possible regression with filecon equivalency

possible regression with filecon equivalency

[Dominick Grift]

This worked a while ago:

root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
> /foo /usr/bin
> /sysroot/foo /usr/bin
> EOF

root@nimbus:~# matchpathcon -m dir /usr/bin
/usr/bin        sys.id:sys.role:exec.file:s0
root@nimbus:~# matchpathcon -m dir /foo
/foo    sys.id:sys.role:exec.file:s0
root@nimbus:~# matchpathcon -m dir /sysroot/foo
/sysroot/foo    sys.id:sys.role:unknown.file:s0

What happened?

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

Re: possible regression with filecon equivalency

[Dominick Grift]

Dominick Grift <dominick.grift@defensec.nl> writes:

example was too simple. Its more complicated:

root@nimbus:~# matchpathcon -m dir /
/       sys.id:sys.role:root.file:s0
root@nimbus:~# matchpathcon -m dir /blaroot
/blaroot        sys.id:sys.role:unknown.file:s0
root@nimbus:~# matchpathcon -m dir /usr/bin
/usr/bin        sys.id:sys.role:exec.file:s0
root@nimbus:~# matchpathcon -m dir /usr/sbin
/usr/sbin       sys.id:sys.role:exec.file:s0
root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
> /blaroot /
> /blaroot/usr/sbin /usr/bin
> EOF
root@nimbus:~# matchpathcon -m dir /
/       sys.id:sys.role:root.file:s0
root@nimbus:~# matchpathcon -m dir /blaroot
/blaroot        sys.id:sys.role:root.file:s0
root@nimbus:~# matchpathcon -m dir /usr/bin
/usr/bin        sys.id:sys.role:exec.file:s0
root@nimbus:~# matchpathcon -m dir /usr/sbin
/usr/sbin       sys.id:sys.role:exec.file:s0
root@nimbus:~# matchpathcon -m dir /blaroot/usr/sbin
/blaroot/usr/sbin       sys.id:sys.role:data.file:s0

> This worked a while ago:
>
> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>> /foo /usr/bin
>> /sysroot/foo /usr/bin
>> EOF
>
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /foo
> /foo    sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /sysroot/foo
> /sysroot/foo    sys.id:sys.role:unknown.file:s0
>
> What happened?

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

Re: possible regression with filecon equivalency

[Dominick Grift]

Dominick Grift <dominick.grift@defensec.nl> writes:

In case its not clear. To clarify. I treat /usr/sbin like /usr/bin this
works fine. until it gets nested:

/fooroot / # treat /fooroot like / (works)
/fooroot/usr/sbin /usr/bin # treat /fooroot/usr/sbin like /usr/bin (no
longer works but use to work)

So now /fooroot/usr/sbin gets a label the equivalent of /usr because it
ignores to /fooroot/usr/sbin /usr/bin equivalency rule.

I hope that clears it up. I rely on this functionality.

> Dominick Grift <dominick.grift@defensec.nl> writes:
>
> example was too simple. Its more complicated:
>
> root@nimbus:~# matchpathcon -m dir /
> /       sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot
> /blaroot        sys.id:sys.role:unknown.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/sbin
> /usr/sbin       sys.id:sys.role:exec.file:s0
> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>> /blaroot /
>> /blaroot/usr/sbin /usr/bin
>> EOF
> root@nimbus:~# matchpathcon -m dir /
> /       sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot
> /blaroot        sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/sbin
> /usr/sbin       sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot/usr/sbin
> /blaroot/usr/sbin       sys.id:sys.role:data.file:s0
>
>> This worked a while ago:
>>
>> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>>> /foo /usr/bin
>>> /sysroot/foo /usr/bin
>>> EOF
>>
>> root@nimbus:~# matchpathcon -m dir /usr/bin
>> /usr/bin        sys.id:sys.role:exec.file:s0
>> root@nimbus:~# matchpathcon -m dir /foo
>> /foo    sys.id:sys.role:exec.file:s0
>> root@nimbus:~# matchpathcon -m dir /sysroot/foo
>> /sysroot/foo    sys.id:sys.role:unknown.file:s0
>>
>> What happened?

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

Re: possible regression with filecon equivalency

[Petr Lautrbach]

Dominick Grift <dominick.grift@defensec.nl> writes:

> This worked a while ago:
>
> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>> /foo /usr/bin
>> /sysroot/foo /usr/bin
>> EOF
>
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /foo
> /foo    sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /sysroot/foo
> /sysroot/foo    sys.id:sys.role:unknown.file:s0
>
> What happened?

i've bisected it to

4d436e4bf80284ac3b645bad022a9757dbc2dd36 is the first bad commit
commit 4d436e4bf80284ac3b645bad022a9757dbc2dd36
Author: Christian Göttsche <cgzones@googlemail.com>
Date:   Tue Nov 26 11:26:20 2024 +0100

    libselinux: use vector instead of linked list for substitutions
    
    Utilize cache locality for the substitutions by storing them in
    contiguous memory instead of a linked list.
    
    Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
    Acked-by: James Carter <jwcart2@gmail.com>



# cat /etc/selinux/targeted/contexts/files/file_contexts.subs
/new_root /
/new_root/foo /usr/bin

before 4d436e4bf80284ac3b645bad022a9757dbc2dd36:

# matchpathcon -m dir /new_root/foo
system_u:object_r:bin_t:s0

after

# matchpathcon -m dir /new_root/foo
/new_root/foo   system_u:object_r:default_t:s0



>
> -- 
> gpg --locate-keys dominick.grift@defensec.nl (wkd)
> Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
> Dominick Grift
> Mastodon: @kcinimod@defensec.nl