2

I'm trying to insert an external kernel module in permanent mode. During the boot, my module is being loaded by systemd-modules-load service so long as Selinux is permissive. But I want to keep Enforcing mode. I wasn't able to insert my module into Selinux list with semodule command. What else could I do? This is my environment:

Fedora release 27
Kernel version 4.18.19-100.fc27.x86_64

rpm -qa 'selinux-*' output:

selinux-policy-targeted-3.13.1-284.37.fc27.noarch
selinux-policy-3.13.1-284.37.fc27.noarch

sestatus output:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

systemctl status systemd-modules-load.service output:

● systemd-modules-load.service - Load Kernel Modules
   Loaded: loaded (/usr/lib/systemd/system/systemd-modules-load.service; static; vendor preset: disabled)
   Active: failed (Result: exit-code) since Fri 2018-12-14 09:50:42 CET; 19min ago
     Docs: man:systemd-modules-load.service(8)
           man:modules-load.d(5)
  Process: 4397 ExecStart=/usr/lib/systemd/systemd-modules-load (code=exited, status=1/FAILURE)
 Main PID: 4397 (code=exited, status=1/FAILURE)

dic 14 09:50:42 localhost.localdomain systemd[1]: Starting Load Kernel Modules...
dic 14 09:50:42 localhost.localdomain systemd-modules-load[4397]: Failed to insert 'hello': Permission denied
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE
dic 14 09:50:42 localhost.localdomain systemd[1]: Failed to start Load Kernel Modules.
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Unit entered failed state.
dic 14 09:50:42 localhost.localdomain systemd[1]: systemd-modules-load.service: Failed with result 'exit-code'.

ls -lZ /usr/lib/systemd/systemd-modules-load output:

 -rwxr-xr-x. 1 root root system_u:object_r:systemd_modules_load_exec_t:s0 15576  4 mag  2018 /usr/lib/systemd/systemd-modules-load

/var/log/audit/audit.log

type=SELINUX_ERR msg=audit(1533716850.521:304): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716850.596:305): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716851.081:306): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
type=SELINUX_ERR msg=audit(1533716851.422:307): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 newcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
..
type=SELINUX_ERR msg=audit(1533717134.510:310): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:fprintd_t:s0

journalctl -xeb -u systemd-modules-load.service

L'unità systemd-modules-load.service ha iniziato la fase di avvio.
dic 13 16:38:08 localhost.localdomain systemd-modules-load[14937]: Failed to insert 'hello': Permission denied
dic 13 16:38:08 localhost.localdomain systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE
dic 13 16:38:08 localhost.localdomain systemd[1]: Failed to start Load Kernel Modules. -- Subject: L'unità systemd-modules-load.service è fallita

ls -Z

    system_u:object_r:modules_object_t:s0 bls.conf             unconfined_u:object_r:modules_object_t:s0 modules.devname
    system_u:object_r:modules_object_t:s0 build                    system_u:object_r:modules_object_t:s0 modules.drm
    system_u:object_r:modules_object_t:s0 config                   system_u:object_r:modules_object_t:s0 modules.modesetting
    system_u:object_r:modules_object_t:s0 extra                    system_u:object_r:modules_object_t:s0 modules.networking
unconfined_u:object_r:modules_object_t:s0 hello.ko                 system_u:object_r:modules_object_t:s0 modules.order
    system_u:object_r:modules_object_t:s0 kernel               unconfined_u:object_r:modules_object_t:s0 modules.softdep
unconfined_u:object_r:modules_object_t:s0 modules.alias        unconfined_u:object_r:modules_object_t:s0 modules.symbols
unconfined_u:object_r:modules_object_t:s0 modules.alias.bin    unconfined_u:object_r:modules_object_t:s0 modules.symbols.bin
    system_u:object_r:modules_object_t:s0 modules.block            system_u:object_r:modules_object_t:s0 source
    system_u:object_r:modules_object_t:s0 modules.builtin          system_u:object_r:modules_object_t:s0 System.map
unconfined_u:object_r:modules_object_t:s0 modules.builtin.bin      system_u:object_r:modules_object_t:s0 updates
unconfined_u:object_r:modules_object_t:s0 modules.dep              system_u:object_r:modules_object_t:s0 vdso
unconfined_u:object_r:modules_object_t:s0 modules.dep.bin                     system_u:object_r:usr_t:s0 vmlinuz

My module is in

/lib/modules/$(uname -r)
7
  • Do you have a related AVC message in audit log /var/log/audit/audit.log?
    – sebasth
    Commented Dec 13, 2018 at 15:29
  • Did you check audit log?
    – sebasth
    Commented Dec 13, 2018 at 15:42
  • 1
    Where is the module located and what are the selinux context of the file ? ls -Z ? You may simply need to restore the context with restorecon see wiki.centos.org/HowTos/…
    – Panther
    Commented Dec 13, 2018 at 15:52
  • Can you please use a pastebin for long output? At least use the code boxes, but pastebin is easier
    – Panther
    Commented Dec 13, 2018 at 16:06
  • 1
    Try running restorecon your module is unconfined_u
    – Panther
    Commented Dec 13, 2018 at 16:07

2 Answers 2

1

Solved! After building the kernel module, I put it into directory /lib/modules/$(uname -r)/kernel/drivers/net. And then with the command depmod I resolved this issue. Now it's loaded after every boot.

0

This is probably not ideal from a security point of view... But you can try to work around this while maintaining Enforcing mode by allowing any domains to load kernel modules, by tweaking this SELinux boolean:

$ sudo semanage boolean --list | grep domain_kernel_load_modules
domain_kernel_load_modules     (off  ,  off)  Allow all domains to have the kernel load modules

You can tweak it with:

$ sudo semanage boolean --modify --on domain_kernel_load_modules

This operation actually modifies the compiled SELinux policy, so once you execute that command, it's permanent (no need to execute it again in further reboots.)

3
  • Probably consider that if restorecon fails
    – Panther
    Commented Dec 14, 2018 at 5:01
  • It didn't work neither "restorecon" nor "semage" Commented Dec 14, 2018 at 8:52
  • @MassimilianoD Please post more details of your environment... What version of Fedora? rpm -qa 'selinux-*' for the versions of the policies? What is the output of systemctl status systemd-modules-load.service? What about ls -lZ /usr/lib/systemd/systemd-modules-load, is the binary tagged with systemd_modules_load_exec_t SELinux type? Please update your question with the response to these questions.
    – filbranden
    Commented Dec 14, 2018 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .