2

I want to prevent all users (including root) from mounting anything under a specific destination (e.g. /tmp) by SELinux or any other Linux tool, is this possible? And how would it be done?

Regarding the proposed duplicate: How to deny mounting permission? -- this is not what I want.

First of all it completely ignores SELinux when talking about the root user. Second it talks about removing "mounting permissions". That isn't what I try to achieve. I am actually talking more about "denying folder permissions" than mounting permissions. The closest to what I'm trying is Myth or reality: SELinux can confine the root user? which just does not talk about folder access, and specifically about denying "mounting" to that folder.

If I would go with an possible solution instead of a question I would ask: "Is there a SELinux Domain to restrict mounting?"

  • Why must you prevent root from being able to do it? That effectively makes it impossible without measures so draconian that they make root completely useless at what it needs to do on any normal system. – Joseph Sible Oct 7 '18 at 4:46
  • @JosephSible I don't want to deny the root user to "mount" I want to deny him access to a specific folder. The "kind" of access it want him to deny is mounting. I Edited the Question to be a bit more specific. Sorry for the inaccuracy in my original post. – Ben Oct 7 '18 at 18:19
  • That doesn't change my comment. It's true about keeping root from doing anything. – Joseph Sible Oct 7 '18 at 20:31
  • @JosephSible I don't think I would make "root completely useless" by preventing it from creating mounts under /tmp – Ben Oct 8 '18 at 6:58
  • 2
    @Ben Note that there needs to be restrictions in place which prevent root from circumventing the restrictions. Including preventing moving/renaming/relabeling the target, preventing modifications to security configuration, not allowing kernel modules to be inserted, denying access to raw devices, etc. – sebasth Oct 8 '18 at 9:37
2

On SELinux enabled systems, every object (processes, files, etc) has a security label. SELinux policy contains the rules which describe permitted operations for those labels. The default policy is quite complex and extensive. Configuring the policy might already be enough to prevent mounting on most locations (based by label).

The policy does not place restrictions on unconfined users. Additionally allow_mount_anyfile boolean controls if mount command can use (almost) any file as a mount point. Using confined users will place many limits on how users can access the system. SELinux Role Based Access Control (RBAC) places confined user in a confined role. Roles limit which domains (process security labels) are allowed for the role. Also, a confined user in user_r can not switch to another role.

We can inspect the installed policy to determine if it is possible for an user in confined role to use a labeled file/directory as a mountpoint (directly or by abusing another allowed domain).

First, to check what domains user_r can transition into with seinfo:

seinfo -r user_t -x 

SELinux policy language has mounton permission which allows a domain to use the target file/directory as mount point. To query the installed policy to find domains are allowed to use the target object as mount point:

sesearch --allow -t <target file/directory type> -p mounton

If there is no rules with a domain that user_r is allowed to, a user in user_r can not use the target as mount point (even if they were root in user_r). Additionally one should verify there are no relabelfrom (relabeling) or unlink permissions which could be used to circumvent the policy.

Restricting administrator (root in sysadm_r) is not trivial. It requires either a policy module with a new custom type and/or customizing the base policy, as sysadm_t likely has the permissions mentioned before. The customized policy needs to have type which is accessible only to the allowed domains. Additionally the policy needs to deny anything which might allow circumventing the policy, resulting in a root user which is somewhat closer to confined user than root user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.