SELinux lead to soft lockup when pid 1 proceess reap child

security/selinux/hooks.c +1 -0

+       }
        return task_has_perm(p, current, PROCESS__SIGCHLD);
 }

It work but it permit pid 1 process to reap child without selinux check. Can we have a better way to handle this problem?

security/selinux/hooks.c static int selinux_task_kill(struct task_struct *p, · line 3601

Quoted 10 lines · yangshukui

security/selinux/hooks.c +2 -0

@@ -3596,6 +3596,9 @@ static int selinux_task_kill(struct task_struct *p,
 struct siginfo *info,
 
 static int selinux_task_wait(struct task_struct *p)
 {
+       if (pid_vnr(task_tgid(current)) == 1){
+                return 0;

this check is not really correct, it can be a sub-thread... Doesn't matter, please see below.

Quoted 5 lines

security/selinux/hooks.c +1 -0

+       }
        return task_has_perm(p, current, PROCESS__SIGCHLD);
 }

It work but it permit pid 1 process to reap child without selinux check. Can we have a better way to handle this problem?

I never understood why security_task_wait() should deny to reap a child. But since it can we probably want some explicit "the whole namespace goes away" check. We could use, say, PIDNS_HASH_ADDING but I'd suggest something like a trivial change below for now.

Eric, what do you think?

Oleg.

security/security.c +3 -0

index f825304..1330b4e 100644
@@ -1027,6 +1027,9 @@ int security_task_kill(struct task_struct *p, struct siginfo *info,
 
 int security_task_wait(struct task_struct *p)
 {
+	/* must be the exiting child reaper */
+	if (unlikely(current->flags & PF_EXITING))
+		return 0;
 	return call_int_hook(task_wait, 0, p);
 }
 

Seriously, could someone explain why do we need the security_task_wait()
hook at all?

Quoted 55 lines · yangshukui

security/selinux/hooks.c static int selinux_task_kill(struct · line 3602

Quoted 12 lines

security/selinux/hooks.c +2 -0

@@ -3596,6 +3596,9 @@ static int selinux_task_kill(struct
 task_struct *p,
 struct siginfo *info,
 
  static int selinux_task_wait(struct task_struct *p)
  {
+       if (pid_vnr(task_tgid(current)) == 1){
+                return 0;

this check is not really correct, it can be a sub-thread... Doesn't matter,
please see below.

Quoted 7 lines

security/selinux/hooks.c +1 -0

+       }
         return task_has_perm(p, current, PROCESS__SIGCHLD);

 }
It work but it permit pid 1 process to reap child without selinux check. Can
we have a better way to handle this problem?

I never understood why security_task_wait() should deny to reap a child. But
since it can we probably want some explicit "the whole namespace goes away" check.
We could use, say, PIDNS_HASH_ADDING but I'd suggest something like a trivial change
below for now.

Eric, what do you think?

Oleg.

security/security.c +0 -0

index f825304..1330b4e 100644
@@ -1027,6 +1027,9 @@ int security_task_kill(struct task_struct *p,
 struct siginfo *info,

 int security_task_wait(struct task_struct *p)
 {

security/security.c +3 -0

+	/* must be the exiting child reaper */
+	if (unlikely(current->flags & PF_EXITING))
+		return 0;

  return call_int_hook(task_wait, 0, p);
 }

Quoted 3 lines · Oleg Nesterov

Seriously, could someone explain why do we need the security_task_wait()
hook at all?

I would be ok with killing it.
IIRC, the original motivation was to block an unauthorized data flow from child to parent when the child context differs, but part of that original design was also to reparent the child automatically, and that was never implemented. I don't think there is a real use case for it in practice and it just breaks things, so let's get rid of it unless someone objects.

Quoted 3 lines · Oleg Nesterov

Seriously, could someone explain why do we need the security_task_wait()
hook at all?

I would be ok with killing it.
IIRC, the original motivation was to block an unauthorized data flow from child to parent when the child context differs, but part of that original design was also to reparent the child automatically, and that was never implemented. I don't think there is a real use case for it in practice and it just breaks things, so let's get rid of it unless someone objects.

Quoted 45 lines · Oleg Nesterov

Quoted 42 lines · yangshukui

security/selinux/hooks.c static int selinux_task_kill(struct · line 3602

Quoted 11 lines

security/selinux/hooks.c +2 -0

@@ -3596,6 +3596,9 @@ static int selinux_task_kill(struct
 task_struct *p,
 struct siginfo *info,
 
 static int selinux_task_wait(struct task_struct *p)
 {
+       if (pid_vnr(task_tgid(current)) == 1){
+                return 0;

this check is not really correct, it can be a sub-thread... Doesn't matter,
please see below.

Quoted 6 lines

security/selinux/hooks.c +1 -0

+       }
        return task_has_perm(p, current, PROCESS__SIGCHLD);

}
It work but it permit pid 1 process to reap child without selinux check. Can
we have a better way to handle this problem?

I never understood why security_task_wait() should deny to reap a child. But
since it can we probably want some explicit "the whole namespace goes away" check.
We could use, say, PIDNS_HASH_ADDING but I'd suggest something like a trivial change
below for now.

Eric, what do you think?

Oleg.

security/security.c +0 -0

index f825304..1330b4e 100644
@@ -1027,6 +1027,9 @@ int security_task_kill(struct task_struct *p,
 struct siginfo *info,
 

Quoted 8 lines

security/security.c int security_task_kill(struct task_struct *p, struct siginfo *info, · line 1034

Quoted 8 lines

security/security.c +3 -0

 int security_task_wait(struct task_struct *p)
 {
+	/* must be the exiting child reaper */
+	if (unlikely(current->flags & PF_EXITING))
+		return 0;
 	return call_int_hook(task_wait, 0, p);
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

I want to use SELinux in system container and only concern the function?
in the container.
this system container run in vm and every vm has only one system container.

How do I use now?
docker run ... system-contaier /sbin/init
after init is running ,the following service is also running:

#this is the part of service file which will run in container after? starting the container.
...
semodule -R?????#use the policy in container.
restorecon /?????#if needed
...

this method seem to work if host os and the docker images use the same?
content for rootfs, but if host use
redhat7 and docker images use centos7, it will deny many normal? operations , and this let some host service not work.

If SELinux is permissive in host and enforcing in container ,it will? resolve my problem. Unfortunately,
there is no namespace for SELinux.

Isolate SELinux is difficult and it has a lot of work to do, but is? easier to isolate selinux_enforcing.

What do you think ?

Quoted 30 lines · yangshukui

I want to use SELinux in system container and only concern the function?
in the container.
this system container run in vm and every vm has only one system container.

How do I use now?
docker run ... system-contaier /sbin/init
after init is running ,the following service is also running:

#this is the part of service file which will run in container after?
starting the container.
...
semodule -R?????#use the policy in container. restorecon /?????#if needed
...

this method seem to work if host os and the docker images use the same?
content for rootfs, but if host use
redhat7 and docker images use centos7, it will deny many normal? operations , and this let some host service not work.

If SELinux is permissive in host and enforcing in container ,it will?
resolve my problem. Unfortunately,
there is no namespace for SELinux.

Quoted 5 lines

Isolate SELinux is difficult and it has a lot of work to do, but is?
easier to isolate selinux_enforcing.

What do you think ?

I'd rather see proper SELinux policy namespace support implemented. Admittedly, that won't be straightforward.

FWIW, ChromiumOS appears to have done something similar to what you suggest for supporting Android containers (i.e. SELinux enforcing for the Android container, permissive for ChromiumOS processes outside the
container), but they never discussed it with upstream SELinux developers AFAIK. ?My only knowledge of what they have done comes from
their kernel repository [1]. It appears that they experimented with a hack to narrow the scope of selinux_enforcing to a PID namespace [2], then reverted that change later and just implemented an option to suppress audit denials for permissive domains [3] (evidently they are running the Chromium OS processes in a permissive domain; I haven't seen their policy). ?I wouldn't recommend either approach; the former won't properly handle permission checks that occur outside of process context or certain permission checks where the source context is not the current task context (e.g. an inter-object relationship check), while the latter requires leaving a permissive domain in the production

policy (which seemingly would violate CTS; not sure why that gets a pass, and if that is ok, then why didn't they just create a domain allowed all permissions and use that outside the container instead - then they won't need to suppress audit at all?) and further requires use of a separate kernel for policy development/debugging. ?Note btw that they could have silenced the permissive denials via dontaudit rules instead (as Android does for its su domain) but chose not to do so to avoid taking the slow path.

[1]?https://chromium.googlesource.com/chromiumos/third_party/kernel [2]?https://chromium-review.googlesource.com/c/361464/ [3]?https://chromium-review.googlesource.com/c/424948/

I want to use SELinux in system container and only concern the function in the container. this system container run in vm and every vm has only one system container.

How do I use now?
docker run ... system-contaier /sbin/init
after init is running ,the following service is also running:

#this is the part of service file which will run in container after starting the container. ..
semodule -R #use the policy in container.
restorecon / #if needed
..

this method seem to work if host os and the docker images use the same content for rootfs, but if host use redhat7 and docker images use centos7, it will deny many normal operations , and this let some host service not work.

If SELinux is permissive in host and enforcing in container ,it will resolve my problem. Unfortunately, there is no namespace for SELinux.

Isolate SELinux is difficult and it has a lot of work to do, but is easier to isolate selinux_enforcing.

What do you think ?

Think you very much.

Signature · 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Quoted 13 lines · yangshukui

I want to use SELinux in system container and only concern the function in the container. this system container run in vm and every vm has only one system container.

How do I use now?
docker run ... system-contaier /sbin/init
after init is running ,the following service is also running:

#this is the part of service file which will run in container after starting the container. ..
semodule -R #use the policy in container.
restorecon / #if needed
..

Quoted 5 lines

this method seem to work if host os and the docker images use the same content for rootfs, but if host use redhat7 and docker images use centos7, it will deny many normal operations , and this let some host service not work.

If SELinux is permissive in host and enforcing in container ,it will resolve my problem. Unfortunately, there is no namespace for SELinux.

The LSM infrastructure is essentially a set of lists. These lists are rooted globally, but there's no reason* they couldn't be rooted in a namespace. That would give each namespace the option of using whatever security scheme was deemed appropriate. There are a number of issues, such as namespacing policy, that would have to be addressed, but the mechanism could work fine. I would look at patches.

---
* Other than the sheer insanity of making security claims about such a system. I would not expect that minor issue to slow demand or deployment any more than it has in the past.

Quoted 14 lines · Casey Schaufler

Quoted 13 lines · yangshukui

I want to use SELinux in system container and only concern the function in the container. this system container run in vm and every vm has only one system container.

How do I use now?
docker run ... system-contaier /sbin/init
after init is running ,the following service is also running:

#this is the part of service file which will run in container after starting the container. ..
semodule -R #use the policy in container.
restorecon / #if needed
..

Quoted 5 lines

Quoted 5 lines

this method seem to work if host os and the docker images use the same content for rootfs, but if host use redhat7 and docker images use centos7, it will deny many normal operations , and this let some host service not work.

If SELinux is permissive in host and enforcing in container ,it will resolve my problem. Unfortunately, there is no namespace for SELinux.

This is mostly a SELinux problem.

Quoted 10 lines

The LSM infrastructure is essentially a set of lists. These lists are rooted globally, but there's no reason* they couldn't be rooted in a namespace. That would give each namespace the option of using whatever security scheme was deemed appropriate. There are a number of issues, such as namespacing policy, that would have to be addressed, but the mechanism could work fine. I would look at patches.

Quoted 5 lines

---
* Other than the sheer insanity of making security claims about such a system. I would not expect that minor issue to slow demand or deployment any more than it has in the past.

I would tend to insist that the container local policy stacks inside the global policy. So that at the least the global security claims would not be reduced.

My expectation is that a container would run as essentially all one label from a global perspective.

To implement this would require a revision on the selinux labels xattrs so that they can be marked as being part of a container... But having the labels look ordinary inside the container.

We almost have a patch that implements something like that for the capability xattr.

Quoted 3 lines · Eric W. Biederman

My expectation is that a container would run as essentially all one label from a global perspective.

Keep in mind that a different classes of objects may have distinct labeling in SELinux. e.g. a process and a file typically have different labels (say, sshd_t vs. sshd_key_t).

Also, I think you will want to have the global namespace always use the original security labels. If accessing an object from outside the container, the original global policy should always apply. Really, this needs to be an invariant property.

I'd suggest implementing an orthogonal 2nd set of security labels which are only ever used within the container.

Quoted 6 lines

To implement this would require a revision on the selinux labels xattrs so that they can be marked as being part of a container... But having the labels look ordinary inside the container.

We almost have a patch that implements something like that for the capability xattr.

It'll be interesting to see.