Re: [PATCH refpolicy] kernel: remove some unused initial SID contexts

[Russell Coker <russell@coker.com.au>]

On Monday, 3 November 2025 12:07:08 AEDT Russell Coker wrote:
> On Sunday, 2 November 2025 12:28:21 AEDT Russell Coker wrote:
> > The above is what apparently used to be the policy so it looks like node_t
> > is being changed to sysctl_t.
> 
> allow sshd_t sysctl_t:tcp_socket node_bind;
> 
> I also tried rebooting a VM running that policy (previously I had loaded it
> on a running system) and got the same result with TCP as an additional
> issue.
> 
> Also I tried kernel 6.12.48+deb13-amd64 (the latest kernel for Debian/Trixie
> the latest stable release).

When I apply the following patch it works correctly, without this I get the 
problem of mislabelling described previously.

Index: refpolicy-2.20251102/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20251102.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20251102/policy/modules/kernel/kernel.te
@@ -220,6 +220,7 @@ neverallow * unlabeled_t:file entrypoint
 
 # Default socket label if no kernel sock is available
 sid any_socket		
gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+sid file_labels		gen_context(system_u:object_r:unlabeled_t,s0)
 
 # Label for userspace tasks surviving from early boot if
 # userspace_initial_context policycap is defined.


The below is the only patch that I have for kernel.te.

Index: refpolicy-2.20250903/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20250903.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20250903/policy/modules/kernel/kernel.te
@@ -37,6 +37,9 @@ role sysadm_r;
 role staff_r;
 role user_r;
 
+# until build issue is fixed
+role unconfined_r;
+
 ifdef(`enable_mls',`
 	role secadm_r;
 	role auditadm_r;

When I don't have that patch I get the following errors on build, two errors 
for MLS and MCS builds.

/usr/bin/checkmodule -M -U deny base.conf -o tmp/base.mod
Compiling default base module
/usr/bin/checkmodule -M -U allow base.conf -o tmp/base.mod
support/fatal_error.m4:42:ERROR 'unknown role unconfined_r' at token ';' on 
line 699886:

	user unconfined_u roles { unconfined_r system_r } level s0 range s0 - 
s15:c0.c1023;
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make[2]: *** [Rules.modular:116: tmp/base.mod] Error 1
make[2]: Leaving directory '/home/etbe/se/ref-git/refpolicy-2.20251102/debian/
build-mls'
make[1]: *** [debian/rules:114: build-mls-policy] Error 2
make[1]: *** Waiting for unfinished jobs....
support/fatal_error.m4:42:ERROR 'unknown role unconfined_r' at token ';' on 
line 695868:
	user unconfined_u roles { unconfined_r system_r } level s0 range s0 - 
s0:c0.c1023;

/usr/bin/checkmodule:  error(s) encountered while parsing configuration

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/