fuse + setfilecon - need some userspace / libselinux1 assistance

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

hi,

i'm not entirely sure what is going on, so thought i'd best ask.

i'm adding xattr support to fuse (*gibber*) so that i can do selinux
permissions properly.

therein immediately lies the problem: the userspace implementation of
getxattr is fine (one might hope) but the userspace implementation of
setxattr is not fine.

why?  well, because a setxattr("security.selinux", <somegarbage>)
operation is performed!

as i found out, that is banned, esp. as the userspace program is run as
getfsuid() to the user.


consequently, i looked around and found the util "setfilecon" which uses
setfilecon().

to my surprise, i found that the argv[] arguments were simply ...
typecast from a char* to a security_context_t.

surely... that's rather unexpected behaviour that could, in the
future, break applications?

well, anyway, what i've done is to check that the string is
"security.selinux" and then to call setfilecon() and that seems to work
fine.



secondly, and this is quite an important one for security reasons: the
fusermount program must be run setuid to root, in order to allow
users to _un_mount their own filesystem.

the fusermount program, whilst running as root, removes all "linux
capabilities" _except_ that of the ability to unmount.

and it also does a setfsuid and setfsgid to the user.

so, my question is: what possible horrors could i encounter,
given that setfsuid and setfilecon are involved?

will the setfilecon operation occur _as_ the user specified under the
setfsuid() uid?

or will the setfilecon operation be actioned as root?

i believe it to be really important that the answer is
"the setfilecon() is done as the setfsuid() uid"!

l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.