Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752876AbdGFFcG (ORCPT ); Thu, 6 Jul 2017 01:32:06 -0400 Received: from mail-qk0-f176.google.com ([209.85.220.176]:34173 "EHLO mail-qk0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751059AbdGFFcF (ORCPT ); Thu, 6 Jul 2017 01:32:05 -0400 MIME-Version: 1.0 From: John Stultz Date: Wed, 5 Jul 2017 22:32:04 -0700 Message-ID: Subject: [Regression?] "selinux: add a map permission check for mmap" causing AOSP to fail booting To: Stephen Smalley , Paul Moore Cc: Jeffrey Vander Stoep , lkml , Android Kernel Team , Nick Kralevich , Kees Cook , Dmitry Shmidt Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2417 Lines: 57 Hey folks, I updated my HiKey kernel tree to linus/master today and it stopped booting (hitting errors at init and reseting immediately into bootloader mode): [ 5.289827] init: Skipped setting INIT_AVB_VERSION (not in recovery mode) [ 5.296709] init: Loading SELinux policy [ 5.334521] SELinux: Permission validate_trans in class security not defined in policy. [ 5.342828] SELinux: Permission map in class file not defined in policy. [ 5.349690] SELinux: Permission map in class dir not defined in policy. [ 5.356464] SELinux: Permission map in class lnk_file not defined in policy. [ 5.363666] SELinux: Permission map in class chr_file not defined in policy. [ 5.370870] SELinux: Permission map in class blk_file not defined in policy. [ 5.378070] SELinux: Permission map in class sock_file not defined in policy. [ 5.385351] SELinux: Permission map in class fifo_file not defined in policy. [ 5.392647] SELinux: Permission map in class socket not defined in policy. [ 5.399670] SELinux: Permission map in class tcp_socket not defined in policy. [ 5.407042] SELinux: Permission map in class udp_socket not defined in policy. [ 5.414415] SELinux: Permission map in class rawip_socket not defined in policy. [ 5.421969] SELinux: Permission map in class netlink_socket not defined in policy. ... [ 5.850590] SELinux: the above unknown classes and permissions will be denied [ 5.892283] audit: type=1403 audit(104.182:2): policy loaded auid=4294967295 ses=4294967295 [ 5.892510] selinux: SELinux: Loaded policy from /sepolicy [ 5.892510] [ 5.907690] audit: type=1404 audit(104.183:3): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 [ 5.911853] selinux: selinux_android_file_context: Error getting file context handle (Permission denied) [ 5.911853] [ 5.911968] init: execv("/init") failed: Permission denied [ 5.911987] init: Security failure... [ 5.912008] init: panic: rebooting to bootloader [ 5.912034] init: Reboot start, reason: reboot, rebootTarget: bootloader I bisected the issue down to 3ba4bf5f1e2c (selinux: add a map permission check for mmap). It seems every -rc1 I hit something like this w/ selinux, and sometimes it is just that I need to fix my sepolicy files, but I'm not really sure which this one is. Reverting the identified commit allows things to boot normally. Ideas? thanks -john