linux-kernel - Re: [PATCH v3 14/15] selinux: allow setxattr on rootfs so initramfs code can set them

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1519153284.14218.18.camel@tycho.nsa.gov>
Date:   Tue, 20 Feb 2018 14:01:24 -0500
From:   Stephen Smalley <sds@...ho.nsa.gov>
To:     Taras Kondratiuk <takondra@...co.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Arnd Bergmann <arnd@...db.de>, Rob Landley <rob@...dley.net>,
        Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        Jonathan Corbet <corbet@....net>,
        James McMechan <james.w.mcmechan@...il.com>
Cc:     initramfs@...r.kernel.org, Victor Kamensky <kamensky@...co.com>,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org, xe-linux-external@...co.com,
        Paul Moore <paul@...l-moore.com>,
        Eric Paris <eparis@...isplace.org>
Subject: Re: [PATCH v3 14/15] selinux: allow setxattr on rootfs so initramfs
 code can set them

On Fri, 2018-02-16 at 20:33 +0000, Taras Kondratiuk wrote:
> From: Victor Kamensky <kamensky@...co.com>
> 
> initramfs code supporting extended cpio format have ability to
> fill extended attributes from cpio archive, but if SELinux enabled
> and security server is not initialized yet, selinux callback would
> refuse setxattr made by initramfs code.
> 
> Solution enable SBLABEL_MNT on rootfs even if secrurity server is
> not initialized yet.

What if we were to instead skip the SBLABEL_MNT check in
selinux_inode_setxattr() if !ss_initialized?  Not dependent on
filesystem type.

> 
> Signed-off-by: Victor Kamensky <kamensky@...co.com>
> ---
>  security/selinux/hooks.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 8644d864e3c1..f3fe65589f02 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -706,6 +706,18 @@ static int selinux_set_mnt_opts(struct
> super_block *sb,
>  
>  	if (!ss_initialized) {
>  		if (!num_opts) {
> +			/*
> +			 * Special handling for rootfs. Is genfs but
> supports
> +			 * setting SELinux context on in-core
> inodes.
> +			 *
> +			 * Chicken and egg problem: policy may
> reside in rootfs
> +			 * but for initramfs code to fill in
> attributes, it
> +			 * needs selinux to allow that.
> +			 */
> +			if (!strncmp(sb->s_type->name, "rootfs",
> +				     sizeof("rootfs")))
> +				sbsec->flags |= SBLABEL_MNT;
> +
>  			/* Defer initialization until
> selinux_complete_init,
>  			   after the initial policy is loaded and
> the security
>  			   server is ready to handle calls. */