* [PATCH userspace 0/2] Introduce an initial SID for early boot processes @ 2023-06-12 9:31 Ondrej Mosnacek 2023-06-12 9:31 ` [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings Ondrej Mosnacek 2023-06-12 9:31 ` [PATCH userspace 2/2] libsepol: add support for the new "init" initial SID Ondrej Mosnacek 0 siblings, 2 replies; 5+ messages in thread From: Ondrej Mosnacek @ 2023-06-12 9:31 UTC (permalink / raw) To: selinux These are userspace support patches corresponding to the following kernel patch submission: https://lore.kernel.org/selinux/20230612090145.1059245-1-omosnace@redhat.com/ The first patch merely removes the names of the discontinued initial SIDs. The second patch adds the new policy capability and re-adds the "init" initial SID's name as it's being reused for the new functionality added by the kernel patch. Ondrej Mosnacek (2): libsepol: stop translating deprecated intial SIDs to strings libsepol: add support for the new "init" initial SID libsepol/include/sepol/policydb/polcaps.h | 1 + libsepol/src/kernel_to_cil.c | 4 +-- libsepol/src/kernel_to_common.h | 34 +++++++++++------------ libsepol/src/kernel_to_conf.c | 4 +-- libsepol/src/module_to_cil.c | 2 +- libsepol/src/polcaps.c | 1 + 6 files changed, 24 insertions(+), 22 deletions(-) -- 2.40.1 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings 2023-06-12 9:31 [PATCH userspace 0/2] Introduce an initial SID for early boot processes Ondrej Mosnacek @ 2023-06-12 9:31 ` Ondrej Mosnacek 2023-06-23 19:10 ` James Carter 2023-06-12 9:31 ` [PATCH userspace 2/2] libsepol: add support for the new "init" initial SID Ondrej Mosnacek 1 sibling, 1 reply; 5+ messages in thread From: Ondrej Mosnacek @ 2023-06-12 9:31 UTC (permalink / raw) To: selinux Many of the initial SIDs are no longer used by the kernel, so translating them to the legacy names doesn't bring much value. Clear the legacy names from the table and let the code translate them to the fallback "unknown" names instead. Note that this only affects the generated text output when converting policies from binary to text form. The text policy languages let the policy define its own names for the initial SIDs based on the order in which they are declared, so the table is never used to convert from name to SID. Thus this is just a cosmetic change and has no functional impact. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> --- libsepol/src/kernel_to_cil.c | 4 ++-- libsepol/src/kernel_to_common.h | 36 ++++++++++++++++----------------- libsepol/src/kernel_to_conf.c | 4 ++-- libsepol/src/module_to_cil.c | 2 +- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c index e9cd89c2..bd04c087 100644 --- a/libsepol/src/kernel_to_cil.c +++ b/libsepol/src/kernel_to_cil.c @@ -567,7 +567,7 @@ static int write_sids_to_cil(FILE *out, const char *const *sid_to_str, for (isid = isids; isid != NULL; isid = isid->next) { i = isid->sid[0]; - if (i < num_sids) { + if (i < num_sids && sid_to_str[i]) { sid = (char *)sid_to_str[i]; } else { snprintf(unknown, 18, "%s%u", "UNKNOWN", i); @@ -2577,7 +2577,7 @@ static int write_sid_context_rules_to_cil(FILE *out, struct policydb *pdb, const for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { i = isid->sid[0]; - if (i < num_sids) { + if (i < num_sids && sid_to_str[i]) { sid = (char *)sid_to_str[i]; } else { snprintf(unknown, 18, "%s%u", "UNKNOWN", i); diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h index 159c4289..6073ff3a 100644 --- a/libsepol/src/kernel_to_common.h +++ b/libsepol/src/kernel_to_common.h @@ -13,33 +13,33 @@ // initial sid names aren't actually stored in the pp files, need to a have // a mapping, taken from the linux kernel static const char * const selinux_sid_to_str[] = { - "null", + NULL, "kernel", "security", "unlabeled", - "fs", + NULL, "file", - "file_labels", - "init", + NULL, + NULL, "any_socket", "port", "netif", "netmsg", "node", - "igmp_packet", - "icmp_socket", - "tcp_socket", - "sysctl_modprobe", - "sysctl", - "sysctl_fs", - "sysctl_kernel", - "sysctl_net", - "sysctl_net_unix", - "sysctl_vm", - "sysctl_dev", - "kmod", - "policy", - "scmp_packet", + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, "devnull", }; diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c index c48a7114..3be87184 100644 --- a/libsepol/src/kernel_to_conf.c +++ b/libsepol/src/kernel_to_conf.c @@ -464,7 +464,7 @@ static int write_sids_to_conf(FILE *out, const char *const *sid_to_str, for (isid = isids; isid != NULL; isid = isid->next) { i = isid->sid[0]; - if (i < num_sids) { + if (i < num_sids && sid_to_str[i]) { sid = (char *)sid_to_str[i]; } else { snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); @@ -2445,7 +2445,7 @@ static int write_sid_context_rules_to_conf(FILE *out, struct policydb *pdb, cons for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { i = isid->sid[0]; - if (i < num_sids) { + if (i < num_sids && sid_to_str[i]) { sid = (char *)sid_to_str[i]; } else { snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c index e7bc6ee6..a46775ca 100644 --- a/libsepol/src/module_to_cil.c +++ b/libsepol/src/module_to_cil.c @@ -2549,7 +2549,7 @@ static int ocontext_isid_to_cil(struct policydb *pdb, const char *const *sid_to_ for (isid = isids; isid != NULL; isid = isid->next) { i = isid->sid[0]; - if (i < num_sids) { + if (i < num_sids && sid_to_string[i]) { sid = (char*)sid_to_string[i]; } else { snprintf(unknown, 18, "%s%u", "UNKNOWN", i); -- 2.40.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings 2023-06-12 9:31 ` [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings Ondrej Mosnacek @ 2023-06-23 19:10 ` James Carter 2023-06-30 8:32 ` Petr Lautrbach 0 siblings, 1 reply; 5+ messages in thread From: James Carter @ 2023-06-23 19:10 UTC (permalink / raw) To: Ondrej Mosnacek; +Cc: selinux On Mon, Jun 12, 2023 at 5:50 AM Ondrej Mosnacek <omosnace@redhat.com> wrote: > > Many of the initial SIDs are no longer used by the kernel, so > translating them to the legacy names doesn't bring much value. Clear the > legacy names from the table and let the code translate them to the > fallback "unknown" names instead. > > Note that this only affects the generated text output when converting > policies from binary to text form. The text policy languages let the > policy define its own names for the initial SIDs based on the order in > which they are declared, so the table is never used to convert from name > to SID. Thus this is just a cosmetic change and has no functional > impact. > > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> For these two patches: Acked-by: James Carter <jwcart2@gmail.com> > --- > libsepol/src/kernel_to_cil.c | 4 ++-- > libsepol/src/kernel_to_common.h | 36 ++++++++++++++++----------------- > libsepol/src/kernel_to_conf.c | 4 ++-- > libsepol/src/module_to_cil.c | 2 +- > 4 files changed, 23 insertions(+), 23 deletions(-) > > diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c > index e9cd89c2..bd04c087 100644 > --- a/libsepol/src/kernel_to_cil.c > +++ b/libsepol/src/kernel_to_cil.c > @@ -567,7 +567,7 @@ static int write_sids_to_cil(FILE *out, const char *const *sid_to_str, > > for (isid = isids; isid != NULL; isid = isid->next) { > i = isid->sid[0]; > - if (i < num_sids) { > + if (i < num_sids && sid_to_str[i]) { > sid = (char *)sid_to_str[i]; > } else { > snprintf(unknown, 18, "%s%u", "UNKNOWN", i); > @@ -2577,7 +2577,7 @@ static int write_sid_context_rules_to_cil(FILE *out, struct policydb *pdb, const > > for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { > i = isid->sid[0]; > - if (i < num_sids) { > + if (i < num_sids && sid_to_str[i]) { > sid = (char *)sid_to_str[i]; > } else { > snprintf(unknown, 18, "%s%u", "UNKNOWN", i); > diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h > index 159c4289..6073ff3a 100644 > --- a/libsepol/src/kernel_to_common.h > +++ b/libsepol/src/kernel_to_common.h > @@ -13,33 +13,33 @@ > // initial sid names aren't actually stored in the pp files, need to a have > // a mapping, taken from the linux kernel > static const char * const selinux_sid_to_str[] = { > - "null", > + NULL, > "kernel", > "security", > "unlabeled", > - "fs", > + NULL, > "file", > - "file_labels", > - "init", > + NULL, > + NULL, > "any_socket", > "port", > "netif", > "netmsg", > "node", > - "igmp_packet", > - "icmp_socket", > - "tcp_socket", > - "sysctl_modprobe", > - "sysctl", > - "sysctl_fs", > - "sysctl_kernel", > - "sysctl_net", > - "sysctl_net_unix", > - "sysctl_vm", > - "sysctl_dev", > - "kmod", > - "policy", > - "scmp_packet", > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > + NULL, > "devnull", > }; > > diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c > index c48a7114..3be87184 100644 > --- a/libsepol/src/kernel_to_conf.c > +++ b/libsepol/src/kernel_to_conf.c > @@ -464,7 +464,7 @@ static int write_sids_to_conf(FILE *out, const char *const *sid_to_str, > > for (isid = isids; isid != NULL; isid = isid->next) { > i = isid->sid[0]; > - if (i < num_sids) { > + if (i < num_sids && sid_to_str[i]) { > sid = (char *)sid_to_str[i]; > } else { > snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); > @@ -2445,7 +2445,7 @@ static int write_sid_context_rules_to_conf(FILE *out, struct policydb *pdb, cons > > for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { > i = isid->sid[0]; > - if (i < num_sids) { > + if (i < num_sids && sid_to_str[i]) { > sid = (char *)sid_to_str[i]; > } else { > snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); > diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c > index e7bc6ee6..a46775ca 100644 > --- a/libsepol/src/module_to_cil.c > +++ b/libsepol/src/module_to_cil.c > @@ -2549,7 +2549,7 @@ static int ocontext_isid_to_cil(struct policydb *pdb, const char *const *sid_to_ > > for (isid = isids; isid != NULL; isid = isid->next) { > i = isid->sid[0]; > - if (i < num_sids) { > + if (i < num_sids && sid_to_string[i]) { > sid = (char*)sid_to_string[i]; > } else { > snprintf(unknown, 18, "%s%u", "UNKNOWN", i); > -- > 2.40.1 > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings 2023-06-23 19:10 ` James Carter @ 2023-06-30 8:32 ` Petr Lautrbach 0 siblings, 0 replies; 5+ messages in thread From: Petr Lautrbach @ 2023-06-30 8:32 UTC (permalink / raw) To: James Carter, Ondrej Mosnacek, selinux James Carter <jwcart2@gmail.com> writes: > On Mon, Jun 12, 2023 at 5:50 AM Ondrej Mosnacek <omosnace@redhat.com> wrote: >> >> Many of the initial SIDs are no longer used by the kernel, so >> translating them to the legacy names doesn't bring much value. Clear the >> legacy names from the table and let the code translate them to the >> fallback "unknown" names instead. >> >> Note that this only affects the generated text output when converting >> policies from binary to text form. The text policy languages let the >> policy define its own names for the initial SIDs based on the order in >> which they are declared, so the table is never used to convert from name >> to SID. Thus this is just a cosmetic change and has no functional >> impact. >> >> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> > > For these two patches: > Acked-by: James Carter <jwcart2@gmail.com> Both merged. Thanks! >> --- >> libsepol/src/kernel_to_cil.c | 4 ++-- >> libsepol/src/kernel_to_common.h | 36 ++++++++++++++++----------------- >> libsepol/src/kernel_to_conf.c | 4 ++-- >> libsepol/src/module_to_cil.c | 2 +- >> 4 files changed, 23 insertions(+), 23 deletions(-) >> >> diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c >> index e9cd89c2..bd04c087 100644 >> --- a/libsepol/src/kernel_to_cil.c >> +++ b/libsepol/src/kernel_to_cil.c >> @@ -567,7 +567,7 @@ static int write_sids_to_cil(FILE *out, const char *const *sid_to_str, >> >> for (isid = isids; isid != NULL; isid = isid->next) { >> i = isid->sid[0]; >> - if (i < num_sids) { >> + if (i < num_sids && sid_to_str[i]) { >> sid = (char *)sid_to_str[i]; >> } else { >> snprintf(unknown, 18, "%s%u", "UNKNOWN", i); >> @@ -2577,7 +2577,7 @@ static int write_sid_context_rules_to_cil(FILE *out, struct policydb *pdb, const >> >> for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { >> i = isid->sid[0]; >> - if (i < num_sids) { >> + if (i < num_sids && sid_to_str[i]) { >> sid = (char *)sid_to_str[i]; >> } else { >> snprintf(unknown, 18, "%s%u", "UNKNOWN", i); >> diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h >> index 159c4289..6073ff3a 100644 >> --- a/libsepol/src/kernel_to_common.h >> +++ b/libsepol/src/kernel_to_common.h >> @@ -13,33 +13,33 @@ >> // initial sid names aren't actually stored in the pp files, need to a have >> // a mapping, taken from the linux kernel >> static const char * const selinux_sid_to_str[] = { >> - "null", >> + NULL, >> "kernel", >> "security", >> "unlabeled", >> - "fs", >> + NULL, >> "file", >> - "file_labels", >> - "init", >> + NULL, >> + NULL, >> "any_socket", >> "port", >> "netif", >> "netmsg", >> "node", >> - "igmp_packet", >> - "icmp_socket", >> - "tcp_socket", >> - "sysctl_modprobe", >> - "sysctl", >> - "sysctl_fs", >> - "sysctl_kernel", >> - "sysctl_net", >> - "sysctl_net_unix", >> - "sysctl_vm", >> - "sysctl_dev", >> - "kmod", >> - "policy", >> - "scmp_packet", >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> + NULL, >> "devnull", >> }; >> >> diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c >> index c48a7114..3be87184 100644 >> --- a/libsepol/src/kernel_to_conf.c >> +++ b/libsepol/src/kernel_to_conf.c >> @@ -464,7 +464,7 @@ static int write_sids_to_conf(FILE *out, const char *const *sid_to_str, >> >> for (isid = isids; isid != NULL; isid = isid->next) { >> i = isid->sid[0]; >> - if (i < num_sids) { >> + if (i < num_sids && sid_to_str[i]) { >> sid = (char *)sid_to_str[i]; >> } else { >> snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); >> @@ -2445,7 +2445,7 @@ static int write_sid_context_rules_to_conf(FILE *out, struct policydb *pdb, cons >> >> for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { >> i = isid->sid[0]; >> - if (i < num_sids) { >> + if (i < num_sids && sid_to_str[i]) { >> sid = (char *)sid_to_str[i]; >> } else { >> snprintf(unknown, sizeof(unknown), "%s%u", "UNKNOWN", i); >> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c >> index e7bc6ee6..a46775ca 100644 >> --- a/libsepol/src/module_to_cil.c >> +++ b/libsepol/src/module_to_cil.c >> @@ -2549,7 +2549,7 @@ static int ocontext_isid_to_cil(struct policydb *pdb, const char *const *sid_to_ >> >> for (isid = isids; isid != NULL; isid = isid->next) { >> i = isid->sid[0]; >> - if (i < num_sids) { >> + if (i < num_sids && sid_to_string[i]) { >> sid = (char*)sid_to_string[i]; >> } else { >> snprintf(unknown, 18, "%s%u", "UNKNOWN", i); >> -- >> 2.40.1 >> ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH userspace 2/2] libsepol: add support for the new "init" initial SID 2023-06-12 9:31 [PATCH userspace 0/2] Introduce an initial SID for early boot processes Ondrej Mosnacek 2023-06-12 9:31 ` [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings Ondrej Mosnacek @ 2023-06-12 9:31 ` Ondrej Mosnacek 1 sibling, 0 replies; 5+ messages in thread From: Ondrej Mosnacek @ 2023-06-12 9:31 UTC (permalink / raw) To: selinux Resurrect the naming of the "init" initial SID, as it has been reintroduced in the kernel. Also add the new "userspace_initial_context" policy capability that is used to enable the new semantics for this initial SID. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> --- libsepol/include/sepol/policydb/polcaps.h | 1 + libsepol/src/kernel_to_common.h | 2 +- libsepol/src/polcaps.c | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h index f5e32e60..14bcc6cb 100644 --- a/libsepol/include/sepol/policydb/polcaps.h +++ b/libsepol/include/sepol/policydb/polcaps.h @@ -15,6 +15,7 @@ enum { POLICYDB_CAP_NNP_NOSUID_TRANSITION, POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS, POLICYDB_CAP_IOCTL_SKIP_CLOEXEC, + POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, __POLICYDB_CAP_MAX }; #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1) diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h index 6073ff3a..5d927a3d 100644 --- a/libsepol/src/kernel_to_common.h +++ b/libsepol/src/kernel_to_common.h @@ -20,7 +20,7 @@ static const char * const selinux_sid_to_str[] = { NULL, "file", NULL, - NULL, + "init", "any_socket", "port", "netif", diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c index 687e971c..be12580a 100644 --- a/libsepol/src/polcaps.c +++ b/libsepol/src/polcaps.c @@ -14,6 +14,7 @@ static const char * const polcap_names[] = { "nnp_nosuid_transition", /* POLICYDB_CAP_NNP_NOSUID_TRANSITION */ "genfs_seclabel_symlinks", /* POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS */ "ioctl_skip_cloexec", /* POLICYDB_CAP_IOCTL_SKIP_CLOEXEC */ + "userspace_initial_context", /* POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT */ NULL }; -- 2.40.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-06-30 8:33 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-06-12 9:31 [PATCH userspace 0/2] Introduce an initial SID for early boot processes Ondrej Mosnacek 2023-06-12 9:31 ` [PATCH userspace 1/2] libsepol: stop translating deprecated intial SIDs to strings Ondrej Mosnacek 2023-06-23 19:10 ` James Carter 2023-06-30 8:32 ` Petr Lautrbach 2023-06-12 9:31 ` [PATCH userspace 2/2] libsepol: add support for the new "init" initial SID Ondrej Mosnacek
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox