Subject: Re: [PATCH] Label /sys/kernel/ns_last_pid as
 sysctl_kernel_ns_last_pid_t
References: <20190410151832.8189-1-lvrabec@redhat.com>
Cc:     Lukas Vrabec <lvrabec@redhat.com>
To:     selinux-refpolicy@vger.kernel.org
From:   Lukas Vrabec <lvrabec@redhat.com>
Openpgp: preference=signencrypt
Autocrypt: addr=lvrabec@redhat.com; keydata=
 mQINBFqX9fsBEACvMZuLfMn8Fj1XFIir6sXAec5zg1ND0GqmcQM6CnvIPPtD9CDS8W4ppywB
 w/QoFHLH9XrrqNONXu/MfxerGvRu1SRtxDkQGphtR1saTZ+0WFn6b8JwrQRzn1zL3bEB55AB
 5APHcxJ+0MLJSCczbWnZ4DymuPBiEigI5yogYx7XTnbCqgsiECEWId4epatX8fyIEfensCjq
 Gc613QCppKkCABzjvR0ivu5csHvN3ZZB56h4EXiZupqzJXric4NnyqO2kDnErKzzzpB1ILiR
 UWbOogO0prR9jgeITWA3baACcjg/+byTCClp19PE5eu6e9LSlJAC0qsTFJC+XbMhDLuieCmB
 kso3uLV8Icka3IOspTp/jXwJY+jZ4vLvVWbBmNM6vBZ8sZIOXBT9L4SieYyvPb/fy5SukV/0
 LzXIKoCNC757AG51TiBLFML87qbys7+5ug5J6lAvYVbmCxSmTPTcB20MJWwUsRlXMG9l55mW
 kDs5VlPm7brq28FCebh+l5K+IKt+D3PkQlrQKa3YYgL/2QPnd65nUHBL4UfX+1vO3yBqUE7O
 hz5RZ7e5MlxirTPea9GMTfv6/QWyLF+szlFgbdqF5yICa0sn0kjHFjD5NQlmIEdmXD44RACP
 VMTnQhJ4trZ7cCiFnDtliAa9Glqedn8nmWQzS+AiMYLnrJ91fQARAQABtCFMdWthcyBWcmFi
 ZWMgPGx2cmFiZWNAcmVkaGF0LmNvbT6JAk4EEwEIADgWIQTHh3QCUBS0Ag7mUIaM2mOtYz9p
 VQUCWpf1+wIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCM2mOtYz9pVclWD/9ijfua
 XSv8CndLbMJWzmOvfjkQPBM9txIK81KgP7pj3bCQg+toQndmsNRp6KSr4hSBz33qqMZ2i7IV
 20FWxxSgvNatjs+YGSRBEmrsTmWc2fJkU8tYSL6ksEaFt0Te7N2QhpflSp72oVXM4v05vuGQ
 P2rMFibDXaP7bUk61+vUkD1N3Rwc/Kmhubk3smYXuA0PEJqs9XFEn4nF4ps4FKmsdGcSrbjJ
 RO/QMjYGQcWjynnBlneOugTY7dPkxti8yVKVE5O7zd69E6yQoqc1ydEuX78HqtbhiJGZRV1Z
 sEVBhJQX6mAVPMNyEAW56Tc3TH4w9WPcOyWUpYDfGyzcCcxeh/kcL5qDlf9nIjzeuzM9x75m
 mZ8Cp2LmN6IFEgeetnoHWmozg6+juZIIxs18fkLqWcnSUO/Eh9Yfk9U5wfQuUy4nb7aLu5f0
 vfllo7ViPXxXu6mMHhda4xKAlVbQtZU1tP/mS4H/pNXSzW5stpQzb2Ohw5G+0rslH6hSbm85
 WKWYLahSq1kETfAgsv/z+QqrDNEHXa0OSKtS4JGS1A/D4+nAComd2SwlfR34TqcyAPaB/21c
 zpeE/JoN5jGdA6UHHHXGPk495ke25rjokAK8LvEz00fpNpuaQf8W7YAjc1AJUiZ6EJBOqgpq
 F/K8WQ+G2So7c6E9J4xO8ZpfDMh+RLkBDQRal/bsAQgAzOxD4ZICqWi+OTf2luLCHk76yShx
 NRj6+DOJJUo31xoFRhgThqAKrSrVdTZT9ZOPyRWcN0hvzrbywOcSXBQE8B76vJipXtG2sGsl
 EfwWUmAObYPxLDtbI5FTZ8tdduDfuk8QMbCJptWHTS01tJKnClSdfApL27qSxOLmsRNxhP4h
 t0Q19bBGHdYaKiZenUc+MmPR/zSLgz4IxzMVBS9VNF069NVDKEOsrDeRNnYAbEf52X/sgDl1
 CFmG1GSEVamteKni3i2o4TT6uLVzSpOq45MjIx1ALCxqKZjrpt+Rv7FnBFi3HLHz978DF9vQ
 iJ0n1jero77zt+3vLVtZ/f97kQARAQABiQNsBBgBCAAgFiEEx4d0AlAUtAIO5lCGjNpjrWM/
 aVUFAlqX9uwCGwIBQAkQjNpjrWM/aVXAdCAEGQEIAB0WIQTfCs/cCtejJiABLstHIBrELynO
 BgUCWpf27AAKCRBHIBrELynOBsUoB/9lookAkdhDRhqv3I2tECBBszKt7Fo1d8vhHC7NGGfm
 3yDAUO4hXB4sobrhDPfpv6lL7QtdlhgTRku6TruT1qLtjaV+IrGB1A+Y1B5w6WO0RXi197gh
 5TlufeRWFOimK+xV2lJt5HXJRO/6Oh+54kdhE/49mx7oLy8flOvxRNC4RXTUZMKKT5ptsuYf
 wYXpmCcqEzPhejhyZnmY9+UTMEENjsV72l+B6BGfPY8lUZdRdumqAF5tWkh5vHT+aH+hpPOY
 YUz7ne7ueyVFoCH9fwNA3o7r5/AGDroMpr+2uu94c/YF04+kZJ/H6dsnekJA9JgeoxyNVTUX
 BrsOJ8DcINucr64P/09kfT9VePExSWppVLt7zM0yt/35WodBpJayoS6lQ/BFip3u7BZwz4y4
 gzTfovKOj1ktwJyxeaPaIbJnCtgDRF8drkfrTTDwFy9RnJz76WKOyGNARVtr9OStI14wGQKo
 RaAePn8uhkbv7zvzvYkse6Gr2uhoFL0/UeWbT48huZhAlzf81yT46nErrT03h+CDDuWaF/sd
 qHNeSNNr2OPE22A1mFLtkYaylpv+l8NUy4TDTPKyK2O3yQCqurJx/2jKVSFojnmpYNmAmVci
 YMiL8dF5wzr2RJUqsVx3X007Tbx4F0x7KD4+9Q9XI2Mw+yHCMZ0HpCZc9QUzE5oSdUCd2N53
 qStoziLp3kJlrCeXEKIE7lV6aoN/BOSEN1NFU0jtR8pHpvZoyZA/3Dm1vKqHjBDoGNr33Yk5
 37Rx8lnkoF513us3FxtWQDzxteQDq24SqfrOOir6dSLHatCOV8cX2Yw1+PHuIx5utLXaLMXH
 vbkaa2Qf3sUY0hvGT2quw+fACkQ+4FA0yLP969E4tfenlQVX1wt8QH5VY4KixL4ReDoCS5Y0
 7cO0wkzI1EYPS4iS4QTcQLNP7EKh3NreV9/hszggrdXnj5p6T2uK1AMCy6wftJBwUx1XoJjo
 dxEY08huxMYJtbY8gIK+Tg2/4eDp3bSWzHU8nTumbUbpf5VcMkvYuQENBFqX9wsBCADIMwny
 vUHLXR+CRcCW93/8zMrtRRNxRVyMuMVWrmBEArSun3sAw+lpmN8FKSkmpD8SO2SYdE0jiAU4
 7OJ7mHL4A1YAqXh3EOjf+GaClcjie46Vb61kR4N7tCymk9wVLxNlrPDb2cxQ9xm8t186z/e9
 RuUfaH/RIBhWUUBAWxdfTuwqX5RbfoOl8+2I5q+C06r56VvgT/fzC3tNtl/fB4+8Cc0iKXi9
 pRGKTEQOfbhxTSogbm4GD4rPs9q4v3CQT3czjSyhrL4uboYGUf82UjQ2ae+XLclDnaUnYfjp
 VrregsW12c5KPN0uuc3Fepvn0G4eQfNhwqqGA9zZqCVJMkDjABEBAAGJAjYEGAEIACAWIQTH
 h3QCUBS0Ag7mUIaM2mOtYz9pVQUCWpf3CwIbDAAKCRCM2mOtYz9pVYeoD/sH++dZ8QLMb3JN
 QiW6mEIKoEmZH5FrOP7t7UWuUmpAlTcUJ87n1221pLcdr/56uFBRIdvpp0YC5rB9ACaqD6gx
 oiNQmR0MkLzN25GWSeD8+bs2thO2SZecO0r+/dAvwgnU3rs+LdVqLcUGPfFwebRH94ZQiPjg
 Y/Ci6LkV6CNDP/rg9odtfYQnL5EHs9yWZdi5f/kLewdrYOAen+i5Sw0oZOiM6tSNOTt59yd3
 LPi6NKDb3rVnul7UU9KkvV7NxZykvs+hyYmUbwnS5UAvFyC40B/dgK9uYongPlzVb4MQmaB0
 rimSlHMMsHRBMnPxNr/F9kpFkYnbIqQwAYIf3FoQ0QuwCn3YljTEJYdbMM3ivl5woclVI6M1
 JytwpFGq6VX3sRhctk+Xe3JOk8Rxt6cvjKeoSmaaxg+kVt4a50LYysh0n3VoETg8d1Gq9NnW
 fhEFtJ0rNy01aZLO28gyDy4sSJiudkSFo17UtabrhcP/hv5ocvaGSzTfXEyYaw4Su23A0RC8
 ska1wAtlZpTYmZ6Mumw2vAkc6bOeh7npcrAfduWSaXtHrUxjuxy6sVCl58IOo2+2AMJaFdMq
 ktne5U1i8Lrrt8r507w4sBasTReQXL5i/AhqOnHt+FkhpVT5J1sE79VM5gwszP3AvBqOREcS
 fhCmGay+X9lHV3XhGE8GWA==
Organization: Red Hat, Inc.
Message-ID: <f36620ab-9375-421b-a147-45f696a7c834@redhat.com>
Date:   Thu, 11 Apr 2019 13:24:26 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <20190410151832.8189-1-lvrabec@redhat.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="Lirv8hMJKklLdnoqmylKUrb4yLsPZflGB"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Lirv8hMJKklLdnoqmylKUrb4yLsPZflGB
Content-Type: multipart/mixed; boundary="WgaxlImsPUx4iAvRtCrjxY16dOOAk275c";
 protected-headers="v1"
From: Lukas Vrabec <lvrabec@redhat.com>
To: selinux-refpolicy@vger.kernel.org
Cc: Lukas Vrabec <lvrabec@redhat.com>
Message-ID: <f36620ab-9375-421b-a147-45f696a7c834@redhat.com>
Subject: Re: [PATCH] Label /sys/kernel/ns_last_pid as
 sysctl_kernel_ns_last_pid_t
References: <20190410151832.8189-1-lvrabec@redhat.com>
In-Reply-To: <20190410151832.8189-1-lvrabec@redhat.com>

--WgaxlImsPUx4iAvRtCrjxY16dOOAk275c
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

On 4/10/19 5:18 PM, Lukas Vrabec wrote:
> CRIU can influence the PID of the threads it wants to create.
> CRIU uses /proc/sys/kernel/ns_last_pidto tell the kernel which
> PID it wants for the next clone().
> So it has to write to that file. This feels like a problematic as
> it opens up the container writing to all sysctl_kernel_t.
>=20
> Using new label container_t will just write to
> sysctl_kernel_ns_last_pid_t instad writing to more generic
> sysctl_kernel_t files.
> ---
>  policy/modules/kernel/kernel.if | 60 +++++++++++++++++++++++++++++++++=

>  policy/modules/kernel/kernel.te |  6 ++++
>  2 files changed, 66 insertions(+)
>=20
> diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/ke=
rnel.if
> index 1ad282aa..3f0a2dbe 100644
> --- a/policy/modules/kernel/kernel.if
> +++ b/policy/modules/kernel/kernel.if
> @@ -2150,6 +2150,66 @@ interface(`kernel_mounton_kernel_sysctl_files',`=

>  	allow $1 sysctl_kernel_t:file { getattr mounton };
>  ')
> =20
> +########################################
> +## <summary>
> +##	Read kernel ns lastpid sysctls.
> +## </summary>
> +## <param name=3D"domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`kernel_read_kernel_ns_lastpid_sysctls',`
> +	gen_require(`
> +		type proc_t, sysctl_t, sysctl_kernel_ns_last_pid_t;
> +	')
> +
> +	read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_ns_last_pid_t =
}, sysctl_kernel_ns_last_pid_t)
> +
> +	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_ns_last_pid_=
t)
> +')
> +
> +########################################
> +## <summary>
> +##	Do not audit attempts to write kernel ns lastpid sysctls.
> +## </summary>
> +## <param name=3D"domain">
> +##	<summary>
> +##	Domain to not audit.
> +##	</summary>
> +## </param>
> +#
> +interface(`kernel_dontaudit_write_kernel_ns_lastpid_sysctl',`
> +	gen_require(`
> +		type sysctl_kernel_ns_last_pid_t;
> +	')
> +
> +	dontaudit $1 sysctl_kernel_ns_last_pid_t:file write;
> +')
> +
> +########################################
> +## <summary>
> +##	Read and write kernel ns lastpid sysctls.
> +## </summary>
> +## <param name=3D"domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`kernel_rw_kernel_ns_lastpid_sysctl',`
> +	gen_require(`
> +		type proc_t, sysctl_t, sysctl_kernel_ns_last_pid_t;
> +	')
> +
> +	rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_ns_last_pid_t },=
 sysctl_kernel_ns_last_pid_t)
> +
> +	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_ns_last_pid_=
t)
> +')
> +
>  ########################################
>  ## <summary>
>  ##	Search filesystem sysctl directories.
> diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/ke=
rnel.te
> index 8e958074..f9486216 100644
> --- a/policy/modules/kernel/kernel.te
> +++ b/policy/modules/kernel/kernel.te
> @@ -132,6 +132,10 @@ genfscon proc /sys/fs gen_context(system_u:object_=
r:sysctl_fs_t,s0)
>  type sysctl_kernel_t, sysctl_type;
>  genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_=
t,s0)
> =20
> +# /sys/kernel/ns_last_pid file
> +type sysctl_kernel_ns_last_pid_t, sysctl_type;
> +genfscon proc /sys/kernel/ns_last_pid gen_context(system_u:object_r:sy=
sctl_kernel_ns_last_pid_t,s0)
> +
>  # /proc/sys/kernel/modprobe file
>  type sysctl_modprobe_t, sysctl_type;
>  genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysct=
l_modprobe_t,s0)
> @@ -232,6 +236,8 @@ allow kernel_t sysctl_kernel_t:dir list_dir_perms;
>  allow kernel_t sysctl_kernel_t:file read_file_perms;
>  allow kernel_t sysctl_t:dir list_dir_perms;
> =20
> +allow kernel_t sysctl_kernel_ns_last_pid_t:file read_file_perms;
> +
>  # Other possible mount points for the root fs are in files
>  allow kernel_t unlabeled_t:dir mounton;
>  # Kernel-generated traffic e.g., TCP resets on
>=20

Patch is related to this story:

https://lisas.de/~adrian/posts/2019-Apr-10-criu-and-selinux.html

Thanks,
Lukas.

--=20
Lukas Vrabec
Senior Software Engineer, Security Technologies
Red Hat, Inc.


--WgaxlImsPUx4iAvRtCrjxY16dOOAk275c--

--Lirv8hMJKklLdnoqmylKUrb4yLsPZflGB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE3wrP3ArXoyYgAS7LRyAaxC8pzgYFAlyvI+oACgkQRyAaxC8p
zgb96Af/VB2gNzP2UncE6SulmSFusf56ADWsAnsoEvL4eIFEC/UXv3v9uISRu845
P3R2s4kyygamqGORm4WUuEIjRHIR00vvquBbERvCOfONB/S5tzEpIH3f6vYxC+Dq
xLgiwpXreJKDwgaKJ8uzHbkWufXf26pseZePAPfDgJWax3p6u5yICeQejp4G9VGP
dQZJT1Bs4HMR+7NImYwsUxXZyzg48L0CCZ3eOR+MB/2aWdEtadQ5MErCkIhM2oia
bXGvbNfIb8/2NXKrVyr9L+UxmQ/8pcc6uuw6UqXt/4jKDBIJEXVJTkKvoR7vR03/
MYYb7U6dNHxqC2tgIGnu8BLsfGuy7A==
=ukea
-----END PGP SIGNATURE-----

--Lirv8hMJKklLdnoqmylKUrb4yLsPZflGB--