From: Stephen Smalley <sds@tycho.nsa.gov>
To: Victor Kamensky <kamensky@cisco.com>
Cc: Taras Kondratiuk <takondra@cisco.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Al Viro <viro@zeniv.linux.org.uk>, Arnd Bergmann <arnd@arndb.de>,
Rob Landley <rob@landley.net>,
Mimi Zohar <zohar@linux.vnet.ibm.com>,
Jonathan Corbet <corbet@lwn.net>,
James McMechan <james.w.mcmechan@gmail.com>,
initramfs@vger.kernel.org, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
xe-linux-external@cisco.com, Paul Moore <paul@paul-moore.com>,
Eric Paris <eparis@parisplace.org>
Subject: Re: [Non-DoD Source] Re: [PATCH v3 14/15] selinux: allow setxattr on rootfs so initramfs code can set them
Date: Tue, 20 Mar 2018 12:33:12 -0400 [thread overview]
Message-ID: <ab0b8e50-a92e-9f36-5493-ddbd295ed182@tycho.nsa.gov> (raw)
In-Reply-To: <alpine.LRH.2.00.1803101848580.24419@sjc-ads-6991.cisco.com>
On 03/10/2018 10:07 PM, Victor Kamensky wrote:
>
>
> On Tue, 20 Feb 2018, Stephen Smalley wrote:
>
>> On Fri, 2018-02-16 at 20:33 +0000, Taras Kondratiuk wrote:
>>> From: Victor Kamensky <kamensky@cisco.com>
>>>
>>> initramfs code supporting extended cpio format have ability to
>>> fill extended attributes from cpio archive, but if SELinux enabled
>>> and security server is not initialized yet, selinux callback would
>>> refuse setxattr made by initramfs code.
>>>
>>> Solution enable SBLABEL_MNT on rootfs even if secrurity server is
>>> not initialized yet.
>>
>> What if we were to instead skip the SBLABEL_MNT check in
>> selinux_inode_setxattr() if !ss_initialized? Not dependent on
>> filesystem type.
>
> Stephen, thank you for looking into this. Sorry, for dealyed reponse -
> I needed to find time to require context about these changes.
>
> As you suggested I've tried this and it works:
>
>> From 6bf35bd055fdb12e94f3d5188eccfdbaa30dbcf4 Mon Sep 17 00:00:00 2001
> From: Victor Kamensky <kamensky@cisco.com>
> Date: Fri, 9 Mar 2018 23:01:20 -0800
> Subject: [PATCH 1/2] selinux: allow setxattr on file systems if policy is not
> loaded
>
> initramfs code supporting extended cpio format have ability to
> fill extended attributes from cpio archive, but if SELinux enabled
> and security server is not initialized yet, selinux callback would
> refuse setxattr made by initramfs code because file system is not
> yet marked as one that support labeling (SBLABEL_MNT flag).
>
> Solution do not refuse setxattr even if SBLABEL_MNT is not set
> for file systems when policy is not loaded yet.
>
> Signed-off-by: Victor Kamensky <kamensky@cisco.com>
> ---
> security/selinux/hooks.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 819fd68..31303ed 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -3120,7 +3120,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
> return selinux_inode_setotherxattr(dentry, name);
>
> sbsec = inode->i_sb->s_security;
> - if (!(sbsec->flags & SBLABEL_MNT))
> + if (!(sbsec->flags & SBLABEL_MNT) && ss_initialized)
> return -EOPNOTSUPP;
>
> if (!inode_owner_or_capable(inode))
I favor the first option.
next prev parent reply other threads:[~2018-03-20 16:33 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-16 20:33 [PATCH v3 00/15] extend initramfs archive format to support xattrs Taras Kondratiuk
[not found] ` <1518813234-5874-1-git-send-email-takondra-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>
2018-02-16 20:33 ` [PATCH v3 01/15] Documentation: add newcx initramfs format description Taras Kondratiuk
2018-02-16 20:59 ` H. Peter Anvin
2018-02-16 21:25 ` Rob Landley
2018-02-16 21:47 ` Victor Kamensky
[not found] ` <alpine.LRH.2.00.1802161336350.22409-fZ7xe+6E5F8pLdfb+Kaa2CW4+XlvGpQz@public.gmane.org>
2018-02-17 0:00 ` hpa-YMNOUZJC4hwAvxtiuMwx3w
[not found] ` <A5A0727C-B932-49F6-A7D7-AA7CAECECF96-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2018-02-17 10:04 ` Taras Kondratiuk
2018-02-17 17:32 ` Rob Landley
2018-02-18 0:15 ` Mimi Zohar
2018-02-18 0:24 ` hpa
[not found] ` <1518912912.5667.277.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-02-18 0:26 ` hpa-YMNOUZJC4hwAvxtiuMwx3w
2018-02-18 0:47 ` Mimi Zohar
2018-02-16 20:33 ` [PATCH v3 02/15] initramfs: replace states with function pointers Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 14/14] selinux: delay sid population for rootfs till init is complete Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 03/15] initramfs: store file name in name_buf Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 04/15] initramfs: remove unnecessary symlinks processing shortcut Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 05/15] initramfs: move files creation into separate state Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 06/15] initramfs: separate reading cpio method from header Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 07/15] initramfs: split header layout information from parsing function Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 08/15] initramfs: add newcx format Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 09/15] initramfs: set extended attributes Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 10/15] gen_init_cpio: move header formatting into function Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 11/15] gen_init_cpio: add newcx format Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 12/15] gen_init_cpio: set extended attributes for " Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 12/14] gen_initramfs_list.sh: add -x option to enable " Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 13/15] " Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 13/14] selinux: allow setxattr on rootfs so initramfs code can set them Taras Kondratiuk
2018-02-16 20:33 ` [PATCH v3 14/15] " Taras Kondratiuk
[not found] ` <1519153284.14218.18.camel@tycho.nsa.gov>
2018-03-11 3:07 ` Victor Kamensky
2018-03-20 16:33 ` Stephen Smalley [this message]
2018-02-16 20:33 ` [PATCH v3 15/15] selinux: delay sid population for rootfs till init is complete Taras Kondratiuk
[not found] ` <1519152994.14218.15.camel@tycho.nsa.gov>
2018-03-07 16:51 ` Rob Landley
2018-03-07 17:26 ` Victor Kamensky
2018-03-11 3:08 ` Victor Kamensky
2018-03-20 16:30 ` [Non-DoD Source] " Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ab0b8e50-a92e-9f36-5493-ddbd295ed182@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=arnd@arndb.de \
--cc=corbet@lwn.net \
--cc=eparis@parisplace.org \
--cc=hpa@zytor.com \
--cc=initramfs@vger.kernel.org \
--cc=james.w.mcmechan@gmail.com \
--cc=kamensky@cisco.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=rob@landley.net \
--cc=takondra@cisco.com \
--cc=viro@zeniv.linux.org.uk \
--cc=xe-linux-external@cisco.com \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).