Linux-Fsdevel Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Daniel Burgener <dburgener@linux.microsoft.com>
To: selinux@vger.kernel.org
Cc: stephen.smalley.work@gmail.com, omosnace@redhat.com,
	paul@paul-moore.com, linux-fsdevel@vger.kernel.org,
	viro@zeniv.linux.org.uk
Subject: [PATCH v3 0/4] Update SELinuxfs out of tree and then swapover
Date: Wed, 19 Aug 2020 15:59:31 -0400	[thread overview]
Message-ID: <20200819195935.1720168-1-dburgener@linux.microsoft.com> (raw)

v2: Clean up commit messages to accurately reflect current scope of
changes
v3: Remove all policy_capabilities directory manipulation.  Switch from
vfs_rename() to d_exchange() for directory exchanging.  Use appropriate
comment style.  Reuse inodes for temporary directories.

In the current implementation, on policy load /sys/fs/selinux is updated
by deleting the previous contents of
/sys/fs/selinux/{class,booleans} and then recreating them.  This means
that there is a period of time when the contents of these directories do
not exist which can cause race conditions as userspace relies on them for
information about the policy.  In addition, it means that error recovery
in the event of failure is challenging.

This patch series follows the design outlined by Al Viro in a previous
e-mail to the list[1].  This approach is to first create the new
directory structures out of tree, then to perform the swapover, and
finally to delete the old directories.  Not handled in this series is
error recovery in the event of failure.

Error recovery in the selinuxfs recreation is unhandled in the current
code, so this series will not cause any regression in this regard.
Handling directory recreation in this manner is a prerequisite to make
proper error handling possible.

In order to demonstrate the race condition that this series fixes, you
can use the following commands:

while true; do cat /sys/fs/selinux/class/service/perms/status
>/dev/null; done &
while true; do load_policy; done;

In the existing code, this will display errors fairly often as the class
lookup fails.  (In normal operation from systemd, this would result in a
permission check which would be allowed or denied based on policy settings
around unknown object classes.) After applying this patch series you
should expect to no longer see such error messages.

This series is relative to https://patchwork.kernel.org/patch/11705743/,
Stephen Smalley's series to split policy loading into a prep and commit.

[1] https://lore.kernel.org/selinux/20181002155810.GP32577@ZenIV.linux.org.uk/

Daniel Burgener (4):
  selinux: Create function for selinuxfs directory cleanup
  selinux: Refactor selinuxfs directory populating functions
  selinux: Standardize string literal usage for selinuxfs directory
    names
  selinux: Create new booleans and class dirs out of tree

 security/selinux/selinuxfs.c | 190 +++++++++++++++++++++++++++--------
 1 file changed, 148 insertions(+), 42 deletions(-)

-- 
2.25.4


             reply	other threads:[~2020-08-19 19:59 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-19 19:59 Daniel Burgener [this message]
2020-08-19 19:59 ` [PATCH v3 1/4] selinux: Create function for selinuxfs directory cleanup Daniel Burgener
2020-08-20 14:53   ` Stephen Smalley
2020-08-21 13:43   ` Paul Moore
2020-08-19 19:59 ` [PATCH v3 2/4] selinux: Refactor selinuxfs directory populating functions Daniel Burgener
2020-08-20 14:55   ` Stephen Smalley
2020-08-21 13:43   ` Paul Moore
2020-08-19 19:59 ` [PATCH v3 3/4] selinux: Standardize string literal usage for selinuxfs directory names Daniel Burgener
2020-08-20 14:56   ` Stephen Smalley
2020-08-21 13:44   ` Paul Moore
2020-08-19 19:59 ` [PATCH v3 4/4] selinux: Create new booleans and class dirs out of tree Daniel Burgener
2020-08-20 15:23   ` Stephen Smalley
2020-08-21 13:44   ` Paul Moore

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200819195935.1720168-1-dburgener@linux.microsoft.com \
    --to=dburgener@linux.microsoft.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=omosnace@redhat.com \
    --cc=paul@paul-moore.com \
    --cc=selinux@vger.kernel.org \
    --cc=stephen.smalley.work@gmail.com \
    --cc=viro@zeniv.linux.org.uk \
    --subject='Re: [PATCH v3 0/4] Update SELinuxfs out of tree and then swapover' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).