* lgetxattr()/getxattr() return different values on a file labelled with selinux disabled @ 2013-03-15 10:54 Thomas COUDRAY 2013-03-15 12:53 ` Stephen Smalley 0 siblings, 1 reply; 5+ messages in thread From: Thomas COUDRAY @ 2013-03-15 10:54 UTC (permalink / raw) To: jmorris, sds, linux-fsdevel, linux-kernel Hi, I encounter trouble that I can't explain when labelling my files. Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on an ext4 fs): 0 - have a regular file "f", with a "before_t" security.selinux attribute 1 - reboot with selinux=0 2 - change the label to "after_t" (setfattr or chcon) 3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n security.selinux" (who calls getxattr(2)) show "after_t" 4 - reboot with selinux enabled 5 - now ls prints "before_t", and getfattr "after_t". I ran a small test that calls both syscalls (lgetxattr/getxattr), I get "before_t" as expected If I touch /.autorelabel, both ls/getfattr give "before_t". -- Thomas Coudray ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled 2013-03-15 10:54 lgetxattr()/getxattr() return different values on a file labelled with selinux disabled Thomas COUDRAY @ 2013-03-15 12:53 ` Stephen Smalley 2013-03-15 15:24 ` Thomas COUDRAY 0 siblings, 1 reply; 5+ messages in thread From: Stephen Smalley @ 2013-03-15 12:53 UTC (permalink / raw) To: Thomas COUDRAY; +Cc: jmorris, linux-fsdevel, linux-kernel, Eric Paris On 03/15/2013 06:54 AM, Thomas COUDRAY wrote: > Hi, > I encounter trouble that I can't explain when labelling my files. > Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on > an ext4 fs): > 0 - have a regular file "f", with a "before_t" security.selinux attribute > 1 - reboot with selinux=0 > 2 - change the label to "after_t" (setfattr or chcon) > 3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n > security.selinux" (who calls getxattr(2)) show "after_t" > 4 - reboot with selinux enabled > 5 - now ls prints "before_t", and getfattr "after_t". > > I ran a small test that calls both syscalls (lgetxattr/getxattr), I > get "before_t" as expected > If I touch /.autorelabel, both ls/getfattr give "before_t". f is truly a regular file and not a symlink pointing to a regular file? before_t and after_t are both defined in the policy? before_t and after_t are not type aliases of each other? What are the credentials (capabilities and SELinux security context/permissions) of the process running the ls and getfattr commands? Any relevant messages from SELinux in dmesg output? ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled 2013-03-15 12:53 ` Stephen Smalley @ 2013-03-15 15:24 ` Thomas COUDRAY 2013-03-15 17:07 ` Stephen Smalley 0 siblings, 1 reply; 5+ messages in thread From: Thomas COUDRAY @ 2013-03-15 15:24 UTC (permalink / raw) To: Stephen Smalley; +Cc: jmorris, linux-fsdevel, linux-kernel, Eric Paris 2013/3/15 Stephen Smalley <sds@tycho.nsa.gov>: > f is truly a regular file and not a symlink pointing to a regular file? f is a truly regular file. > before_t and after_t are both defined in the policy? Only before_t was defined in the policy. When I define after_t in the policy, both commands return the same label (after_t). But I wouldn't expect this to make a difference in the output of both commands (as the only visible difference is lgetxattr() vs getxattr()) > before_t and after_t are not type aliases of each other? They are not. > What are the credentials (capabilities and SELinux security > context/permissions) of the process running the ls and getfattr commands? It has unconfined_u:unconfined_r:before_t label with before_t type. Same as the file f. The process has full SELinux rights on both command and file. > Any relevant messages from SELinux in dmesg output? No avc warnings in dmesg and audit.log. All looks good. -- Thomas Coudray ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled 2013-03-15 15:24 ` Thomas COUDRAY @ 2013-03-15 17:07 ` Stephen Smalley 2013-03-25 16:39 ` Thomas COUDRAY 0 siblings, 1 reply; 5+ messages in thread From: Stephen Smalley @ 2013-03-15 17:07 UTC (permalink / raw) To: Thomas COUDRAY; +Cc: jmorris, linux-fsdevel, linux-kernel, Eric Paris On 03/15/2013 11:24 AM, Thomas COUDRAY wrote: > 2013/3/15 Stephen Smalley <sds@tycho.nsa.gov>: >> f is truly a regular file and not a symlink pointing to a regular file? > > f is a truly regular file. > >> before_t and after_t are both defined in the policy? > > Only before_t was defined in the policy. If not defined in policy, then kernel should remap to unlabeled sid context. > When I define after_t in the policy, both commands return the same > label (after_t). > But I wouldn't expect this to make a difference in the output of both > commands (as the only visible difference is lgetxattr() vs getxattr()) getxattr security.* results are supplied by the security module rather than the filesystem to allow the value to be canonicalized. But this should happen the same for lgetxattr and getxattr; those should only differ if the file is a symlink. >> before_t and after_t are not type aliases of each other? > > They are not. > >> What are the credentials (capabilities and SELinux security >> context/permissions) of the process running the ls and getfattr commands? > > It has unconfined_u:unconfined_r:before_t label with before_t type. > Same as the file f. > The process has full SELinux rights on both command and file. Did it run as root? Does it have :capability2 mac_override permission? >> Any relevant messages from SELinux in dmesg output? > > No avc warnings in dmesg and audit.log. All looks good. What about SELinux: messages? e.g. SELinux: Context ... is not valid (left unmapped). ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled 2013-03-15 17:07 ` Stephen Smalley @ 2013-03-25 16:39 ` Thomas COUDRAY 0 siblings, 0 replies; 5+ messages in thread From: Thomas COUDRAY @ 2013-03-25 16:39 UTC (permalink / raw) To: Stephen Smalley; +Cc: jmorris, linux-fsdevel, linux-kernel, Eric Paris 2013/3/15 Stephen Smalley <sds@tycho.nsa.gov>: > On 03/15/2013 11:24 AM, Thomas COUDRAY wrote: >> >> 2013/3/15 Stephen Smalley <sds@tycho.nsa.gov>: >>> before_t and after_t are both defined in the policy? >> >> Only before_t was defined in the policy. > > If not defined in policy, then kernel should remap to unlabeled sid context. That is not the case. >>> What are the credentials (capabilities and SELinux security >>> context/permissions) of the process running the ls and getfattr commands? >> It has unconfined_u:unconfined_r:before_t label with before_t type. >> Same as the file f. >> The process has full SELinux rights on both command and file. > > Did it run as root? Does it have :capability2 mac_override permission? When I run it as root, both commands return the same label. The process has mac_override, mac_admin and syslog permission on f. >>> Any relevant messages from SELinux in dmesg output? >> >> No avc warnings in dmesg and audit.log. All looks good. > > What about SELinux: messages? e.g. SELinux: Context ... is not valid (left > unmapped). > You're right. > SELinux: Context system_u:object_r:after_t is not valid (left unmapped). I'm using the modular-base-policy from notebook-source. -- Thomas Coudray [ 0.021583] SELinux: Initializing. [ 0.021978] SELinux: Starting in permissive mode [ 0.765100] EVM: security.selinux [ 1.037649] SELinux: Registering netfilter hooks [ 4.374957] SELinux: 32 avtab hash slots, 82 rules. [ 4.374966] SELinux: 32 avtab hash slots, 82 rules. [ 4.374968] SELinux: 2 users, 2 roles, 2 types, 0 bools [ 4.374969] SELinux: 82 classes, 82 rules [ 4.375041] SELinux: Completing initialization. [ 4.375042] SELinux: Setting up existing superblocks. [ 4.375045] SELinux: initialized (dev sysfs, type sysfs), not configured for labeling [ 4.375047] SELinux: initialized (dev rootfs, type rootfs), not configured for labeling [ 4.375122] SELinux: initialized (dev bdev, type bdev), not configured for labeling [ 4.375125] SELinux: initialized (dev proc, type proc), uses genfs_contexts [ 4.375129] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs [ 4.375132] SELinux: initialized (dev devtmpfs, type devtmpfs), not configured for labeling [ 4.375188] SELinux: initialized (dev debugfs, type debugfs), not configured for labeling [ 4.375594] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs [ 4.375596] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs [ 4.375598] SELinux: initialized (dev anon_inodefs, type anon_inodefs), not configured for labeling [ 4.375600] SELinux: initialized (dev devpts, type devpts), uses transition SIDs [ 4.375603] SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses transition SIDs [ 4.375605] SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs [ 4.375607] SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts [ 4.375614] SELinux: initialized (dev securityfs, type securityfs), not configured for labeling [ 4.375616] SELinux: initialized (dev sysfs, type sysfs), not configured for labeling [ 4.375746] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs [ 4.375804] SELinux: initialized (dev sda1, type ext4), uses xattr [ 4.929828] SELinux: initialized (dev fusectl, type fusectl), not configured for labeling [ 4.934859] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs [ 4.936117] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs [ 6.926947] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), not configured for labeling [ 17.550807] SELinux: initialized (dev vboxsf, type vboxsf), not configured for labeling [ 77.497646] SELinux: Context system_u:object_r:after_t is not valid (left unmapped). ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-03-25 16:39 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-03-15 10:54 lgetxattr()/getxattr() return different values on a file labelled with selinux disabled Thomas COUDRAY 2013-03-15 12:53 ` Stephen Smalley 2013-03-15 15:24 ` Thomas COUDRAY 2013-03-15 17:07 ` Stephen Smalley 2013-03-25 16:39 ` Thomas COUDRAY
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).