Re: SELinux on Android

[Stephen Smalley <sds@tycho.nsa.gov>]

On Thu, 2011-12-01 at 19:42 +0100, Bhargava Shastry wrote:
> Hi All,
> 
> I was wondering if there is way to do automatic policy updates for
> SELinux at runtime. On similar lines, is there a means by which
> SELinux queries a "supervisor" in the userspace in case a policy
> violation is detected in enforcing mode. For example, lets say
> SELinux's initial policy (loaded during device boot) does not permit
> program X to read file Y. If SELinux is enforcing such a policy, X is
> not allowed to read Y (obviously). In this scenario, is there a way to
> allow SELinux ask a user-space decision maker program if Y could
> indeed be read by X? Maybe the user-space decision maker deems the
> file safe to be read.
> 
> Apologies if I am being a little vague here. To put my question in
> perspective, I am working on evaluating SELinux on Android and it is
> sometimes useful for the Android middleware (sitting on top of the
> Linux kernel) to interfere in kernel-level MAC e.g. SELinux. So, it
> would be useful to know if a communication channel between SELinux and
> the middleware could be established esp. wrt policy updates.

SELinux does not support upcalls to userspace for decision making (and
doing so would be impossible for a number of the hooks, which are called
under various conditions and cannot always block).

It is however possible for a userspace agent to exercise various degrees
of control over SELinux, e.g. by loading new policy, by changing policy
booleans, or by specifying how to label particular processes and
objects.  But that would occur in response to some event visible to the
userspace agent, not in response to an upcall from SELinux in the middle
of processing some system call.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.