Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230511123213.722912-1-cgzones@googlemail.com>
 <6301fdfd0927df2b2fd7a4f2b384e477.paul@paul-moore.com> <CAHC9VhSSA04wzPFgx_Z4jf1gOdEO40hU-augjMqX1uGd-eHLQA@mail.gmail.com>
In-Reply-To: <CAHC9VhSSA04wzPFgx_Z4jf1gOdEO40hU-augjMqX1uGd-eHLQA@mail.gmail.com>
From:   =?UTF-8?Q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com>
Date:   Tue, 23 May 2023 20:25:25 +0200
Message-ID: <CAJ2a_DeJhGcXBtVfuOp3xeUNxJyFR4QG-+5=4Q_38go+v6d9-A@mail.gmail.com>
Subject: Re: [PATCH] selinux: deprecated fs ocon
To:     Paul Moore <paul@paul-moore.com>
Cc:     selinux@vger.kernel.org,
        Stephen Smalley <stephen.smalley.work@gmail.com>,
        Eric Paris <eparis@parisplace.org>,
        Xiu Jianfeng <xiujianfeng@huawei.com>,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, 18 May 2023 at 22:18, Paul Moore <paul@paul-moore.com> wrote:
>
> On Thu, May 18, 2023 at 1:56=E2=80=AFPM Paul Moore <paul@paul-moore.com> =
wrote:
> > On May 11, 2023 =3D?UTF-8?q?Christian=3D20G=3DC3=3DB6ttsche?=3D <cgzone=
s@googlemail.com> wrote:
> > >
> > > The object context type `fs`, not to be confused with the well used
> > > object context type `fscon`, was introduced in the initial git commit
> > > 1da177e4c3f4 ("Linux-2.6.12-rc2") but never actually used since.
> > >
> > > The paper "A Security Policy Configuration for the Security-Enhanced
> > > Linux" [1] mentions it under `7.2 File System Contexts` but also stat=
es:
> > >
> > >     Currently, this configuration is unused.
> > >
> > > The policy statement defining such object contexts is `fscon`, e.g.:
> > >
> > >     fscon 2 3 gen_context(system_u:object_r:conA_t,s0) gen_context(sy=
stem_u:object_r:conB_t,s0)
> > >
> > > It is not documented at selinuxproject.org or in the SELinux notebook
> > > and not supported by the Reference Policy buildsystem - the statement=
 is
> > > not properly sorted - and thus not used in the Reference or Fedora
> > > Policy.
> > >
> > > Print a warning message at policy load for each such object context:
> > >
> > >     SELinux:  void and deprecated fs ocon 02:03
> > >
> > > This topic was initially highlighted by Nicolas Iooss [2].
> > >
> > > [1]: https://media.defense.gov/2021/Jul/29/2002815735/-1/-1/0/SELINUX=
-SECURITY-POLICY-CONFIGURATION-REPORT.PDF
> > > [2]: https://lore.kernel.org/selinux/CAJfZ7=3DmP2eJaq2BfO3y0VnwUJaY2c=
S2p=3DHZMN71z1pKjzaT0Eg@mail.gmail.com/
> > >
> > > Signed-off-by: Christian G=C3=B6ttsche <cgzones@googlemail.com>
> > > ---
> > >  security/selinux/ss/policydb.c | 4 ++++
> > >  security/selinux/ss/policydb.h | 2 +-
> > >  2 files changed, 5 insertions(+), 1 deletion(-)
> >
> > Thanks, this is a nice catch, although some minor suggestions below ...
> >
> > > diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/pol=
icydb.c
> > > index 97c0074f9312..31b08b34c722 100644
> > > --- a/security/selinux/ss/policydb.c
> > > +++ b/security/selinux/ss/policydb.c
> > > @@ -2257,6 +2257,10 @@ static int ocontext_read(struct policydb *p, c=
onst struct policydb_compat_info *
> > >                               if (rc)
> > >                                       goto out;
> > >
> > > +                             if (i =3D=3D OCON_FS)
> > > +                                     pr_warn("SELinux:  void and dep=
recated fs ocon %s\n",
> > > +                                             c->u.name);
> >
> > Instead of having to check if 'i =3D=3D OCON_FS', why not simply put th=
e
> > pr_warn() call up in the OCON_FS case block on line ~2249 and let it
> > continue to fallthrough to the OCON_NETIF block?
>
> Bah, nevermind, you need to leave it here because of the 'c->u.name'
> in the pr_warn().  If you're okay with me adjusting the deprecation
> comment (below) during the merge I'll can merge this now ... ?

Yes, please feel free to adjust the inline comment.

>
> > >                               rc =3D context_read_and_validate(&c->co=
ntext[0], p, fp);
> > >                               if (rc)
> > >                                       goto out;
> > > diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/pol=
icydb.h
> > > index ffc4e7bad205..39cd6222e1a8 100644
> > > --- a/security/selinux/ss/policydb.h
> > > +++ b/security/selinux/ss/policydb.h
> > > @@ -225,7 +225,7 @@ struct genfs {
> > >
> > >  /* object context array indices */
> > >  #define OCON_ISID    0 /* initial SIDs */
> > > -#define OCON_FS              1 /* unlabeled file systems */
> > > +#define OCON_FS              1 /* unlabeled file systems (deprecated=
 in 6.5) */
> >
> > Since you are likely re-spinning this (see above), I would just leave
> > it as "(deprecated)"; those that want to know where it was deprecated
> > can always check the git log/tags.
> >
> > >  #define OCON_PORT    2 /* TCP and UDP port numbers */
> > >  #define OCON_NETIF   3 /* network interfaces */
> > >  #define OCON_NODE    4 /* nodes */
> > > --
> > > 2.40.1
>
> --
> paul-moore.com