<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
if I understand you correctly, you are referring to SELinux and the fact that there is no SELinux policy for Kamailio on the system available.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
There is no SELinux policy that is provided from the Kamailio project. I am not aware of existing policy that you could use, maybe some distributions provide something.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
If this is a hard requirement, you can create a policy for Kamailio from your side. Have a look e.g. to</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux" id="LPlnkOWALinkPreview">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux</a></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
for some pointers. If you've created something, it would be great if you could share somewhere. In this case we might be able to include this in the Kamailio project, if appropriate.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Cheers,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Henning</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1">
<div id="LPBorder_GTaHR0cHM6Ly9hY2Nlc3MucmVkaGF0LmNvbS9kb2N1bWVudGF0aW9uL2VuLXVzL3JlZF9oYXRfZW50ZXJwcmlzZV9saW51eC84L2h0bWwvdXNpbmdfc2VsaW51eC93cml0aW5nLWEtY3VzdG9tLXNlbGludXgtcG9saWN5X3VzaW5nLXNlbGludXg." class="LPBorder176785" style="width: 100%; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;">
<table id="LPContainer176785" role="presentation" style="padding: 12px 36px 12px 12px; width: 100%; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td>
<div id="LPImageContainer176785" style="position: relative; margin-right: 12px; height: 160px; overflow: hidden;">
<a target="_blank" id="LPImageAnchor176785" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux"><img id="LPThumbnailImageId176785" alt="" height="160" style="display: block;" width="160" src="https://access.redhat.com/webassets/avalon/g/shadowman-200.png"></a></div>
</td>
<td style="width: 100%;">
<div id="LPTitle176785" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;">
<a target="_blank" id="LPUrlAnchor176785" href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux" style="text-decoration: none; color: var(--themePrimary);">Chapter 8.
Writing a custom SELinux policy Red Hat Enterprise Linux 8 - Red Hat Customer Portal</a></div>
<div id="LPDescription176785" style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;">
An SELinux security policy is a collection of SELinux rules. A policy is a core component of SELinux and is loaded into the kernel by SELinux user-space tools.</div>
<div id="LPMetadata176785" style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;">
access.redhat.com</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<br>
<div id="signature_bookmark"></div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> sr-users <sr-users-bounces@lists.kamailio.org> im Auftrag von HimaBindu G <himabindu.garadareddy@gmail.com><br>
<b>Gesendet:</b> Mittwoch, 10. August 2022 08:35<br>
<b>An:</b> sr-users@lists.kamailio.org <sr-users@lists.kamailio.org><br>
<b>Betreff:</b> [SR-Users] Kamailio has unconfined processes</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi,
<div><br>
</div>
<div>
<table class="x_gmail-MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="78%" style="width:78.12%; border-collapse:collapse">
<tbody>
<tr style="height:12.7pt">
<td width="79%" valign="top" style="width:79.76%; border-top:none; border-left:none; border-bottom:1pt solid windowtext; border-right:1pt solid windowtext; padding:0in 5.4pt; height:12.7pt">
<p class="x_MsoNormal" style="margin:0in; font-size:11pt; font-family:Calibri,sans-serif">
<span style="font-size:9pt; font-family:Arial,sans-serif">Problem Description:<br>
Customer security scan returned unconfined services on Kamailio.<br>
Unconfined processes run in unconfined domains Rationale:<br>
For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running<br>
in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC<br>
rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from<br>
gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security<br>
enhancement on top of DAC rules - it does not replace them<br>
Solution<br>
Investigate any unconfined processes found during the audit action. They may need to have an existing security<br>
context assigned to them or a policy built for them.<br>
Notes:<br>
Occasionally certain daemons such as backup or centralized management software may require running<br>
unconfined. Any such software should be carefully analyzed and documented before such an exception is made.<br>
See Also<br>
</span></p>
<p class="x_MsoNormal elementToProof" style="margin:0in; font-size:11pt; font-family:Calibri,sans-serif">
<span style="font-size:9pt; font-family:Arial,sans-serif"><a href="https://workbench.cisecurity.org/files/2485" data-auth="NotApplicable" style="color:rgb(5,99,193)">https://workbench.cisecurity.org/files/2485</a><br>
</span></p>
<p class="x_MsoNormal" style="margin:0in; font-size:11pt; font-family:Calibri,sans-serif">
<span style="font-size:9pt; font-family:Arial,sans-serif"><br>
For Kamailio<br>
======<br>
The command returned :<br>
00 kamailio<br>
00 kamailio<br>
00 kamailio<br>
00 kamailio<br>
00 kamailio<br>
10 kamailio<br>
10 kamailio<br>
10 kamailio<br>
10 kamailio<br>
00 kamailio<br>
00 kamailio<br>
00 kamailio<br>
00 kamailio<br>
33 kamailio<br>
33 kamailio<br>
33 kamailio<br>
32 kamailio<br>
17 kamailio<br>
16 kamailio<br>
33 kamailio<br>
00 kamailio<br>
00 kamailio<br>
03 kamailio<br>
05 kamailio<br>
18 kamailio<br>
17 kamailio<br>
18 kamailio<br>
18 kamailio<br>
07 kamailio<br>
00 sleep</span></p>
</td>
</tr>
</tbody>
</table>
</div>
<div><br>
</div>
<div>is any security context available to assign kamailio processes ?</div>
<div><span style="font-size:11pt; font-family:Calibri,sans-serif">theses services can be run as confined services ?</span><br>
</div>
<div><span style="font-size:11pt; font-family:Calibri,sans-serif"><br>
</span></div>
<div><span style="font-size:11pt; font-family:Calibri,sans-serif">Please suggest us with resolution, thanks in advance.</span></div>
<div><br clear="all">
<div>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr">Thanks & Regards,
<div> Hima Bindu.</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>