Question about libselinux *_with_level functions

Question about libselinux *_with_level functions

[Filippo Bonazzi]

[-- Attachment #1: Type: text/plain, Size: 1986 bytes --]

Hi all,

While looking into an openSUSE SELinux bug report[0] I ended up looking at the
*with_level functions of libselinux:

     int get_ordered_context_list_with_level(const char *user, const char *level, const char *fromcon, char ***list);
     int get_default_context_with_level(const char *user, const char *level, const char *fromcon, char **newcon);

The function names and the man page seem to suggest that these functions should
apply the provided level parameter to the context. However, in my testing with
libselinux-3.10, this does not happen: both functions return the context without
an applied level.

Simple example:

     char *seuser = "unconfined_u";
     char *level = "s0-s0:c0.c1023";
     char *newcon_with_level = NULL;
     char *newcon_without_level = NULL;
     get_default_context_with_level(seuser, level, NULL, &newcon_with_level);
     get_default_context(seuser, NULL, &newcon_without_level);
     printf("With: %s\n", newcon_with_level);
     printf("Without: %s\n", newcon_without_level);

> With:    unconfined_u:unconfined_r:unconfined_t:s0
> Without: unconfined_u:unconfined_r:unconfined_t:s0

newcon_with_level and newcon_without_level should be different, but they are
identical.

It looks to me like the implementation of get_ordered_context_list_with_level()
is just not fully handling the level parameter. The parameter is only used to
get to define the newfromcon parameter, but the level information is then
stripped anyway by the call to get_ordered_context_list().

Am I misunderstanding something?

Thank you,

Filippo

P.S. I previously reported this issue on Github [1] in a bit less detail, but I
hope to get better answers asking this directly here.

[0] https://bugzilla.suse.com/show_bug.cgi?id=1259191
[1] https://github.com/SELinuxProject/selinux/issues/508

-- 
Filippo Bonazzi
Security Engineer                        suse.com
8257 4398 947A 2DBE F21D 76E6 937A 63F0 5B36 46D9

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 525 bytes --]

Re: Question about libselinux *_with_level functions

[Stephen Smalley]

On Thu, Mar 12, 2026 at 2:12 PM Filippo Bonazzi <fbonazzi@suse.de> wrote:
>
> Hi all,
>
> While looking into an openSUSE SELinux bug report[0] I ended up looking at the
> *with_level functions of libselinux:
>
>      int get_ordered_context_list_with_level(const char *user, const char *level, const char *fromcon, char ***list);
>      int get_default_context_with_level(const char *user, const char *level, const char *fromcon, char **newcon);
>
> The function names and the man page seem to suggest that these functions should
> apply the provided level parameter to the context. However, in my testing with
> libselinux-3.10, this does not happen: both functions return the context without
> an applied level.
>
> Simple example:
>
>      char *seuser = "unconfined_u";
>      char *level = "s0-s0:c0.c1023";
>      char *newcon_with_level = NULL;
>      char *newcon_without_level = NULL;
>      get_default_context_with_level(seuser, level, NULL, &newcon_with_level);
>      get_default_context(seuser, NULL, &newcon_without_level);
>      printf("With: %s\n", newcon_with_level);
>      printf("Without: %s\n", newcon_without_level);
>
> > With:    unconfined_u:unconfined_r:unconfined_t:s0
> > Without: unconfined_u:unconfined_r:unconfined_t:s0
>
> newcon_with_level and newcon_without_level should be different, but they are
> identical.
>
> It looks to me like the implementation of get_ordered_context_list_with_level()
> is just not fully handling the level parameter. The parameter is only used to
> get to define the newfromcon parameter, but the level information is then
> stripped anyway by the call to get_ordered_context_list().
>
> Am I misunderstanding something?

I believe this is a regression introduced by the deprecation/removal
of /sys/fs/selinux/user,
as used by security_compute_user(), which was formerly used by
get_ordered_context_list*().
Previously, the kernel would compute the reachable contexts (including
MLS ranges) and
get_ordered_context_list*() could just down-select from those. Absent
that, we need
get_ordered_context_list*() to properly substitute the level/role/etc
into the returned context(s)
and see if they are valid/reachable.

>
> Thank you,
>
> Filippo
>
> P.S. I previously reported this issue on Github [1] in a bit less detail, but I
> hope to get better answers asking this directly here.
>
> [0] https://bugzilla.suse.com/show_bug.cgi?id=1259191
> [1] https://github.com/SELinuxProject/selinux/issues/508
>
> --
> Filippo Bonazzi
> Security Engineer                        suse.com
> 8257 4398 947A 2DBE F21D 76E6 937A 63F0 5B36 46D9

Re: Question about libselinux *_with_level functions

[Filippo Bonazzi]

[-- Attachment #1: Type: text/plain, Size: 485 bytes --]

On 2026-05-27 13:46 (UTC -0400), Stephen Smalley wrote:
>I believe this is a regression introduced by the deprecation/removal
>of /sys/fs/selinux/user,
>as used by security_compute_user(), which was formerly used by
>get_ordered_context_list*().

Hi,

Just checking the state of this. Is this planned to be fixed at some point?

Thanks,

Filippo

-- 
Filippo Bonazzi
Security Engineer                        suse.com
8257 4398 947A 2DBE F21D 76E6 937A 63F0 5B36 46D9

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 525 bytes --]

Re: Question about libselinux *_with_level functions

[Stephen Smalley]

On Thu, Nov 5, 2026 at 6:03 AM Filippo Bonazzi <fbonazzi@suse.de> wrote:
>
> On 2026-05-27 13:46 (UTC -0400), Stephen Smalley wrote:
> >I believe this is a regression introduced by the deprecation/removal
> >of /sys/fs/selinux/user,
> >as used by security_compute_user(), which was formerly used by
> >get_ordered_context_list*().
>
> Hi,
>
> Just checking the state of this. Is this planned to be fixed at some point?

Sorry I saw Petr's response in the GitHub issue and was then unclear
that there is anything to be fixed at the moment. Patches accepted if
there is in fact a real bug for a real user of this interface.

Re: Question about libselinux *_with_level functions

[Stephen Smalley]

On Thu, Nov 5, 2026 at 9:18 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Thu, Nov 5, 2026 at 6:03 AM Filippo Bonazzi <fbonazzi@suse.de> wrote:
> >
> > On 2026-05-27 13:46 (UTC -0400), Stephen Smalley wrote:
> > >I believe this is a regression introduced by the deprecation/removal
> > >of /sys/fs/selinux/user,
> > >as used by security_compute_user(), which was formerly used by
> > >get_ordered_context_list*().
> >
> > Hi,
> >
> > Just checking the state of this. Is this planned to be fixed at some point?
>
> Sorry I saw Petr's response in the GitHub issue and was then unclear
> that there is anything to be fixed at the moment. Patches accepted if
> there is in fact a real bug for a real user of this interface.

Actually, on a re-read, I see that there is indeed a bug that likely
has a relatively simple fix; is that something you want to create or
should we?

Re: Question about libselinux *_with_level functions

[Filippo Bonazzi]

[-- Attachment #1: Type: text/plain, Size: 1488 bytes --]

On 2026-11-05 09:25 (UTC -0500), Stephen Smalley wrote:
>On Thu, Nov 5, 2026 at 9:18 AM Stephen Smalley
><stephen.smalley.work@gmail.com> wrote:
>>
>> On Thu, Nov 5, 2026 at 6:03 AM Filippo Bonazzi <fbonazzi@suse.de> wrote:
>> >
>> > On 2026-05-27 13:46 (UTC -0400), Stephen Smalley wrote:
>> > >I believe this is a regression introduced by the deprecation/removal
>> > >of /sys/fs/selinux/user,
>> > >as used by security_compute_user(), which was formerly used by
>> > >get_ordered_context_list*().
>> >
>> > Hi,
>> >
>> > Just checking the state of this. Is this planned to be fixed at some point?
>>
>> Sorry I saw Petr's response in the GitHub issue and was then unclear
>> that there is anything to be fixed at the moment. Patches accepted if
>> there is in fact a real bug for a real user of this interface.
>
>Actually, on a re-read, I see that there is indeed a bug that likely
>has a relatively simple fix; is that something you want to create or
>should we?

Yes, I understood that the GH response was a red herring back then and I figured
this email thread was the right path. But then it kinda fell through the cracks.

I'd appreciate if you could come up with a fix, since I lack the historical
context to understand he regression and the deprecation of the previous
features you mentioned.

Thank you

Filippo

-- 
Filippo Bonazzi
Security Engineer                        suse.com
8257 4398 947A 2DBE F21D 76E6 937A 63F0 5B36 46D9

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 525 bytes --]