From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:42644 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727688AbgKCTC3 (ORCPT ); Tue, 3 Nov 2020 14:02:29 -0500 From: Sven Schnelle Subject: Re: [PATCH v3 1/1] selinux: fix error initialization in inode_doinit_with_dentry() References: <20201009013630.6777-1-rentianyue@tj.kylinos.cn> <20201009013630.6777-2-rentianyue@tj.kylinos.cn> Date: Tue, 03 Nov 2020 20:02:11 +0100 In-Reply-To: (Paul Moore's message of "Tue, 3 Nov 2020 12:11:08 -0500") Message-ID: MIME-Version: 1.0 Content-Type: text/plain List-ID: To: Paul Moore Cc: rentianyue@tj.kylinos.cn, Stephen Smalley , Eric Paris , Andreas Gruenbacher , yangzhao@kylinos.cn, selinux@vger.kernel.org, Tianyue Ren , linux-s390@vger.kernel.org, hca@linux.ibm.com, borntraeger@de.ibm.com Hi Paul, Paul Moore writes: > On Tue, Nov 3, 2020 at 8:14 AM Sven Schnelle wrote: >> Paul Moore writes: >> >> > On Thu, Oct 8, 2020 at 9:37 PM wrote: >> >> From: Tianyue Ren >> >> >> >> Mark the inode security label as invalid if we cannot find >> >> a dentry so that we will retry later rather than marking it >> >> initialized with the unlabeled SID. >> >> >> >> Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock") >> >> Signed-off-by: Tianyue Ren >> >> --- >> >> security/selinux/hooks.c | 19 ++++++++++++++++--- >> >> 1 file changed, 16 insertions(+), 3 deletions(-) >> > >> > Merged into selinux/next with some minor tweaks to the comments. >> > Thanks for your help! >> >> This seems to break booting on s390: >> >> Welcome to Fedora 32 (Thirty Two)! >> >> [ 1.434571] systemd[1]: Set hostname to >> [ 1.436839] audit: type=1400 audit(1604408868.681:4): avc: denied { write } for pid=1 comm="systemd" dev="cgroup2" ino=2 scontext=system_u:sys >> tem_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0 >> [ 1.436840] systemd[1]: Failed to create /init.scope control group: Permission denied >> [ 1.438039] systemd[1]: Failed to allocate manager object: Permission denied >> [ [0;1;31m!!!!!! [0m] Failed to allocate manager object. >> [ 1.438281] systemd[1]: Freezing execution. >> >> Any ideas? If i revert 83370b31a915493231e5b9addc72e4bef69f8d31 from >> linux-next-20201103 it works fine... > > Thanks for the report. > > Looking at this again, I'm thinking that setting the isec->initialized > field outside of the spinlock is probably a bad idea. My guess is > that your system is racing on inode_doinit_with_dentry() and the > initialized field is getting messed up. > > Any chance you could try the attached (completely untested) patch? Thanks for the patch. Unfortunately it doesn't seem to change anything for me. I can take a look into this tomorrow, but i don't know much about the internals of selinux, so i'm not sure whether i'm of much help. Regards Sven