2014-06-26 16:48:13 +00:00
|
|
|
|
---
|
|
|
|
|
|
layout: post
|
|
|
|
|
|
title: "Gentoo hardened desktop with GNOME 3 – Round one"
|
2016-02-26 15:19:42 +00:00
|
|
|
|
date: 2011-05-12T20:32:41Z
|
2014-06-26 16:48:13 +00:00
|
|
|
|
tags: [gentoo, gnome3, selinux]
|
|
|
|
|
|
permalink: /blog/2011/5/12/gentoo-hardened-desktop-with-gnome-3-round-one
|
|
|
|
|
|
published: true
|
|
|
|
|
|
author:
|
|
|
|
|
|
name: Gergely Polonkai
|
|
|
|
|
|
email: gergely@polonkai.eu
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
After having some hard times with Ubuntu (upgrading from 10.10 to 11.04), I
|
|
|
|
|
|
decided to switch back to my old friend, Gentoo. As I’m currently learning
|
|
|
|
|
|
about Linux hardening, I decided to use the new SELinux profile, which
|
|
|
|
|
|
supports the v2 reference policy.
|
|
|
|
|
|
|
|
|
|
|
|
Installation was pretty easy, using the [Gentoo x86
|
|
|
|
|
|
Handbook](http://www.gentoo.org/doc/hu/handbook/handbook-x86.xml). This profile
|
|
|
|
|
|
automatically turns on the `USE=selinux` flag (so does the old SELinux
|
|
|
|
|
|
profile), but deprecated `FEATURE=loadpolicy` (which is turned on by the
|
|
|
|
|
|
profile, so portage will complain about it until you disable it in
|
|
|
|
|
|
`/etc/make.conf`).
|
|
|
|
|
|
|
|
|
|
|
|
For the kernel, I chose `hardened-sources-2.6.37-r7`. This seems to be recent
|
|
|
|
|
|
enough for my security testing needs. I turned on both SELinux, PaX and
|
|
|
|
|
|
grsecurity. So far, I have no problem with it, but I don’t have X installed
|
|
|
|
|
|
yet, which will screw up things for sure.
|
|
|
|
|
|
|
|
|
|
|
|
After having those hard times with Ubuntu mentioned before, I decided not to
|
|
|
|
|
|
install Grub2 yet, as it renders things unusable (eg. my Windows 7
|
|
|
|
|
|
installation, which I sometimes need at the office). So I installed Grub 0.97
|
|
|
|
|
|
(this is the only version marked as stable, as I remember), touched
|
|
|
|
|
|
`/.autorelabel`, and reboot.
|
|
|
|
|
|
|
|
|
|
|
|
My first mistake was using an UUID as the root device on the kernel parameter
|
|
|
|
|
|
list (I don’t want to list all the small mistakes like forgetting to include to
|
|
|
|
|
|
correct SATA driver from my kernel and such). Maybe I was lame, but after
|
|
|
|
|
|
including `/dev/sda5` instead of the UUID thing, it worked like…
|
|
|
|
|
|
|
|
|
|
|
|
Well, charm would not be the good word. For example, I forgot to install the
|
|
|
|
|
|
lvm2 package, so nothing was mounted except my root partition. After I
|
|
|
|
|
|
installed it with the install CD, I assumed everything will be all right, but
|
|
|
|
|
|
I was wrong.
|
|
|
|
|
|
|
|
|
|
|
|
udev and LVM is a critical point in a hardened environment. udev itself
|
|
|
|
|
|
doesn’t want to work without the `CONFIG_DEVFS_TEMPFS=y` kernel option, so I
|
|
|
|
|
|
also had to change that. It seemed that it can be done without the install CD,
|
|
|
|
|
|
as it compiled the kernel with no problems. However, when it reached the point
|
|
|
|
|
|
when it compresses the kernel with gzip, it stopped with a `Permission denied`
|
|
|
|
|
|
message (although it was running with root privileges).
|
|
|
|
|
|
|
|
|
|
|
|
The most beautiful thing in the hardened environment with Mandatory Access
|
|
|
|
|
|
Control enabled) is that root is not a real power user any more by default.
|
|
|
|
|
|
You can get this kind of messages many times. There are many tools to debug
|
|
|
|
|
|
these, I will talk about these later.
|
|
|
|
|
|
|
|
|
|
|
|
So, my gzip needed a fix. After digging a bit on the Internet, I found that
|
|
|
|
|
|
the guilty thing is text relocation, which can be corrected if gzip is
|
|
|
|
|
|
compiled with PIC enabled. Thus, I turned on `USE=pic` flag globally, and
|
|
|
|
|
|
tried to remerge gzip. Of course it failed, as it had to use gzip to unpack
|
|
|
|
|
|
the gzip sources. So it did when I tried to install the PaX tools and gradm to
|
|
|
|
|
|
turn these checks off. The install CD came to the rescue again, with which I
|
|
|
|
|
|
successfully recompiled gzip, and with this new gzip, I compressed my new
|
|
|
|
|
|
kernel, with which udev started successfully. So far, so good, let’s try to
|
|
|
|
|
|
reboot!
|
|
|
|
|
|
|
|
|
|
|
|
Damn, LVM is still not working. So I decided to finally consult the Gentoo
|
|
|
|
|
|
hardened guide. It says that the LVM startup scripts under `/lib/rcscripts/…`
|
|
|
|
|
|
must be modified, so LVM will put its lock files under `/etc/lvm/lock` instead
|
|
|
|
|
|
of `/dev/.lvm`. After this step and a reboot, LVM worked fine (finally).
|
|
|
|
|
|
|
|
|
|
|
|
The next thing was the file system labelling. SELinux should automatically
|
|
|
|
|
|
relabel the entire file system at boot time whenever it finds the
|
|
|
|
|
|
`/.autorelabel` file. Well, in my case it didn’t happen. After checking the
|
|
|
|
|
|
[Gentoo Hardening](http://wiki.gentoo.org/wiki/Hardened_Gentoo) docs, I realised that the `rlpkg` program does exactly the same
|
|
|
|
|
|
(as far as I know, it is designed specifically for Gentoo). So I ran `rlpkg`,
|
|
|
|
|
|
and was kind of shocked. It says it will relabel ext2, ext3, xfs and JFS
|
|
|
|
|
|
partitions. Oh great, no ext4 support? Well, consulting the forums and adding
|
|
|
|
|
|
some extra lines to `/etc/portage/package.keywords` solved the problem (`rlpkg`
|
|
|
|
|
|
and some dependencies had to have the `~x86` keyword set). Thus, `rlpkg`
|
|
|
|
|
|
relabelled my file systems (I checked some directories with `ls -lZ`, it seemed
|
|
|
|
|
|
good for me).
|
|
|
|
|
|
|
|
|
|
|
|
Now it seems that everything is working fine, except the tons of audit
|
|
|
|
|
|
messages. Tomorrow I will check them with `audit2why` or `audit2allow` to see if
|
|
|
|
|
|
it is related with my SELinux lameness, or with a bug in the policy included
|
|
|
|
|
|
with Gentoo.
|
