* Force avc_has_perm to return success if enforcing == 0;
@ 2012-02-14 21:22 Daniel J Walsh
2012-02-16 14:25 ` Stephen Smalley
2012-02-16 15:18 ` Colin Walters
0 siblings, 2 replies; 6+ messages in thread
From: Daniel J Walsh @ 2012-02-14 21:22 UTC (permalink / raw)
To: Stephen Smalley, SELinux
[-- Attachment #1: Type: text/plain, Size: 695 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I would like to patch libselinux to always return 0 on avc_has_perm if
the machine is in permissive mode.
This will allow Userspace Object Managers to work even if the system
is totally mislabeled and processes as running with bad context.
Currently if a program like dbus asks with a bad process label it can
get denials even in permissive mode.
Does anyone see a problem with this?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk860IQACgkQrlYvE4MpobNPFwCfVbE1QGJ0M8byHYZlf2U3XpdE
Ga0An2Z2/wBklr/e6OX+4EYTrFDvL69o
=btOY
-----END PGP SIGNATURE-----
[-- Attachment #2: avc_has_perm_permissive.patch --]
[-- Type: text/x-patch, Size: 300 bytes --]
diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
index e7ad31d..2de39b9 100644
--- a/libselinux/src/avc.c
+++ b/libselinux/src/avc.c
@@ -801,6 +801,7 @@ int avc_has_perm_noaudit(security_id_t ssid,
out:
avc_release_lock(avc_lock);
+ if (!avc_enforcing) return 0;
return rc;
}
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: Force avc_has_perm to return success if enforcing == 0;
2012-02-14 21:22 Force avc_has_perm to return success if enforcing == 0; Daniel J Walsh
@ 2012-02-16 14:25 ` Stephen Smalley
2012-02-16 14:37 ` Daniel J Walsh
2012-02-16 15:18 ` Colin Walters
1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2012-02-16 14:25 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux
On Tue, 2012-02-14 at 16:22 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I would like to patch libselinux to always return 0 on avc_has_perm if
> the machine is in permissive mode.
>
> This will allow Userspace Object Managers to work even if the system
> is totally mislabeled and processes as running with bad context.
> Currently if a program like dbus asks with a bad process label it can
> get denials even in permissive mode.
>
> Does anyone see a problem with this?
I'm not fond of it. Permissive mode is just supposed to control whether
permission is granted, not to hide other kinds of errors. Consider how
difficult debugging of an actual failure will be if it only shows up in
enforcing mode even though it has nothing to do with policy.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Force avc_has_perm to return success if enforcing == 0;
2012-02-16 14:25 ` Stephen Smalley
@ 2012-02-16 14:37 ` Daniel J Walsh
2012-02-21 20:37 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: Daniel J Walsh @ 2012-02-16 14:37 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/16/2012 09:25 AM, Stephen Smalley wrote:
> On Tue, 2012-02-14 at 16:22 -0500, Daniel J Walsh wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> I would like to patch libselinux to always return 0 on
>> avc_has_perm if the machine is in permissive mode.
>>
>> This will allow Userspace Object Managers to work even if the
>> system is totally mislabeled and processes as running with bad
>> context. Currently if a program like dbus asks with a bad process
>> label it can get denials even in permissive mode.
>>
>> Does anyone see a problem with this?
>
> I'm not fond of it. Permissive mode is just supposed to control
> whether permission is granted, not to hide other kinds of errors.
> Consider how difficult debugging of an actual failure will be if it
> only shows up in enforcing mode even though it has nothing to do
> with policy.
>
Well I guess I can only due the return in the audit_has_perm not the
audit_has_perm_noaudit, since then the audit message will get
generated but dbus,passwd,xserver ... will allow the access.
If an app calls audit_has_perm_noaudit, it will still return failure.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk89FLMACgkQrlYvE4MpobNF/wCeP6Mu+zaa9AlNxFKnr20ClPaj
0kYAn243TIM6fcwHel6CdnfEDB3YXDeZ
=UnKT
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Force avc_has_perm to return success if enforcing == 0;
2012-02-16 14:37 ` Daniel J Walsh
@ 2012-02-21 20:37 ` Stephen Smalley
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2012-02-21 20:37 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux
On Thu, 2012-02-16 at 09:37 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/16/2012 09:25 AM, Stephen Smalley wrote:
> > On Tue, 2012-02-14 at 16:22 -0500, Daniel J Walsh wrote:
> >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >>
> >> I would like to patch libselinux to always return 0 on
> >> avc_has_perm if the machine is in permissive mode.
> >>
> >> This will allow Userspace Object Managers to work even if the
> >> system is totally mislabeled and processes as running with bad
> >> context. Currently if a program like dbus asks with a bad process
> >> label it can get denials even in permissive mode.
> >>
> >> Does anyone see a problem with this?
> >
> > I'm not fond of it. Permissive mode is just supposed to control
> > whether permission is granted, not to hide other kinds of errors.
> > Consider how difficult debugging of an actual failure will be if it
> > only shows up in enforcing mode even though it has nothing to do
> > with policy.
> >
> Well I guess I can only due the return in the audit_has_perm not the
> audit_has_perm_noaudit, since then the audit message will get
> generated but dbus,passwd,xserver ... will allow the access.
>
> If an app calls audit_has_perm_noaudit, it will still return failure.
That doesn't help. The issue is that avc_has_perm can fail for reasons
other than permission failure (which is why you are making this change),
but those other reasons are not logged/audited, so if you make them
succeed in permissive mode, then they won't be seen there. At all.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Force avc_has_perm to return success if enforcing == 0;
2012-02-14 21:22 Force avc_has_perm to return success if enforcing == 0; Daniel J Walsh
2012-02-16 14:25 ` Stephen Smalley
@ 2012-02-16 15:18 ` Colin Walters
1 sibling, 0 replies; 6+ messages in thread
From: Colin Walters @ 2012-02-16 15:18 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux
On Tue, 2012-02-14 at 16:22 -0500, Daniel J Walsh wrote:
> I would like to patch libselinux to always return 0 on avc_has_perm if
> the machine is in permissive mode.
>
> This will allow Userspace Object Managers to work even if the system
> is totally mislabeled and processes as running with bad context.
> Currently if a program like dbus asks with a bad process label it can
> get denials even in permissive mode.
The patch seems like it could at least use a comment.
For reference the previous discussion was here:
http://marc.info/?l=selinux&m=123973525511476&w=2
I'm not opposed to the proposed patch, but ultimately while it will
make their system not crash when in permissive, it also won't help
much in getting people towards an enforcing system. It seems to me
we need to improve:
1) The notification that the system requires a relabel. If terminals
were HTML, we'd be using <blink>
2) The process of relabeling.
I think fixfiles defaulting to "all files on all mounted filesystems"
is kind of wrong. We should only relabel things installed by RPM
first, which should get you back to a clean slate for the system,
then you can look at relabeling your custom web content, etc.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
[parent not found: <CAPzO=Nw+T8_QkzHPboQ-s399hmdMF0jb0_3ipSrSyqpHztfOfg@mail.gmail.com>]
* Re: Force avc_has_perm to return success if enforcing == 0;
[not found] <CAPzO=Nw+T8_QkzHPboQ-s399hmdMF0jb0_3ipSrSyqpHztfOfg@mail.gmail.com>
@ 2012-02-15 15:25 ` Daniel J Walsh
0 siblings, 0 replies; 6+ messages in thread
From: Daniel J Walsh @ 2012-02-15 15:25 UTC (permalink / raw)
To: Sven Vermeulen; +Cc: SELinux, Stephen Smalley
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/15/2012 07:50 AM, Sven Vermeulen wrote:
> On Feb 14, 2012 10:26 PM, "Daniel J Walsh" <dwalsh@redhat.com
> <mailto:dwalsh@redhat.com>> wrote:
>> I would like to patch libselinux to always return 0 on
>> avc_has_perm if the machine is in permissive mode.
>>
>> This will allow Userspace Object Managers to work even if the
>> system is totally mislabeled and processes as running with bad
>> context. Currently if a program like dbus asks with a bad process
>> label it can get denials even in permissive mode.
>
> Shouldn't SELinux-aware applications be aware as well that
> "permissive" exists? I don't know what the impact would be to
> change the libselinux code here, but if dbus (and other
> applications that link with libselinux) would check the selinuxtype
> as well they have full control over what happens.
>
> A similar thing exists with SELinux-aware applications that call
> getexeccon() when their context is wrong. Some of these
> applications expect this call to always result non-NULL which, in
> case of permissive runs, yields abnormal behavior (SSHd segfaulting
> is an example on this, Gentoo's Portage refusing to work is
> another).
>
> In these cases too, it is much more important imo to have the
> application check if the system is running in permissive mode or
> not.
>
> Wkr, Sven Vermeulen
>
Well this code actually already had a check in there to see if it was
in permissive mode. It was just not checking all failure modes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk87znAACgkQrlYvE4MpobPjNwCeJR2x6XWmzJQx6oXuFNeXG4uj
ZxsAoLUS78u1sP9XJW9dY2PFiOQS076Y
=60ac
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-02-21 20:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-14 21:22 Force avc_has_perm to return success if enforcing == 0; Daniel J Walsh
2012-02-16 14:25 ` Stephen Smalley
2012-02-16 14:37 ` Daniel J Walsh
2012-02-21 20:37 ` Stephen Smalley
2012-02-16 15:18 ` Colin Walters
[not found] <CAPzO=Nw+T8_QkzHPboQ-s399hmdMF0jb0_3ipSrSyqpHztfOfg@mail.gmail.com>
2012-02-15 15:25 ` Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.