Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
In-Reply-To: <202106141503.B3144DFE@keescook>
References: <20210608171221.276899-1-keescook@chromium.org>
 <20210614100234.12077-1-youling257@gmail.com> <202106140826.7912F27CD@keescook>
 <202106140941.7CE5AE64@keescook> <CAOzgRdZJeN6sQWP=Ou0H3bTrp+7ijKuJikG-f4eer5f1oVjrCQ@mail.gmail.com>
 <202106141503.B3144DFE@keescook>
From:   youling 257 <youling257@gmail.com>
Date:   Tue, 15 Jun 2021 09:55:35 +0800
Message-ID: <CAOzgRdahaEjtk4jS5N=FQEDbsZVnB+-=xD+-WtV9zD9Tgbm0Hg@mail.gmail.com>
Subject: Re: [PATCH] proc: Track /proc/$pid/attr/ opener mm_struct
To:     Kees Cook <keescook@chromium.org>
Cc:     torvalds@linux-foundation.org, christian.brauner@ubuntu.com,
        andrea.righi@canonical.com, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org, regressions@lists.linux.dev,
        linux-security-module@vger.kernel.org,
        Paul Moore <paul@paul-moore.com>,
        Stephen Smalley <stephen.smalley.work@gmail.com>,
        SElinux list <selinux@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

if try to find problem on userspace, i used linux 5.13rc6 on old
android 7 cm14.1, not aosp android 11.
http://git.osdn.net/view?p=android-x86/system-core.git;a=blob;f=init/service.cpp;h=a5334f447fc2fc34453d2f6a37523bedccadc690;hb=refs/heads/cm-14.1-x86#l457

 457         if (!seclabel_.empty()) {
 458             if (setexeccon(seclabel_.c_str()) < 0) {
 459                 ERROR("cannot setexeccon('%s'): %s\n",
 460                       seclabel_.c_str(), strerror(errno));
 461                 _exit(127);
 462             }
 463         }

2021-06-15 6:50 GMT+08:00, Kees Cook <keescook@chromium.org>:
> On Tue, Jun 15, 2021 at 02:46:19AM +0800, youling 257 wrote:
>> I test this patch cause "init: cannot setexeccon(u:r:ueventd:s0)
>> operation not permitted.
>> init ctrl_write_limited.
>
> Thanks for testing!
>
> This appears to come from here:
> https://github.com/aosp-mirror/platform_system_core/blob/master/init/service.cpp#L242
>
>
> In setexeccon(), I see (pid=0, attr="exec"):
>
>         fd = openattr(pid, attr, O_RDWR | O_CLOEXEC);
> ...
>                         ret = write(fd, context2, strlen(context2) + 1);
> ...
>         close(fd);
>
>
> and openattr() is doing:
> ...
>                 rc = asprintf(&path, "/proc/thread-self/attr/%s", attr);
>                 if (rc < 0)
>                         return -1;
>                 fd = open(path, flags | O_CLOEXEC);
> ...
>
> I'm not sure how the above could fail. (mm_access() always allows
> introspection...)
>
> The only way I can understand the check failing is if a process did:
>
> open, exec, write
>
> But setexeccon() is not doing anything between the open and the write...
>
> I will keep looking...
>
> -Kees
>
> --
> Kees Cook
>