linux-kernel - Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 25 Mar 2013 17:39:01 +0100
From:	Thomas COUDRAY <amanone@...il.com>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	jmorris@...ei.org, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, Eric Paris <eparis@...isplace.org>
Subject: Re: lgetxattr()/getxattr() return different values on a file labelled
 with selinux disabled

2013/3/15 Stephen Smalley <sds@...ho.nsa.gov>:
> On 03/15/2013 11:24 AM, Thomas COUDRAY wrote:
>>
>> 2013/3/15 Stephen Smalley <sds@...ho.nsa.gov>:
>>> before_t and after_t are both defined in the policy?
>>
>> Only before_t was defined in the policy.
>
> If not defined in policy, then kernel should remap to unlabeled sid context.

That is not the case.

>>> What are the credentials (capabilities and SELinux security
>>> context/permissions) of the process running the ls and getfattr commands?
>> It has unconfined_u:unconfined_r:before_t label with before_t type.
>> Same as the file f.
>> The process has full SELinux rights on both command and file.
>
> Did it run as root?  Does it have :capability2 mac_override permission?

When I run it as root, both commands return the same label.
The process has mac_override, mac_admin and syslog permission on f.

>>> Any relevant messages from SELinux in dmesg output?
>>
>> No avc warnings in dmesg and audit.log. All looks good.
>
> What about SELinux: messages?  e.g. SELinux:  Context ... is not valid (left
> unmapped).
>

You're right.
> SELinux: Context system_u:object_r:after_t is not valid (left unmapped).

I'm using the modular-base-policy from notebook-source.

--
Thomas Coudray


[    0.021583] SELinux:  Initializing.
[    0.021978] SELinux:  Starting in permissive mode
[    0.765100] EVM: security.selinux
[    1.037649] SELinux:  Registering netfilter hooks
[    4.374957] SELinux: 32 avtab hash slots, 82 rules.
[    4.374966] SELinux: 32 avtab hash slots, 82 rules.
[    4.374968] SELinux:  2 users, 2 roles, 2 types, 0 bools
[    4.374969] SELinux:  82 classes, 82 rules
[    4.375041] SELinux:  Completing initialization.
[    4.375042] SELinux:  Setting up existing superblocks.
[    4.375045] SELinux: initialized (dev sysfs, type sysfs), not
configured for labeling
[    4.375047] SELinux: initialized (dev rootfs, type rootfs), not
configured for labeling
[    4.375122] SELinux: initialized (dev bdev, type bdev), not
configured for labeling
[    4.375125] SELinux: initialized (dev proc, type proc), uses genfs_contexts
[    4.375129] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[    4.375132] SELinux: initialized (dev devtmpfs, type devtmpfs), not
configured for labeling
[    4.375188] SELinux: initialized (dev debugfs, type debugfs), not
configured for labeling
[    4.375594] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
[    4.375596] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
[    4.375598] SELinux: initialized (dev anon_inodefs, type
anon_inodefs), not configured for labeling
[    4.375600] SELinux: initialized (dev devpts, type devpts), uses
transition SIDs
[    4.375603] SELinux: initialized (dev hugetlbfs, type hugetlbfs),
uses transition SIDs
[    4.375605] SELinux: initialized (dev mqueue, type mqueue), uses
transition SIDs
[    4.375607] SELinux: initialized (dev selinuxfs, type selinuxfs),
uses genfs_contexts
[    4.375614] SELinux: initialized (dev securityfs, type securityfs),
not configured for labeling
[    4.375616] SELinux: initialized (dev sysfs, type sysfs), not
configured for labeling
[    4.375746] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[    4.375804] SELinux: initialized (dev sda1, type ext4), uses xattr
[    4.929828] SELinux: initialized (dev fusectl, type fusectl), not
configured for labeling
[    4.934859] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[    4.936117] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[    6.926947] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs),
not configured for labeling
[   17.550807] SELinux: initialized (dev vboxsf, type vboxsf), not
configured for labeling
[   77.497646] SELinux:  Context system_u:object_r:after_t is not
valid (left unmapped).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/