2023-05-11 12:44:26

by Christian Göttsche

Subject: [PATCH] selinux: deprecated fs ocon

The object context type `fs`, not to be confused with the well used
object context type `fscon`, was introduced in the initial git commit
1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.

The paper "A Security Policy Configuration for the Security-Enhanced
Linux" [1] mentions it under `7.2 File System Contexts` but also states:

Currently, this configuration is unused.

The policy statement defining such object contexts is `fscon`, e.g.:

fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(system_u:object_r:conB_t,s0)

It is not documented at selinuxproject.org or in the SELinux notebook
and not supported by the Reference Policy buildsystem - the statement is
not properly sorted - and thus not used in the Reference or Fedora
Policy.

Print a warning message at policy load for each such object context:

SELinux: void and deprecated fs ocon 02:03

This topic was initially highlighted by Nicolas Iooss [2].

[1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
[2]: https://lore.kernel.org/selinux/CAJfZ7=mP2eJaq2BfO3y0VnwUJaY2cS2p=HZMN71z1pKjzaT0Eg@mail.gmail.com/

Signed-off-by: Christian Göttsche <[email protected]>
---
security/selinux/ss/policydb.c | 4 ++++
security/selinux/ss/policydb.h | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 97c0074f9312..31b08b34c722 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, const struct policydb_compat_info *
if (rc)
goto out;

+ if (i == OCON_FS)
+ pr_warn("SELinux: void and deprecated fs ocon %s\n",
+ c->u.name);
+
rc = context_read_and_validate(&c->context[0], p, fp);
if (rc)
goto out;
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index ffc4e7bad205..39cd6222e1a8 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -225,7 +225,7 @@ struct genfs {

/* object context array indices */
#define OCON_ISID 0 /* initial SIDs */
-#define OCON_FS 1 /* unlabeled file systems */
+#define OCON_FS 1 /* unlabeled file systems (deprecated in 6.5) */
#define OCON_PORT 2 /* TCP and UDP port numbers */
#define OCON_NETIF 3 /* network interfaces */
#define OCON_NODE 4 /* nodes */
--
2.40.1

2023-05-18 18:15:17

by Paul Moore

Subject: Re: [PATCH] selinux: deprecated fs ocon

On May 11, 2023 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <[email protected]> wrote:
>
> The object context type `fs`, not to be confused with the well used
> object context type `fscon`, was introduced in the initial git commit
> 1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.
>
> The paper "A Security Policy Configuration for the Security-Enhanced
> Linux" [1] mentions it under `7.2 File System Contexts` but also states:
>
> Currently, this configuration is unused.
>
> The policy statement defining such object contexts is `fscon`, e.g.:
>
> fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(system_u:object_r:conB_t,s0)
>
> It is not documented at selinuxproject.org or in the SELinux notebook
> and not supported by the Reference Policy buildsystem - the statement is
> not properly sorted - and thus not used in the Reference or Fedora
> Policy.
>
> Print a warning message at policy load for each such object context:
>
> SELinux: void and deprecated fs ocon 02:03
>
> This topic was initially highlighted by Nicolas Iooss [2].
>
> [1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
> [2]: https://lore.kernel.org/selinux/CAJfZ7=mP2eJaq2BfO3y0VnwUJaY2cS2p=HZMN71z1pKjzaT0Eg@mail.gmail.com/
>
> Signed-off-by: Christian Göttsche <[email protected]>
> ---
> security/selinux/ss/policydb.c | 4 ++++
> security/selinux/ss/policydb.h | 2 +-
> 2 files changed, 5 insertions(+), 1 deletion(-)

Thanks, this is a nice catch, although some minor suggestions below ...

> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> index 97c0074f9312..31b08b34c722 100644
> --- a/security/selinux/ss/policydb.c
> +++ b/security/selinux/ss/policydb.c
> @@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, const struct policydb_compat_info *
> if (rc)
> goto out;
>
> + if (i == OCON_FS)
> + pr_warn("SELinux: void and deprecated fs ocon %s\n",
> + c->u.name);

Instead of having to check if 'i == OCON_FS', why not simply put the
pr_warn() call up in the OCON_FS case block on line ~2249 and let it
continue to fallthrough to the OCON_NETIF block?

> rc = context_read_and_validate(&c->context[0], p, fp);
> if (rc)
> goto out;
> diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
> index ffc4e7bad205..39cd6222e1a8 100644
> --- a/security/selinux/ss/policydb.h
> +++ b/security/selinux/ss/policydb.h
> @@ -225,7 +225,7 @@ struct genfs {
>
> /* object context array indices */
> #define OCON_ISID 0 /* initial SIDs */
> -#define OCON_FS 1 /* unlabeled file systems */
> +#define OCON_FS 1 /* unlabeled file systems (deprecated in 6.5) */

Since you are likely re-spinning this (see above), I would just leave
it as "(deprecated)"; those that want to know where it was deprecated
can always check the git log/tags.

> #define OCON_PORT 2 /* TCP and UDP port numbers */
> #define OCON_NETIF 3 /* network interfaces */
> #define OCON_NODE 4 /* nodes */
> --
> 2.40.1

--
paul-moore.com

2023-05-18 20:49:38

by Paul Moore

Subject: Re: [PATCH] selinux: deprecated fs ocon

On Thu, May 18, 2023 at 1:56 PM Paul Moore <[email protected]> wrote:
> On May 11, 2023 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <[email protected]> wrote:
> >
> > The object context type `fs`, not to be confused with the well used
> > object context type `fscon`, was introduced in the initial git commit
> > 1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.
> >
> > The paper "A Security Policy Configuration for the Security-Enhanced
> > Linux" [1] mentions it under `7.2 File System Contexts` but also states:
> >
> > Currently, this configuration is unused.
> >
> > The policy statement defining such object contexts is `fscon`, e.g.:
> >
> > fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(system_u:object_r:conB_t,s0)
> >
> > It is not documented at selinuxproject.org or in the SELinux notebook
> > and not supported by the Reference Policy buildsystem - the statement is
> > not properly sorted - and thus not used in the Reference or Fedora
> > Policy.
> >
> > Print a warning message at policy load for each such object context:
> >
> > SELinux: void and deprecated fs ocon 02:03
> >
> > This topic was initially highlighted by Nicolas Iooss [2].
> >
> > [1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
> > [2]: https://lore.kernel.org/selinux/CAJfZ7=mP2eJaq2BfO3y0VnwUJaY2cS2p=HZMN71z1pKjzaT0Eg@mail.gmail.com/
> >
> > Signed-off-by: Christian Göttsche <[email protected]>
> > ---
> > security/selinux/ss/policydb.c | 4 ++++
> > security/selinux/ss/policydb.h | 2 +-
> > 2 files changed, 5 insertions(+), 1 deletion(-)
>
> Thanks, this is a nice catch, although some minor suggestions below ...
>
> > diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> > index 97c0074f9312..31b08b34c722 100644
> > --- a/security/selinux/ss/policydb.c
> > +++ b/security/selinux/ss/policydb.c
> > @@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, const struct policydb_compat_info *
> > if (rc)
> > goto out;
> >
> > + if (i == OCON_FS)
> > + pr_warn("SELinux: void and deprecated fs ocon %s\n",
> > + c->u.name);
>
> Instead of having to check if 'i == OCON_FS', why not simply put the
> pr_warn() call up in the OCON_FS case block on line ~2249 and let it
> continue to fallthrough to the OCON_NETIF block?

Bah, nevermind, you need to leave it here because of the 'c->u.name'
in the pr_warn(). If you're okay with me adjusting the deprecation
comment (below) during the merge I'll can merge this now ... ?

> > rc = context_read_and_validate(&c->context[0], p, fp);
> > if (rc)
> > goto out;
> > diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
> > index ffc4e7bad205..39cd6222e1a8 100644
> > --- a/security/selinux/ss/policydb.h
> > +++ b/security/selinux/ss/policydb.h
> > @@ -225,7 +225,7 @@ struct genfs {
> >
> > /* object context array indices */
> > #define OCON_ISID 0 /* initial SIDs */
> > -#define OCON_FS 1 /* unlabeled file systems */
> > +#define OCON_FS 1 /* unlabeled file systems (deprecated in 6.5) */
>
> Since you are likely re-spinning this (see above), I would just leave
> it as "(deprecated)"; those that want to know where it was deprecated
> can always check the git log/tags.
>
> > #define OCON_PORT 2 /* TCP and UDP port numbers */
> > #define OCON_NETIF 3 /* network interfaces */
> > #define OCON_NODE 4 /* nodes */
> > --
> > 2.40.1

--
paul-moore.com

2023-05-23 18:31:06

by Christian Göttsche

Subject: Re: [PATCH] selinux: deprecated fs ocon

On Thu, 18 May 2023 at 22:18, Paul Moore <[email protected]> wrote:
>
> On Thu, May 18, 2023 at 1:56 PM Paul Moore <[email protected]> wrote:
> > On May 11, 2023 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <[email protected]> wrote:
> > >
> > > The object context type `fs`, not to be confused with the well used
> > > object context type `fscon`, was introduced in the initial git commit
> > > 1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.
> > >
> > > The paper "A Security Policy Configuration for the Security-Enhanced
> > > Linux" [1] mentions it under `7.2 File System Contexts` but also states:
> > >
> > > Currently, this configuration is unused.
> > >
> > > The policy statement defining such object contexts is `fscon`, e.g.:
> > >
> > > fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(system_u:object_r:conB_t,s0)
> > >
> > > It is not documented at selinuxproject.org or in the SELinux notebook
> > > and not supported by the Reference Policy buildsystem - the statement is
> > > not properly sorted - and thus not used in the Reference or Fedora
> > > Policy.
> > >
> > > Print a warning message at policy load for each such object context:
> > >
> > > SELinux: void and deprecated fs ocon 02:03
> > >
> > > This topic was initially highlighted by Nicolas Iooss [2].
> > >
> > > [1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
> > > [2]: https://lore.kernel.org/selinux/CAJfZ7=mP2eJaq2BfO3y0VnwUJaY2cS2p=HZMN71z1pKjzaT0Eg@mail.gmail.com/
> > >
> > > Signed-off-by: Christian Göttsche <[email protected]>
> > > ---
> > > security/selinux/ss/policydb.c | 4 ++++
> > > security/selinux/ss/policydb.h | 2 +-
> > > 2 files changed, 5 insertions(+), 1 deletion(-)
> >
> > Thanks, this is a nice catch, although some minor suggestions below ...
> >
> > > diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> > > index 97c0074f9312..31b08b34c722 100644
> > > --- a/security/selinux/ss/policydb.c
> > > +++ b/security/selinux/ss/policydb.c
> > > @@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, const struct policydb_compat_info *
> > > if (rc)
> > > goto out;
> > >
> > > + if (i == OCON_FS)
> > > + pr_warn("SELinux: void and deprecated fs ocon %s\n",
> > > + c->u.name);
> >
> > Instead of having to check if 'i == OCON_FS', why not simply put the
> > pr_warn() call up in the OCON_FS case block on line ~2249 and let it
> > continue to fallthrough to the OCON_NETIF block?
>
> Bah, nevermind, you need to leave it here because of the 'c->u.name'
> in the pr_warn(). If you're okay with me adjusting the deprecation
> comment (below) during the merge I'll can merge this now ... ?

Yes, please feel free to adjust the inline comment.

>
> > > rc = context_read_and_validate(&c->context[0], p, fp);
> > > if (rc)
> > > goto out;
> > > diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
> > > index ffc4e7bad205..39cd6222e1a8 100644
> > > --- a/security/selinux/ss/policydb.h
> > > +++ b/security/selinux/ss/policydb.h
> > > @@ -225,7 +225,7 @@ struct genfs {
> > >
> > > /* object context array indices */
> > > #define OCON_ISID 0 /* initial SIDs */
> > > -#define OCON_FS 1 /* unlabeled file systems */
> > > +#define OCON_FS 1 /* unlabeled file systems (deprecated in 6.5) */
> >
> > Since you are likely re-spinning this (see above), I would just leave
> > it as "(deprecated)"; those that want to know where it was deprecated
> > can always check the git log/tags.
> >
> > > #define OCON_PORT 2 /* TCP and UDP port numbers */
> > > #define OCON_NETIF 3 /* network interfaces */
> > > #define OCON_NODE 4 /* nodes */
> > > --
> > > 2.40.1
>
> --
> paul-moore.com

2023-05-23 20:34:47

by Paul Moore

Subject: Re: [PATCH] selinux: deprecated fs ocon

On Tue, May 23, 2023 at 2:25 PM Christian Göttsche
<[email protected]> wrote:
> On Thu, 18 May 2023 at 22:18, Paul Moore <[email protected]> wrote:
> > On Thu, May 18, 2023 at 1:56 PM Paul Moore <[email protected]> wrote:
> > > On May 11, 2023 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <[email protected]> wrote:
> > > >
> > > > The object context type `fs`, not to be confused with the well used
> > > > object context type `fscon`, was introduced in the initial git commit
> > > > 1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.
> > > >
> > > > The paper "A Security Policy Configuration for the Security-Enhanced
> > > > Linux" [1] mentions it under `7.2 File System Contexts` but also states:
> > > >
> > > > Currently, this configuration is unused.
> > > >
> > > > The policy statement defining such object contexts is `fscon`, e.g.:
> > > >
> > > > fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(system_u:object_r:conB_t,s0)
> > > >
> > > > It is not documented at selinuxproject.org or in the SELinux notebook
> > > > and not supported by the Reference Policy buildsystem - the statement is
> > > > not properly sorted - and thus not used in the Reference or Fedora
> > > > Policy.
> > > >
> > > > Print a warning message at policy load for each such object context:
> > > >
> > > > SELinux: void and deprecated fs ocon 02:03
> > > >
> > > > This topic was initially highlighted by Nicolas Iooss [2].
> > > >
> > > > [1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
> > > > [2]: https://lore.kernel.org/selinux/CAJfZ7=mP2eJaq2BfO3y0VnwUJaY2cS2p=HZMN71z1pKjzaT0Eg@mail.gmail.com/
> > > >
> > > > Signed-off-by: Christian Göttsche <[email protected]>
> > > > ---
> > > > security/selinux/ss/policydb.c | 4 ++++
> > > > security/selinux/ss/policydb.h | 2 +-
> > > > 2 files changed, 5 insertions(+), 1 deletion(-)
> > >
> > > Thanks, this is a nice catch, although some minor suggestions below ...
> > >
> > > > diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> > > > index 97c0074f9312..31b08b34c722 100644
> > > > --- a/security/selinux/ss/policydb.c
> > > > +++ b/security/selinux/ss/policydb.c
> > > > @@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, const struct policydb_compat_info *
> > > > if (rc)
> > > > goto out;
> > > >
> > > > + if (i == OCON_FS)
> > > > + pr_warn("SELinux: void and deprecated fs ocon %s\n",
> > > > + c->u.name);
> > >
> > > Instead of having to check if 'i == OCON_FS', why not simply put the
> > > pr_warn() call up in the OCON_FS case block on line ~2249 and let it
> > > continue to fallthrough to the OCON_NETIF block?
> >
> > Bah, nevermind, you need to leave it here because of the 'c->u.name'
> > in the pr_warn(). If you're okay with me adjusting the deprecation
> > comment (below) during the merge I'll can merge this now ... ?
>
> Yes, please feel free to adjust the inline comment.

Okay, done and merged into selinux/next, thanks.

--
paul-moore.com