selinux: make mls_compute_sid always polyinstantiate

PATCH In review Eamon Walsh 5 participants 12 messages Jan 24, 2008 – Feb 8, 2008 SELinux security module

Share & tools

Eamon Walsh

author

2008-01-24 20:30 UTC #0 lore raw

PATCH 1/1 selinux: make mls_compute_sid always polyinstantiate

This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.

Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).

Signed-off-by Eamon Walsh <[email protected]>

---

mls.c | 11 ++---------

1 file changed, 2 insertions(+), 9 deletions(-)

security/selinux/ss/mls.c +0 -0

index fb5d70a..3bbcb53 100644
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,

			/* Use the process effective MLS attributes. */
			return mls_context_cpy_low(newcontext, scontext);
	case AVTAB_MEMBER:

- /* Only polyinstantiate the MLS attributes if
- the type is being polyinstantiated */
- if (newcontext->type != tcontext->type) {
- /* Use the process effective MLS attributes. */
- return mls_context_cpy_low(newcontext, scontext);
- } else {
- /* Use the related object MLS attributes. */
- return mls_context_cpy(newcontext, tcontext);
- }
+ /* Use the process effective MLS attributes. */

+		return mls_context_cpy_low(newcontext, scontext);
	default:
		return -EINVAL;
	}

Signature · 8 lines

Eamon Walsh <[email protected]>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

Acked-by on v1 1/1

2008-01-24 20:36 UTC #1 lore raw

Quoted 9 lines · Eamon Walsh

This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>

Acked-by Stephen Smalley <[email protected]>

Quoted 4 lines

---

 mls.c |   11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

(nit: use diffstat -p1 in the future)

Quoted 26 lines

security/selinux/ss/mls.c +2 -9

index fb5d70a..3bbcb53 100644
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
 			/* Use the process effective MLS attributes. */
 			return mls_context_cpy_low(newcontext, scontext);
 	case AVTAB_MEMBER:
-		/* Only polyinstantiate the MLS attributes if
-		   the type is being polyinstantiated */
-		if (newcontext->type != tcontext->type) {
-			/* Use the process effective MLS attributes. */
-			return mls_context_cpy_low(newcontext, scontext);
-		} else {
-			/* Use the related object MLS attributes. */
-			return mls_context_cpy(newcontext, tcontext);
-		}
+		/* Use the process effective MLS attributes. */
+		return mls_context_cpy_low(newcontext, scontext);
 	default:
 		return -EINVAL;
 	}

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Joshua Brindle

2008-01-24 20:46 UTC #2 lore raw

In reply to Eamon Walsh

Quoted 23 lines · Eamon Walsh

This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
mls.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
security/selinux/ss/mls.c +0 -4
index fb5d70a..3bbcb53 100644
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
            /* Use the process effective MLS attributes. */
            return mls_context_cpy_low(newcontext, scontext);
    case AVTAB_MEMBER:
-        /* Only polyinstantiate the MLS attributes if
-           the type is being polyinstantiated */
-        if (newcontext->type != tcontext->type) {
-            /* Use the process effective MLS attributes. */

security/selinux/ss/mls.c int mls_compute_sid(struct context *scontext, · line 544

Quoted 10 lines

security/selinux/ss/mls.c +2 -5

-            return mls_context_cpy_low(newcontext, scontext);
-        } else {
-            /* Use the related object MLS attributes. */
-            return mls_context_cpy(newcontext, tcontext);
-        }
+        /* Use the process effective MLS attributes. */
+        return mls_context_cpy_low(newcontext, scontext);
    default:
        return -EINVAL;
    }

Should there be a patch to update mls.c in libsepol as well? I hope we are keeping the kss and uss in sync.

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2008-01-24 21:01 UTC #3 lore raw

Quoted 34 lines · Joshua Brindle

Quoted 33 lines · Eamon Walsh
This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
mls.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
security/selinux/ss/mls.c +0 -9
index fb5d70a..3bbcb53 100644
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
            /* Use the process effective MLS attributes. */
            return mls_context_cpy_low(newcontext, scontext);
    case AVTAB_MEMBER:
-        /* Only polyinstantiate the MLS attributes if
-           the type is being polyinstantiated */
-        if (newcontext->type != tcontext->type) {
-            /* Use the process effective MLS attributes. */
-            return mls_context_cpy_low(newcontext, scontext);
-        } else {
-            /* Use the related object MLS attributes. */
-            return mls_context_cpy(newcontext, tcontext);
-        }

Quoted 8 lines

security/selinux/ss/mls.c int mls_compute_sid(struct context *scontext, · line 544
Quoted 5 lines
security/selinux/ss/mls.c +2 -0
+        /* Use the process effective MLS attributes. */
+        return mls_context_cpy_low(newcontext, scontext);
    default:
        return -EINVAL;
    }
Should there be a patch to update mls.c in libsepol as well? I hope we are keeping the kss and uss in sync.

Yes, we should likely mirror the change there.

We aren't however keeping them in sync in general; there are certainly any number of recent changes that have only gone into the kernel ss (e.g. policy validation code, boolean preservation, handle unknown support, new ebitmap implementation, object class and permission discovery, etc). And keeping them in sync is hard; most changes have to be manually ported since the kernel ss is specialized for Linux and the original contributor has to agree on porting the code to libsepol since it has a different license (GPL vs. LGPL).

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Joshua Brindle

2008-01-24 21:14 UTC #4 lore raw

Quoted 43 lines · Stephen Smalley

Quoted 29 lines · Joshua Brindle
Quoted 27 lines · Eamon Walsh
This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
mls.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
security/selinux/ss/mls.c +0 -8
index fb5d70a..3bbcb53 100644
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
            /* Use the process effective MLS attributes. */
            return mls_context_cpy_low(newcontext, scontext);
    case AVTAB_MEMBER:
-        /* Only polyinstantiate the MLS attributes if
-           the type is being polyinstantiated */
-        if (newcontext->type != tcontext->type) {
-            /* Use the process effective MLS attributes. */
-            return mls_context_cpy_low(newcontext, scontext);
-        } else {
-            /* Use the related object MLS attributes. */
-            return mls_context_cpy(newcontext, tcontext);
Quoted 9 lines
security/selinux/ss/mls.c int mls_compute_sid(struct context *scontext, · line 544
Quoted 7 lines
security/selinux/ss/mls.c +2 -1
-        }
+        /* Use the process effective MLS attributes. */
+        return mls_context_cpy_low(newcontext, scontext);
    default:
        return -EINVAL;
    }
Should there be a patch to update mls.c in libsepol as well? I hope we are keeping the kss and uss in sync.
Yes, we should likely mirror the change there.

Quoted 9 lines

We aren't however keeping them in sync in general; there are certainly any number of recent changes that have only gone into the kernel ss (e.g. policy validation code, boolean preservation, handle unknown support, new ebitmap implementation, object class and permission discovery, etc). And keeping them in sync is hard; most changes have to be manually ported since the kernel ss is specialized for Linux and the original contributor has to agree on porting the code to libsepol since it has a different license (GPL vs. LGPL).

I'm not worried about mechanistic changes, only functionality so that we know the kss and the uss would give the same answer given the same policy and query. That is an interesting point about the license though, I hadn't thought of that.

James Morris

2008-01-24 22:43 UTC #5 lore raw

In reply to Eamon Walsh

Quoted 9 lines · Eamon Walsh

This patch removes the requirement that the new and related object types differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6.git#for-akpm

Signature · 7 lines

James Morris
<[email protected]>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Xavier Toth

2008-02-05 17:52 UTC #6 lore raw

In reply to Eamon Walsh

Is this in rawhide, if not when will it be?

Quoted 45 lines · Eamon Walsh

This patch removes the requirement that the new and related object types
differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
  mls.c |   11 ++---------
  1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c index fb5d70a..3bbcb53 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
                        /* Use the process effective MLS attributes. */
                        return mls_context_cpy_low(newcontext, scontext);
        case AVTAB_MEMBER:
 -               /* Only polyinstantiate the MLS attributes if
 -                  the type is being polyinstantiated */
 -               if (newcontext->type != tcontext->type) {
 -                       /* Use the process effective MLS attributes. */
 -                       return mls_context_cpy_low(newcontext, scontext);
 -               } else {
 -                       /* Use the related object MLS attributes. */
 -                       return mls_context_cpy(newcontext, tcontext);
 -               }
 +               /* Use the process effective MLS attributes. */
 +               return mls_context_cpy_low(newcontext, scontext);
        default:
                return -EINVAL;
        }
--
Eamon Walsh <[email protected]>
National Security Agency

Quoted 5 lines

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2008-02-05 20:48 UTC #7 lore raw

Quoted 1 line · Xavier Toth

Is this in rawhide, if not when will it be?

Not up to us, obviously. The patch is in Linus' git tree, but looks like latest fedora devel kernel is frozen on 2.6.24 + specific individual patches, not feeding from Linus' git presently. James could possibly ask the Fedora kernel maintainer about adding it - it is small, self-contained, and has no side effects on existing code (nothing prior to XSELinux uses the compute member support; pam_namespace usage was disabled since it didn't work right for multi-level dirs).

Quoted 57 lines · Eamon Walsh

Quoted 45 lines
This patch removes the requirement that the new and related object types
differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
  mls.c |   11 ++---------
  1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c index fb5d70a..3bbcb53 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
                        /* Use the process effective MLS attributes. */
                        return mls_context_cpy_low(newcontext, scontext);
        case AVTAB_MEMBER:
 -               /* Only polyinstantiate the MLS attributes if
 -                  the type is being polyinstantiated */
 -               if (newcontext->type != tcontext->type) {
 -                       /* Use the process effective MLS attributes. */
 -                       return mls_context_cpy_low(newcontext, scontext);
 -               } else {
 -                       /* Use the related object MLS attributes. */
 -                       return mls_context_cpy(newcontext, tcontext);
 -               }
 +               /* Use the process effective MLS attributes. */
 +               return mls_context_cpy_low(newcontext, scontext);
        default:
                return -EINVAL;
        }
--
Eamon Walsh <[email protected]>
National Security Agency
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

James Morris

2008-02-05 22:35 UTC #8 lore raw

Quoted 11 lines · Stephen Smalley

Quoted 1 line · Xavier Toth
Is this in rawhide, if not when will it be?
Not up to us, obviously. The patch is in Linus' git tree, but looks like latest fedora devel kernel is frozen on 2.6.24 + specific individual patches, not feeding from Linus' git presently. James could possibly ask the Fedora kernel maintainer about adding it - it is small, self-contained, and has no side effects on existing code (nothing prior to XSELinux uses the compute member support; pam_namespace usage was disabled since it didn't work right for multi-level dirs).

The rawhide kernel usually tracks Linus pretty closely -- perhaps wait a couple of days until people recover from LCA.

Quoted 59 lines

Quoted 58 lines · Eamon Walsh
Quoted 45 lines
This patch removes the requirement that the new and related object types
differ in order to polyinstantiate by MLS level. This allows MLS polyinstantiation to occur in the absence of explicit type_member rules or when the type has not changed.
Potential users of this support include pam_namespace.so (directory polyinstantiation) and the SELinux X support (property polyinstantiation).
Signed-off-by Eamon Walsh <[email protected]>
---
  mls.c |   11 ++---------
  1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c index fb5d70a..3bbcb53 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
                        /* Use the process effective MLS attributes. */
                        return mls_context_cpy_low(newcontext, scontext);
        case AVTAB_MEMBER:
 -               /* Only polyinstantiate the MLS attributes if
 -                  the type is being polyinstantiated */
 -               if (newcontext->type != tcontext->type) {
 -                       /* Use the process effective MLS attributes. */
 -                       return mls_context_cpy_low(newcontext, scontext);
 -               } else {
 -                       /* Use the related object MLS attributes. */
 -                       return mls_context_cpy(newcontext, tcontext);
 -               }
 +               /* Use the process effective MLS attributes. */
 +               return mls_context_cpy_low(newcontext, scontext);
        default:
                return -EINVAL;
        }
--
Eamon Walsh <[email protected]>
National Security Agency
Quoted 5 lines
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Signature · 7 lines

James Morris
<[email protected]>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2008-02-06 14:49 UTC #9 lore raw

Quoted 14 lines · James Morris

Quoted 11 lines · Stephen Smalley
Quoted 1 line · Xavier Toth
Is this in rawhide, if not when will it be?
Not up to us, obviously. The patch is in Linus' git tree, but looks like latest fedora devel kernel is frozen on 2.6.24 + specific individual patches, not feeding from Linus' git presently. James could possibly ask the Fedora kernel maintainer about adding it - it is small, self-contained, and has no side effects on existing code (nothing prior to XSELinux uses the compute member support; pam_namespace usage was disabled since it didn't work right for multi-level dirs).

Quoted 2 lines

The rawhide kernel usually tracks Linus pretty closely -- perhaps wait a couple of days until people recover from LCA.

Looks like they froze it on 2.6.24 (kernel.spec has released_kernel 1, gitrev 0 in Fedora devel CVS), and are only cherry picking individual patches, like the /proc/net fix for SELinux. Unless that was only for the Fedora 9 Alpha release and they'll re-open the flood gates soon?

If they don't start pulling from git again soon, we should likely take the specific patch to fedora kernel list.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2008-02-08 20:25 UTC #10 lore raw

Quoted 18 lines · Stephen Smalley

Quoted 14 lines · James Morris
Quoted 11 lines · Stephen Smalley
Quoted 1 line · Xavier Toth
Is this in rawhide, if not when will it be?
Not up to us, obviously. The patch is in Linus' git tree, but looks like latest fedora devel kernel is frozen on 2.6.24 + specific individual patches, not feeding from Linus' git presently. James could possibly ask the Fedora kernel maintainer about adding it - it is small, self-contained, and has no side effects on existing code (nothing prior to XSELinux uses the compute member support; pam_namespace usage was disabled since it didn't work right for multi-level dirs).
Quoted 2 lines
The rawhide kernel usually tracks Linus pretty closely -- perhaps wait a couple of days until people recover from LCA.

Quoted 7 lines

Looks like they froze it on 2.6.24 (kernel.spec has released_kernel 1, gitrev 0 in Fedora devel CVS), and are only cherry picking individual patches, like the /proc/net fix for SELinux. Unless that was only for the Fedora 9 Alpha release and they'll re-open the flood gates soon?
If they don't start pulling from git again soon, we should likely take the specific patch to fedora kernel list.

Latest rawhide kernel pulled in 2.6.24.1-rc1, so they seem to be stabilizing on 2.6.24.x rather than pulling from git again for Fedora 9. Which means we'll have to get the patch added explicitly if we want it in Fedora 9. Likely requires posting of the patch to fedora kernel list.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Eamon Walsh

author

2008-02-08 23:58 UTC #11 lore raw

Quoted 30 lines · Stephen Smalley

Quoted 19 lines · Stephen Smalley
Quoted 15 lines · James Morris
Quoted 4 lines · Stephen Smalley
Quoted 2 lines · Xavier Toth
Is this in rawhide, if not when will it be?
Quoted 8 lines
Not up to us, obviously. The patch is in Linus' git tree, but looks like latest fedora devel kernel is frozen on 2.6.24 + specific individual patches, not feeding from Linus' git presently. James could possibly ask the Fedora kernel maintainer about adding it - it is small, self-contained, and has no side effects on existing code (nothing prior to XSELinux uses the compute member support; pam_namespace usage was disabled since it didn't work right for multi-level dirs).
Quoted 2 lines
The rawhide kernel usually tracks Linus pretty closely -- perhaps wait a couple of days until people recover from LCA.
Quoted 8 lines
Looks like they froze it on 2.6.24 (kernel.spec has released_kernel 1, gitrev 0 in Fedora devel CVS), and are only cherry picking individual patches, like the /proc/net fix for SELinux. Unless that was only for the Fedora 9 Alpha release and they'll re-open the flood gates soon?
If they don't start pulling from git again soon, we should likely take the specific patch to fedora kernel list.

Quoted 6 lines

Latest rawhide kernel pulled in 2.6.24.1-rc1, so they seem to be stabilizing on 2.6.24.x rather than pulling from git again for Fedora 9. Which means we'll have to get the patch added explicitly if we want it in Fedora 9. Likely requires posting of the patch to fedora kernel list.

Please do get this pulled in if you can. Although, with the ongoing schedule slip in the X server, I'm wondering if Fedora 9 is even going to be able to ship a 1.4.1 point release, much less a 1.5 server that would include my stuff.

Signature · 8 lines

Eamon Walsh <[email protected]>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.