows login and terminal login, nosetuid, noexec in home directory.
  • staff_u – X Windows login and terminal login, nosetuid except sudo.

The purpose of test day is testing these SELinux users in your desktop and try to test users in specific cases. So for example like xguest_u, user_u or staff_u try to login to X Windows, try to start firefox, IM, try to run terminal, try to run ping, sudo and so on.

What's Needed to Be Able to Test

You will need following packages on your system:

  • selinux-policy-targeted
  • policycoreutils-gui
  • setroubleshoot

Set up SELinux users ...

How to Test

The main goal is testing of chosen users and to do usual things for you with these SELinux users.

For example if you log as xguest and try to run ping or sudo in your favourite terminal you won't be able to run it. But if you won't be able to run Firefox then probably this is a bug.

Test Cases

guest_u

  • Terminal login, nosetuid, nonetwork, noxwindows, noexec in home directory.

Set up a server only machine, with apache service. And apache sharing users home directories. Change default login to guest_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.

Add an user account. Ssh to the box and try the following:

  • Good Test - Try to do expected behaviour
    • Edit files in home directory.
    • scp files to home directory and public_html directory.
    • Copy files to public_html directory.
    • Verify content is viewable via apache.
  • Bad Test - Try to do evil
    • Try to ping off the box.
    • Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
    • Copy an executable into home directory and try to execute it.
    • Try to read a file in the /secrets directory.
    • Try to read the mysql database.

xguest_u

  • X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory.

Set up a client machine, with network access. Change default login to xguest_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.

Add an user account.

  • Good Test - Try to do expected behaviour
    • Edit files in home directory.
    • Verify firefox works and can access the network. Try it on several sites like www.ford.com to verify flash works.
    • Plug in USB disk and make sure xguest_u user can read/write the disk.
    • Plug in USB camera and make sure it works.
    • Plug in other USB devices.
    • Verify Network Manager works.
    • Verify printing from Firefox and from the desktop works.
  • Bad Test - Try to do evil
    • Try to ping off the box.
    • Try any network protocol, try to get off the box (ssh, sendmail, rsh, telnet etc.)
    • Copy an executable into home directory and try to execute it.
    • Try to read a file in the /secrets directory.
    • Try to read the mysql database.

user_u

  • X Windows Login and terminal login, nosetuid, noexec in home directory

Setup a client machine, with network access. Change default login to user_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.

Add a user account. Login to the box.

* Good Test - Try to do expected behaviour
 * Edit files in home directory
 * verify firefox works and access network.  Try it on several sites like www.ford.com to verify flash works.
 * Verify other network protocols work, aol, ssh, sendmail etc.
 * Plug in USB disk and make sure xguest_u user can read/write disk
 * Plugin in USB camera and make sure it works.
 * Other USB devices.
 * Verify Network Manager works.
 * Verify Printing from Firefox and from the desktop works.
* Bad Test - Try to do evil
 * Try to ping off the box
 * Try to breakinto the root account , su, sudo
 * Copy and executable into homedir and try to execute it.
 * Try to read a file in the /secrets directory
 * try to read the mysql database.

staff_u

  • X Windows Login and terminal login, nosetuid except sudo

Setup a client machine, with network access. Change default login to user_u. Create a directory named /secrets, and install mysql, make sure the database is world readable.

Add an user account. Login to the box

* Good Test - Try to do expected behaviour
 * Edit files in home directory
 * verify firefox works and access network.  Try it on several sites like www.ford.com to verify flash works.
 * Verify other network protocols work, aol, ssh, sendmail etc.
 * Plug in USB disk and make sure xguest_u user can read/write disk
 * Plugin in USB camera and make sure it works.
 * Other USB devices.
 * Verify Network Manager works.
 * Verify Printing from Firefox and from the desktop works.
 * Try to ping off the box
 * Copy and executable into homedir and try to execute it.
 * setup sudo and selinux to allow staff_t to become unconfined_t via sudo
* Bad Test - Try to do evil
 * Try to breakinto the root account sudo
 * Try to read a file in the /secrets directory
 * try to read the mysql database.

Kiosk user

  • X Windows login and terminal login, nosetuid, nonetwork, noexec in home directory - NO password required. Home directory and /tmp get destroyed on logout.

Set up a client machine, with network access. Install xguest package.

  • Good Test - Try to do expected behaviour
    • Edit files in home directory.
    • Verify firefox works and can access the network. Try it on several sites like www.ford.com to verify flash works.
    • Plug in USB disk and make sure xguest_u user can read/write the disk.
    • Plug in USB camera and make sure it works.
    • Plug in other USB devices.
    • Verify that Network Manager works.
    • Verify printing from Firefox and from the desktop works.
    • Logout and log back to verify that home directory disappeared.
    • Verify password is not required.
  • Bad Test - Try to do evil
    • Try to ping off the box.
    • Try any network protocol, try to get off the box (ssh, sendmail, telnet, rsh etc.)
    • Copy an executable into home directory and try to execute it.
    • Try to read a file in the /secrets directory
    • Try to read the mysql database.
    • Verify that you can not ssh into the box as the xguest account.

Confined administrator

Let's set up an administrator that can manage MySQL and Apache.

Set up a client machine, with network access. Build policy for web_db_admin_t. Add an user which can log in as staff_u. Setup a transition from staff_u to web_db_admin_t. Set up sudo to make this happen automatically. Create a directory named /secrets, and install MySQL, make sure the database is world readable.

  • Good Test - try to do expected behaviour
    • Edit files in home directory.
    • Verify Firefox works and can access the network. Try it on several sites like http://www.ford.com to verify flash works.
    • Verify other network protocols work (aol, ssh, mail etc.)
    • Plug in USB disk and make sure xguest_u user can read/write the disk.
    • Plug in USB camera and make sure it works.
    • Plug in other USB devices.
    • Verify Network Manager works.
    • Verify printing from firefox and from the desktop works.
    • Try to ping off the box.
    • Copy an executable into home directory and try to execute it.
    • Set up sudo and SELinux to allow staff_t to become unconfined_t via sudo.
    • Execute sudo sh and make sure you end up as web_db_adm_t.
    • Try to edit /var/www/html directory and some of the mysql directories.
    • Try to start/stop mysql and apache.
  • Bad Test - try to do evil
    • Try to break into the root account via su.
    • Try to read a file in the /secrets directory.
    • Try to read the MySQL database.
    • As web_db_adm_t try to add an user, modify files in /usr/share.

Guest user that can send an email

Set up a server machine, with network access. Build policy for sendmail_user_t. Add an user which can log in as sendmail_user_u.

  • Good Test - try to do expected behaviour
    • Edit files in home directory.
    • Verify you can send a mail from this user.
  • Bad Test - try to do evil
    • Try to break into the root account via sudo.
    • Try to read a file in the /secrets directory.
    • Try to read the MySQL database.

Links

  1. http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html
  2. http://magazine.redhat.com/2008/07/02/writing-policy-for-confined-selinux-users/
  3. http://www.linuxtopia.org/online_books/fedora_selinux_guides/fedora_10_selinux_user_guide/fedora_10_selinux_sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html
  4. http://selinux-mac.blogspot.com/2009/06/selinux-lockdown-part-one-confined.html