is_selinux_enabled() after chroot()

[Petr Lautrbach <plautrba@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1848 bytes --]

Hello,

libselinux sets selinut_mnt and has_selinux_config only in its constructor and
is_selinux_enabled() and others just use selinux_mnt to check if SELinux is
enabled. But it doesn't work correctly when you use chroot() to a directory without /proc
and /sys/fs/selinux mounted as it was discovered in
https://bugzilla.redhat.com/show_bug.cgi?id=1321375 

In this case, is_selinux_enabled() after chroot() returns true while in a new
program run from chrooted process it returns false. It can be demonstrated by
the steps below.

The solution could be to check if selinux_mnt still exists whenever a function
depending on this is called. Would this be acceptable?




$ sudo dnf --nogpg --installroot=/var/lib/machines/example  install systemd

$ cat > test_libselinux.c <<EOF
#include <selinux/selinux.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
  pid_t pid;
  int wstatus;

  if (argc > 1) {
    printf("SELinux in chrooted process: %d\n", is_selinux_enabled());
    return 0;
  }
  if (chroot("/var/lib/machines/example") != 0)
    return -1;

  printf("SELinux in process after chroot(): %d\n", is_selinux_enabled());
  printf("/sys/fs/selinux exists: %d\n", access("/sys/fs/selinux", F_OK));
  printf("/etc/selinux/config exists: %d\n\n", access("/etc/selinux/config", F_OK));

  if ((pid = fork()) == 0 ) {
    execv("./test_is_selinux_enabled", (char *[]){ "./test_is_selinux_enabled", "chrooted", NULL});
  }

  wait(&wstatus);
  return 0;
}
EOF

$ gcc -o test_is_selinux_enabled test_libselinux.c -lselinux

$ sudo ./test_is_selinux_enabled                            
SELinux in process after chroot(): 1
/sys/fs/selinux exists: -1
/etc/selinux/config exists: -1

SELinux in chrooted process: 0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]