net_admin

net_admin

[Russell Coker]

allow crond_t self:capability net_admin;
allow policykit_t self:capability net_admin;
allow postfix_cleanup_t self:capability net_admin;
allow postfix_master_t self:capability net_admin;
allow postfix_pickup_t self:capability net_admin;
allow postfix_qmgr_t self:capability net_admin;
allow postfix_smtp_t self:capability net_admin;
allow system_dbusd_t self:capability net_admin;

Above are some of the output from audit2allow on my laptop running the latest 
Debian/Unstable.

Seems that some recent library changes have made lots of programs try to 
change socket buffer sizes in a way that requires net_admin.  This isn't a 
sudden thing, it's been slowly increasing over time.

/* Allow interface configuration */
/* Allow administration of IP firewall, masquerading and accounting */
/* Allow setting debug option on sockets */
/* Allow modification of routing tables */
/* Allow setting arbitrary process / process group ownership on
   sockets */
/* Allow binding to any address for transparent proxying (also via NET_RAW) */
/* Allow setting TOS (type of service) */
/* Allow setting promiscuous mode */
/* Allow clearing driver statistics */
/* Allow multicasting */
/* Allow read/write of device-specific registers */
/* Allow activation of ATM control sockets */

#define CAP_NET_ADMIN        12

Above from capability.h has the list of things that net_admin might be for.  I 
don't know what the debug option on sockets is or the process/process group 
ownership.  Setting TOS and multicast are things that many root owned 
processes might want to do.  I've been hesitant to put in dontaudit rules 
because there are many programs like the Postfix master process which might 
have a legitimate need for debug mode, process ownership, or TOS.

Below are some of the audit log analysis of denials for setting buffer size.  
Those programs work ok without it.

Should we have a tunable for dontauditing this?

Also while we don't want to have the 300 capabilities that Irix apparently 
had, splitting net_admin into multiple capabilities seems like a good option 
(I know the probability of this is close to zero).

type=PROCTITLE msg=audit(03/09/18 10:42:19.376:20586) : proctitle=/usr/lib/
dbus-1.0/dbus-daemon-launch-helper org.kde.powerdevil.backlighthelper 
type=SYSCALL msg=audit(03/09/18 10:42:19.376:20586) : arch=x86_64 
syscall=setsockopt success=no exit=EPERM(Operation not permitted) a0=0x3 
a1=SOL_SOCKET a2=SO_RCVBUFFORCE a3=0x7ffe74e25b30 items=0 ppid=27258 pid=27259 
auid=unset uid=messagebus gid=messagebus euid=root suid=root fsuid=root 
egid=messagebus sgid=messagebus fsgid=messagebus tty=(none) ses=unset 
comm=dbus-daemon-lau exe=/usr/lib/dbus-1.0/dbus-daemon-launch-helper 
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(03/09/18 10:42:19.376:20586) : avc:  denied  { net_admin } 
for  pid=27259 comm=dbus-daemon-lau capability=net_admin  
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability 
permissive=0 
----
type=PROCTITLE msg=audit(05/01/19 12:17:01.555:20586) : proctitle=/usr/sbin/
CRON -f 
type=SYSCALL msg=audit(05/01/19 12:17:01.555:20586) : arch=x86_64 
syscall=setsockopt success=no exit=EPERM(Operation not permitted) a0=0x3 
a1=SOL_SOCKET a2=SO_SNDBUFFORCE a3=0x7ffc8f730a20 items=0 ppid=21686 pid=21688 
auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root 
fsgid=root tty=(none) ses=1120 comm=cron exe=/usr/sbin/cron 
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(05/01/19 12:17:01.555:20586) : avc:  denied  { net_admin } 
for  pid=21688 comm=cron capability=net_admin  
scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 
tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=capability 
permissive=0

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: net_admin

[Chris PeBenito]

On 1/4/19 8:31 PM, Russell Coker wrote:
> allow crond_t self:capability net_admin;
> allow policykit_t self:capability net_admin;
> allow postfix_cleanup_t self:capability net_admin;
> allow postfix_master_t self:capability net_admin;
> allow postfix_pickup_t self:capability net_admin;
> allow postfix_qmgr_t self:capability net_admin;
> allow postfix_smtp_t self:capability net_admin;
> allow system_dbusd_t self:capability net_admin;
> 
> Above are some of the output from audit2allow on my laptop running the latest
> Debian/Unstable.
> 
> Seems that some recent library changes have made lots of programs try to
> change socket buffer sizes in a way that requires net_admin.  This isn't a
> sudden thing, it's been slowly increasing over time.
> 
> /* Allow interface configuration */
> /* Allow administration of IP firewall, masquerading and accounting */
> /* Allow setting debug option on sockets */
> /* Allow modification of routing tables */
> /* Allow setting arbitrary process / process group ownership on
>     sockets */
> /* Allow binding to any address for transparent proxying (also via NET_RAW) */
> /* Allow setting TOS (type of service) */
> /* Allow setting promiscuous mode */
> /* Allow clearing driver statistics */
> /* Allow multicasting */
> /* Allow read/write of device-specific registers */
> /* Allow activation of ATM control sockets */
> 
> #define CAP_NET_ADMIN        12
> 
> Above from capability.h has the list of things that net_admin might be for.  I
> don't know what the debug option on sockets is or the process/process group
> ownership.  Setting TOS and multicast are things that many root owned
> processes might want to do.  I've been hesitant to put in dontaudit rules
> because there are many programs like the Postfix master process which might
> have a legitimate need for debug mode, process ownership, or TOS.
> 
> Below are some of the audit log analysis of denials for setting buffer size.
> Those programs work ok without it.
> 
> Should we have a tunable for dontauditing this?

I'm not a fan of a tunable, as it seems like unnecessary overhead.  If 
anything I'd put it under the hide_broken_symptoms build option.

-- 
Chris PeBenito