Give access to /proc/sys/vm/overcommit_memory to all domains

PATCH Superseded Vincent Brillault 3 participants 9 messages Aug 2, 2014 – Aug 14, 2014

lore

Share & tools

lore

Vincent Brillault

author

2014-08-02 18:35 UTC #0 lore raw

cover Give access to /proc/sys/vm/overcommit_memory to all domains

Dear all,

Since a "recent" change in glibc (https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb583c0e585e83a01253299afed9ea9a11), a lot of different domains try to read /proc/sys/vm/overcommit_memory. This generates a lot of AVC like the following:
allow * sysctl_vm_t:dir search;
allow * sysctl_vm_t:file { read open };

This access seems to be useless unless /proc/sys/vm/overcommit_memory contains '2', so the denials probably don't hurt, but I see no reason not to allow this access. More details can be found on https://bugzilla.redhat.com/show_bug.cgi?id=872729
The first patch is directly taken from the fedora policy, I only rebased it (and added a comment)

Cheers,
Vincent Brillault

Vincent Brillault

author

2014-08-02 18:35 UTC #1 lore raw

PATCH 1/2 Allow all domains to read /proc/sys/vm/overcommit_memory

From: Vincent Brillault <[email protected]>

glibc malloc read this file since commit 9fab36eb
(https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb)

Patch adapted from commit 343c0887514718387f36ee8ead2b941ba9bfb894 on fedora selinux-policy made by Dan Walsh <[email protected]>

---
 policy/modules/kernel/domain.te |  4 +++
 policy/modules/kernel/kernel.if | 57 +++++++++++++++++++++++++++++++++++++++++
 policy/modules/kernel/kernel.te |  4 +++
 3 files changed, 65 insertions(+)

policy/modules/kernel/domain.te +4 -0

index 4af7dbd..b95c75d 100644
@@ -99,6 +99,10 @@ allow domain self:process { fork sigchld };
 # glibc get_nprocs requires read access to /sys/devices/system/cpu/online
 dev_read_cpu_online(domain)
 
+# glibc malloc requires access to /proc/sys/vm/overcommit_memory
+# see https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb
+kernel_read_vm_overcommit_sysctls(domain)
+
 # Use trusted objects in /dev
 dev_rw_null(domain)
 dev_rw_zero(domain)

policy/modules/kernel/kernel.if +57 -0

60 lines not on this page · raw message

policy/modules/kernel/kernel.te +4 -0

index 5d6da7f..ca50f10 100644
@@ -153,6 +153,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
 type sysctl_vm_t, sysctl_type;
 genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
 
+# /proc/sys/vm/overcommit_memory
+type sysctl_vm_overcommit_t, sysctl_type;
+genfscon proc /sys/vm/overcommit_memory gen_context(system_u:object_r:sysctl_vm_overcommit_t,s0)
+
 # /proc/sys/dev directory and files
 type sysctl_dev_t, sysctl_type;
 genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)

Signature · 1 line

1.8.5.5

Vincent Brillault

author

2014-08-02 18:35 UTC #2 lore raw

PATCH 2/2 Extend kernel_search_*_overcommit_sysctl search

In reply to Vincent Brillault

From: Vincent Brillault <[email protected]>

When going to /proc/sys/vm/overcommit_memory, passing through /proc/sys/vm, i-e sysctl_vm_t, is required

---
 policy/modules/kernel/kernel.if | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

policy/modules/kernel/kernel.if +7 -7

index 122d560..4ba431a 100644
@@ -3222,10 +3222,10 @@ interface(`kernel_unconfined',`
 #
 interface(`kernel_search_vm_overcommit_sysctl',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_overcommit_t)
+	search_dirs_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_overcommit_t)
 ')
 
 ########################################

@@ -3241,10 +3241,10 @@ interface(`kernel_search_vm_overcommit_sysctl',`
 #
 interface(`kernel_read_vm_overcommit_sysctls',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
 ')
 
 ########################################

@@ -3260,9 +3260,9 @@ interface(`kernel_read_vm_overcommit_sysctls',`
 #
 interface(`kernel_rw_vm_overcommit_sysctls',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
-	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_overcommit_t)
+	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+	list_dirs_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_overcommit_t)
 ')

Signature · 1 line

1.8.5.5

Vincent Brillault

author

2014-08-02 18:47 UTC #3 lore raw

v2 cover Give access to /proc/sys/vm/overcommit_memory to all domains

In reply to Vincent Brillault

This v2 fixes the author of the first commit (which was lost as I played too much with the "From" headers)

Cheers,
Vincent Brillault

Vincent Brillault

author

2014-08-02 18:47 UTC #4 lore raw

PATCH v2 1/2 Allow all domains to read /proc/sys/vm/overcommit_memory

From: Dan Walsh <[email protected]>

glibc malloc read this file since commit 9fab36eb
(https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb)

Patch adapted from commit 343c0887514718387f36ee8ead2b941ba9bfb894 on fedora selinux-policy

Signed-off-by Vincent Brillault <[email protected]>

---
 policy/modules/kernel/domain.te |  4 +++
 policy/modules/kernel/kernel.if | 57 +++++++++++++++++++++++++++++++++++++++++
 policy/modules/kernel/kernel.te |  4 +++
 3 files changed, 65 insertions(+)

policy/modules/kernel/domain.te +4 -0

index 4af7dbd..b95c75d 100644
@@ -99,6 +99,10 @@ allow domain self:process { fork sigchld };
 # glibc get_nprocs requires read access to /sys/devices/system/cpu/online
 dev_read_cpu_online(domain)
 
+# glibc malloc requires access to /proc/sys/vm/overcommit_memory
+# see https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb
+kernel_read_vm_overcommit_sysctls(domain)
+
 # Use trusted objects in /dev
 dev_rw_null(domain)
 dev_rw_zero(domain)

policy/modules/kernel/kernel.if +57 -0

60 lines not on this page · raw message

policy/modules/kernel/kernel.te +4 -0

index 7fe10c3..150d2ea 100644
@@ -153,6 +153,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
 type sysctl_vm_t, sysctl_type;
 genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
 
+# /proc/sys/vm/overcommit_memory
+type sysctl_vm_overcommit_t, sysctl_type;
+genfscon proc /sys/vm/overcommit_memory gen_context(system_u:object_r:sysctl_vm_overcommit_t,s0)
+
 # /proc/sys/dev directory and files
 type sysctl_dev_t, sysctl_type;
 genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)

Signature · 1 line

1.8.5.5

Christopher J. PeBenito

2014-08-14 19:29 UTC #5 lore raw

PATCH v2 1/2 Allow all domains to read /proc/sys/vm/overcommit_memory

Quoted 20 lines · Vincent Brillault

From: Dan Walsh <[email protected]>
glibc malloc read this file since commit 9fab36eb
(https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb)
Patch adapted from commit 343c0887514718387f36ee8ead2b941ba9bfb894 on fedora selinux-policy
Signed-off-by Vincent Brillault <[email protected]>
---
 policy/modules/kernel/domain.te |  4 +++
 policy/modules/kernel/kernel.if | 57 +++++++++++++++++++++++++++++++++++++++++
 policy/modules/kernel/kernel.te |  4 +++
 3 files changed, 65 insertions(+)
policy/modules/kernel/domain.te +0 -0
index 4af7dbd..b95c75d 100644

policy/modules/kernel/domain.te allow domain self:process { fork sigchld }; · line 104

Quoted 6 lines

policy/modules/kernel/domain.te +3 -0

@@ -99,6 +99,10 @@ allow domain self:process { fork sigchld };
 # glibc get_nprocs requires read access to /sys/devices/system/cpu/online
 dev_read_cpu_online(domain)
 
+# glibc malloc requires access to /proc/sys/vm/overcommit_memory
+# see https://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb
+kernel_read_vm_overcommit_sysctls(domain)

This set of lines should go higher than dev_read_cpu_online().

Quoted 7 lines

policy/modules/kernel/domain.te +7 -0

+interface(`kernel_read_vm_overcommit_sysctls',`
+	gen_require(`
+		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+	')
+
+	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+')

[...]

policy/modules/kernel/domain.te

Quoted 8 lines

policy/modules/kernel/domain.te +8 -0

+interface(`kernel_rw_vm_overcommit_sysctls',`
+	gen_require(`
+		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+	')
+
+	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_overcommit_t)
+')

These two interfaces are overspecified. sysctl_vm_overcommit_t shouldn't be included in the second parameter of the patterns (read_files_pattern and rw_files_pattern) since the type is never used on a directory.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2014-08-14 19:47 UTC #6 lore raw

PATCH v2 1/2 Allow all domains to read /proc/sys/vm/overcommit_memory

Quoted 5 lines · Christopher J. PeBenito

These two interfaces are overspecified. sysctl_vm_overcommit_t shouldn't be included in the second parameter of the patterns (read_files_pattern and rw_files_pattern) since the type is never used on a directory.

I do not like associating these "secondary" rules with an type attribute as fundamental as domain.

domain type attribute is fundamental to the policy due to the neverallow rules that are associated with it.

I want to be able to create "domains" that respect the neverallow rule but i do not want to be forced to use these "secondary" rules.

Christopher J. PeBenito

2014-08-14 19:59 UTC #7 lore raw

PATCH v2 1/2 Allow all domains to read /proc/sys/vm/overcommit_memory

Quoted 10 lines · Dominick Grift

Quoted 5 lines · Christopher J. PeBenito
These two interfaces are overspecified. sysctl_vm_overcommit_t shouldn't be included in the second parameter of the patterns (read_files_pattern and rw_files_pattern) since the type is never used on a directory.
I do not like associating these "secondary" rules with an type attribute as fundamental as domain.

I don't understand what you mean by "secondary". If all domains (at least all those linked with glibc, which is usually all) require this access, how is it secondary?

Quoted 5 lines

domain type attribute is fundamental to the policy due to the neverallow rules that are associated with it.
I want to be able to create "domains" that respect the neverallow rule but i do not want to be forced to use these "secondary" rules.

What neverallow is violated with these rules?

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Vincent Brillault

author

2014-08-02 18:47 UTC #8 lore raw

PATCH v2 2/2 Extend kernel_search_*_overcommit_sysctl search

In reply to Vincent Brillault

From: Vincent Brillault <[email protected]>

When going to /proc/sys/vm/overcommit_memory, passing through /proc/sys/vm, i-e sysctl_vm_t, is required

---
 policy/modules/kernel/kernel.if | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

policy/modules/kernel/kernel.if +7 -7

index 54e3aef..425db84 100644
@@ -3204,10 +3204,10 @@ interface(`kernel_unconfined',`
 #
 interface(`kernel_search_vm_overcommit_sysctl',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_overcommit_t)
+	search_dirs_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_overcommit_t)
 ')
 
 ########################################

@@ -3223,10 +3223,10 @@ interface(`kernel_search_vm_overcommit_sysctl',`
 #
 interface(`kernel_read_vm_overcommit_sysctls',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
 ')
 
 ########################################

@@ -3242,9 +3242,9 @@ interface(`kernel_read_vm_overcommit_sysctls',`
 #
 interface(`kernel_rw_vm_overcommit_sysctls',`
 	gen_require(`
-		type proc_t, sysctl_t, sysctl_vm_overcommit_t;
+		type proc_t, sysctl_t, sysctl_vm_t, sysctl_vm_overcommit_t;
 	')
 
-	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
-	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_overcommit_t)
+	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_t sysctl_vm_overcommit_t }, sysctl_vm_overcommit_t)
+	list_dirs_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_overcommit_t)
 ')

Signature · 1 line

1.8.5.5