2

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep Enforcing mode. I wasn't able to insert my module into Selinux list with semodule command. What else could I do? This is my environment:

Fedora release 27
Kernel version 4.18.19-100.fc27.x86_64

rpm -qa 'selinux-*' output:

selinux-policy-targeted-3.13.1-284.37.fc27.noarch
selinux-policy-3.13.1-284.37.fc27.noarch

sestatus output:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

systemctl status systemd-modules-load.service output:

● systemd-modules-load.service - Load Kernel Modules
   Loaded: loaded (/usr/lib/systemd/system/systemd-modules-load.service; static; vendor preset: disabled)
   Active: failed (Result: exit-code) since Fri 2018-12-14 09:50:42 CET; 19min ago
     Docs: man:systemd-modules-load.service(8)
           man:modules-load.d(5)
  Process: 4397 ExecStart=/usr/lib/systemd/systemd-modules-load (code=exited, status=1/FAILURE)
 Main PID: 4397 (code=exited, status=1/FAILURE)

dic 14 09:50:42 localhost.localdomain systemd[1]: Starting Load Kernel Modules...
dic 14 09:50:42 localhost.localdomain systemd-modules-load[4397]: Failed to insert 'hello': Permission denied
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE
dic 14 09:50:42 localhost.localdomain systemd[1]: Failed to start Load Kernel Modules.
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Unit entered failed state.
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Failed with result 'exit-code'.

ls -lZ /usr/lib/systemd/systemd-modules-load output:

 -rwxr-xr-x. 1 root root system_u:object_r:systemd_modules_load_exec_t:s0 15576  4 mag  2018 /usr/lib/systemd/systemd-modules-load

/var/log/audit/audit.log

type=SELINUX_ERR msg=audit(1533716850.521:304): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716850.596:305): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716851.081:306): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716851.422:307): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
..
type=SELINUX_ERR msg=audit(1533717134.510:310): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:fprintd_t:s0

journalctl -xeb -u systemd-modules-load.service

L'unità systemd-modules-load.service ha iniziato la fase di avvio.
dic 13 16:38:08 localhost.localdomain systemd-modules-load[14937]: Failed to insert 'hello': Permission denied
dic 13 16:38:08 localhost.localdomain systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE
dic 13 16:38:08 localhost.localdomain systemd[1]: Failed to start Load Kernel Modules. -- Subject: L'unità systemd-modules-load.service è fallita

ls -Z

    system_u:object_r:modules_object_t:s0 bls.conf             unconfined_u:object_r:modules_object_t:s0 modules.devname
    system_u:object_r:modules_object_t:s0 build                    system_u:object_r:modules_object_t:s0 modules.drm
    system_u:object_r:modules_object_t:s0 config                   system_u:object_r:modules_object_t:s0 modules.modesetting
    system_u:object_r:modules_object_t:s0 extra                    system_u:object_r:modules_object_t:s0 modules.networking
unconfined_u:object_r:modules_object_t:s0 hello.ko                 system_u:object_r:modules_object_t:s0 modules.order
    system_u:object_r:modules_object_t:s0 kernel               unconfined_u:object_r:modules_object_t:s0 modules.softdep
unconfined_u:object_r:modules_object_t:s0 modules.alias        unconfined_u:object_r:modules_object_t:s0 modules.symbols
unconfined_u:object_r:modules_object_t:s0 modules.alias.bin    unconfined_u:object_r:modules_object_t:s0 modules.symbols.bin
    system_u:object_r:modules_object_t:s0 modules.block            system_u:object_r:modules_object_t:s0 source
    system_u:object_r:modules_object_t:s0 modules.builtin          system_u:object_r:modules_object_t:s0 System.map
unconfined_u:object_r:modules_object_t:s0 modules.builtin.bin      system_u:object_r:modules_object_t:s0 updates
unconfined_u:object_r:modules_object_t:s0 modules.dep              system_u:object_r:modules_object_t:s0 vdso
unconfined_u:object_r:modules_object_t:s0 modules.dep.bin                     system_u:object_r:usr_t:s0 vmlinuz

My module is in

/lib/modules/$(uname -r)
  • Do you have a related AVC message in audit log /var/log/audit/audit.log? – sebasth Dec 13 '18 at 15:29
  • Did you check audit log? – sebasth Dec 13 '18 at 15:42
  • 1
    Where is the module located and what are the selinux context of the file ? ls -Z ? You may simply need to restore the context with restorecon see wiki.centos.org/HowTos/… – Panther Dec 13 '18 at 15:52
  • Can you please use a pastebin for long output? At least use the code boxes, but pastebin is easier – Panther Dec 13 '18 at 16:06
  • 1
    Try running restorecon your module is unconfined_u – Panther Dec 13 '18 at 16:07
1

Solved! After building the kernel module, I put it into directory /lib/modules/$(uname -r)/kernel/drivers/net. And then with the command depmod I resolved this issue. Now it's loaded after every boot.

0

This is probably not ideal from a security point of view... But you can try to work around this while maintaining Enforcing mode by allowing any domains to load kernel modules, by tweaking this SELinux boolean:

$ sudo semanage boolean --list | grep domain_kernel_load_modules
domain_kernel_load_modules     (off  ,  off)  Allow all domains to have the kernel load modules

You can tweak it with:

$ sudo semanage boolean --modify --on domain_kernel_load_modules

This operation actually modifies the compiled SELinux policy, so once you execute that command, it's permanent (no need to execute it again in further reboots.)

  • Probably consider that if restorecon fails – Panther Dec 14 '18 at 5:01
  • It didn't work neither "restorecon" nor "semage" – Massimiliano D Dec 14 '18 at 8:52
  • @MassimilianoD Please post more details of your environment... What version of Fedora? rpm -qa 'selinux-*' for the versions of the policies? What is the output of systemctl status systemd-modules-load.service? What about ls -lZ /usr/lib/systemd/systemd-modules-load, is the binary tagged with systemd_modules_load_exec_t SELinux type? Please update your question with the response to these questions. – filbranden Dec 14 '18 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.