Hi,
I encounter trouble that I can't explain when labelling my files.
Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on
an ext4 fs):
0 - have a regular file "f", with a "before_t" security.selinux attribute
1 - reboot with selinux=0
2 - change the label to "after_t" (setfattr or chcon)
3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n
security.selinux" (who calls getxattr(2)) show "after_t"
4 - reboot with selinux enabled
5 - now ls prints "before_t", and getfattr "after_t".
I ran a small test that calls both syscalls (lgetxattr/getxattr), I
get "before_t" as expected
If I touch /.autorelabel, both ls/getfattr give "before_t".
--
Thomas Coudray
On 03/15/2013 06:54 AM, Thomas COUDRAY wrote:
> Hi,
> I encounter trouble that I can't explain when labelling my files.
> Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on
> an ext4 fs):
> 0 - have a regular file "f", with a "before_t" security.selinux attribute
> 1 - reboot with selinux=0
> 2 - change the label to "after_t" (setfattr or chcon)
> 3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n
> security.selinux" (who calls getxattr(2)) show "after_t"
> 4 - reboot with selinux enabled
> 5 - now ls prints "before_t", and getfattr "after_t".
>
> I ran a small test that calls both syscalls (lgetxattr/getxattr), I
> get "before_t" as expected
> If I touch /.autorelabel, both ls/getfattr give "before_t".
f is truly a regular file and not a symlink pointing to a regular file?
before_t and after_t are both defined in the policy?
before_t and after_t are not type aliases of each other?
What are the credentials (capabilities and SELinux security
context/permissions) of the process running the ls and getfattr commands?
Any relevant messages from SELinux in dmesg output?
2013/3/15 Stephen Smalley <[email protected]>:
> f is truly a regular file and not a symlink pointing to a regular file?
f is a truly regular file.
> before_t and after_t are both defined in the policy?
Only before_t was defined in the policy.
When I define after_t in the policy, both commands return the same
label (after_t).
But I wouldn't expect this to make a difference in the output of both
commands (as the only visible difference is lgetxattr() vs getxattr())
> before_t and after_t are not type aliases of each other?
They are not.
> What are the credentials (capabilities and SELinux security
> context/permissions) of the process running the ls and getfattr commands?
It has unconfined_u:unconfined_r:before_t label with before_t type.
Same as the file f.
The process has full SELinux rights on both command and file.
> Any relevant messages from SELinux in dmesg output?
No avc warnings in dmesg and audit.log. All looks good.
--
Thomas Coudray
On 03/15/2013 11:24 AM, Thomas COUDRAY wrote:
> 2013/3/15 Stephen Smalley <[email protected]>:
>> f is truly a regular file and not a symlink pointing to a regular file?
>
> f is a truly regular file.
>
>> before_t and after_t are both defined in the policy?
>
> Only before_t was defined in the policy.
If not defined in policy, then kernel should remap to unlabeled sid
context.
> When I define after_t in the policy, both commands return the same
> label (after_t).
> But I wouldn't expect this to make a difference in the output of both
> commands (as the only visible difference is lgetxattr() vs getxattr())
getxattr security.* results are supplied by the security module rather
than the filesystem to allow the value to be canonicalized. But this
should happen the same for lgetxattr and getxattr; those should only
differ if the file is a symlink.
>> before_t and after_t are not type aliases of each other?
>
> They are not.
>
>> What are the credentials (capabilities and SELinux security
>> context/permissions) of the process running the ls and getfattr commands?
>
> It has unconfined_u:unconfined_r:before_t label with before_t type.
> Same as the file f.
> The process has full SELinux rights on both command and file.
Did it run as root? Does it have :capability2 mac_override permission?
>> Any relevant messages from SELinux in dmesg output?
>
> No avc warnings in dmesg and audit.log. All looks good.
What about SELinux: messages? e.g. SELinux: Context ... is not valid
(left unmapped).
2013/3/15 Stephen Smalley <[email protected]>:
> On 03/15/2013 11:24 AM, Thomas COUDRAY wrote:
>>
>> 2013/3/15 Stephen Smalley <[email protected]>:
>>> before_t and after_t are both defined in the policy?
>>
>> Only before_t was defined in the policy.
>
> If not defined in policy, then kernel should remap to unlabeled sid context.
That is not the case.
>>> What are the credentials (capabilities and SELinux security
>>> context/permissions) of the process running the ls and getfattr commands?
>> It has unconfined_u:unconfined_r:before_t label with before_t type.
>> Same as the file f.
>> The process has full SELinux rights on both command and file.
>
> Did it run as root? Does it have :capability2 mac_override permission?
When I run it as root, both commands return the same label.
The process has mac_override, mac_admin and syslog permission on f.
>>> Any relevant messages from SELinux in dmesg output?
>>
>> No avc warnings in dmesg and audit.log. All looks good.
>
> What about SELinux: messages? e.g. SELinux: Context ... is not valid (left
> unmapped).
>
You're right.
> SELinux: Context system_u:object_r:after_t is not valid (left unmapped).
I'm using the modular-base-policy from notebook-source.
--
Thomas Coudray
[ 0.021583] SELinux: Initializing.
[ 0.021978] SELinux: Starting in permissive mode
[ 0.765100] EVM: security.selinux
[ 1.037649] SELinux: Registering netfilter hooks
[ 4.374957] SELinux: 32 avtab hash slots, 82 rules.
[ 4.374966] SELinux: 32 avtab hash slots, 82 rules.
[ 4.374968] SELinux: 2 users, 2 roles, 2 types, 0 bools
[ 4.374969] SELinux: 82 classes, 82 rules
[ 4.375041] SELinux: Completing initialization.
[ 4.375042] SELinux: Setting up existing superblocks.
[ 4.375045] SELinux: initialized (dev sysfs, type sysfs), not
configured for labeling
[ 4.375047] SELinux: initialized (dev rootfs, type rootfs), not
configured for labeling
[ 4.375122] SELinux: initialized (dev bdev, type bdev), not
configured for labeling
[ 4.375125] SELinux: initialized (dev proc, type proc), uses genfs_contexts
[ 4.375129] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[ 4.375132] SELinux: initialized (dev devtmpfs, type devtmpfs), not
configured for labeling
[ 4.375188] SELinux: initialized (dev debugfs, type debugfs), not
configured for labeling
[ 4.375594] SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
[ 4.375596] SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
[ 4.375598] SELinux: initialized (dev anon_inodefs, type
anon_inodefs), not configured for labeling
[ 4.375600] SELinux: initialized (dev devpts, type devpts), uses
transition SIDs
[ 4.375603] SELinux: initialized (dev hugetlbfs, type hugetlbfs),
uses transition SIDs
[ 4.375605] SELinux: initialized (dev mqueue, type mqueue), uses
transition SIDs
[ 4.375607] SELinux: initialized (dev selinuxfs, type selinuxfs),
uses genfs_contexts
[ 4.375614] SELinux: initialized (dev securityfs, type securityfs),
not configured for labeling
[ 4.375616] SELinux: initialized (dev sysfs, type sysfs), not
configured for labeling
[ 4.375746] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[ 4.375804] SELinux: initialized (dev sda1, type ext4), uses xattr
[ 4.929828] SELinux: initialized (dev fusectl, type fusectl), not
configured for labeling
[ 4.934859] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[ 4.936117] SELinux: initialized (dev tmpfs, type tmpfs), uses
transition SIDs
[ 6.926947] SELinux: initialized (dev rpc_pipefs, type rpc_pipefs),
not configured for labeling
[ 17.550807] SELinux: initialized (dev vboxsf, type vboxsf), not
configured for labeling
[ 77.497646] SELinux: Context system_u:object_r:after_t is not
valid (left unmapped).