supporting RBACSEP in genhomedircon

Treat a users prefix like a mapping to the role for file context specifications in users homedirs. This behavior is only applicable when the users prefix is the identifier of a role which is valid for the given user. If the prefix is not a valid role, then genhomedircon will write contexts out as normal.

Additionally, this commit enables configuring RBACSEP in policy:

(tunableif enable_rbacsep
(true
(userprefix user_u user_r)
(false
(userprefix user_u object_r))))

Signed-off-by Gary Tierney <[email protected]>

---
 libsemanage/src/genhomedircon.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

libsemanage/src/genhomedircon.c +35 -3

index 3fc9e7a..0dd2b29 100644
@@ -100,6 +100,7 @@ typedef struct user_entry {
 	char *home;
 	char *level;
 	char *login;
+	char *homedir_role;
 	struct user_entry *next;
 } genhomedircon_user_entry_t;
 

@@ -177,6 +178,13 @@ static int ignore(const char *homedir) {
 	return 0;
 }
 
+static int prefix_is_homedir_role(const semanage_user_t *user,
+				  const char *prefix)
+{
+	return strcmp(OBJECT_R, prefix) == 0 ||
+		semanage_user_has_role(user, prefix);
+}
+
 static semanage_list_t *default_shell_list(void)
 {
 	semanage_list_t *list = NULL;

@@ -638,6 +646,11 @@ static int write_contexts(genhomedircon_settings_t *s, FILE *out,
 			goto fail;
 		}
 
+		if (user->homedir_role &&
+		    sepol_context_set_role(sepolh, context, user->homedir_role) < 0) {
+			goto fail;
+		}
+
 		if (sepol_context_to_string(sepolh, context,
 					    &new_context_str) < 0) {
 			goto fail;

@@ -756,7 +769,7 @@ static int name_user_cmp(char *key, semanage_user_t ** val)
 static int push_user_entry(genhomedircon_user_entry_t ** list, const char *n,
 			   const char *u, const char *g, const char *sen,
 			   const char *pre, const char *h, const char *l,
-			   const char *ln)
+			   const char *ln, const char *hd_role)
 {
 	genhomedircon_user_entry_t *temp = NULL;
 	char *name = NULL;

@@ -767,6 +780,7 @@ static int push_user_entry(genhomedircon_user_entry_t ** list, const char *n,
 	char *home = NULL;
 	char *level = NULL;
 	char *lname = NULL;
+	char *homedir_role = NULL;
 
 	temp = malloc(sizeof(genhomedircon_user_entry_t));
 	if (!temp)

@@ -795,6 +809,11 @@ static int push_user_entry(genhomedircon_user_entry_t ** list, const char *n,
 	lname = strdup(ln);
 	if (!lname)
 		goto cleanup;
+	if (hd_role) {
+		homedir_role = strdup(hd_role);
+		if (!homedir_role)
+			goto cleanup;
+	}
 
 	temp->name = name;
 	temp->uid = uid;

@@ -804,6 +823,7 @@ static int push_user_entry(genhomedircon_user_entry_t ** list, const char *n,
 	temp->home = home;
 	temp->level = level;
 	temp->login = lname;
+	temp->homedir_role = homedir_role;
 	temp->next = (*list);
 	(*list) = temp;
 

@@ -818,6 +838,7 @@ static int push_user_entry(genhomedircon_user_entry_t ** list, const char *n,
 	free(home);
 	free(level);
 	free(lname);
+	free(homedir_role);
 	free(temp);
 	return STATUS_ERR;
 }

@@ -839,6 +860,7 @@ static void pop_user_entry(genhomedircon_user_entry_t ** list)
 	free(temp->home);
 	free(temp->level);
 	free(temp->login);
+	free(temp->homedir_role);
 	free(temp);
 }
 

@@ -852,6 +874,7 @@ static int setup_fallback_user(genhomedircon_settings_t * s)
 	const char *seuname = NULL;
 	const char *prefix = NULL;
 	const char *level = NULL;
+	const char *homedir_role = NULL;
 	unsigned int i;
 	int retval;
 	int errors = 0;

@@ -886,10 +909,14 @@ static int setup_fallback_user(genhomedircon_settings_t * s)
 					level = FALLBACK_LEVEL;
 			}
 
+			if (prefix_is_homedir_role(u, prefix)) {
+				homedir_role = prefix;
+			}
+
 			if (push_user_entry(&(s->fallback), FALLBACK_NAME,
 					    FALLBACK_UIDGID, FALLBACK_UIDGID,
 					    seuname, prefix, "", level,
-					    FALLBACK_NAME) != 0)
+					    FALLBACK_NAME, homedir_role) != 0)
 				errors = STATUS_ERR;
 			semanage_user_key_free(key);
 			if (u)

@@ -946,6 +973,7 @@ static int add_user(genhomedircon_settings_t * s,
 	struct passwd pwstorage, *pwent = NULL;
 	const char *prefix = NULL;
 	const char *level = NULL;
+	const char *homedir_role = NULL;
 	char uid[11];
 	char gid[11];
 

@@ -969,6 +997,10 @@ static int add_user(genhomedircon_settings_t * s,
 		level = FALLBACK_LEVEL;
 	}
 
+	if (prefix_is_homedir_role(user, prefix)) {
+		homedir_role = prefix;
+	}
+
 	retval = getpwnam_r(name, &pwstorage, rbuf, rbuflen, &pwent);
 	if (retval != 0 || pwent == NULL) {
 		if (retval != 0 && retval != ENOENT) {

@@ -1010,7 +1042,7 @@ static int add_user(genhomedircon_settings_t * s,
 	}
 
 	retval = push_user_entry(head, name, uid, gid, sename, prefix,
-				pwent->pw_dir, level, selogin);
+				pwent->pw_dir, level, selogin, homedir_role);
 cleanup:
 	free(rbuf);
 	return retval;

New version of the previous genhomedircon-rbacsep patch with some changes. A bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working with both RBACSEP and non-RBACEP:
https://tfirg.asu.su/2016/10/03/garys-patches/

There are still some rough edges though, for example in policy you can't write a statement like: (userprefix id role) and put it in an abstract namespace, since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id might even just be id here, haven't checked if users are expanded or also taken as literals].

Though this is something I can look at later if all is well here.

[1] https://github.com/SELinuxProject/selinux/blob/master/libsemanage/src/genhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

New version of the previous genhomedircon-rbacsep patch with some changes. A bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working with both RBACSEP and non-RBACEP:
https://tfirg.asu.su/2016/10/03/garys-patches/

There are still some rough edges though, for example in policy you can't write a statement like: (userprefix id role) and put it in an abstract namespace, since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id might even just be id here, haven't checked if users are expanded or also taken as literals].

Though this is something I can look at later if all is well here.

[1] https://github.com/SELinuxProject/selinux/blob/master/libsemanage/src/genhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

New version of the previous genhomedircon-rbacsep patch with some changes. A bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working with both RBACSEP and non-RBACEP:
https://tfirg.asu.su/2016/10/03/garys-patches/

There are still some rough edges though, for example in policy you can't write a statement like: (userprefix id role) and put it in an abstract namespace, since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id might even just be id here, haven't checked if users are expanded or also taken as literals].

Though this is something I can look at later if all is well here.

[1] https://github.com/SELinuxProject/selinux/blob/master/libsemanage/src/genhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

Quoted 37 lines · Gary Tierney

New version of the previous genhomedircon-rbacsep patch with some changes. A
bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info
messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working
with both RBACSEP and non-RBACEP:
https://tfirg.asu.su/2016/10/03/garys-patches/

There are still some rough edges though, for example in policy you can't write a
statement like: (userprefix id role) and put it in an abstract namespace, since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

Quoted 9 lines

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id
might even just be id here, haven't checked if users are expanded or also taken
as literals].

Users are fully qualified, so it is "wheel.id". It is true though that "role" in "(userprefix id role)" is taken as a string and is not expanded. The only identifiers that are fully qualified are those that will exist in the kernel policy and are stored in symbol tables.

To get what you want you need to write:

(block usersubj
(blockabstract usersubj)
(user id)
(userlevel id (SENS))
(userrange id ((SENS)(SENS (CAT))))
(role role)
(userrole id role))

(block wheel
(blockinherit usersubj))

(userprefix wheel.id wheel.role)

which is inconvenient. It seems to me that if the userprefix statement is allowed in a block, then it makes sense to fully qualify it, but I tend to see the prefix as a string, so it would make more sense to me to just not allow it in blocks.

This makes more sense in the following example.

(block userdecl
(blockabstract userdecl)
(user u)
(userlevel u (SENS))
(userrange u ((SENS) (SENS (CAT))))
(role r)
(userrole u r))

(block user
(blockinherit userdecl))

(userprefix user.u user)

Where user is acting like a true prefix for user user.u and role user.r.

Jim

Quoted 13 lines

Though this is something I can look at later if all is well here.

[1]
https://github.com/SELinuxProject/selinux/blob/master/libsemanage/src/genhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38
+++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

Quoted 68 lines · James Carter

Quoted 37 lines · Gary Tierney

New version of the previous genhomedircon-rbacsep patch with some changes. A
bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info
messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working
with both RBACSEP and non-RBACEP:
https://tfirg.asu.su/2016/10/03/garys-patches/

There are still some rough edges though, for example in policy you can't write a
statement like: (userprefix id role) and put it in an abstract namespace, since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

Quoted 9 lines

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id
might even just be id here, haven't checked if users are expanded or also taken
as literals].

Users are fully qualified, so it is "wheel.id". It is true though that "role" in "(userprefix id role)" is taken as a string and is not expanded. The only identifiers that are fully qualified are those that will exist in the kernel policy and are stored in symbol tables.

To get what you want you need to write:

(block usersubj
(blockabstract usersubj)
(user id)
(userlevel id (SENS))
(userrange id ((SENS)(SENS (CAT))))
(role role)
(userrole id role))

(block wheel
(blockinherit usersubj))

(userprefix wheel.id wheel.role)

Quoted 4 lines

which is inconvenient. It seems to me that if the userprefix statement is allowed in a block, then it makes sense to fully qualify it, but I tend to see the prefix as a string, so it would make more sense to me to just not allow it in blocks.

It use to be a string, but that is no longer true with this patch. It is a role now. In my view it should be treated as such

Quoted 12 lines

This makes more sense in the following example.

(block userdecl
(blockabstract userdecl)
(user u)
(userlevel u (SENS))
(userrange u ((SENS) (SENS (CAT))))
(role r)
(userrole u r))

Quoted 25 lines

(block user
(blockinherit userdecl))

(userprefix user.u user)

Where user is acting like a true prefix for user user.u and role user.r.

Jim

Quoted 13 lines

Though this is something I can look at later if all is well here.

[1]
https://github.com/SELinuxProject/selinux/blob/master/libsemanage/src/genhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38
+++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected].
To get help, send an email containing "help" to [email protected].

Quoted 76 lines · Dominick Grift

Quoted 74 lines · James Carter

Quoted 39 lines · Gary Tierney

New version of the previous genhomedircon-rbacsep patch with some changes. A
bit of a delay as I had to get in a libsepol/cil fix which was blocking this.

1. Remove semanage.conf option
2. Drop unrelated change
3. Adds a new homedir_role member to the genhomedircon_user struct.
4. Sets homedir_role if the SELinux users prefix is a valid role for that user.
5. Replaces all roles with homedir_role in context specifications if homedir_role is set.

One issue that came up when writing these patches is that genhomedircon squashes logging [1] for some reason, which can result in no warning / info
messages and an empty file_contexts.homedirs file if policy has been incorrectly configured. Can we get rid of this behavior or add a flag to
conditionally enable logging?

Dominick Grift helpfully created some test images that demo DSSP policy working
with both RBACSEP and non-RBACEP:
https://secure-web.cisco.com/1em6l9je6cqcAfGQVqhiZiKLtU_K4PYkUi5VPpxqpiJ0xFDQJUnis-aED9BTadea2qheKi_0jaAflaiNJ6ocv9AJLowENdrpAIfdNAmv61QfkK7Qr23GGrqF2O80Zrc4fxNfK-JxffEi4s972g2yKtY3E2AE9JvP0FUv-DoidzmJjIO3AmbLgIXJjwVrcqLGn0zgqLpR7qomQI0GXEJt4Rasx3UCy7RWTLj_lBAwSJyl2pLwGqs6DnQpmhT5ne2upcAdAZdU8dxQmnXEHIokDLdfHJXySjUj9CFBW1-Tk_ao/https%3A%2F%2Ftfirg.asu.su%2F2016%2F10%2F03%2Fgarys-patches%2F

There are still some rough edges though, for example in policy you can't write a
statement like: (userprefix id role) and put it in an abstract namespace,
since it is interpreted as a literal:

(block usersubj
(blockabstract usersubj)
(user id)
(role role)
(userrole id role)
(userprefix id role))

Quoted 9 lines

(block wheel
(blockinherit usersubj))

Which leaves us with a (userid, prefix) tuple of (wheel.id, role) [wheel.id
might even just be id here, haven't checked if users are expanded or also taken
as literals].

Users are fully qualified, so it is "wheel.id". It is true though that "role" in "(userprefix id role)" is taken as a string and is not expanded. The only identifiers that are fully qualified are those that will exist in the kernel policy and are stored in symbol tables.

To get what you want you need to write:

(block usersubj
(blockabstract usersubj)
(user id)
(userlevel id (SENS))
(userrange id ((SENS)(SENS (CAT))))
(role role)
(userrole id role))

(block wheel
(blockinherit usersubj))

(userprefix wheel.id wheel.role)

which is inconvenient. It seems to me that if the userprefix statement is allowed in a block, then it makes sense to fully qualify it, but I tend to see the prefix as a string, so it would make more sense to me to just not allow it in blocks.

Quoted 2 lines

It use to be a string, but that is no longer true with this patch. It is a role now. In my view it should be treated as such

This patch does not exactly make it a role. It treats it as a role if the prefix matches a valid role. The CIL compiler cannot assume that the prefix is a role. CIL could check to see if the prefix matches a role and fully qualify it if it does, but if it didn't match then it wouldn't be fully qualified and that doesn't seem like the desired behavior.

Jim

Quoted 49 lines

Quoted 12 lines

This makes more sense in the following example.

(block userdecl
(blockabstract userdecl)
(user u)
(userlevel u (SENS))
(userrange u ((SENS) (SENS (CAT))))
(role r)
(userrole u r))

Quoted 26 lines

(block user
(blockinherit userdecl))

(userprefix user.u user)

Where user is acting like a true prefix for user user.u and role user.r.

Jim

Quoted 14 lines

Though this is something I can look at later if all is well here.

[1]
https://secure-web.cisco.com/1iokgtqyM7Itorx97YhxU8Y8BPLgnjhdbqw6zxi_8hNknLJZx7ewWbWlxADD-Yf0luWHa_y6s01T-ngCV3fJ_U6nEqsvl6lXoXC2dm2zkY0pNleYg5DKjNMpcc60QnNRbO6XqutpZW0wqX0S6P_71J-E8rijBcVKVU0Jn35ArI4axuTiHzajjpc7GNh7r-8CZ-nPQDDMhNpo8JAm79rLCLLMe6hIKimqLzrvU8zvY4VDs1MqXVTLK0OXmfHGle_Y1/https%3A%2F%2Fgithub.com%2FSELinuxProject%2Fselinux%2Fblob%2Fmaster%2Flibsemanage%2Fsrc%2Fgenhomedircon.c#L568-L572

Gary Tierney (1):
genhomedircon: use userprefix as the role for homedir content

 libsemanage/src/genhomedircon.c | 38
+++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to [email protected].