suggestion to help transition to selinux: dynamic loading of libselinux

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

dear nsa et al,

love selinux principle.  it's _got_ to be made easier.

idea: make all the modifications to e.g. coreutils, login etc.
compile with the header files but not necessarily _need_
libselinux at run-time.

way to do that is the same way that libdvdcss is loaded by
libdvdread: dynamically [there are plenty of other programs
that use the same technique].

the suggestion is based on the premise that if you have a
non-selinux kernel, and no libselinux installed, the programs
(pam, coreutils, login etc.) will attempt to dynamically load
libselinux (with dlopen), find it missing, _won't care_
and will adapt and proceed knowing that there's no security
enhancements - i.e. as if they had never been patched to
deal with selinux in the first place;

whilst if they _do_ detect that libselinux is available, an
init function is called which returns a pointer to a vector
table of all the functions needed, which are then used;

and i presume that if such programs are compromised, and someone
attempts to _stop_ libselinux from being loaded, well then
those programs will not be capable of making domain transitions
etc. and they will be useless [am i right?]


the technique of having one function available from a dynamic
library, which returns a table of all functions available in
the library, and which is accessed via dlsym is very common,
i am sure you have heard of it:

/* change all functions listed in this vector table from
   extern to static: they are made accessible _only_ through
   the vector table, instead
 */

static libselinux_vector_table fns =
{
    is_selinux_enabled,
	freecon,
	freeconary,
	getcon,
	getpidcon,
	getprevcon,
	getexeccon,
	....
	....
	fsetfilecon
}


extern libselinux_vector_table *libselinux_init_fn(void);


then you do this, in every program that requires access to
libselinux functions:

void *handle = dlopen("/usr/lib/libselinux.so", blah);
void *(void) fn = dlsym(handle, "libselinux_init_fn");

libselinux_vector_table *sel = (libselinux_vector_table*)(*fn)();

then, for example, in the patch to coreutils,
http://selinux.lemuria.org/newselinux/coreutils/coreutils.diff

in coreutils-5.0.91/src/copy.c line 1444 approx, instead of
++#ifdef WITH_SELINUX
++	if (x->preserve_security_context) 
++	  setfscreatecon(NULL);
++#endif

you have:

if (sel != NULL && x->preserve_security_context)
	sel->setfscreatecon(NULL);


yes, correct: no #ifdef WITH_SELINUX :)


i.e. you must compile always with the header files, but you must NOT
require the library libselinux to be present in order for the program
to actually work.

this is a standard programming technique, i am sure that someone could
provide better examples of how it is deployed.

the advantage of deploying it is that at present there is
completely justifiable resistance upstream in accepting
patches to the core functionality of linux useability that
makes it impossible to use the core utilities for a non-selinux
environment (!), and this suggestion makes the reason for that
resistance go away.


i hope that you will consider adapting libselinux for use in this
manner, because the sooner the dual-maintenance of the "alternate"
versions of the core utils disappears, the better.

sincerely,

l.

p.s. please ask me for clarifications if needed or even for
patches rather than go "uhn?  weirdo, weird language, can't
even touch a shift key, don't talk to him".  i _want_ selinux
to be adapted mainstream by debian, quickly, so talk to me.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.