• Stephen Smalley's avatar
    selinux: support deferred mapping of contexts · 12b29f34
    Stephen Smalley authored
    Introduce SELinux support for deferred mapping of security contexts in
    the SID table upon policy reload, and use this support for inode
    security contexts when the context is not yet valid under the current
    policy.  Only processes with CAP_MAC_ADMIN + mac_admin permission in
    policy can set undefined security contexts on inodes.  Inodes with
    such undefined contexts are treated as having the unlabeled context
    until the context becomes valid upon a policy reload that defines the
    context.  Context invalidation upon policy reload also uses this
    support to save the context information in the SID table and later
    recover it upon a subsequent policy reload that defines the context
    again.
    
    This support is to enable package managers and similar programs to set
    down file contexts unknown to the system policy at the time the file
    is created in order to better support placing loadable policy modules
    in packages and to support build systems that need to create images of
    different distro releases with different policies w/o requiring all of
    the contexts to be defined or legal in the build host policy.
    
    With this patch applied, the following sequence is possible, although
    in practice it is recommended that this permission only be allowed to
    specific program domains such as the package manager.
    
    # rmdir baz
    # rm bar
    # touch bar
    # chcon -t foo_exec_t bar # foo_exec_t is not yet defined
    chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
    # mkdir -Z system_u:object_r:foo_exec_t baz
    mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
    # cat setundefined.te
    policy_module(setundefined, 1.0)
    require {
    	type unconfined_t;
    	type unlabeled_t;
    }
    files_type(unlabeled_t)
    allow unconfined_t self:capability2 mac_admin;
    # make -f /usr/share/selinux/devel/Makefile setundefined.pp
    # semodule -i setundefined.pp
    # chcon -t foo_exec_t bar # foo_exec_t is not yet defined
    # mkdir -Z system_u:object_r:foo_exec_t baz
    # ls -Zd bar baz
    -rw-r--r--  root root system_u:object_r:unlabeled_t    bar
    drwxr-xr-x  root root system_u:object_r:unlabeled_t    baz
    # cat foo.te
    policy_module(foo, 1.0)
    type foo_exec_t;
    files_type(foo_exec_t)
    # make -f /usr/share/selinux/devel/Makefile foo.pp
    # semodule -i foo.pp # defines foo_exec_t
    # ls -Zd bar baz
    -rw-r--r--  root root user_u:object_r:foo_exec_t       bar
    drwxr-xr-x  root root system_u:object_r:foo_exec_t    baz
    # semodule -r foo
    # ls -Zd bar baz
    -rw-r--r--  root root system_u:object_r:unlabeled_t    bar
    drwxr-xr-x  root root system_u:object_r:unlabeled_t    baz
    # semodule -i foo.pp
    # ls -Zd bar baz
    -rw-r--r--  root root user_u:object_r:foo_exec_t       bar
    drwxr-xr-x  root root system_u:object_r:foo_exec_t    baz
    # semodule -r setundefined foo
    # chcon -t foo_exec_t bar # no longer defined and not allowed
    chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
    # rmdir baz
    # mkdir -Z system_u:object_r:foo_exec_t baz
    mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
    Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    12b29f34
sidtab.c 5.28 KB