Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

selinux-policy: adjust kernel permissions for NFS #205

Merged
merged 1 commit into from
Nov 5, 2024
Merged

selinux-policy: adjust kernel permissions for NFS #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion packages/selinux-policy/mcs.cil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,9 +86,11 @@
; Restrict process transitions unless one of these conditions is met:
; * the new label exactly matches the old label
; * the source context is for a trusted subject
; * the target context is not forbidden

(mlsconstrain (processes (transform))
(or (eq t1 trusted_s)
(or (and (eq t1 trusted_s)
(neq t2 forbidden_t))
Comment on lines +92 to +93
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added this so that any rules related to process transitions wouldn't be affected by the presence of MLS categories on the label. Previously it was a blanket "allow this for trusted subjects" and now it is "allow this for trusted subjects, unless the target context is forbidden".

(and (and (and (and
(eq u1 u2)
(eq r1 r2))
Expand Down
18 changes: 18 additions & 0 deletions packages/selinux-policy/rules.cil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,10 +166,28 @@
; Subjects that must run verified code can execute immutable objects, since
; those are all protected by dm-verity.
(allow verified_s immutable_o (files (execute)))
(allow kernel_t immutable_o (files (execute)))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is necessary because kernel_t dropped out of the verified_s set.


; Subjects that must run verified code cannot execute mutable objects.
(neverallow verified_s mutable_o (files (execute)))

; Ideally the kernel would also be denied permission to execute mutable
; objects. However, this breaks certain scenarios such as serving files
; over NFS, where the kernel's permissions are checked.
(allow kernel_t mutable_o (file (execute)))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the actual fix to the NFS serving issue.

Note that files (execute) grants both "execute" and "execute_no_trans"; I've moved to the more specific file here in order to split up those two permissions.


; Prevent the kernel from executing mutable objects by blocking execution
; unless there's a defined transition.
(neverallow kernel_t mutable_o (file (execute_no_trans)))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This prevents execution because of this check in the "no transition" branch.


; Backstop against kernel execution of mutable objects by defining a type
; transition, which is then explicitly disallowed.
(typetransition kernel_t mutable_o process forbidden_t)
(neverallow kernel_t forbidden_t (processes (transform)))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This prevents execution because of this check in the "transition" branch.


; Block the use of any object as an entry point to the forbidden type.
(neverallow forbidden_t all_o (files (enter)))
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This causes the next check in the "transition" branch to fail.


; All subjects are allowed to write to objects with their own label.
; This includes files like the ones under /proc/self.
(allow all_s self (files (mutate)))
Expand Down
11 changes: 9 additions & 2 deletions packages/selinux-policy/subject.cil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,12 +68,18 @@
(roletype system_r super_t)
(context admin (system_u system_r super_t s0))

; Processes that should never exist.
(type forbidden_t)
(roletype system_r forbidden_t)
(context forbidden (system_u system_r forbidden_t s0))
Comment on lines +71 to +74
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is boilerplate to define the forbidden_t type.


; The set of all subjects.
(typeattribute all_s)
(typeattributeset all_s (
kernel_t init_t system_t mount_t api_t
network_t clock_t bus_t runtime_t
container_t control_t super_t))
container_t control_t super_t
forbidden_t))
Comment on lines +81 to +82
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add forbidden_t to the set of all subjects (all_s) since there are a couple "neverallow" rules that should apply to it also.


; Subjects that are treated as a privileged part of the OS.
(typeattribute privileged_s)
Expand Down Expand Up @@ -121,7 +127,8 @@

; Subjects shipped with the OS that should only execute verified code.
(typeattribute verified_s)
(typeattributeset verified_s (xor (host_s) (runtime_t mount_t api_t init_t)))
(typeattributeset verified_s (xor (host_s) (
runtime_t mount_t api_t init_t kernel_t)))
Comment on lines +130 to +131
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This drops kernel_t from the verified_s set, so that we can retain the more restrictive rule:

(neverallow verified_s mutable_o (files (execute)))


; Subjects that are allowed to manage the system clock.
(typeattribute clock_s)
Expand Down