12b29f3455
Introduce SELinux support for deferred mapping of security contexts in
the SID table upon policy reload, and use this support for inode
security contexts when the context is not yet valid under the current
policy. Only processes with CAP_MAC_ADMIN + mac_admin permission in
policy can set undefined security contexts on inodes. Inodes with
such undefined contexts are treated as having the unlabeled context
until the context becomes valid upon a policy reload that defines the
context. Context invalidation upon policy reload also uses this
support to save the context information in the SID table and later
recover it upon a subsequent policy reload that defines the context
again.
This support is to enable package managers and similar programs to set
down file contexts unknown to the system policy at the time the file
is created in order to better support placing loadable policy modules
in packages and to support build systems that need to create images of
different distro releases with different policies w/o requiring all of
the contexts to be defined or legal in the build host policy.
With this patch applied, the following sequence is possible, although
in practice it is recommended that this permission only be allowed to
specific program domains such as the package manager.
# rmdir baz
# rm bar
# touch bar
# chcon -t foo_exec_t bar # foo_exec_t is not yet defined
chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
# mkdir -Z system_u:object_r:foo_exec_t baz
mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
# cat setundefined.te
policy_module(setundefined, 1.0)
require {
type unconfined_t;
type unlabeled_t;
}
files_type(unlabeled_t)
allow unconfined_t self:capability2 mac_admin;
# make -f /usr/share/selinux/devel/Makefile setundefined.pp
# semodule -i setundefined.pp
# chcon -t foo_exec_t bar # foo_exec_t is not yet defined
# mkdir -Z system_u:object_r:foo_exec_t baz
# ls -Zd bar baz
-rw-r--r-- root root system_u:object_r:unlabeled_t bar
drwxr-xr-x root root system_u:object_r:unlabeled_t baz
# cat foo.te
policy_module(foo, 1.0)
type foo_exec_t;
files_type(foo_exec_t)
# make -f /usr/share/selinux/devel/Makefile foo.pp
# semodule -i foo.pp # defines foo_exec_t
# ls -Zd bar baz
-rw-r--r-- root root user_u:object_r:foo_exec_t bar
drwxr-xr-x root root system_u:object_r:foo_exec_t baz
# semodule -r foo
# ls -Zd bar baz
-rw-r--r-- root root system_u:object_r:unlabeled_t bar
drwxr-xr-x root root system_u:object_r:unlabeled_t baz
# semodule -i foo.pp
# ls -Zd bar baz
-rw-r--r-- root root user_u:object_r:foo_exec_t bar
drwxr-xr-x root root system_u:object_r:foo_exec_t baz
# semodule -r setundefined foo
# chcon -t foo_exec_t bar # no longer defined and not allowed
chcon: failed to change context of `bar' to `system_u:object_r:foo_exec_t': Invalid argument
# rmdir baz
# mkdir -Z system_u:object_r:foo_exec_t baz
mkdir: failed to set default file creation context to `system_u:object_r:foo_exec_t': Invalid argument
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
89 lines
2.4 KiB
C
89 lines
2.4 KiB
C
/*
|
|
* Multi-level security (MLS) policy operations.
|
|
*
|
|
* Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
*/
|
|
/*
|
|
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
*
|
|
* Support for enhanced MLS infrastructure.
|
|
*
|
|
* Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
|
|
*/
|
|
/*
|
|
* Updated: Hewlett-Packard <paul.moore@hp.com>
|
|
*
|
|
* Added support to import/export the MLS label from NetLabel
|
|
*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*/
|
|
|
|
#ifndef _SS_MLS_H_
|
|
#define _SS_MLS_H_
|
|
|
|
#include "context.h"
|
|
#include "policydb.h"
|
|
|
|
int mls_compute_context_len(struct context *context);
|
|
void mls_sid_to_context(struct context *context, char **scontext);
|
|
int mls_context_isvalid(struct policydb *p, struct context *c);
|
|
int mls_range_isvalid(struct policydb *p, struct mls_range *r);
|
|
int mls_level_isvalid(struct policydb *p, struct mls_level *l);
|
|
|
|
int mls_context_to_sid(struct policydb *p,
|
|
char oldc,
|
|
char **scontext,
|
|
struct context *context,
|
|
struct sidtab *s,
|
|
u32 def_sid);
|
|
|
|
int mls_from_string(char *str, struct context *context, gfp_t gfp_mask);
|
|
|
|
int mls_convert_context(struct policydb *oldp,
|
|
struct policydb *newp,
|
|
struct context *context);
|
|
|
|
int mls_compute_sid(struct context *scontext,
|
|
struct context *tcontext,
|
|
u16 tclass,
|
|
u32 specified,
|
|
struct context *newcontext);
|
|
|
|
int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
|
|
struct context *usercon);
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void mls_export_netlbl_lvl(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
void mls_import_netlbl_lvl(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_export_netlbl_cat(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_import_netlbl_cat(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
#else
|
|
static inline void mls_export_netlbl_lvl(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline void mls_import_netlbl_lvl(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline int mls_export_netlbl_cat(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
static inline int mls_import_netlbl_cat(struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
#endif
|
|
|
|
#endif /* _SS_MLS_H */
|
|
|