: patch to allow mount use kernel file descriptors

PATCH New Guido Trentalancia 4 participants 10 messages Feb 16, 2011 – Mar 4, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-02-16 06:42 UTC #0 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

This patch allows mount to use kernel file descriptors.

policy/modules/system/mount.te +1 -0

diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)

Christopher J. PeBenito

2011-02-28 15:05 UTC #1 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57

Quoted 13 lines · Guido Trentalancia

This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +1 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)

How did you come across this?

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-02-28 19:16 UTC #2 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 8 lines · Christopher J. PeBenito

Quoted 7 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +0 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 

Quoted 8 lines

policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 6 lines
policy/modules/system/mount.te +1 -0
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?

type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd

Regards,

Guido

Christopher J. PeBenito

2011-03-01 19:10 UTC #3 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 18 lines · Guido Trentalancia

Quoted 8 lines · Christopher J. PeBenito
Quoted 7 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +0 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
Quoted 8 lines
policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 6 lines
policy/modules/system/mount.te +1 -0
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?

Quoted 4 lines

type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd

Can you provide more detail? What was happening on the system?

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-03-01 21:08 UTC #4 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 19 lines · Christopher J. PeBenito

Quoted 18 lines · Guido Trentalancia
Quoted 16 lines · Christopher J. PeBenito
policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 13 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +1 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?

Quoted 6 lines

Quoted 4 lines
type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd
Can you provide more detail? What was happening on the system?

Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).

You could just drop it for the time being...

Regards,

Guido

Daniel J Walsh

2011-03-02 19:07 UTC #5 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 34 lines · Guido Trentalancia

Quoted 19 lines · Christopher J. PeBenito
Quoted 18 lines · Guido Trentalancia
Quoted 16 lines · Christopher J. PeBenito
policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 13 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +1 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?
Quoted 6 lines
Quoted 4 lines
type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd
Can you provide more detail? What was happening on the system?
Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).
You could just drop it for the time being...

Quoted 8 lines

Regards,
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout passes it to init, which passes it to initrc_t which passes it to mount_t. (init_t could pass it directly to mount_t).

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1ulXkACgkQrlYvE4MpobNlJACgjjGcF1kHsBNjZ2ns4Xz6HyRD 5J4AoNqkmm3Sx++tyOqpVORdXkL39sN6
=8pzm
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-03-02 19:47 UTC #6 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 39 lines · Daniel J Walsh

Quoted 38 lines · Guido Trentalancia
Quoted 19 lines · Christopher J. PeBenito
Quoted 18 lines · Guido Trentalancia
Quoted 16 lines · Christopher J. PeBenito
policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 13 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +1 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
 files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
 kernel_read_system_state(mount_t)
 kernel_read_kernel_sysctls(mount_t)
 kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?
Quoted 6 lines
Quoted 4 lines
type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd
Can you provide more detail? What was happening on the system?
Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).
You could just drop it for the time being...
Regards,
Guido

Quoted 8 lines

Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout passes it to init, which passes it to initrc_t which passes it to mount_t. (init_t could pass it directly to mount_t).

And mount_t uses it to print out messages such as "mount point /proc/bus/usb does not exist" very early during boot-up. Does this sound like a possible end of the story ?

Regards,

Guido

Christopher J. PeBenito

2011-03-03 13:39 UTC #7 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 36 lines · Guido Trentalancia

Quoted 35 lines · Daniel J Walsh
Quoted 33 lines · Guido Trentalancia
Quoted 19 lines · Christopher J. PeBenito
Quoted 18 lines · Guido Trentalancia
Quoted 16 lines · Christopher J. PeBenito
policy/modules/system/mount.te can_exec(mount_t, mount_exec_t) · line 57
Quoted 13 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
policy/modules/system/mount.te +1 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
  files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
  kernel_read_system_state(mount_t)
  kernel_read_kernel_sysctls(mount_t)
  kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?
Quoted 6 lines
Quoted 4 lines
type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd
Can you provide more detail? What was happening on the system?
Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).
You could just drop it for the time being...

Quoted 7 lines

Quoted 3 lines
I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout passes it to init, which passes it to initrc_t which passes it to mount_t. (init_t could pass it directly to mount_t).
And mount_t uses it to print out messages such as "mount point /proc/bus/usb does not exist" very early during boot-up. Does this sound like a possible end of the story ?

This scenario doesn't sound right to me. Why would the kernel be using a pty? I would expect it to be using /dev/console.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Daniel J Walsh

2011-03-03 13:49 UTC #8 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 48 lines · Christopher J. PeBenito

Quoted 47 lines · Guido Trentalancia
Quoted 45 lines · Daniel J Walsh
Quoted 32 lines · Guido Trentalancia
Quoted 31 lines · Christopher J. PeBenito
Quoted 29 lines · Guido Trentalancia
Quoted 14 lines · Christopher J. PeBenito
Quoted 13 lines · Guido Trentalancia
This patch allows mount to use kernel file descriptors.
diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te
---
refpolicy-git-15022011-test/policy/modules/system/mount.te
2011-02-16 02:34:33.253189215 +0100
+++
refpolicy-git-15022011-test-new/policy/modules/system/mount.te 2011-02-16
03:54:18.732023725 +0100
(quoted diff) +0 -0
@@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t)
 
Quoted 8 lines
Review can_exec(mount_t, mount_exec_t) · line 57
Quoted 6 lines
(quoted diff) +1 -0
  files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
 
+kernel_use_fds(mount_t)
  kernel_read_system_state(mount_t)
  kernel_read_kernel_sysctls(mount_t)
  kernel_dontaudit_getattr_core_if(mount_t)
How did you come across this?
type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429
comm="mount" path="/dev/pts/0" dev=devpts ino=3 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=fd
Quoted 8 lines
Quoted 1 line
Can you provide more detail? What was happening on the system?
Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).
You could just drop it for the time being...
I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout passes it to init, which passes it to initrc_t which passes it to mount_t. (init_t could pass it directly to mount_t).

Quoted 7 lines

Quoted 3 lines
And mount_t uses it to print out messages such as "mount point /proc/bus/usb does not exist" very early during boot-up. Does this sound like a possible end of the story ?
This scenario doesn't sound right to me. Why would the kernel be using a pty? I would expect it to be using /dev/console.

Maybe to talk to plymouth?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1vnFEACgkQrlYvE4MpobOo+ACgjM1WxvUhnyx6Fvuvo4x/4XVA oakAmwdoLNxGbf2QmV+Lv0+Hz0GQ7KwB
=OgrZ
-----END PGP SIGNATURE-----

Russell Coker

2011-03-04 06:54 UTC #9 lore raw

PATCH 32/34 : patch to allow mount use kernel file descriptors

Quoted 9 lines · Daniel J Walsh

Quoted 9 lines
Quoted 9 lines
Quoted 9 lines
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
+kernel_use_fds(mount_t)
Unfortunately I cannot provide more details now. I believe it's happening at boot-up. I am also quite sure it's not critical. And the only "uncommon" thing that I am using is the /sbin/mount.tmpfs script from Fedora (will be obsoleted soon by the way).
You could just drop it for the time being...

Quoted 7 lines

Quoted 7 lines
Quoted 4 lines
Quoted 3 lines
I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout passes it to init, which passes it to initrc_t which passes it to mount_t. (init_t could pass it directly to mount_t).
This scenario doesn't sound right to me. Why would the kernel be using a pty? I would expect it to be using /dev/console.

Sounds to me like the pty is being created before the policy is loaded. Everything that is done before the first policy load is run as "kernel" which becomes "kernel_t".

So the question is, why is that pty being leaked or why is a pty from before policy load hanging around until afterwards?

Signature · 2 lines

My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/