lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 22 Nov 2020 18:14:37 -0500 From: Paul Moore <paul@...l-moore.com> To: Lokesh Gidra <lokeshgidra@...gle.com> Cc: Andrea Arcangeli <aarcange@...hat.com>, Alexander Viro <viro@...iv.linux.org.uk>, James Morris <jmorris@...ei.org>, Stephen Smalley <stephen.smalley.work@...il.com>, Casey Schaufler <casey@...aufler-ca.com>, Eric Biggers <ebiggers@...nel.org>, "Serge E. Hallyn" <serge@...lyn.com>, Eric Paris <eparis@...isplace.org>, Daniel Colascione <dancol@...col.org>, Kees Cook <keescook@...omium.org>, "Eric W. Biederman" <ebiederm@...ssion.com>, KP Singh <kpsingh@...gle.com>, David Howells <dhowells@...hat.com>, Thomas Cedeno <thomascedeno@...gle.com>, Anders Roxell <anders.roxell@...aro.org>, Sami Tolvanen <samitolvanen@...gle.com>, Matthew Garrett <matthewgarrett@...gle.com>, Aaron Goidel <acgoide@...ho.nsa.gov>, Randy Dunlap <rdunlap@...radead.org>, "Joel Fernandes (Google)" <joel@...lfernandes.org>, YueHaibing <yuehaibing@...wei.com>, Christian Brauner <christian.brauner@...ntu.com>, Alexei Starovoitov <ast@...nel.org>, Alexey Budankov <alexey.budankov@...ux.intel.com>, Adrian Reber <areber@...hat.com>, Aleksa Sarai <cyphar@...har.com>, Linux FS Devel <linux-fsdevel@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org>, LSM List <linux-security-module@...r.kernel.org>, SElinux list <selinux@...r.kernel.org>, Kalesh Singh <kaleshsingh@...gle.com>, Calin Juravle <calin@...gle.com>, Suren Baghdasaryan <surenb@...gle.com>, Jeffrey Vander Stoep <jeffv@...gle.com>, "Cc: Android Kernel" <kernel-team@...roid.com>, "open list:MEMORY MANAGEMENT" <linux-mm@...ck.org>, Andrew Morton <akpm@...ux-foundation.org>, hch@...radead.org, Ondrej Mosnacek <omosnace@...hat.com> Subject: Re: [PATCH v12 3/4] selinux: teach SELinux about anonymous inodes On Wed, Nov 18, 2020 at 5:39 PM Lokesh Gidra <lokeshgidra@...gle.com> wrote: > I have created a cuttlefish build and have tested with the attached > userfaultfd program: Thanks, that's a good place to start, a few comments: - While we support Android as a distribution, it isn't a platform that we common use for development and testing. At the moment, Fedora is probably your best choice for that. - Your test program should be written in vanilla C for the selinux-testsuite. Looking at the userfaultfdSimple.cc code that should be a trivial conversion. - I think you have a good start on a test for the selinux-testsuite, please take a look at the test suite and submit a patch against that repo. Ondrej (CC'd) currently maintains the test suite and he may have some additional thoughts. * https://github.com/SELinuxProject/selinux-testsuite > 1) Without these kernel patches the program executes without any restrictions > > vsoc_x86_64:/ $ ./system/bin/userfaultfdSimple > api: 170 > features: 511 > ioctls: 9223372036854775811 > > read: Try again > > > 2) With these patches applied but without any policy the 'permission > denied' is thrown > > vsoc_x86_64:/ $ ./system/bin/userfaultfdSimple > syscall(userfaultfd): Permission denied > > with the following logcat message: > 11-18 14:21:44.041 3130 3130 W userfaultfdSimp: type=1400 > audit(0.0:107): avc: denied { create } for dev="anon_inodefs" > ino=45031 scontext=u:r:shell:s0 tcontext=u:object_r:shell:s0 > tclass=anon_inode permissive=0 > > > 3) With the attached .te policy file in place the following output is > observed, confirming that the patch is working as intended. > vsoc_x86_64:/ $ ./vendor/bin/userfaultfdSimple > UFFDIO_API: Permission denied > > with the following logcat message: > 11-18 14:33:29.142 2028 2028 W userfaultfdSimp: type=1400 > audit(0.0:104): avc: denied { ioctl } for > path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=41169 > ioctlcmd=0xaa3f scontext=u:r:userfaultfdSimple:s0 > tcontext=u:object_r:uffd_t:s0 tclass=anon_inode permissive=0 -- paul moore www.paul-moore.com
Powered by blists - more mailing lists