Messages in this thread | | | Date | Tue, 8 Feb 2022 10:47:44 -0500 | Subject | Re: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX | From | Chris PeBenito <> |
| |
On 2/8/2022 09:17, William Roberts wrote: > <snip> > > This is getting too long for me. > >>> >>> I don't have a strong opinion either way. If one were to allow this >>> using a policy rule, it would result in a major policy breakage. The >>> rule would turn on extended perm checks across the entire system, >>> which the SELinux Reference Policy isn't written for. I can't speak >>> to the Android policy, but I would imagine it would be the similar >>> problem there too. >> >> Excuse me if I am wrong but AFAIK adding a xperm rule does not turn on >> xperm checks across the entire system. > > It doesn't as you state below its target + class. > >> >> If i am not mistaken it will turn on xperm checks only for the >> operations that have the same source and target/target class. > > That's correct.
Just to clarify (Demi Marie also mentioned this earlier in the thread), what I originally meant was how to emulate this patch by using policy rules means you need a rule that allows the two ioctls on all domains for all objects. That results in xperms checks enabled everywhere.
>> This is also why i don't (with the exception TIOSCTI for termdev >> chr_file) use xperms by default. >> >> 1. it is really easy to selectively filter ioctls by adding xperm rules >> for end users (and since ioctls are often device/driver specific they >> know best what is needed and what not) > >>>>> and FIONCLEX can be trivially bypassed unless fcntl(F_SETFD) >> >> 2. if you filter ioctls in upstream policy for example like i do with >> TIOSCTI using for example (allowx foo bar (ioctl chr_file (not >> (0xXXXX)))) then you cannot easily exclude additional ioctls later where source is >> foo and target/tclass is bar/chr_file because there is already a rule in >> place allowing the ioctl (and you cannot add rules) > > Currently, fcntl flag F_SETFD is never checked, it's silently allowed, but > the equivalent FIONCLEX and FIOCLEX are checked. So if you wrote policy > to block the FIO*CLEX flags, it would be bypassable through F_SETFD and > FD_CLOEXEC. So the patch proposed makes the FIO flags behave like > F_SETFD. Which means upstream policy users could drop this allow, which > could then remove the target/class rule and allow all icotls. Which is easy > to prevent and fix you could be a rule in to allowx 0 as documented in the > wiki: https://selinuxproject.org/page/XpermRules > > The questions I think we have here are: > 1. Do we agree that the behavior between SETFD and the FIO flags are equivalent? > I think they are. > 2. Do we want the interfaces to behave the same? > I think they should.
If you can bypass FIONCLEX and FIOCLEX checks by F_SETFD and FD_CLOEXEC, then I agree that the two FIO checks don't have value and can be skipped as F_SETFD is.
> 3. Do upstream users of the policy construct care? > The patch is backwards compat, but I don't want their to be cruft > floating around with extra allowxperm rules.
Reference policy does not have any xperm rules at this time. I looked at the Fedora policy, and that doesn't have any.
-- Chris PeBenito
| |