From patchwork Tue Sep 4 20:51:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 10587885 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4C73F14E0 for ; Tue, 4 Sep 2018 20:50:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3022E29F96 for ; Tue, 4 Sep 2018 20:50:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 23D6D29FC2; Tue, 4 Sep 2018 20:50:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from UCOL19PA11.eemsg.mail.mil (ucol19pa11.eemsg.mail.mil [214.24.24.84]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5EDDF29F96 for ; Tue, 4 Sep 2018 20:50:27 +0000 (UTC) X-EEMSG-check-008: 585185328|UCOL19PA11_EEMSG_MP9.csd.disa.mil X-IronPort-AV: E=Sophos;i="5.53,330,1531785600"; d="scan'208";a="585185328" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by UCOL19PA11.eemsg.mail.mil with ESMTP/TLS/DHE-RSA-AES256-SHA256; 04 Sep 2018 20:50:24 +0000 X-IronPort-AV: E=Sophos;i="5.53,330,1531785600"; d="scan'208";a="17785654" IronPort-PHdr: 9a23:lNPchhzhnscFY7zXCy+O+j09IxM/srCxBDY+r6Qd1ugSK/ad9pjvdHbS+e9qxAeQG9mDtLQc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q99pHPYQhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb5Q6o0WTC/5Kl1ThHmhjoMOzog/G3JlsB8iaRWqw+jqRNi2Y7ZeIGbOuRwcK3eet0UWHJBU8RMWyFPDYyzc4QBAPQaPetDs4nwpUEDoQekCAWwGu/izCJDiH/s3a091uQsCRzI3BA+ENIWsHTbstP1P7oPX+Cw1qbIyTHDYO1W2Dzg74XIaQ0uoeqXULJsccve1UkvFwTfglWWsozqJSmZ1usKs2iF9udtU/+khW0/qwxpvzSiycghhpPJi44I0FzI6yp0zJgvKdGlTkNwfMSqH4FKty6AMot7WsYiQ2Z1tykk0rAGopu7fDQSyJQg2h7fd+SLc4iW7RLnU+acOSt4i2h/eLK+mhay6lKsyuz6Vsm611ZKtTRKncXWunAR1x3c9siHSvxn8kenxTmPzBzc5vtBIUA1karXM58hwrgumZoPqUnPAyD7lUrsgKKWa0ko4Pak5uv5brn8u5OQL4p0hRv/MqQqlMy/G+M4Mg0WUmiA5+u80Lzj/UvkQLRFl/E5ia7ZsI3cJcsHuKG5GBRY0poj6hmjDzem184UnX8cLF1fYh6HgI/pO0/WLPDiEfi/m0iskCtsx/3ePL3hBZPNIWLfkLfhZ7l97VVRyAg0zdBZ4pJbEKoBIO7tVU/rr9zUFBg5Mxa7w+z/EtVyypseWX6TAq+eKK7Ss12I6fgzLOmPf48VvzD9K/k75/P1g385nUIdfKay0psKbnC4AulmL1+eYXr2jdcLCX0KsRYmTOz2lF2CViZeZnizX6I44zE0FpimAJzNRo+znbOB2z27EYdOZmBcDVCME2nneJmYW/sWbyKSOMBhmCQeVbe9U48hyQ2utAjixrV6MuXU/yoYtZT/1NRo/ODTiw899SZ1D8Wc1GGNSXt4nmUWSD8qxKp/u1Byyk+f0ahkhPxVDcFc5+9TXQcgLpPT0+t6C9XuVQ3bZdeJVEyqQtO4DjEtVtgx2cMBY15hG9W+iRDOxzSlA6cPmLyRBZw06bnR32DrKMZnynbGz7Ehj108TcRTK2KqnKl/9xLcB4TRiUWWi76qdbgA3C7K7GqDznCBvEJfUA5tSqjFXmoQZkjRrdTk/E/CSKWuCbs/OAtb1cGCMrdKasHujVheXvjsJc7eY2OvlGeqHhuH3K+DbI/wd2UaxiXdB1AOkxoP8naeKQg+GiChrnrEDDNzCF3ieEzs8exxqX+hSE870R2KZVV717Wp4h4VmeCcS/QL07IftichsTJ0HE2h39/NENqAoQ1hfatZYdwn5ldLz2TZuBJhPpa4NaBtmkYecxhrv0Ppzxh2BJ9Pkcw2rHw01gpyMrmV0E1feDOCxp/wJ7jXJnP1/BC1ZK7cwkve38qO+qcT9PQ4rE3uvAeoFkom93VozcJV3mCG6ZrUFgoSVoj9UkEt9xh1v7vaeDUy55vI1X1wNqm5qiHC29M1C+s5zRagZc1TP7+EFA/1Fc0aCNOjKOgrm1ivdB0EJudS+LQzP8O8ePuMwLSrM/p4nDK6kWRH55hw0kaN9ypnVu7Exo0FzO+c3guGUTf8kVigv9vsmYBcZDESGGu/xjT/BIJLYK19Y5oLA3+0I8Kr3tV+m4LtW3lA+V65AFMG3MupdgSIb1Ph2g1R218aoWe6mSSk1Dx4iTYprrCQ3CbW2eTtaAIHOnJXRGlllVrsIpa7j9YBXEWzbAgmih2l5V38x6dFuKRzNW7TQV1HfyLuNWFtTrOwtqaeY85I8J4oqT9YUPm4YV+EUr7yuR0a0z/9EGtE3z07aiqqtYvjnxxhkm6dN3FzrGfDec5s2xjf6tvcReRe3jUYXiV4jyfYBkSkNdmz4dqUj4vDsvy5V2+5SJ1TdzTkwJietCu9+GJqAQezn/atld37CQI6yzP018F2VSXUqxbxepHr2L6nMeJjZURnGF7869Z6G41nnIs/npcQ1WIdhpWP8noNiX3zPslD2aLicHoNQiYGw9DP7wjjxE1jKXeJypn3VnqD38RhYMO6bXkO2iIn6MBKCrmb46BYnSdvpVq4tw3Ra+BnnjgB0fsu9GIag+YRtQoo1CqdBrQSEldEPSzwjRuH9cuzrKNJa2azari/yFBxnci/A72YpAFTRmr5cI84HSBs9sV/LE7M0Hrr54HqYtnfc88ctgaOnBfGk+hVL4kxm+EQiiV7PGLxp3oly/Q0jRZ2x5G1oJCHK3lx/KK+GhNYLiP6aNgN9THrjKZegsGW0puuHpp/BDoEQoHkTfWyEDIdrf7nLRqBECUgqneHHrrSBRSQ51xho3LLEpCrLG2XJGIDwdV5WhaSOFZTgBsKUzU+n545EB2qxcP6fUhl5jER/EP4qgBWxuNmLRb/TnzfpACuajsuT5ifNhVW5BlY50jJKcye8v5zHyZA85K6rQyNJWubZwJTAG4UREOLHFHjMaOo5dXa9OiYHOW+JePUYbqSsexeS+uIxZW334R88DaDLNuPMWd5Av08wkpMQ3Z5G8HDlDUOTywYjCXNbsGBqBe74C13odi18O73VwL3+YuPF7xSPM1z+xCxhKePLfSQhCF4KDlG0JMD3mXIyL8B014RkCxhaz6tEbEcuiHXV6LQhrVbDxgFZCNvLMFI9b4z3hFROc7HjdP4zrx4jv41ClddUlzhnsCpZdAULGymMVPHBVqLNK6YKjHRxMH3e6y8Q6VKjOpIrx2wpSqbE0j7MzSAlzjpUw6gPPpJjCGcMhxetp+ycgpxCWjjS9LmbwO0PMVxjTIo3b0+nmnKOnIEMThgb0NNqaWd7SVGjfplH2xM9XllLe6fmyaF9ebYLI0WsfhqAihukeJV/mg6waNP7C5YXPx1hDfSrtl2rlG8jOaP0SRoXwBUqjlXhIKGpl5tOaTD9pZdXnbE8goN7X+OBBUKvddlDMPgu7xIwNjViK3zMCtC887T/cYEGsfUL8SHMHw8PhX3HD7UDRAIQiS1OmHFgExRivaS9mearpIisJjjhIIOSqNHVFwyDv4VF15qHMIDIJhqRTMpiqSUjNQS5Xq5ohjRX9tVsYzaVvKIAPXvNDaYgaNCZxQW3bPyNZ4TOZHj20x+dll6m5zHG1HOUtBJoy1haBI0oUpW/XdiSW0z3l7qZRm24H8PD/K0mAA5ihdma+Q36Djs+0s3JkbNpCYojEkxmNDlgTeNcD7xLKa9RpxZCyv0tkcrKZz3WQB1YhOunUZ8LjfLW6pRj6d8dWBskALTo59PGf9AQqJaeBAQwPGWZ/Mv0VRasCqq3lRI5erfBptkjQcqf4Oso2hG2w19cN4/PbbQK7ZRzlhMmqKOuTel2fsvzw8YPEsC6n6deDAWt0wSLbkpPTCo/+x25QyFgTtDd3AGV+A2rfJy6kM9J+OAwjrv075eK0CxM+ifIL2cu2XbiMGHXEg/1kISmElD57R21t0jc0WMXUA10LSRDwgJNdbFKQxNdcpS8nnTcjqOseXKxZJ1JJ2zGPn1Q+GUqKsahVmpExouH4QJ8ssOBIKs0F3CIcfhMrEF1Q0n5B73K1WdEPRJZBWLnS8do86l1p932pJSKyoBAWVnKyq3+KjYpgsrgPqFU9c2ZnYaXoQENnIqVs21gTRZv3FaADmxzO0Z1BCI7yXgqSTIEDn8c91jae+aZB92FN62+TQ/8623iVHN8ZXTPGD6Osp8tdDR8+8aoIyHC/xMR7lnr0jcg5VYR2CtU2PXFN66PYLwa4oyYtzoC3a6VFO/hik7TsjrOtaiMqyIgQb1RYlJq4mXxjYjOtGhFjsGARd/u/kD5L5gZQ0Ee5c0ewTotxk4N6ClIweVydSuQ2esKTtKVPZT1+O6aKJLzyA0dO+11GMgTo0mz+mw6UMNRZcKjg3AyvaneYZeVDb8GmBHewTPvic5kHBhOfg0wuc62hzIsF0cPCuMdO1mcmBEuMs8BVyKK3VsFmU4X0OcjZbE4gO0w7AS+C5dks1I0eFZtXjxpYXTYDSyV6y3sZ/VqTYvbcA6o61tNozuOsmGtJTAkTHEUZbfrBaFXzCgF/pGhNdfPThUQP9WlmE5IcYGo5ZO6VItVsciILxCEKcspqqwZjpiESESzDQZWpiF3Dwag+ewwqDalxmLcJg4NxwEqppCiMMHUyFqeiMeuLOjV4LOmm+YV2cEPQYT4h5I5A8bioBweeXl75bSQ59X1z5aufR0XTXXFpNw7Vv0VnmWgUTkSPWmi+GpxRlSzO723dYGRB5yElNdx+FLlksyNL54Na8QvpLQsjCScUP2pmXtyPGpJFNJ083ba0X4DJbZtWr7SiAT4nMUSpNTxHzdCJgfnRF0Z7ospFVJPI+pYF3+5yA+y4RvAba4Sdihx0w5onYeWyeqD91BBvl8sF3JRTJlY4qkqIn+NpVWRW9Q5oOSp0lFn0VqLiG214BQK8dT7T4QRDJPuymSvMOuSM1f3s97F4MMIs1htHjjBaxJI4WRo3kqurz10HDZ5TE8sFC+xDqtB6+0VeVZ/3cRGg8xPWSRtlEvD/cw8mfV6l3NsEp7//1cBriUiUV+uih9E4tLBjZU0XClM1VzQ2VHs+pALqTVaNZQQ/4oZR+gIxY+D+Ip31SV/UFomnf0ey5yuRFc+yDTRQk0UjQajan2lD0CsM6nPyQaS5VSYTUncSjFNxqRmTpLsxZHd0FqR5cZD85D+7EfxoZU/8zCSUO2JSEEWhxiOBg43uBElU5fqkWYZDzSDRa1dfbVrBJ7Z8CRrNSmLP7h5gdIlpvnsPwk96UEX3CmnwytTszZr4/4rNKKrVGCdKb/M+27en/BVyPBjRW/iLYrFZXK+DLTMAVDIZlg1XUkeYThCXLMPRleO60UPU5bWr5hadVaouFaYNRpeL0V9q9sGB2HQA/vGI21o/VcKFbcWyjeJT2b8uOjuYLT8aDdSe/4a8yI3HbHRqJ6M4x06TblBrjq1pVe9VDu2vd38UN6S0bJPDydrNj7IQML/saifFP4vpI1BTPWHItwkH31y0FCdsoXRjan8JEGx5JZ9nnwU+N40k78sOFI8blr95U36ahzycioPafSNehasUh/DxiVBwRl7I8iD3RkSmBKfOARNOnecrgDgcDpseD3GLQd6AeJ9OxBddvHO0bBl9GkBTGdUhxFkh0OqTwbLguAz/6KgbJ0ScK+qOfl3UIi/kaxIQQbzLB34oeE4LCHqPXQbxvLwrgOQrLqSd/rrrQwp0OS4uUplKYUdWxpfwKnEOYcVskHxmfj1Kwq1jwjE8fCH7Lm5f5CWGk0nir6lJBhA1oWGv0VHb2R/YRdhGs4mPLWNscQcq9cnmaDDxmkEqUNyXSz8SuYPHFlgg3S0xH3WW688F32ojVkTibX09jjlU5VVr22BUhMRSqpJVF3vy+PPAbys9r3o6s15lksMmP4rNKNiHehOLRPEs36I9ycJzU0pF0Jg5AqQ9yv2JoUGdyjL9cN/nB+aeHe62CwkyNbpadImZbe6NmP+vrLBXmgk7Gaq7KVyTBX1nc4pko/5sm9OP/B4dOKQvKo13seTipktAvBWgS6qrrFoFwOPkyLykjLkpQQPt5FxXk4yl3m5O87TdIx8wVeFoDAa+keqjDzPDv03EuQYtM2VimYyDtXHVP1HEJmGKg9xmL/psbJmmrR+1EyQIl/aVDnjwRtD4okMUIt9EQXwi0bHAgMdxCUFreoCF/hLYsZSEcDaBOH3KOgdqcwx01zzaul5PXPYuxkG6oNKvFdgxaMnFdFFJIWv6keTalyelBH8q7YuBTiB5LhX/f4iXo6Lee1TdxC8cAFq3si5R6yRxWk6ZdE4bcUlpSIdqpfbJjXu8B86UZn6iIVeixLnhd/kwuzUfoAq+D7/tjbrJ2o5/6rVKYsROUX9B80Cn98j5Tqg1AjptfX2PlaSoHPj4Tw7hxNKWaQuInGyxl8NfYOK4Wzcbl76XoHITQeKmkVPdqSbPk8/zNtMCvN6FNfGM8MYskYPMXVkwBOlkLpQK1T9tbcGlKAE4dzcMQo4HDtyDE79ps8Vujg5SSzJZDY6FFNJO1Mgzl2lNLFv+gV2vvSCC4Y4XWDbBh12CyCwYGXC/ns5eWM1M3UV1QeEy44TYhdIDuC+RS5SeeulZTpUwaU6srtj5IkcEKfWGa9nKMfsqZDCeRAkDn03iBCFoDpgPKYq9St6HNNtl1GDIl88wbIGKBePpVnIxT3iNOnRk9mBivwYMvUbAYhuPKKxucQ5OVzL0z+ZYsFLR8f07L67WBaThBySL73olmZQfgRa8V4R//eqHBa955gIbcVPFeBvJzqsitIqFcuDQ8tab8wqCFad0bXkA1RWqb0o6IAihAHXN54o0BMH2WwNHg55zrdWqRflLORB+AN8jWPUqwOVF1lMiZkTByp2JVuer2pnfdcv2NYnyN9puYl0zhnRBu6pC3tqLgB2TU6+LG3rD8Bo2BKTv2CkyfUDlVO1PYKgr0fC3bl8lOxe2QDbI3u4LlnIsTg6IYh43QjYRk5eS0JQ/igATnqj6yUGoyPrM5chBmVtcXMaL+zKjISNq48yRL4XHV91BLRnBN2/2sKWDmg68UkJIqlM8Y/2iWoAXTbdEoL4q5Rq8vxu1sLQ/c3ZF5i22hjzNaIRjcMRM3OHGY1iBIoaWNaf5JfulcmEPwwiyuMlrFP4wVRZTDTCInj8Y7VzunS3nxodstn3mLboOW+g5ou1HB004dv4jWmpGUZd+ueVdRlRHf0yNEMmqTFe/yxv7VfG8Ndw7O7XapHaJGu X-IPAS-Result: A2A9AgCL745b/wHyM5BaHAEBAQQBAQoBAYMkgg4ojARfjB4BAQEBAQEGihiNShSBEANHL4guNBgBAgEBAQEBAQIBbCiCNSSCZgIkExQgCwMDCQJACAgDAS0VHwsFGASCQT+BdQ2kZzOEbIUWhkaEKXmBB4hvARIBbIULAo0yP41lCY9uCxeOWAGVJjg0MHErCAIYCCEPO4JsgiUXjjNTinCCOwEB Received: from tarius.tycho.ncsc.mil (HELO tarius.infosec.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 04 Sep 2018 20:50:24 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w84KnfbF014416; Tue, 4 Sep 2018 16:49:50 -0400 Received: from tarius.infosec.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w84Kndh3023504 for ; Tue, 4 Sep 2018 16:49:39 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto.infosec.tycho.ncsc.mil [192.168.25.131]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w84KnbJ0014414; Tue, 4 Sep 2018 16:49:38 -0400 From: Stephen Smalley To: paul@paul-moore.com Date: Tue, 4 Sep 2018 16:51:36 -0400 Message-Id: <20180904205136.27935-1-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.14.4 Subject: [PATCH] selinux: fix mounting of cgroup2 under older policies X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: longman@redhat.com, stable@vger.kernel.org, Stephen Smalley , dvyukov@google.com, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP commit 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs") broke mounting of cgroup2 under older SELinux policies which lacked a genfscon rule for cgroup2. This prevents mounting of cgroup2 even when SELinux is permissive. Change the handling when there is no genfscon rule in policy to just mark the inode unlabeled and not return an error to the caller. This permits mounting and access if allowed by policy, e.g. to unconfined domains. I also considered changing the behavior of security_genfs_sid() to never return -ENOENT, but the current behavior is relied upon by other callers to perform caller-specific handling. Fixes: 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs") CC: Reported-by: Dmitry Vyukov Reported-by: Waiman Long Signed-off-by: Stephen Smalley Tested-by: Waiman Long --- security/selinux/hooks.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index f78318af8254..58fee382a3bb 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1508,6 +1508,11 @@ static int selinux_genfs_get_sid(struct dentry *dentry, } rc = security_genfs_sid(&selinux_state, sb->s_type->name, path, tclass, sid); + if (rc == -ENOENT) { + /* No match in policy, mark as unlabeled. */ + *sid = SECINITSID_UNLABELED; + rc = 0; + } } free_page((unsigned long)buffer); return rc;