IronPort-PHdr: =?us-ascii?q?9a23=3A4HDjohdiQo1gbbi67zSCzsfOlGMj4u6mDksu8pMi?=
 =?us-ascii?q?zoh2WeGdxc25YhyN2/xhgRfzUJnB7Loc0qyN4vCmAzJLv8fJmUtBWaQEbwUCh8?=
 =?us-ascii?q?QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYdFRrlKAV6?=
 =?us-ascii?q?OPn+FJLMgMSrzeCy/IDYbxlViDanb75/KBa7oR/PusQXjodvK6I8wQbVr3VVfO?=
 =?us-ascii?q?hb2XlmLk+JkRbm4cew8p9j8yBOtP8k6sVNT6b0cbkmQLJBFDgpPHw768PttRnY?=
 =?us-ascii?q?UAuA/WAcXXkMkhpJGAfK8hf3VYrsvyTgt+p93C6aPdDqTb0xRD+v4btnRAPuhS?=
 =?us-ascii?q?waLDMy7n3ZhdJsg6JauBKhpgJww4jIYIGOKfFyerrRcc4GSWZdW8pcUSJOApm4?=
 =?us-ascii?q?b4ASEeQPO+hWpJT5q1cXsBeyGQygCeXywTFKm3D2x7U33ec8Hw/GwgIuEdABsH?=
 =?us-ascii?q?rTrNrpM6kdXu+7wbLUzTjAdf5axS3w5JTKfx0nvPqCXahwcc3UyUQ3Cg3Fkkuf?=
 =?us-ascii?q?qZTlPzyL0OQGrnWV7+96WuKrj24otQFwqSWoy8c3l4bJnZkYykzE9CplwIY1Is?=
 =?us-ascii?q?e0SEhgYdG+CpdQuCaaN5VvT84kXmpmtiE6yrgctp66eigH0JsnxxnYa/yId4iH?=
 =?us-ascii?q?/AnjVOGMITdimH1qZqiziAq18UilzOD3S8q60E5SoyZYndTBuWoB2hzO5sSdVP?=
 =?us-ascii?q?dw8Vmt1SyS2w3V9+pKO1o7lbDBJJ4k2rMwk50TvlndESLug0X2ibOWdl0j+ui1?=
 =?us-ascii?q?9+TrerXmqYGYN49zkgz+Lr4hmta+AeQlKQgCRXSb+OSg273j+k31WrNKgeEtkq?=
 =?us-ascii?q?bFqpzaIMUbpqqhDw9U1IYs9Qq/Ai+73NkXknQLNlJIdA+dg4T3NFzCPur0Aeqn?=
 =?us-ascii?q?j1SpijhrxvTGPrP7ApXKK3jOiKzhcqtm60NH1AoyzcxQ55JTCr0bJvLzQVX+uM?=
 =?us-ascii?q?bXDh8+LQy42/znB8ll1oMCRWKPBbeUP77TsV+N5+IvP/OMZY8OuDb9MPUl6Pnu?=
 =?us-ascii?q?jXg2mV8ZY6alx4cYaHe9Hv5+OUWWfWLsgssdEWcNpgc+T/Llh0OZUTFPYHayWK?=
 =?us-ascii?q?E86yo0CIKhCofDSYStj6Kb0CinGZ1WY3hMCkqQHnfwa4WER/AMZTqUIs9nkTwJ?=
 =?us-ascii?q?TrehS4gm1RGhsA/11aBrIfbT+i0drZjjzsR65/XPlREu8jx5F8Cd02CLT2FpkW?=
 =?us-ascii?q?IEXjw2075loUx71FiD1bN1g+JXFdNN/fNFSAQ6OoDGz+x8Fd/yXhjNftCTSFap?=
 =?us-ascii?q?Wt+mGy0+Tsotw98SZEZwA9aigQ7Z3yqsHbAVk6WHBIAq/a3G2nj8PNxyy3Db26?=
 =?us-ascii?q?k7iFkmQ9ZAOXe6ia548gjZH5TJnFmBl6a2aaQc2zbA9GWdwmqAskFYThV9UarC?=
 =?us-ascii?q?XXAYaUvWqcr26lneQL+pDLQtKhFBxtKaKqtWdt3pik1LRPXkONTeZWK9gXywBQ?=
 =?us-ascii?q?qVxrOIcIrren4Q3CHcCEgCiQ8T53GGORI5Bie7rGLUFCZuGk73Y0Pw7el+r2u2?=
 =?us-ascii?q?TlcuwAGXa01szKK19QQIhfyYUv8T27UEuCA7qzpqBlqyw9XWC9/T7zZmKZ1VfN?=
 =?us-ascii?q?d1xVBAz2+R4xR0I5iIN6l/ghsbdANtsgXl0BAhTs1ilsgs5Eg20Q5uO+rM0lRB?=
 =?us-ascii?q?cXWDwY30Jq//Lmj09QqoLanM1QeamPSb9KkV5eVwlVzlsAyzXnE+9Hh/m41X3n?=
 =?us-ascii?q?WS+L3FCw0dVZ+3WUEyoVwyjrfWeC4868v32GdqPK38jjLL3pp9B+Y/zBukOstS?=
 =?us-ascii?q?OaasHQn+CcobC46lL+l8yHazaRdRB/xf7K45OYudcvKC3KO6dLJ7kCmOkXVM4I?=
 =?us-ascii?q?c71FmFsSV7VLibjN4+3/iE017fBH/Hh1C7v5WywNkcaA=3D=3D?=
Message-ID: <1499695041.7580.1.camel@tycho.nsa.gov>
Subject: Re: [Regression?] "selinux: add a map permission check for mmap"
 causing AOSP to fail booting
From: Stephen Smalley <sds@tycho.nsa.gov>
To: Paul Moore <paul@paul-moore.com>, John Stultz <john.stultz@linaro.org>,
        Jeffrey Vander Stoep <jeffv@google.com>,
        Android Kernel Team <kernel-team@android.com>
Cc: lkml <linux-kernel@vger.kernel.org>, Nick Kralevich <nnk@google.com>,
        Kees Cook <keescook@google.com>, Dmitry Shmidt <dimitrysh@google.com>
Date: Mon, 10 Jul 2017 09:57:21 -0400
In-Reply-To: <CAHC9VhT0MS9bRAYqMJ6aB+LQXBD3Jpj2sDDOM2gV9vBm5eZK9w@mail.gmail.com>
References: <CALAqxLUoN5tkqBwQVMrFDxDuqJATsj583UGB2xKNbrOHsdwXtg@mail.gmail.com>
         <CAHC9VhQk1BYzoBvKLEukHcgdpFjUeXTE2PVU_2yz1fcV5O4Phw@mail.gmail.com>
         <CAHC9VhT0MS9bRAYqMJ6aB+LQXBD3Jpj2sDDOM2gV9vBm5eZK9w@mail.gmail.com>
Organization: National Security Agency
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 4514
Lines: 107

On Thu, 2017-07-06 at 10:36 -0400, Paul Moore wrote:
> On Thu, Jul 6, 2017 at 9:30 AM, Paul Moore <paul@paul-moore.com>
> wrote:
> > On Thu, Jul 6, 2017 at 1:32 AM, John Stultz <john.stultz@linaro.org
> > > wrote:
> > > Hey folks,
> > >    I updated my HiKey kernel tree to linus/master today and it
> > > stopped
> > > booting (hitting errors at init and reseting immediately into
> > > bootloader mode):
> > > 
> > > [    5.289827] init: Skipped setting INIT_AVB_VERSION (not in
> > > recovery mode)
> > > [    5.296709] init: Loading SELinux policy
> > > [    5.334521] SELinux:  Permission validate_trans in class
> > > security
> > > not defined in policy.
> > > [    5.342828] SELinux:  Permission map in class file not defined
> > > in policy.
> > > [    5.349690] SELinux:  Permission map in class dir not defined
> > > in policy.
> > > [    5.356464] SELinux:  Permission map in class lnk_file not
> > > defined in policy.
> > > [    5.363666] SELinux:  Permission map in class chr_file not
> > > defined in policy.
> > > [    5.370870] SELinux:  Permission map in class blk_file not
> > > defined in policy.
> > > [    5.378070] SELinux:  Permission map in class sock_file not
> > > defined
> > > in policy.
> > > [    5.385351] SELinux:  Permission map in class fifo_file not
> > > defined
> > > in policy.
> > > [    5.392647] SELinux:  Permission map in class socket not
> > > defined in policy.
> > > [    5.399670] SELinux:  Permission map in class tcp_socket not
> > > defined in policy.
> > > [    5.407042] SELinux:  Permission map in class udp_socket not
> > > defined in policy.
> > > [    5.414415] SELinux:  Permission map in class rawip_socket not
> > > defined in policy.
> > > [    5.421969] SELinux:  Permission map in class netlink_socket
> > > not
> > > defined in policy.
> > > ...
> > > [    5.850590] SELinux: the above unknown classes and permissions
> > > will be denied
> > > [    5.892283] audit: type=1403 audit(104.182:2): policy loaded
> > > auid=4294967295 ses=4294967295
> > > [    5.892510] selinux: SELinux: Loaded policy from /sepolicy
> > > [    5.892510]
> > > [    5.907690] audit: type=1404 audit(104.183:3): enforcing=1
> > > old_enforcing=0 auid=4294967295 ses=4294967295
> > > [    5.911853] selinux: selinux_android_file_context: Error
> > > getting
> > > file context handle (Permission denied)
> > > [    5.911853]
> > > [    5.911968] init: execv("/init") failed: Permission denied
> > > [    5.911987] init: Security failure...
> > > [    5.912008] init: panic: rebooting to bootloader
> > > [    5.912034] init: Reboot start, reason: reboot, rebootTarget:
> > > bootloader
> > > 
> > > 
> > > I bisected the issue down to 3ba4bf5f1e2c (selinux: add a map
> > > permission check for mmap).
> > > 
> > > It seems every -rc1 I hit something like this w/ selinux, and
> > > sometimes it is just that I need to fix my sepolicy files, but
> > > I'm not
> > > really sure which this one is.
> > > 
> > > Reverting the identified commit allows things to boot normally.
> > 
> > Hello,
> > 
> > The short version is that this is the expected behavior given your
> > SELinux policy configuration and isn't a regression; your SELinux
> > policy is configured to not be overly permissive when new access
> > control points are introduced and that is what it is doing.
> > 
> > The slightly longer version is that your SELinux policy is set to
> > deny
> > access to any new object classes or permissions that are not
> > defined
> > in the policy, and we can see from your boot output your SELinux
> > policy does not define the new "map" permission for a number of
> > object
> > classes.  The solution is to either update your SELinux policy to
> > include the SELinux policy, or to allow unknown object classes and
> > permissions.
> > 
> > What distribution are you running (where are you getting your
> > SELinux
> > policy and userspace)?  I would suggest starting a conversation
> > there,
> > I'm happy to lend a hand if you need some help explaining the
> > situation.
> 
> I'm sorry, I just realized you mentioned AOSP in the subject line ...
> In that case Jeffery and the rest of the Android folks are a good
> place to start, hopefully they will chime in on this thread with
> their
> plans for supporting these newer kernel features.

Try this change to your policy:
https://android-review.googlesource.com/#/c/432339/