headers
Javier Juan Martínez Cabezón | 8 Oct 2011 00:36
Picon

PROT_EXEC PROT_WRITE

Hi

I think it would be a good idea to split the MAP_EXEC request into two
requests, MAP_EXEC to EXEC only mappings and MAP_WRITE to write only
mappings, with this I think we could get W or X or mprotect pax facility
implemented in RC or ACL as requests fully integrated. In case both required
every one could grant both (java and a few ones more..., nothing important
though)

I think every PROT_EXEC rights should be granted only to every T_FILE
targets, and PROT_WRITE to T_NONE. I think changes wouldn't be so heavy,
don't you think?.

from mprotect.c:

MAP_EXEC||MAP_WRITE
 #ifdef CONFIG_RSBAC
 317                 if ((prot & PROT_EXEC) && !(vma->vm_flags & PROT_EXEC))
{
 318                         rsbac_pr_debug(aef, "calling ADF\n");
 319                         if (vma->vm_file) {
 320                                 rsbac_target = T_FILE;
 321                                 rsbac_target_id.file.device =
vma->vm_file->f_dentry->d_inode->i_sb->s_dev;
 322                                 rsbac_target_id.file.inode =
vma->vm_file->f_dentry->d_inode->i_ino;
 323                                 rsbac_target_id.file.dentry_p =
vma->vm_file->f_dentry;
 324                         } else {
 325                                 rsbac_target = T_NONE;
(Continue reading)

Permalink | Reply | 0 comments |
headers
Jens Kasten | 8 Oct 2011 15:12
Picon

jail

Hi list,

i have a problem with the jail.
Maybe its a bug iam not sure.

For example:
Sat Oct  8 14:56:38 2011 :<6>0000001846|rsbac_adf_request(): request
WRITE_OPEN, pid 32427, ppid 1, prog_name licq, prog_file /usr/bin/licq,
uid 1000, targe
t_type DEV, tid char 01:03, attr open_flag, value 32770, result
NOT_GRANTED by JAIL

Now i add this jail flag and start the licq again.
Then the system free.
Similar behavior i got on openoffice.

Iam not sure, maybe it could also been a pax issue.

Grüße
Jens

_______________________________________________
rsbac mailing list
rsbac <at> rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac
Permalink | Reply | 4 comments |
headers
Javier Juan Martínez Cabezón | 8 Oct 2011 15:41
Picon

Re: jail

Your app is trying to write in /dev/null and it can't, Have you thought in
create the node into the jail? (maybe you could create it into a loop device
with mknod and mount it using --bind into de jails required.

2011/10/8 Jens Kasten <jens <at> kasten-edv.de>

> Hi list,
>
> i have a problem with the jail.
> Maybe its a bug iam not sure.
>
> For example:
> Sat Oct  8 14:56:38 2011 :<6>0000001846|rsbac_adf_request(): request
> WRITE_OPEN, pid 32427, ppid 1, prog_name licq, prog_file /usr/bin/licq,
> uid 1000, targe
> t_type DEV, tid char 01:03, attr open_flag, value 32770, result
> NOT_GRANTED by JAIL
>
> Now i add this jail flag and start the licq again.
> Then the system free.
> Similar behavior i got on openoffice.
>
> Iam not sure, maybe it could also been a pax issue.
>
> Grüße
> Jens
>
> _______________________________________________
> rsbac mailing list
> rsbac <at> rsbac.org
(Continue reading)

Permalink | Reply | 3 comments |
headers
Javier Juan Martínez Cabezón | 8 Oct 2011 15:49
Picon

Re: jail

Did you use "-t" flag?

El 8 de octubre de 2011 15:41, Javier Juan Martínez Cabezón <
tazok.id0 <at> gmail.com> escribió:

> Your app is trying to write in /dev/null and it can't, Have you thought in
> create the node into the jail? (maybe you could create it into a loop device
> with mknod and mount it using --bind into de jails required.
>
>
> 2011/10/8 Jens Kasten <jens <at> kasten-edv.de>
>
>> Hi list,
>>
>> i have a problem with the jail.
>> Maybe its a bug iam not sure.
>>
>> For example:
>> Sat Oct  8 14:56:38 2011 :<6>0000001846|rsbac_adf_request(): request
>> WRITE_OPEN, pid 32427, ppid 1, prog_name licq, prog_file /usr/bin/licq,
>> uid 1000, targe
>> t_type DEV, tid char 01:03, attr open_flag, value 32770, result
>> NOT_GRANTED by JAIL
>>
>> Now i add this jail flag and start the licq again.
>> Then the system free.
>> Similar behavior i got on openoffice.
>>
>> Iam not sure, maybe it could also been a pax issue.
>>
(Continue reading)

Permalink | Reply | 2 comments |
headers
Javier Juan Martínez Cabezón | 8 Oct 2011 15:52
Picon

Re: jail

Try jail_flag "D"

El 8 de octubre de 2011 15:49, Javier Juan Martínez Cabezón <
tazok.id0 <at> gmail.com> escribió:

> Did you use "-t" flag?
>
> El 8 de octubre de 2011 15:41, Javier Juan Martínez Cabezón <
> tazok.id0 <at> gmail.com> escribió:
>
> Your app is trying to write in /dev/null and it can't, Have you thought in
>> create the node into the jail? (maybe you could create it into a loop device
>> with mknod and mount it using --bind into de jails required.
>>
>>
>> 2011/10/8 Jens Kasten <jens <at> kasten-edv.de>
>>
>>> Hi list,
>>>
>>> i have a problem with the jail.
>>> Maybe its a bug iam not sure.
>>>
>>> For example:
>>> Sat Oct  8 14:56:38 2011 :<6>0000001846|rsbac_adf_request(): request
>>> WRITE_OPEN, pid 32427, ppid 1, prog_name licq, prog_file /usr/bin/licq,
>>> uid 1000, targe
>>> t_type DEV, tid char 01:03, attr open_flag, value 32770, result
>>> NOT_GRANTED by JAIL
>>>
>>> Now i add this jail flag and start the licq again.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Jens Kasten | 8 Oct 2011 16:27
Picon

Re: jail

Yes i use this flags -D

Am Samstag, den 08.10.2011, 15:52 +0200 schrieb Javier Juan Martínez
Cabezón:
> Try jail_flag "D"
> 
> El 8 de octubre de 2011 15:49, Javier Juan Martínez Cabezón <
> tazok.id0 <at> gmail.com> escribió:
> 
> > Did you use "-t" flag?
> >
> > El 8 de octubre de 2011 15:41, Javier Juan Martínez Cabezón <
> > tazok.id0 <at> gmail.com> escribió:
> >
> > Your app is trying to write in /dev/null and it can't, Have you thought in
> >> create the node into the jail? (maybe you could create it into a loop device
> >> with mknod and mount it using --bind into de jails required.
> >>
> >>
> >> 2011/10/8 Jens Kasten <jens <at> kasten-edv.de>
> >>
> >>> Hi list,
> >>>
> >>> i have a problem with the jail.
> >>> Maybe its a bug iam not sure.
> >>>
> >>> For example:
> >>> Sat Oct  8 14:56:38 2011 :<6>0000001846|rsbac_adf_request(): request
> >>> WRITE_OPEN, pid 32427, ppid 1, prog_name licq, prog_file /usr/bin/licq,
> >>> uid 1000, targe
(Continue reading)

Permalink | Reply | 0 comments |

Gmane