<html><head><style type="text/css"></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">My mistakes, apologies for the confusion, under part 2, I was trying to do domain_auto_trans instead of doman_entry_file, so... 2. Created a domain transition so that the vmware user programs e.g. /usr/lib/vmplayer script, /usr/lib/vmware/bin/vmplayer that are labelleled system_u:object_r:vmware_exec_t will transit to system_u:object_r:vmware_t when executed. I put it also in vmware.te: domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) but on making the vmware.pp module I get this warning and error: 'syntax error' at token '1' on line 81143: #line 13 allow $1_t vmware_exec_t: file {getattr read execute}; <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">Thanks in advance, Louis ----- Original Message ---- From: Louis Lam <lshoujun@yahoo.com> To: Daniel J Walsh <dwalsh@redhat.com> Cc: fedora-selinux-list@redhat.com Sent: Friday, July 27, 2007 5:05:05 AM Subject: Re: Containing vmware player 2.0.0 with SELINUX <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">Thanks Daniel for the information, hi everyone I've tried to make the following changes: 1. Defined the vmware_t type in vmware.te: type vmware_t; I need to do this since I'm trying to let the vmware user program run under vmware_t domain but this is not defined. In terms of overall code compliance is it correct to define here? or should be at the vmware.if? 2. Created a domain transition so that the vmware user programs e.g. /usr/lib/vmplayer script, /usr/lib/vmware/bin/vmplayer that are labelleled system_u:object_r:vmware_exec_t will transit to system_u:object_r:vmware_t when executed. I put it also in vmware.te: domain_entry_file($1_t, vmware_exec_t, $1_vmware_t) but on making the vmware.pp module I get this warning and error: 'syntax error' at token '1' on line 81143: #line 13 allow $1_t vmware_exec_t: file entrypoint; Not very sure what this means and how it should be corrected. Thanks in advance, Louis <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">----- Original Message ---- From: Daniel J Walsh <dwalsh@redhat.com> To: Louis Lam <lshoujun@yahoo.com> Cc: Ken YANG <spng.yang@gmail.com>; fedora-selinux-list@redhat.com Sent: Wednesday, July 25, 2007 3:12:56 PM Subject: Re: Containing vmware player 2.0.0 with SELINUX <div>Louis Lam wrote: > Hi All, > > Still on the topic of transition between a file vmware_exec_t to vmware_t. > > Under the vmware.if file, there is a: > > domain_entry_file($1_vmware_t, vmware_exec_t) > role $3 types $1_vmware_t > > Is this a rule that allows files marked with vmware_exec_t to transit > to vmware_t? What does the $1,$2,$3 represent? Pardon my ignorance on > this but i see these $1, $2 things appear in a lot of places which > confuse me. Can anyone point me to a place to learn more about the > substitutions? > This just says that files labeled vmware_exec_t can be used as entrypoints into the $1_vmware_t, where $1 is a user type. "user", "staff", "guest", "xguest". The next line specifies which roles can reach the specified domain. No transition rules have been defined. > For the transition to take place I'd probably need to add something > like this: > > domain_auto_trans(initrc_t, vmware_exec_t, vmware_t) > Yes this allows it to reach this particular domain. But to reach the user domains defined above. domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) or domain_auto_trans(user_t, vmware_exec_t, user_vmware_t) > That is following the suggestion below by Daniel to make the > /usr/bin/vmplayer script initrc_exec_t. > > But not too sure where to place this statement, in vmware.te? > > I tried that but get a compilation error > > vmware.te:13:ERROR: 'unknown type vmware_t' at token ';' > Yes I was mistaken. That is not the way the policy is written. ( I guess I should read before I speak.) If you want to get vmware to transition from unconfined_t you will have to write the transition rules from uncofined_t to unconfined_vmware_t. > I thought vmware_t has been defined in vmware.if? > > Thanks in Advance, > Best Regards, > Louis > > ----- Original Message ---- > From: Daniel J Walsh <dwalsh@redhat.com> > To: Louis Lam <lshoujun@yahoo.com> > Cc: Ken YANG <spng.yang@gmail.com>; fedora-selinux-list@redhat.com > Sent: Monday, July 16, 2007 1:24:00 PM > Subject: Re: Containing vmware player 2.0.0 with SELINUX > > Louis Lam wrote: > > Hi All, > > > > I managed to get the vmware host services e.g. vmnet-bridge, > vmnet-dhcpd etc... to be running in > > vmware_host_t domain. I did it by modifying the net-services.sh as > described in an earlier post. > > > > Next I tried to get vmplayer (i'm using vmware player 2.0.0 but it > is similar for vmware ws 6) to > > run in vmware_t domain. First i tried to chcon /usr/bin/vmplayer to > > system_u:object_r:vmware_exec_t. But it turns out that > /usr/bin/vmplayer is a script that would in > > turn execute /usr/lib/vmware/bin/vmplayer. I have chcon > /usr/lib/vmware/bin/vmplayer to > > system_u:object_r:vmware_exec_t but still it runs in unconfined_t > when i launched it. I seems like > > the domain transition didn't take place. Please help. > > > > 1. What should be the context for the /usr/bin/vmplayer script? Does > it affect the transition of > > the actual executable /usr/lib/vmware/bin/vmplayer? > > > > 2. For those who could get vmware workstation 6 to run how did you > get it to run in vmware_t > > domain? > > > > > There is currently no transition from unconfined_t to vmware_t. So the > only way to get > the transition to happen is through the initrc script. You could label > the vmplayer script > initrc_exec_t and the transitions should happen properly. > > THanks, > > Louis > > > > --- Daniel J Walsh <dwalsh@redhat.com> wrote: > > > > > >> Ken YANG wrote: > >> > >>> Daniel J Walsh wrote: > >>> > >>> > >>>> Louis Lam wrote: > >>>> > >>>> > >>>>> Hi all, > >>>>> > >>>>> At this point i'm still trying to use SELINUX to "contain" vmware > >>>>> player, making it run in > >>>>> targeted mode. > >>>>> > >>>>> I'm still rather new to this but through the help of Ken, i've been > >>>>> able to manipulate modules and > >>>>> get it to "affect" the vmware player but at this point my vmware > >>>>> player is still "broken". > >>>>> Would anyone be able to share their configurations (.te,.fc,.if) > file > >>>>> if you've managed to get it > >>>>> to work with vmware player or vmware-workstation 6 ? CUrrently i'm > >>>>> working with Fedora 7 but > >>>>> intend to port it back to RHEL 5. > >>>>> > >>>>> I've downloaded the latest reference policy from oss and > examined the > >>>>> vmware relevant files. From > >>>>> examining the vmware.fc and > >>>>> "/etc/selinux/targeted/modules/active/file_context", seems like the > >>>>> vmware.fc file could have been written for an older/different > version > >>>>> of vmware where the vmnet > >>>>> devices are at /dev/vmnet.* instead of /dev/vmnet* found in vmplayer > >>>>> 2/workstation 6. Which > >>>>> version was it written for? > >>>>> > >>>>> > >>>>> > >>>>> > >>>> There is vmware policy that we are starting to use in Rawhide (fc8) > >>>> > >>>> > >>>>> I went on to modify the vmware.fc file and managed to compile > and load > >>>>> the vmware.pp module. But > >>>>> currently this affected the vmware services at startup, e.g. > >>>>> vmnet-dhcpd. For vmware, when > >>>>> something fails to start, it would ask me to rum vmware-config.pl > >>>>> again when i restart it. Doing > >>>>> this would recreate the /dev/vmnet* files over again but it will not > >>>>> have the right context, > >>>>> defaulting to "device_t" instead of "vmware_device_t" that i have > >>>>> modified. The line in my > >>>>> vmware.fc looks like this: > >>>>> > >>>>> /dev/vmnet0 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>>> /dev/vmnet1 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>>> /dev/vmnet8 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>>> > >>>>> I was thinking that if the script has created a new /dev/vmnet > file it > >>>>> would automatically use the > >>>>> vmware_device_t context but it didn't. Did i miss out anything? > >>>>> > >>>>> > >>>>> > >>>> The problem here is the script is running as initrc_t which has > no rules > >>>> when creating devices in directories labeled device_t (/dev) So > it uses > >>>> the default and labels the devices the same as the > directory. Usually > >>>> when we have this situation, we just run restorecon /dev/XYZ > after the > >>>> creation, > >>>> for example > >>>> > >>>> mknod /dev/XYZ > >>>> chmod 666 /dev/XYZ > >>>> restorecon /dev/XYZ > >>>> > >>>> > >>> as tom said, it seemed that it's "$vmdb_answer_LIBDIR"/net-services.sh > >>> who create such devices: > >>> > >>> <a rel="nofollow" target="_blank" href="http://marc.info/?l=fedora-selinux-list&m=118407622004161&w=2">http://marc.info/?l=fedora-selinux-list&m=118407622004161&w=2</a> > <<a rel="nofollow" target="_blank" href="http://marc.info/?l=fedora-selinux-list&m=118407622004161&w=2">http://marc.info/?l=fedora-selinux-list&m=118407622004161&w=2</a>> > >>> > >>> > >>> i notice "/dev" is tmpfs: > >>> > >>> -(:14:45:$)-> cat /proc/mounts > >>> rootfs / rootfs rw 0 0 > >>> /dev/root / ext3 rw,data=ordered 0 0 > >>> /dev /dev tmpfs rw 0 0 > >>> ...... > >>> > >>> i want to add rules in policy: > >>> > >>> type_transition "vmware type" tmpfs_t : chr_file vmware_device_t; > >>> > >>> additionally i don't know what type of the net-services.sh, now it is: > >>> > >>> ... root root user_u:object_r:lib_t /usr/lib/vmware/net-services.sh > >>> > >>> > >>> is this method appropriate? > >>> > >>> > >>> > >>> > >>> > >>> > >>>>> What is the two "--" on the line mean? are they significant? > >>>>> > >>>>> > >>>>> > >>>> The -- indicates that this matches only files. > >>>> > >>>> -d directories > >>>> -s sock_file > >>>> -l link file > >>>> -c char_file > >>>> ... > >>>> > >>>> Second character matches the first character of the ls -l line > >>>> > >>>> ls -l /dev/ttyS0 > >>>> crw-rw---- 1 root uucp 4, 64 2007-07-11 19:07 /dev/ttyS0 > >>>> > >>>> If you have no option specified it would match any file type. > >>>> > >>>> /dev/vmnet0 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>> /dev/vmnet1 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>> /dev/vmnet8 -- gen_context(system_u:object_r:vmware_device_t,s0) > >>>> > >>>> > >>>> Would match only "Regular files" with this labels. So you would be > >>>> better off with -c (or -b if they are block devices). > >>>> > >>>> > >>>>> Sorry about the long post, any help or advice? Thanks. > >>>>> > >>>>> Louis > >>>>> Send instant messages to your online friends > >>>>> <a rel="nofollow" target="_blank" href="http://uk.messenger.yahoo.com">http://uk.messenger.yahoo.com</a> > >>>>> -- > >>>>> fedora-selinux-list mailing list > >>>>> fedora-selinux-list@redhat.com > >>>>> <a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a> > >>>>> > >>>>> > >>>>> > >>>> -- > >>>> fedora-selinux-list mailing list > >>>> fedora-selinux-list@redhat.com > >>>> <a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a> > >>>> > >>>> > >>>> > >>> > >>> > >> One approach to this would be to label the /etc/init.d/vmware script > >> vmware_initrc_exec_t and then setup the proper transitions. > >> > >> This is something we are considering for RBAC. For example we want to > >> allow the webadm_t to be able to only restart/execute the httpd > >> script. Currently we have to allow him to execute any initrc script, > >> although we can prevent him from starting other confined domains. > >> A cleaner solution might be to label the script differently and setup > >> another domain for the script to transition to. > >> > >> > > > > > > Send instant messages to your online friends > <a rel="nofollow" target="_blank" href="http://uk.messenger.yahoo.com">http://uk.messenger.yahoo.com</a> > > > > > > Send instant messages to your online friends > <a rel="nofollow" target="_blank" href="http://uk.messenger.yahoo.com">http://uk.messenger.yahoo.com</a> </div></div> </div></div> Send instant messages to your online friends <a target="_blank" href="http://uk.messenger.yahoo.com">http://uk.messenger.yahoo.com</a> </div> </div></div> Send instant messages to your online friends http://uk.messenger.yahoo.com </body></html>