BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Ondrej Mosnáček]

Hello Android binder maintainers,

Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
which turns out to cause the binder tests of selinux-testsuite [2] to
fail.

Minimal reproducer (no SELinux involved):
# git clone https://github.com/SELinuxProject/selinux-testsuite
# cd selinux-testsuite/tests/binder
# make
# ./init_binder.sh
# setenforce 0   ### <-- may be needed if SELinux is enabled
# ./manager -n &
# sleep 1
# ./service_provider -n &
# sleep 1
# ./client -n -c -r 3
Client ioctl BINDER_WRITE_READ error: Invalid argument
#

With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.

The issue reproduces even on a kernel compiled from commit
eafedbc7c050, so it seems to date back to the origin of the Rust
implementation. I'm not sure if it's a bug in the new kernel code or
some bug/wrong assumption in the testsuite code - can you please look
into it?

Thanks,
Ondrej

[1] https://gitlab.com/cki-project/kernel-ark/-/commit/c12a0ae360f154fcffc0dd72381550391f77793c
[2] https://github.com/SELinuxProject/selinux-testsuite

Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Greg Kroah-Hartman]

On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> Hello Android binder maintainers,
> 
> Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> which turns out to cause the binder tests of selinux-testsuite [2] to
> fail.
> 
> Minimal reproducer (no SELinux involved):
> # git clone https://github.com/SELinuxProject/selinux-testsuite
> # cd selinux-testsuite/tests/binder
> # make
> # ./init_binder.sh
> # setenforce 0   ### <-- may be needed if SELinux is enabled
> # ./manager -n &
> # sleep 1
> # ./service_provider -n &
> # sleep 1
> # ./client -n -c -r 3
> Client ioctl BINDER_WRITE_READ error: Invalid argument
> #
> 
> With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> 
> The issue reproduces even on a kernel compiled from commit
> eafedbc7c050, so it seems to date back to the origin of the Rust
> implementation. I'm not sure if it's a bug in the new kernel code or
> some bug/wrong assumption in the testsuite code - can you please look
> into it?

Given that the "real" binder client works, perhaps the test is wrong and
should be fixed?

thanks,

greg k-h

Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Alice Ryhl]

On Sun, Oct 18, 2026 at 06:53:49PM +0200, Greg Kroah-Hartman wrote:
> On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> > Hello Android binder maintainers,
> > 
> > Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> > which turns out to cause the binder tests of selinux-testsuite [2] to
> > fail.
> > 
> > Minimal reproducer (no SELinux involved):
> > # git clone https://github.com/SELinuxProject/selinux-testsuite
> > # cd selinux-testsuite/tests/binder
> > # make
> > # ./init_binder.sh
> > # setenforce 0   ### <-- may be needed if SELinux is enabled
> > # ./manager -n &
> > # sleep 1
> > # ./service_provider -n &
> > # sleep 1
> > # ./client -n -c -r 3
> > Client ioctl BINDER_WRITE_READ error: Invalid argument
> > #
> > 
> > With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> > 
> > The issue reproduces even on a kernel compiled from commit
> > eafedbc7c050, so it seems to date back to the origin of the Rust
> > implementation. I'm not sure if it's a bug in the new kernel code or
> > some bug/wrong assumption in the testsuite code - can you please look
> > into it?
> 
> Given that the "real" binder client works, perhaps the test is wrong and
> should be fixed?

Apparently there is a divergence of behavior if the SELinux permission
`binder { impersonate }` is granted to a process, though Android never
uses this permission anywhere.

Thanks for the report.

Alice

Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Stephen Smalley]

On Mon, Oct 19, 2026 at 12:58 PM Alice Ryhl <aliceryhl@google.com> wrote:
>
> On Sun, Oct 18, 2026 at 06:53:49PM +0200, Greg Kroah-Hartman wrote:
> > On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> > > Hello Android binder maintainers,
> > >
> > > Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> > > which turns out to cause the binder tests of selinux-testsuite [2] to
> > > fail.
> > >
> > > Minimal reproducer (no SELinux involved):
> > > # git clone https://github.com/SELinuxProject/selinux-testsuite
> > > # cd selinux-testsuite/tests/binder
> > > # make
> > > # ./init_binder.sh
> > > # setenforce 0   ### <-- may be needed if SELinux is enabled
> > > # ./manager -n &
> > > # sleep 1
> > > # ./service_provider -n &
> > > # sleep 1
> > > # ./client -n -c -r 3
> > > Client ioctl BINDER_WRITE_READ error: Invalid argument
> > > #
> > >
> > > With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> > >
> > > The issue reproduces even on a kernel compiled from commit
> > > eafedbc7c050, so it seems to date back to the origin of the Rust
> > > implementation. I'm not sure if it's a bug in the new kernel code or
> > > some bug/wrong assumption in the testsuite code - can you please look
> > > into it?
> >
> > Given that the "real" binder client works, perhaps the test is wrong and
> > should be fixed?
>
> Apparently there is a divergence of behavior if the SELinux permission
> `binder { impersonate }` is granted to a process, though Android never
> uses this permission anywhere.
>
> Thanks for the report.

I would treat Android as authoritative here and fix the
selinux-testsuite to match unless you think there is an actual bug in
the Rust driver.
We originally implemented the binder impersonate check just to make
sure no one ever impersonated a different sender without us noticing.

Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Paul Moore]

On Mon, Oct 19, 2026 at 2:33 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
> On Mon, Oct 19, 2026 at 12:58 PM Alice Ryhl <aliceryhl@google.com> wrote:
> > On Sun, Oct 18, 2026 at 06:53:49PM +0200, Greg Kroah-Hartman wrote:
> > > On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> > > > Hello Android binder maintainers,
> > > >
> > > > Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> > > > which turns out to cause the binder tests of selinux-testsuite [2] to
> > > > fail.
> > > >
> > > > Minimal reproducer (no SELinux involved):
> > > > # git clone https://github.com/SELinuxProject/selinux-testsuite
> > > > # cd selinux-testsuite/tests/binder
> > > > # make
> > > > # ./init_binder.sh
> > > > # setenforce 0   ### <-- may be needed if SELinux is enabled
> > > > # ./manager -n &
> > > > # sleep 1
> > > > # ./service_provider -n &
> > > > # sleep 1
> > > > # ./client -n -c -r 3
> > > > Client ioctl BINDER_WRITE_READ error: Invalid argument
> > > > #
> > > >
> > > > With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> > > >
> > > > The issue reproduces even on a kernel compiled from commit
> > > > eafedbc7c050, so it seems to date back to the origin of the Rust
> > > > implementation. I'm not sure if it's a bug in the new kernel code or
> > > > some bug/wrong assumption in the testsuite code - can you please look
> > > > into it?
> > >
> > > Given that the "real" binder client works, perhaps the test is wrong and
> > > should be fixed?
> >
> > Apparently there is a divergence of behavior if the SELinux permission
> > `binder { impersonate }` is granted to a process, though Android never
> > uses this permission anywhere.
> >
> > Thanks for the report.
>
> I would treat Android as authoritative here and fix the
> selinux-testsuite to match unless you think there is an actual bug in
> the Rust driver.
> We originally implemented the binder impersonate check just to make
> sure no one ever impersonated a different sender without us noticing.

Unless someone knows of any other widespread Binder users, I tend to
agree with Stephen that we should treat Android as the standard at the
present time.  I may have missed it, but has anyone posted a fix for
the test?  We're at -rc1 now and we really should get the test fixed
soon ...

-- 
paul-moore.com

Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Stephen Smalley]

On Mon, Nov 2, 2026 at 7:47 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Mon, Oct 19, 2026 at 2:33 PM Stephen Smalley
> <stephen.smalley.work@gmail.com> wrote:
> > On Mon, Oct 19, 2026 at 12:58 PM Alice Ryhl <aliceryhl@google.com> wrote:
> > > On Sun, Oct 18, 2026 at 06:53:49PM +0200, Greg Kroah-Hartman wrote:
> > > > On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> > > > > Hello Android binder maintainers,
> > > > >
> > > > > Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> > > > > which turns out to cause the binder tests of selinux-testsuite [2] to
> > > > > fail.
> > > > >
> > > > > Minimal reproducer (no SELinux involved):
> > > > > # git clone https://github.com/SELinuxProject/selinux-testsuite
> > > > > # cd selinux-testsuite/tests/binder
> > > > > # make
> > > > > # ./init_binder.sh
> > > > > # setenforce 0   ### <-- may be needed if SELinux is enabled
> > > > > # ./manager -n &
> > > > > # sleep 1
> > > > > # ./service_provider -n &
> > > > > # sleep 1
> > > > > # ./client -n -c -r 3
> > > > > Client ioctl BINDER_WRITE_READ error: Invalid argument
> > > > > #
> > > > >
> > > > > With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> > > > >
> > > > > The issue reproduces even on a kernel compiled from commit
> > > > > eafedbc7c050, so it seems to date back to the origin of the Rust
> > > > > implementation. I'm not sure if it's a bug in the new kernel code or
> > > > > some bug/wrong assumption in the testsuite code - can you please look
> > > > > into it?
> > > >
> > > > Given that the "real" binder client works, perhaps the test is wrong and
> > > > should be fixed?
> > >
> > > Apparently there is a divergence of behavior if the SELinux permission
> > > `binder { impersonate }` is granted to a process, though Android never
> > > uses this permission anywhere.
> > >
> > > Thanks for the report.
> >
> > I would treat Android as authoritative here and fix the
> > selinux-testsuite to match unless you think there is an actual bug in
> > the Rust driver.
> > We originally implemented the binder impersonate check just to make
> > sure no one ever impersonated a different sender without us noticing.
>
> Unless someone knows of any other widespread Binder users, I tend to
> agree with Stephen that we should treat Android as the standard at the
> present time.  I may have missed it, but has anyone posted a fix for
> the test?  We're at -rc1 now and we really should get the test fixed
> soon ...

I have now posted a fix for the selinux-testsuite at:
https://lore.kernel.org/selinux/20261110153110.29256-1-stephen.smalley.work@gmail.com/T/#u

I didn't cc the kernel binder maintainers since it is specific to the
selinux-testsuite but certainly if any of you see a problem, please
let me know.