[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87ee4dnw52.fsf@defensec.nl>
Date: Tue, 08 Feb 2022 17:47:05 +0100
From: Dominick Grift <dominick.grift@...ensec.nl>
To: Chris PeBenito <chpebeni@...ux.microsoft.com>
Cc: William Roberts <bill.c.roberts@...il.com>,
Paul Moore <paul@...l-moore.com>,
Demi Marie Obenour <demiobenour@...il.com>,
Stephen Smalley <stephen.smalley.work@...il.com>,
Eric Paris <eparis@...isplace.org>,
SElinux list <selinux@...r.kernel.org>,
Linux kernel mailing list <linux-kernel@...r.kernel.org>,
selinux-refpolicy@...r.kernel.org
Subject: Re: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX
Chris PeBenito <chpebeni@...ux.microsoft.com> writes:
> On 2/8/2022 09:17, William Roberts wrote:
>> <snip>
>> This is getting too long for me.
>>
>>>>
>>>> I don't have a strong opinion either way. If one were to allow this
>>>> using a policy rule, it would result in a major policy breakage. The
>>>> rule would turn on extended perm checks across the entire system,
>>>> which the SELinux Reference Policy isn't written for. I can't speak
>>>> to the Android policy, but I would imagine it would be the similar
>>>> problem there too.
>>>
>>> Excuse me if I am wrong but AFAIK adding a xperm rule does not turn on
>>> xperm checks across the entire system.
>> It doesn't as you state below its target + class.
>>
>>>
>>> If i am not mistaken it will turn on xperm checks only for the
>>> operations that have the same source and target/target class.
>> That's correct.
>
> Just to clarify (Demi Marie also mentioned this earlier in the
> thread), what I originally meant was how to emulate this patch by
> using policy rules means you need a rule that allows the two ioctls on
> all domains for all objects. That results in xperms checks enabled
> everywhere.
Thanks. That is clear now. I also learned that is pretty much what
Android's sepolicy is doing. That is probably not something I would do
(enable xperms globally). I would probably leverage it only for "devnode"
chr and maybe blk files and only where they actually are accessed.
I would not mind removing these two checks, but i am not a big user of
xperms (i only filter TIOSCTI on terminal chr files and only for the
entities that write or append them).
>
>
>>> This is also why i don't (with the exception TIOSCTI for termdev
>>> chr_file) use xperms by default.
>>>
>>> 1. it is really easy to selectively filter ioctls by adding xperm rules
>>> for end users (and since ioctls are often device/driver specific they
>>> know best what is needed and what not)
>>
>>>>>> and FIONCLEX can be trivially bypassed unless fcntl(F_SETFD)
>>>
>>> 2. if you filter ioctls in upstream policy for example like i do with
>>> TIOSCTI using for example (allowx foo bar (ioctl chr_file (not
>>> (0xXXXX)))) then you cannot easily exclude additional ioctls later where source is
>>> foo and target/tclass is bar/chr_file because there is already a rule in
>>> place allowing the ioctl (and you cannot add rules)
>> Currently, fcntl flag F_SETFD is never checked, it's silently
>> allowed, but
>> the equivalent FIONCLEX and FIOCLEX are checked. So if you wrote policy
>> to block the FIO*CLEX flags, it would be bypassable through F_SETFD and
>> FD_CLOEXEC. So the patch proposed makes the FIO flags behave like
>> F_SETFD. Which means upstream policy users could drop this allow, which
>> could then remove the target/class rule and allow all icotls. Which is easy
>> to prevent and fix you could be a rule in to allowx 0 as documented in the
>> wiki: https://selinuxproject.org/page/XpermRules
>> The questions I think we have here are:
>> 1. Do we agree that the behavior between SETFD and the FIO flags are equivalent?
>> I think they are.
>> 2. Do we want the interfaces to behave the same?
>> I think they should.
>
> If you can bypass FIONCLEX and FIOCLEX checks by F_SETFD and
> FD_CLOEXEC, then I agree that the two FIO checks don't have value and
> can be skipped as F_SETFD is.
>
>> 3. Do upstream users of the policy construct care?
>> The patch is backwards compat, but I don't want their to be cruft
>> floating around with extra allowxperm rules.
>
> Reference policy does not have any xperm rules at this time. I looked
> at the Fedora policy, and that doesn't have any.
--
gpg --locate-keys dominick.grift@...ensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098
Dominick Grift
Powered by blists - more mailing lists