Kiosk Mode, or why are all the cool Linux security tools on Fedora?

It's not that I have anything against Fedora, but for some reason I've never used it much, but I'm thinking I should wipe OpenSuSE on my 2nd partition and add Fedora (8 or 9?) because there seems to be a lot going on there. The most recent example is Fedora Kiosk Mode which is built on xguest and Linux namespaces (how many times can you say polyinstantiation?) GNOME Sabayon and SELinux of course to create "highly secure" (or at very least restricted environments) for public environments such as classrooms or public information kiosks. Cool stuff.

HT: James Morris

Linux Auditing Tool Showdown: sectool v. ProShield

So I ran across ProShield on Complete Dose of Linux Poison and I was expecting good things by the writeup, but when I peeked inside the .deb I was shocked to see a 1000+ line shell script. Got a new test? Just tack in on the end of a monolithic script.

The horror. The horror.

Unless you are writing system startup scripts there is no reason anything should be written in shell that is longer than 10-20 lines.

(Having had to maintain thousands of lines of shell/sed/awk scripts that somebody else wrote.)

On the other hand sectool (which doesn't work out of the box with Ubuntu/Debian) does have some potential not only because it is written in a post-1970s scripting language (Python) but has a framework-plugin architecture where where individual test cases can be written in shell or Python.

Of course a limitation of both of these is that must be run locally to get results (I assume) making it very difficult to scan large numbers of systems -- unlike what you can do with Nessus compliance checks for UNIX.

Good Recent Paper to Get Up to Speed on SELinux

James Morris (of RedHat) has one of the better papers seen so far, Have you driven an SELinux lately?.

Among the areas for future work, he defines:

*Continued extension of SELinux architecture to the
desktop infrastructure and major applications. The
Imsep work mentioned in section 10.1 looks to be a
promising model for general separation of security
domains within applications.
• Working with the IETF to standardize Labeled
NFS, and with the Linux community to have it accepted
into the mainline kernel.
• Ongoing performance improvement, and efforts to
further reduce the memory footprint of SELinux.
• Further simplification of policy, perhaps through
the development of a higher-level policy language
with idioms more familiar to Linux administrators.
• Support for more virtualization models, including
Linux as hypervisor (e.g. KVM) and containers.
• Improved support for third party distribution of
policy modules, such as the case of cross-building
RPMs on systems with a conflicting host policy.
Continued usability improvements for end users,
administrators and developers.
• Better documentation.

SELinux on Ubuntu LTS: Baby Steps

Silly me, I didn't know SELinux was built into the kernel (or at least available) on Ubuntu LTS, until I saw a kernel message this afternoon, so while waiting for my daughter to fall asleep with here Little Bear video, I decided to give it a shot on my Thinkpad.

Do the apt dance

apt-get install selinux

or maybe installed python-selinux, can't remember, but a whole bunch of shit got installed.


Edit GRUB kernel options

I got rid of splash and quiet, always hated those.

ro apparmor.enabled=0 selinux=1 enforcing=0

Use syslog-ng to capture audit events

destination df_selinux { file("/var/log/selinux"); };
filter f_selinux {
       match("audit") or match ("restorecond:");
};
log {
       source(s_all);
       filter(f_selinux);
       destination(df_selinux);
};

Then reboot, it is normal for it to relabel the fileystem.

Now to figure out what the hell all this means..

Oct 31 21:03:31 mfranz-t61 restorecond: terminated
Oct 31 21:04:35 mfranz-t61 kernel: [ 15.685858] audit: initializing netlink socket (disabled)
Oct 31 21:04:35 mfranz-t61 kernel: [ 15.685935] audit(1225501446.416:1): initialized
Oct 31 21:04:35 mfranz-t61 kernel: [ 18.857262] audit(1225501456.585:2): policy loaded auid=4294967295
Oct 31 21:04:35 mfranz-t61 kernel: [ 36.373309] audit(1225501474.769:3): avc: denied { mmap_zero } for pid=5224 comm="vbetool" scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=memprotect
Oct 31 21:04:36 mfranz-t61 restorecond: Reset file context /var/run/cups: system_u:object_r:var_run_t->system_u:object_r:cupsd_var_run_t
Oct 31 21:05:27 mfranz-t61 restorecond: Reset file context /etc/resolv.conf: system_u:object_r:etc_runtime_t->system_u:object_r:net_conf_t

Etch and a Half and Python SELinux

So by about 10 o'clock on another day off I finally managed to stop checking my work email. Something to feel proud off. I guess I knew it was time when I sent somebody at work a sarcastic email saying I couldn't answer their email because I was on PTO.

And after getting back from having another freaking tire replaced (thank God for Sears Road Hazard) I actually managed to get some computer time since my daughter is feeling better.

Since times are so tough I canceled my VPS, so I've been using Google sites instead and I started a new Linux Security Page to cover stuff on SELinux and AppArmor, both of which I've wanted to play around with for a long time. Also added some new virtualization projects to my watch list which uses the "lists" feature of Google Sites. Very nice.

I don't have any CentOS boxes handy at home but SELinux is available in Debian 4.0 so I gave the latest release a try.

Wow, the python wrappers for SELinux are so cool:

debian4-1008:~# python
Python 2.4.4 (#2, Apr 15 2008, 23:43:20) 
[GCC 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import selinux
>>> selinux.is_selinux_enabled()
1

Sure, whatever.