IronPort-PHdr: =?us-ascii?q?9a23=3APsYEVxzl3dptO/PXCy+O+j09IxM/srCxBDY+r6Qd?=
 =?us-ascii?q?0ukfLfad9pjvdHbS+e9qxAeQG9mDsrQf06GJ6ujJYi8p2d65qncMcZhBBVcuqP?=
 =?us-ascii?q?49uEgeOvODElDxN/XwbiY3T4xoXV5h+GynYwAOQJ6tL1LdrWev4jEMBx7xKRR6?=
 =?us-ascii?q?JvjvGo7Vks+7y/2+94fcbglUmTaxe71/IAm5oQjTq8UdnJdvJLs2xhbVuHVDZv?=
 =?us-ascii?q?5YxXlvJVKdnhb84tm/8Zt++ClOuPwv6tBNX7zic6s3UbJXAjImM3so5MLwrhnM?=
 =?us-ascii?q?URGP5noHXWoIlBdDHhXI4wv7Xpf1tSv6q/Z91SyHNsD4Ubw4RTKv5LpwRRT2lC?=
 =?us-ascii?q?kIKSI28GDPisxxkq1bpg6hpwdiyILQeY2ZKeZycr/Ycd4cS2VBRMJRXDFfDI26?=
 =?us-ascii?q?YYUEEu4NMf9Go4XholcDqwa1CwuxC+P10jJGhWL4060k3eovEw7G0gsgEM4Jvn?=
 =?us-ascii?q?vbo9v4L7sSXOOvwaXU1zjPc/Fb1DHg44bIaBAhpvSMUKptf8rN10YvDwPFgUuW?=
 =?us-ascii?q?qYf4Ij2V0/4Cs2yf7+V+VeOklmkqqxpsrTi03coslonIiZ4VylDD7yl5xp01Ks?=
 =?us-ascii?q?eiRE50Zt6kDoJduieHPIV1WsMvW3xktSk1x7EcuZO3YTIGxIooyhLBcfCLbo6F?=
 =?us-ascii?q?6Q/5WumLOzd3nndldaq6hxa17Eev1PXxVtKx0FZWtipFlcTMtmwV2xzT9MeHTv?=
 =?us-ascii?q?x981+92TmVzQDT6/xEIVsumarHK58u3r4wlp0JvUTFAiD2g1n5gLWTdkUl/uik?=
 =?us-ascii?q?8+XnYrP4qZ+AL4J4lw7zP6s0lsG/HOg0KBYCUmeF9eimybHv5Uj5T69Ljv0ynK?=
 =?us-ascii?q?nZqpfaJcEDq66iHgBVyZ0u6wq/Dji60NQYmmMLLFReeB2dlYTpNFbOIO7gAfel?=
 =?us-ascii?q?n1usiCtrx+zBPrD5BpXNL37DkKrufLpk6E5T1hAzzdZB6JJQEbwBPv3zVVHrtN?=
 =?us-ascii?q?DCDR82LRa0w+D5B9V5zI8eXniPAqCBOqPIrVCI/v4vI/WLZIINoDb9L+Iq5+Py?=
 =?us-ascii?q?jX8jglASZ7Kk3YEJZ3+lHvRpOVmZbWDwjdcGFGcAphA+Q/DyiF2eTT5TYG6/X6?=
 =?us-ascii?q?Yi5jEhEo2pFpnMSZy2jbybwii0A51WaXpaClyWDXjocICEUe8WaC2OOs9hjiAE?=
 =?us-ascii?q?Vb+5RoA82xChrgv6y6FnLufP4C0Xq4/s1Nhv6O3Pjx096Tt0D8GF2WGXU250hn?=
 =?us-ascii?q?8IRyMx3K1nv0N90k2M0bJ5g/xDDtFT/+lGUh07NZ7H1+x6D8r9VR7fcduTT1am?=
 =?us-ascii?q?WNqmCykrTt0t298Of1p9G9K6gxDbxSWqHrsVmqeTBJMu76Lc22H9J8N6y3bBzq?=
 =?us-ascii?q?kukUMqTddINW2jnqR/7RTcB5bVk0WFkKanbaQd0zTL9GeMz2qOvUFYUAl2UaXK?=
 =?us-ascii?q?QHwSfUvWrcnj6ULMUbCuCK4rPRdGyc6HeeN2bYj4hFNJRvbjP9LRKzagkmG/Bx?=
 =?us-ascii?q?eIwbWDNaLqZmwC0SSbA08BxURbt26PKAwWHi68pyfbCzt0GBTkZEamub1moW6/?=
 =?us-ascii?q?Zlc90gXPakpmzbfz8RkQ07jUAf4L16gFow85oi91B0651tnbTd2aqEApKKhEaM?=
 =?us-ascii?q?k8+39f3HjYrBR5N5etaad4iQhaO05sskfv0QhnIplRmsgt6nUxxUx9LrzSmAda?=
 =?us-ascii?q?ejeZ243gEqHGIWn1uha0YujZ3U+IlJ6686EO5fBwiR3ctQWyFgJ2/2pu18JV+2?=
 =?us-ascii?q?GR6pXDEEwZVpenFg4T6htzvPnkeCA36oicgXlyK6C+vzTqwd8lBOI5jB2neoEb?=
 =?us-ascii?q?eJuJCBW6N8QHG9KkIecq0wyxahsZIPpY/YYuMs+mfufA06muarVOhjWj2F9b7Z?=
 =?us-ascii?q?h930TEzC91TurFzt5R2P2D9heWXDf7ylG6u4b4np4SNmJaJXa21SWxXN0ZXaZ1?=
 =?us-ascii?q?Z4teTD70e8A=3D?=
Message-ID: <1513178296.19161.8.camel@tycho.nsa.gov>
Subject: Re: [BUG]kernel softlockup due to sidtab_search_context run for
 long time because of too many sidtab context node
From: Stephen Smalley <sds@tycho.nsa.gov>
To: yangjihong <yangjihong1@huawei.com>,
        "paul@paul-moore.com" <paul@paul-moore.com>,
        "eparis@parisplace.org" <eparis@parisplace.org>,
        "selinux@tycho.nsa.gov" <selinux@tycho.nsa.gov>,
        Daniel J Walsh <dwalsh@redhat.com>, Lukas Vrabec <lvrabec@redhat.com>,
        Petr Lautrbach <plautrba@redhat.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Date: Wed, 13 Dec 2017 10:18:16 -0500
In-Reply-To: <1BC3DBD98AD61A4A9B2569BC1C0B4437D5D1F3@DGGEMM506-MBS.china.huawei.com>
References: <1BC3DBD98AD61A4A9B2569BC1C0B4437D5D1F3@DGGEMM506-MBS.china.huawei.com>
Organization: National Security Agency
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 4688
Lines: 91

On Wed, 2017-12-13 at 09:25 +0000, yangjihong wrote:
> Hello, 
> 
> I am doing stressing testing on 3.10 kernel(centos 7.4), to
> constantly starting numbers of docker ontainers with selinux enabled,
> and after about 2 days, the kernel softlockup panic:
>  <IRQ>  [<ffffffff810bb778>] sched_show_task+0xb8/0x120
>  [<ffffffff8116133f>] show_lock_info+0x20f/0x3a0
>  [<ffffffff811226aa>] watchdog_timer_fn+0x1da/0x2f0
>  [<ffffffff811224d0>] ? watchdog_enable_all_cpus.part.4+0x40/0x40
>  [<ffffffff810abf82>] __hrtimer_run_queues+0xd2/0x260
>  [<ffffffff810ac520>] hrtimer_interrupt+0xb0/0x1e0
>  [<ffffffff8104a477>] local_apic_timer_interrupt+0x37/0x60
>  [<ffffffff8166fd90>] smp_apic_timer_interrupt+0x50/0x140
>  [<ffffffff8166e1dd>] apic_timer_interrupt+0x6d/0x80
>  <EOI>  [<ffffffff812b4193>] ? sidtab_context_to_sid+0xb3/0x480
>  [<ffffffff812b41f0>] ? sidtab_context_to_sid+0x110/0x480
>  [<ffffffff812c0d15>] ? mls_setup_user_range+0x145/0x250
>  [<ffffffff812bd477>] security_get_user_sids+0x3f7/0x550
>  [<ffffffff812b1a8b>] sel_write_user+0x12b/0x210
>  [<ffffffff812b1960>] ? sel_write_member+0x200/0x200
>  [<ffffffff812b01d8>] selinux_transaction_write+0x48/0x80
>  [<ffffffff811f444d>] vfs_write+0xbd/0x1e0
>  [<ffffffff811f4eef>] SyS_write+0x7f/0xe0
>  [<ffffffff8166d433>] system_call_fastpath+0x16/0x1b
> 
> My opinion:
> when the docker container starts, it would mount overlay filesystem
> with different selinux context, mount point such as: 
> overlay on
> /var/lib/docker/overlay2/be3ef517730d92fc4530e0e952eae4f6cb0f07b4bc32
> 6cb07495ca08fc9ddb66/merged type overlay
> (rw,relatime,context="system_u:object_r:svirt_sandbox_file_t:s0:c414,
> c873",lowerdir=/var/lib/docker/overlay2/l/Z4U7WY6ASNV5CFWLADPARHHWY7:
> /var/lib/docker/overlay2/l/V2S3HOKEFEOQLHBVAL5WLA3YLS:/var/lib/docker
> /overlay2/l/46YGYO474KLOULZGDSZDW2JPRI,upperdir=/var/lib/docker/overl
> ay2/be3ef517730d92fc4530e0e952eae4f6cb0f07b4bc326cb07495ca08fc9ddb66/
> diff,workdir=/var/lib/docker/overlay2/be3ef517730d92fc4530e0e952eae4f
> 6cb0f07b4bc326cb07495ca08fc9ddb66/work)
> shm on
> /var/lib/docker/containers/9fd65e177d2132011d7b422755793449c91327ca57
> 7b8f5d9d6a4adf218d4876/shm type tmpfs
> (rw,nosuid,nodev,noexec,relatime,context="system_u:object_r:svirt_san
> dbox_file_t:s0:c414,c873",size=65536k)
> overlay on
> /var/lib/docker/overlay2/38d1544d080145c7d76150530d0255991dfb7258cbca
> 14ff6d165b94353eefab/merged type overlay
> (rw,relatime,context="system_u:object_r:svirt_sandbox_file_t:s0:c431,
> c651",lowerdir=/var/lib/docker/overlay2/l/3MQQXB4UCLFB7ANVRHPAVRCRSS:
> /var/lib/docker/overlay2/l/46YGYO474KLOULZGDSZDW2JPRI,upperdir=/var/l
> ib/docker/overlay2/38d1544d080145c7d76150530d0255991dfb7258cbca14ff6d
> 165b94353eefab/diff,workdir=/var/lib/docker/overlay2/38d1544d080145c7
> d76150530d0255991dfb7258cbca14ff6d165b94353eefab/work)
> shm on
> /var/lib/docker/containers/662e7f798fc08b09eae0f0f944537a4bcedc1dcf05
> a65866458523ffd4a71614/shm type tmpfs
> (rw,nosuid,nodev,noexec,relatime,context="system_u:object_r:svirt_san
> dbox_file_t:s0:c431,c651",size=65536k)
> 
> sidtab_search_context check the context whether is in the sidtab
> list, If not found, a new node is generated and insert into the list,
> As the number of containers is increasing,  context nodes are also
> more and more, we tested the final number of nodes reached 300,000 +,
> sidtab_context_to_sid runtime needs 100-200ms, which will lead to the
> system softlockup.
> 
> Is this a selinux bug? When filesystem umount, why context node is
> not deleted?  I cannot find the relevant function to delete the node
> in sidtab.c
> 
> Thanks for reading and looking forward to your reply.

So, does docker just keep allocating a unique category set for every
new container, never reusing them even if the container is destroyed? 
That would be a bug in docker IMHO.  Or are you creating an unbounded
number of containers and never destroying the older ones?

On the selinux userspace side, we'd also like to eliminate the use of
/sys/fs/selinux/user (sel_write_user -> security_get_user_sids)
entirely, which is what triggered this for you.

We cannot currently delete a sidtab node because we have no way of
knowing if there are any lingering references to the SID.  Fixing that
would require reference-counted SIDs, which goes beyond just SELinux
since SIDs/secids are returned by LSM hooks and cached in other kernel
data structures.

sidtab_search_context() could no doubt be optimized for the negative
case; there was an earlier optimization for the positive case by adding
a cache to sidtab_context_to_sid() prior to calling it.  It's a reverse
lookup in the sidtab.