lkml.org 
[lkml]   [2022]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX
From
On 2/8/2022 09:17, William Roberts wrote:
> <snip>
>
> This is getting too long for me.
>
>>>
>>> I don't have a strong opinion either way. If one were to allow this
>>> using a policy rule, it would result in a major policy breakage. The
>>> rule would turn on extended perm checks across the entire system,
>>> which the SELinux Reference Policy isn't written for. I can't speak
>>> to the Android policy, but I would imagine it would be the similar
>>> problem there too.
>>
>> Excuse me if I am wrong but AFAIK adding a xperm rule does not turn on
>> xperm checks across the entire system.
>
> It doesn't as you state below its target + class.
>
>>
>> If i am not mistaken it will turn on xperm checks only for the
>> operations that have the same source and target/target class.
>
> That's correct.

Just to clarify (Demi Marie also mentioned this earlier in the thread),
what I originally meant was how to emulate this patch by using policy
rules means you need a rule that allows the two ioctls on all domains
for all objects. That results in xperms checks enabled everywhere.


>> This is also why i don't (with the exception TIOSCTI for termdev
>> chr_file) use xperms by default.
>>
>> 1. it is really easy to selectively filter ioctls by adding xperm rules
>> for end users (and since ioctls are often device/driver specific they
>> know best what is needed and what not)
>
>>>>> and FIONCLEX can be trivially bypassed unless fcntl(F_SETFD)
>>
>> 2. if you filter ioctls in upstream policy for example like i do with
>> TIOSCTI using for example (allowx foo bar (ioctl chr_file (not
>> (0xXXXX)))) then you cannot easily exclude additional ioctls later where source is
>> foo and target/tclass is bar/chr_file because there is already a rule in
>> place allowing the ioctl (and you cannot add rules)
>
> Currently, fcntl flag F_SETFD is never checked, it's silently allowed, but
> the equivalent FIONCLEX and FIOCLEX are checked. So if you wrote policy
> to block the FIO*CLEX flags, it would be bypassable through F_SETFD and
> FD_CLOEXEC. So the patch proposed makes the FIO flags behave like
> F_SETFD. Which means upstream policy users could drop this allow, which
> could then remove the target/class rule and allow all icotls. Which is easy
> to prevent and fix you could be a rule in to allowx 0 as documented in the
> wiki: https://selinuxproject.org/page/XpermRules
>
> The questions I think we have here are:
> 1. Do we agree that the behavior between SETFD and the FIO flags are equivalent?
> I think they are.
> 2. Do we want the interfaces to behave the same?
> I think they should.

If you can bypass FIONCLEX and FIOCLEX checks by F_SETFD and FD_CLOEXEC,
then I agree that the two FIO checks don't have value and can be skipped
as F_SETFD is.

> 3. Do upstream users of the policy construct care?
> The patch is backwards compat, but I don't want their to be cruft
> floating around with extra allowxperm rules.

Reference policy does not have any xperm rules at this time. I looked
at the Fedora policy, and that doesn't have any.



--
Chris PeBenito

\
 
 \ /
  Last update: 2022-02-08 16:48    [W:0.136 / U:1.984 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site