From patchwork Sun Mar 11 03:08:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Victor Kamensky (kamensky)" X-Patchwork-Id: 10274507 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C455060390 for ; Sun, 11 Mar 2018 03:08:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B3CED28ED5 for ; Sun, 11 Mar 2018 03:08:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A7E9428EDD; Sun, 11 Mar 2018 03:08:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B99428ED5 for ; Sun, 11 Mar 2018 03:08:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751268AbeCKDIR (ORCPT ); Sat, 10 Mar 2018 22:08:17 -0500 Received: from alln-iport-4.cisco.com ([173.37.142.91]:49691 "EHLO alln-iport-4.cisco.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751223AbeCKDIP (ORCPT ); Sat, 10 Mar 2018 22:08:15 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5900; q=dns/txt; s=iport; t=1520737695; x=1521947295; h=date:from:to:cc:subject:in-reply-to:message-id: references:mime-version; bh=+TTzppLhkUrwW179fIT3xqqvy6nVVk6QOKzAYL5cIvg=; b=U+4FU+MVYY6/msNpkun/b19b5f4udMMDto8/4e9+XafxhWQ4gHkzK+PL IfgPCAxL6+iTamyWZEIri4sTgvnVo405Sr0XpBBc++I2iPpyJnJJmtdCX Tk2JyTDbBIJZGwY7/DzC1IrMi2h4z0sinGmx9SxHWko4ZR3toyCx9x1eg w=; X-IronPort-AV: E=Sophos;i="5.47,453,1515456000"; d="scan'208";a="82242987" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2018 03:08:15 +0000 Received: from sjc-ads-6991 (sjc-ads-6991.cisco.com [10.30.218.111]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id w2B38DGX021737 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 11 Mar 2018 03:08:14 GMT Date: Sat, 10 Mar 2018 19:08:13 -0800 (PST) From: Victor Kamensky To: Stephen Smalley cc: Taras Kondratiuk , "H. Peter Anvin" , Al Viro , Arnd Bergmann , Rob Landley , Mimi Zohar , Jonathan Corbet , James McMechan , initramfs@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, xe-linux-external@cisco.com, Paul Moore , Eric Paris Subject: Re: [PATCH v3 15/15] selinux: delay sid population for rootfs till init is complete In-Reply-To: <1519152994.14218.15.camel@tycho.nsa.gov> Message-ID: References: <1518813234-5874-1-git-send-email-takondra@cisco.com> <1518813234-5874-19-git-send-email-takondra@cisco.com> <1519152994.14218.15.camel@tycho.nsa.gov> User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP On Tue, 20 Feb 2018, Stephen Smalley wrote: > On Fri, 2018-02-16 at 20:33 +0000, Taras Kondratiuk wrote: >> From: Victor Kamensky >> >> With initramfs cpio format that supports extended attributes >> we need to skip sid population on sys_lsetxattr call from >> initramfs for rootfs if security server is not initialized yet. >> >> Otherwise callback in selinux_inode_post_setxattr will try to >> translate give security.selinux label into sid context and since >> security server is not available yet inode will receive default >> sid (typically kernel_t). Note that in the same time proper >> label will be stored in inode xattrs. Later, since inode sid >> would be already populated system will never look back at >> actual xattrs. But if we skip sid population for rootfs and >> we have policy that direct use of xattrs for rootfs, proper >> sid will be filled in from extended attributes one node is >> accessed and server is initialized. >> >> Note new DELAYAFTERINIT_MNT super block flag is introduced >> to only mark rootfs for such behavior. For other types of >> tmpfs original logic is still used. > > (cc selinux maintainers) > > Wondering if we shouldn't just do this always, for all filesystem > types. Ok, I think it makes sense. The one that do not support xattrs will not reach selinux_inode_post_setxattr anyway. And try to cache sid while !ss_initialized is not good idea for any filesystem types. > Also, I think this should likely also be done in > selinux_inode_setsecurity() for consistency. I am not sure that I follow selinux_inode_setsecurity suggestion. selinux_inode_setsecurity is about permission check. And selinux_inode_post_setxattr deals with processing and setting side effects if xattr was "security.selinux", it does not matter what happens in selinux_inode_setsecurity if it returns access_ok, LSM will still call selinux_inode_post_setxattr and we would need to check and not produce any sid caching side effects if !ss_initialized. Sitll keeping logic in selinux_inode_post_setxattr, checked that the following with much simple code works too: >From bfc54e4805f3059671417ff2cda1266bc68e18f9 Mon Sep 17 00:00:00 2001 From: Victor Kamensky Date: Fri, 9 Mar 2018 23:06:08 -0800 Subject: [PATCH 2/2] selinux: delay sid population in setxattr till policy loaded With initramfs cpio format that supports extended attributes we need to skip sid population on sys_lsetxattr call from initramfs for rootfs if security server is not initialized yet. Otherwise callback in selinux_inode_post_setxattr will try to translate give security.selinux label into sid context and since security server is not available yet inode will receive default sid (typically kernel_t). Note that in the same time proper label will be stored in inode xattrs. Later, since inode sid would be already populated system will never look back at actual xattrs. But if we skip sid population for rootfs and we have policy that direct use of xattrs for rootfs, proper sid will be filled in from extended attributes one node is accessed and server is initialized. Signed-off-by: Victor Kamensky --- security/selinux/hooks.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 31303ed..4c13759 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3197,6 +3197,10 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, return; } + if (!ss_initialized) { + return; + } + rc = security_context_to_sid_force(value, size, &newsid); if (rc) { printk(KERN_ERR "SELinux: unable to map context to SID"