From patchwork Tue Jun 14 10:20:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12880895 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9E01CCA480 for ; Tue, 14 Jun 2022 10:20:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353921AbiFNKUq (ORCPT ); Tue, 14 Jun 2022 06:20:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241060AbiFNKUn (ORCPT ); Tue, 14 Jun 2022 06:20:43 -0400 Received: from mail-ej1-x632.google.com (mail-ej1-x632.google.com [IPv6:2a00:1450:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C08284754D for ; Tue, 14 Jun 2022 03:20:38 -0700 (PDT) Received: by mail-ej1-x632.google.com with SMTP id s12so16246298ejx.3 for ; Tue, 14 Jun 2022 03:20:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=NyEGGrynwPPAJH0lUD5qlNsw/KMP8bFHuEGs0AaiA6k=; b=gbzqOeOu5UdpR56ajFbHTgql9/wLdhl4l1qLL2qyvzZFIIdJdBbwTfLQh0sGnX2ra/ 79BNBPTtzGK/2p0r9opQ2s42v1WSHX/ksvYBTh2Egd8uS/6IVgtp9A6TzNMiuTdic2k5 iI59lGnx1XWt4S6IbnJOSQBjtAoZNpN17yd6cVEEbYF4njsXMMwqU9LAzsofcgccQYO7 lsl+puzug5wFIlsJa2P4/GfAr7JxxAPdCOpEmUDfhHRl3WdsAt3g9UP5pHwYfBo+aVFM 4BMrGnp+d6bc4Z+1ZMwK5D8RG7cXWyqIZzOvzZCDIHWmqCWCH7kisGMiEm1x7ljcABnA EbaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=NyEGGrynwPPAJH0lUD5qlNsw/KMP8bFHuEGs0AaiA6k=; b=J0i0WB+EeUh2csIvb2QozkWSvWKcSUjMHzIZC+wg/dQWvpX1g3diSY6Ss+utq1TSkR KxFYHwc7O39OmeR9wY2bMQ1xdZnBaqlkSOvMH+UA5IecTbCb6b1PDBYmmU5DjRMOYlad lH3za3NphNLREDJEV3RRYdiU5AfuQ21nwSNP7Wc/pbJhvFoJcDCm2ZHycCDX3ZyGhP2F 8+SvZ8UVHpX4Wr3mpaoF5gYhUCHi0BxUYfQe55FeGILmkgLTi+OvvX+1bJy5SnFUtiqp KozSvVkVoYKka0FRQ80f66oSKSCBgX/bRdfJemaIkxbKdHbglIkBbLL83gprYqFJke9y H7qA== X-Gm-Message-State: AOAM531rofyj/csbrZavjn5Nr4iatp8rFqjpc4dcGzbUbkajsoaxClBQ s4/dRz7m0s7xkKMZpcioL6Efo8g71IA= X-Google-Smtp-Source: AGRyM1u3nqQbYAe5Nxt3EV1ShEUzcb2v0GI1PH46r85F5VxMvtbXnoewZ/wTWevOcFclqslSeLGHDg== X-Received: by 2002:a17:906:7c0c:b0:6f9:1fc:ebf3 with SMTP id t12-20020a1709067c0c00b006f901fcebf3mr3667096ejo.403.1655202037095; Tue, 14 Jun 2022 03:20:37 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-001-087-232.77.1.pool.telefonica.de. [77.1.87.232]) by smtp.gmail.com with ESMTPSA id gv17-20020a170906f11100b006febc1e9fc8sm4871186ejb.47.2022.06.14.03.20.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jun 2022 03:20:36 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 1/4] support Dash as default shell Date: Tue, 14 Jun 2022 12:20:26 +0200 Message-Id: <20220614102029.13006-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.36.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Debian uses Dash as default shell and switching via dpkg-reconfigure dash has become deprecated. * Use POSIX compliant `> target 2>&1` instead of `>& target`. * Call runcon directly to avoid a fork within Dash, which breaks tests requiring to not change the PID of executing commands * Use bash explicitly for non POSIX read option -t Signed-off-by: Christian Göttsche --- README.md | 7 ------- tests/binder/test | 2 +- tests/bpf/test | 4 ++-- tests/fdreceive/test | 2 +- tests/filesystem/Filesystem.pm | 14 +++++++------- tests/inet_socket/test | 2 +- tests/ptrace/test | 6 +++--- tests/sctp/test | 2 +- tests/sigkill/test | 2 +- tests/task_getpgid/test | 6 +++--- tests/task_getscheduler/test | 6 +++--- tests/task_getsid/test | 6 +++--- tests/task_setnice/test | 6 +++--- tests/task_setscheduler/test | 6 +++--- tests/unix_socket/test | 2 +- tests/vsock_socket/test | 2 +- 16 files changed, 34 insertions(+), 41 deletions(-) diff --git a/README.md b/README.md index 29e3421..e90a20d 100644 --- a/README.md +++ b/README.md @@ -147,13 +147,6 @@ On Debian prior to version 11 (bullseye) you need to build and install netlabel_ # make # sudo make install -Debian further requires reconfiguring the default /bin/sh to be bash -to support bashisms employed in the testsuite Makefiles and scripts: - - # dpkg-reconfigure dash - -Select "No" when asked if you want to use dash as the default system shell. - #### Other Distributions The testsuite requires a pre-existing base policy configuration of SELinux, diff --git a/tests/binder/test b/tests/binder/test index 14f2096..b35aee1 100755 --- a/tests/binder/test +++ b/tests/binder/test @@ -80,7 +80,7 @@ sub service_start { } # Wait for it to initialize. - system("read -t 5 <>$basedir/$flag"); + `bash -c 'read -t 5 <>$basedir/$flag'`; return $pid; } diff --git a/tests/bpf/test b/tests/bpf/test index 6ab7686..f3147a8 100755 --- a/tests/bpf/test +++ b/tests/bpf/test @@ -106,7 +106,7 @@ if ( ( $pid = fork() ) == 0 ) { } # Wait for it to initialize. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Test BPF map & prog fd on transfer: $result = system @@ -149,7 +149,7 @@ sub service_start { } # Wait for it to initialize. - system("read -t 5 <>$basedir/$flag"); + `bash -c 'read -t 5 <>$basedir/$flag'`; return $pid; } diff --git a/tests/fdreceive/test b/tests/fdreceive/test index 2415361..4451f7d 100755 --- a/tests/fdreceive/test +++ b/tests/fdreceive/test @@ -22,7 +22,7 @@ if ( ( $pid = fork() ) == 0 ) { } # Wait for it to initialize. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_fdreceive_server_t can receive a rw fd to the test_file # from test_fdreceive_client_t. diff --git a/tests/filesystem/Filesystem.pm b/tests/filesystem/Filesystem.pm index c14e760..e3cd8ee 100644 --- a/tests/filesystem/Filesystem.pm +++ b/tests/filesystem/Filesystem.pm @@ -49,12 +49,12 @@ sub udisks2_stop { $status = 0; if ( -e "/usr/bin/systemctl" ) { - $u_status_cmd = "/usr/bin/systemctl status udisks2 >& /dev/null"; - $u_stop_cmd = "/usr/bin/systemctl stop udisks2 >& /dev/null"; + $u_status_cmd = "/usr/bin/systemctl status udisks2 > /dev/null 2>&1"; + $u_stop_cmd = "/usr/bin/systemctl stop udisks2 > /dev/null 2>&1"; } elsif ( -e "/usr/sbin/service" ) { - $u_status_cmd = "/usr/sbin/service udisks2 status >& /dev/null"; - $u_stop_cmd = "/usr/sbin/service udisks2 stop >& /dev/null"; + $u_status_cmd = "/usr/sbin/service udisks2 status > /dev/null 2>&1"; + $u_stop_cmd = "/usr/sbin/service udisks2 stop > /dev/null 2>&1"; } if ($u_status_cmd) { @@ -78,10 +78,10 @@ sub udisks2_restart { if ( $status eq 3 ) { print "Restarting udisks2 service.\n"; if ( -e "/usr/bin/systemctl" ) { - system("/usr/bin/systemctl start udisks2 >& /dev/null"); + system("/usr/bin/systemctl start udisks2 > /dev/null 2>&1"); } elsif ( -e "/usr/sbin/service" ) { - system("/usr/sbin/service udisks2 start >& /dev/null"); + system("/usr/sbin/service udisks2 start > /dev/null 2>&1"); } } } @@ -133,7 +133,7 @@ sub make_fs { attach_dev( $mk_dev, $mk_dir ); print "Make $mk_type filesystem on $mk_dev\n"; - $result = system("yes | mkfs.$mk_type $mk_dev >& /dev/null"); + $result = system("yes | mkfs.$mk_type $mk_dev > /dev/null 2>&1"); if ( $result != 0 ) { system("losetup -d $mk_dev 2>/dev/null"); print "mkfs.$mk_type failed to create filesystem on $mk_dev\n"; diff --git a/tests/inet_socket/test b/tests/inet_socket/test index f09b4e3..18b1014 100755 --- a/tests/inet_socket/test +++ b/tests/inet_socket/test @@ -59,7 +59,7 @@ sub server_start { } # Wait for it to initialize. - system("read -t 5 <>$basedir/flag"); + `bash -c 'read -t 5 <>$basedir/flag'`; return $pid; } diff --git a/tests/ptrace/test b/tests/ptrace/test index 78589c6..dbbfe5f 100755 --- a/tests/ptrace/test +++ b/tests/ptrace/test @@ -9,13 +9,13 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the process to be traced. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_ptrace_traced_t sh -c 'echo >$basedir/flag; while :; do :; done'"; + exec 'runcon', '-t', 'test_ptrace_traced_t', 'sh', '-c', + "echo >$basedir/flag; while :; do :; done"; exit; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that the nottracer domain cannot attach to the process. # Should fail on the ptrace permission check. diff --git a/tests/sctp/test b/tests/sctp/test index e28d214..078f762 100755 --- a/tests/sctp/test +++ b/tests/sctp/test @@ -120,7 +120,7 @@ sub server_start { } # Wait for it to initialize. - system("read -t 5 <>$basedir/flag"); + `bash -c 'read -t 5 <>$basedir/flag'`; return $pid; } diff --git a/tests/sigkill/test b/tests/sigkill/test index 6c7289a..cd50952 100755 --- a/tests/sigkill/test +++ b/tests/sigkill/test @@ -13,7 +13,7 @@ if ( ( $pid = fork() ) == 0 ) { } # Wait for it to initialize. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_kill_signal_t cannot send CHLD, STOP, or KILL to the server. $result = system "runcon -t test_kill_signal_t -- kill -s CHLD $pid 2>&1"; diff --git a/tests/task_getpgid/test b/tests/task_getpgid/test index ff9ccc6..d1d1847 100755 --- a/tests/task_getpgid/test +++ b/tests/task_getpgid/test @@ -9,12 +9,12 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the target process. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_getpgid_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; + exec 'runcon', '-t', 'test_getpgid_target_t', 'sh', '-c', + "echo >$basedir/flag; while :; do :; done"; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_getpgid_yes_t can get the target's process group ID. $result = system "runcon -t test_getpgid_yes_t -- $basedir/source $pid 2>&1"; diff --git a/tests/task_getscheduler/test b/tests/task_getscheduler/test index ce7f047..e38dd9e 100755 --- a/tests/task_getscheduler/test +++ b/tests/task_getscheduler/test @@ -9,12 +9,12 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the target process. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_getsched_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; + exec 'runcon', '-t', 'test_getsched_target_t', 'sh', '-c', + "echo >$basedir/flag; while :; do :; done"; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_getsched_yes_t can get the scheduling. # SCHED_OTHER 0 priority must == 0 diff --git a/tests/task_getsid/test b/tests/task_getsid/test index 16190c5..30efbfc 100755 --- a/tests/task_getsid/test +++ b/tests/task_getsid/test @@ -9,12 +9,12 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the target process. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_getsid_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; + exec 'runcon', '-t', 'test_getsid_target_t', 'sh', '-c', + "echo >$basedir/flag; while :; do :; done"; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_getsid_yes_t can get the session ID. $result = system "runcon -t test_getsid_yes_t -- $basedir/source $pid 2>&1"; diff --git a/tests/task_setnice/test b/tests/task_setnice/test index 09352ed..ed25884 100755 --- a/tests/task_setnice/test +++ b/tests/task_setnice/test @@ -9,12 +9,12 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the process that will have its priority changed. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_setsched_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; + exec 'runcon', '-t', 'test_setsched_target_t', 'sh', '-c', + "echo >$basedir/flag; while :; do :; done"; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; # Verify that test_setsched_yes_t can change the priority up and down. $result = system "runcon -t test_setsched_yes_t -- renice +10 -p $pid 2>&1"; diff --git a/tests/task_setscheduler/test b/tests/task_setscheduler/test index fa7d9cb..42a161a 100755 --- a/tests/task_setscheduler/test +++ b/tests/task_setscheduler/test @@ -9,12 +9,12 @@ $basedir =~ s|(.*)/[^/]*|$1|; # Start the process that will have its priority and scheduling changed. system("mkfifo $basedir/flag"); if ( ( $pid = fork() ) == 0 ) { - exec -"runcon -t test_setsched_target_t sh -c 'echo >$basedir/flag; while :; do sleep 1; done'"; + exec 'runcon', '-t', 'test_setsched_target_t', 'sh', '-c', + "echo >$basedir/flag; while :; do sleep 1; done"; } # Wait for it to start. -system("read -t 5 <>$basedir/flag"); +`bash -c 'read -t 5 <>$basedir/flag'`; $cgroup_cpu = "/sys/fs/cgroup/cpu/tasks"; if ( -w $cgroup_cpu ) { diff --git a/tests/unix_socket/test b/tests/unix_socket/test index c48d1ad..600fc99 100755 --- a/tests/unix_socket/test +++ b/tests/unix_socket/test @@ -38,7 +38,7 @@ sub server_start { } # Wait for it to initialize. - system("read -t 5 <>$basedir/flag"); + `bash -c 'read -t 5 <>$basedir/flag'`; return $pid; } diff --git a/tests/vsock_socket/test b/tests/vsock_socket/test index 41d9bc8..70fde70 100755 --- a/tests/vsock_socket/test +++ b/tests/vsock_socket/test @@ -34,7 +34,7 @@ sub server_start { } # Wait for it to initialize, read port number. - my $port = `read -t 5 <>$basedir/flag; echo \$REPLY`; + my $port = `bash -c 'read -t 5 <>$basedir/flag; echo \$REPLY'`; return ( $pid, $port ); } From patchwork Tue Jun 14 10:20:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12880892 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26C65C43334 for ; Tue, 14 Jun 2022 10:20:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242084AbiFNKUn (ORCPT ); Tue, 14 Jun 2022 06:20:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36796 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353921AbiFNKUl (ORCPT ); Tue, 14 Jun 2022 06:20:41 -0400 Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3389C47551 for ; Tue, 14 Jun 2022 03:20:39 -0700 (PDT) Received: by mail-ej1-x629.google.com with SMTP id fu3so16207631ejc.7 for ; Tue, 14 Jun 2022 03:20:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=8v3lOwdOL3F0eEbpP5W4KoI3XA83qxbQy2tuMQ8utlY=; b=L9wFGIOS7/pPJgf45hwLQ6SNVwMzZuFDGXRL3XXXBdrG8eFmp6oBTIkURAEBrcWJXq uLzboPlWNvgSKsS4SXU4554WhYK8xn6piyBtuHbOZKRt1h9W721usmrfNmnigDmgwlnB 3Y9WrDE+A2HeFCDZad/e/vVOr9XzAnBQJon7BUfTNYMkGYV7aCz+mViyyKmlJ/92SOAI JgwlS1l2uSirAgX6qEAEQQaZnDdELY8FdhHnS9l3BhNjp6qlsFlv8RjLVLY2xRjLZu0C 9RvJilJtnMCWbV6hH/oTm4VYOsbXWRZniCCMn/I1ZeihAG2CWx38EJlpMgmYuNBgzv7T zx8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=8v3lOwdOL3F0eEbpP5W4KoI3XA83qxbQy2tuMQ8utlY=; b=1QTNFxoGsj8eJW3plRJFIH/HfjXMgLerDUEGkPCCc/XhGPoDO5QBdbB/w5hEMmuBCl 44VeoPn7xWoFFQSJdh2eSWZkRGIpU6AxyJClowhXF8J1/3kuv5PhKetSG5fWNboYOq8c aeyaFTgzdgdN0dXc0mMIVlLKOiR2UJQPi8W0jyhAcAZ8QNXpvSCIkmLhtNR0egYuDu2K xTWG3kSHZdjDIItTFRa7J3rk6YjdxW1/j0A7RBzEt7K2KjRNYbGUIaQvqEQPfxS7N9Fp GB3Gswl3fqRr98XKERMOBGuaR/gqh0mk61tcnyMihS6UsPsS3lqFtKrvioSFTBhFFVv3 6Idw== X-Gm-Message-State: AOAM530zyhmnhtF7pZ7cSK9VBUQ56I23TaPjYhbmJvRR+Nk+M0DSHiRA MkH4yurwOYL8TYCs22/9pr0wJYTu+3k= X-Google-Smtp-Source: ABdhPJyz/hcofYIx8f4lFf+DEFN8K0+6lqtpFggXv1W9/3kOGx8tMWBIwc8j93JUNXyeTexUvaapyQ== X-Received: by 2002:a17:906:73de:b0:715:784d:2cdd with SMTP id n30-20020a17090673de00b00715784d2cddmr3572644ejl.273.1655202037678; Tue, 14 Jun 2022 03:20:37 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-001-087-232.77.1.pool.telefonica.de. [77.1.87.232]) by smtp.gmail.com with ESMTPSA id gv17-20020a170906f11100b006febc1e9fc8sm4871186ejb.47.2022.06.14.03.20.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jun 2022 03:20:37 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 2/4] support perf_event_paranoid=3 Date: Tue, 14 Jun 2022 12:20:27 +0200 Message-Id: <20220614102029.13006-2-cgzones@googlemail.com> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220614102029.13006-1-cgzones@googlemail.com> References: <20220614102029.13006-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Debian uses a downstream patch[1] to allow further restriction of perf_event_open, which requires CAP_SYS_ADMIN for all perf_event_open(2) operations. [1]: https://salsa.debian.org/kernel-team/linux/-/blob/debian/5.17.3-1/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch Signed-off-by: Christian Göttsche --- policy/test_perf_event.te | 29 +++++++++++++++++++++++------ tests/perf_event/test | 39 ++++++++++++++++++++++++++++----------- 2 files changed, 51 insertions(+), 17 deletions(-) diff --git a/policy/test_perf_event.te b/policy/test_perf_event.te index fb05120..dc2b49f 100644 --- a/policy/test_perf_event.te +++ b/policy/test_perf_event.te @@ -10,18 +10,29 @@ unconfined_runs_test(test_perf_t) typeattribute test_perf_t testdomain; typeattribute test_perf_t perfdomain; +allow test_perf_t self:capability { sys_admin }; allow test_perf_t self:capability2 { perfmon }; allow test_perf_t self:perf_event { open cpu kernel tracepoint read write }; allow_lockdown_confidentiality(test_perf_t) ################# Deny capability2 { perfmon } ########################## -type test_perf_no_cap_t; -domain_type(test_perf_no_cap_t) -unconfined_runs_test(test_perf_no_cap_t) -typeattribute test_perf_no_cap_t testdomain; -typeattribute test_perf_no_cap_t perfdomain; +type test_perf_no_cap_perfmon_t; +domain_type(test_perf_no_cap_perfmon_t) +unconfined_runs_test(test_perf_no_cap_perfmon_t) +typeattribute test_perf_no_cap_perfmon_t testdomain; +typeattribute test_perf_no_cap_perfmon_t perfdomain; -allow test_perf_no_cap_t self:perf_event { open cpu kernel tracepoint read write }; +allow test_perf_no_cap_perfmon_t self:perf_event { open cpu kernel tracepoint read write }; + +################# Deny capability { sys_admin } ########################## +type test_perf_no_cap_sysadmin_t; +domain_type(test_perf_no_cap_sysadmin_t) +unconfined_runs_test(test_perf_no_cap_sysadmin_t) +typeattribute test_perf_no_cap_sysadmin_t testdomain; +typeattribute test_perf_no_cap_sysadmin_t perfdomain; + +allow test_perf_no_cap_sysadmin_t self:capability2 { perfmon }; +allow test_perf_no_cap_sysadmin_t self:perf_event { open cpu kernel tracepoint read write }; ################# Deny perf_event { open } ########################## type test_perf_no_open_t; @@ -30,6 +41,7 @@ unconfined_runs_test(test_perf_no_open_t) typeattribute test_perf_no_open_t testdomain; typeattribute test_perf_no_open_t perfdomain; +allow test_perf_no_open_t self:capability { sys_admin }; allow test_perf_no_open_t self:capability2 { perfmon }; allow test_perf_no_open_t self:perf_event { cpu kernel tracepoint read write }; @@ -40,6 +52,7 @@ unconfined_runs_test(test_perf_no_cpu_t) typeattribute test_perf_no_cpu_t testdomain; typeattribute test_perf_no_cpu_t perfdomain; +allow test_perf_no_cpu_t self:capability { sys_admin }; allow test_perf_no_cpu_t self:capability2 { perfmon }; allow test_perf_no_cpu_t self:perf_event { open kernel tracepoint read write }; allow_lockdown_confidentiality(test_perf_no_cpu_t) @@ -51,6 +64,7 @@ unconfined_runs_test(test_perf_no_kernel_t) typeattribute test_perf_no_kernel_t testdomain; typeattribute test_perf_no_kernel_t perfdomain; +allow test_perf_no_kernel_t self:capability { sys_admin }; allow test_perf_no_kernel_t self:capability2 { perfmon }; allow test_perf_no_kernel_t self:perf_event { open cpu tracepoint read write }; @@ -61,6 +75,7 @@ unconfined_runs_test(test_perf_no_tracepoint_t) typeattribute test_perf_no_tracepoint_t testdomain; typeattribute test_perf_no_tracepoint_t perfdomain; +allow test_perf_no_tracepoint_t self:capability { sys_admin }; allow test_perf_no_tracepoint_t self:capability2 { perfmon }; allow test_perf_no_tracepoint_t self:perf_event { open cpu kernel read write }; allow_lockdown_confidentiality(test_perf_no_tracepoint_t) @@ -72,6 +87,7 @@ unconfined_runs_test(test_perf_no_read_t) typeattribute test_perf_no_read_t testdomain; typeattribute test_perf_no_read_t perfdomain; +allow test_perf_no_read_t self:capability { sys_admin }; allow test_perf_no_read_t self:capability2 { perfmon }; allow test_perf_no_read_t self:perf_event { open cpu kernel tracepoint write }; allow_lockdown_confidentiality(test_perf_no_read_t) @@ -83,6 +99,7 @@ unconfined_runs_test(test_perf_no_write_t) typeattribute test_perf_no_write_t testdomain; typeattribute test_perf_no_write_t perfdomain; +allow test_perf_no_write_t self:capability { sys_admin }; allow test_perf_no_write_t self:capability2 { perfmon }; allow test_perf_no_write_t self:perf_event { open cpu kernel tracepoint read }; allow_lockdown_confidentiality(test_perf_no_write_t) diff --git a/tests/perf_event/test b/tests/perf_event/test index c336477..5aacdf9 100755 --- a/tests/perf_event/test +++ b/tests/perf_event/test @@ -5,8 +5,8 @@ BEGIN { $basedir = $0; $basedir =~ s|(.*)/[^/]*|$1|; - $test_count = 8; - $capability = 0; + $cap_perfmon = 0; + $cap_sysadmin = 0; # allow info to be shown during tests $v = $ARGV[0]; @@ -22,8 +22,10 @@ BEGIN { $level = `cat /proc/sys/kernel/perf_event_paranoid`; chomp($level); if ( $level >= 2 ) { # These tests require CAP_PERFMON - $test_count += 1; - $capability = 1; + $cap_perfmon = 1; + } + if ( $level >= 3 ) { # These tests require CAP_SYS_ADMIN + $cap_sysadmin = 1; } if ( $v eq "-v" ) { @@ -32,12 +34,15 @@ BEGIN { print "\tNot paranoid\n"; } elsif ( $level eq 0 ) { - print "\tDisallow raw tracepoint/ftrace without CAP_SYS_ADMIN\n"; + print "\tDisallow raw tracepoint/ftrace without CAP_PERFMON\n"; } elsif ( $level eq 1 ) { - print "\tDisallow CPU event access without CAP_SYS_ADMIN\n"; + print "\tDisallow CPU event access without CAP_PERFMON\n"; } elsif ( $level eq 2 ) { + print "\tDisallow kernel profiling without CAP_PERFMON\n"; + } + elsif ( $level eq 3 ) { print "\tDisallow kernel profiling without CAP_SYS_ADMIN\n"; } else { @@ -45,7 +50,7 @@ BEGIN { } } - plan tests => $test_count; + plan tests => 10; } # find some CPU that is online @@ -67,13 +72,25 @@ print "Test perf_event\n"; $result = system "runcon -t test_perf_t $basedir/perf_event $v $cpu $event_id"; ok( $result eq 0 ); -if ($capability) { +# Deny capability { perfmon } - EACCES perf_event_open(2) if perf_event_paranoid >= 2 +$result = system +"runcon -t test_perf_no_cap_perfmon_t $basedir/perf_event $v $cpu $event_id 2>&1"; +if ($cap_perfmon) { + ok( $result >> 8 eq 1 ); +} +else { + ok( $result eq 0 ); +} - # Deny capability { perfmon } - EACCES perf_event_open(2) - $result = system - "runcon -t test_perf_no_cap_t $basedir/perf_event $v $cpu $event_id 2>&1"; +# Deny capability { sys_admin } - EACCES perf_event_open(2) if perf_event_paranoid >= 3 +$result = system +"runcon -t test_perf_no_cap_sysadmin_t $basedir/perf_event $v $cpu $event_id 2>&1"; +if ($cap_sysadmin) { ok( $result >> 8 eq 1 ); } +else { + ok( $result eq 0 ); +} # Deny perf_event { open } - EACCES perf_event_open(2) $result = From patchwork Tue Jun 14 10:20:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12880893 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 408A6CCA47C for ; Tue, 14 Jun 2022 10:20:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353999AbiFNKUp (ORCPT ); Tue, 14 Jun 2022 06:20:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353908AbiFNKUl (ORCPT ); Tue, 14 Jun 2022 06:20:41 -0400 Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B65C047395 for ; Tue, 14 Jun 2022 03:20:39 -0700 (PDT) Received: by mail-ed1-x52d.google.com with SMTP id d14so10893657eda.12 for ; Tue, 14 Jun 2022 03:20:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=SyaBdVPVW3Xwd5w3bqkEnZxWpvGDJO8hWc12yYaeDRA=; b=X5JKRUvDTTvW0kYMgn9zWzpvnP9sGqHX3AFSTYqWC0h/ondD6Quke0ILI9bnoxtsjS p4MvEYuJ8q9Dh0NNhJDQ62g+8KX5iPAwprBBxwDOg5SvdDeb4iaRiRhesj+49Cvg8z2A xOHvuyt0tNG6qC51oM0gZspEN7YWDRdZfWQIMoao5BsBnkdbRBnuoR6m6RlAGlTDsSS8 r1NmDcDZu2qFzlWj3RKsK09GpL/gS1FnuxmS7mbP4Yac5b8mQyX0ePPbAz5YbC9FT6gO Amw13T0cmOrGTNPOktbq7+Yo04McgsPXMtPo2mXdFlDdglOc1yRrqXsJajPY3xmKM0IL fzFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=SyaBdVPVW3Xwd5w3bqkEnZxWpvGDJO8hWc12yYaeDRA=; b=ZeoqSqSZNU7wXl+DbUEBIhPiIqQHSCfG/v5d+Vc+Qnd1iXi/xVrbLtH4lYgRZNAt/0 Xh2H4G5V3YDKbUdDbZT58rQJd6rnrJs2Xvi/s2T/BEc6aY/xd+fWDk4X/cIgeOz3BudG iO6th3Wssyh7FBNKnSQRW9xMUdL+YhlWJOJiNVsHuGQJgSU4EkdeRveX6u7T+wzIuofN 56waNj70WZnrvBaFWNAHpLe9ueXuHfFfsDhpEo/qSmRDd9FfssS9kGAORvHgb4p05p5c nTiYI8vYjXeHrzJe0mgKDU+DBGfrLiRLTEiuiNOyyFLVDJ2YIXnjJuCQ5ealIIfYH2Zi l2Ig== X-Gm-Message-State: AOAM531x1PlRAsqg5ms0DxxK7SXL0sShAT+jSaU5ZHEtn/mlAzHrRimw qRH6PTAThVYGuthXteTNM1vxcXRZtQ4= X-Google-Smtp-Source: AGRyM1toiWsvgSgPLQNk4lfbgdEuGnURYr8deACp9S3tID++c06OIDkb9j2+8gsRONgmJHTvbLcS8g== X-Received: by 2002:aa7:d6d5:0:b0:431:b7c0:50c9 with SMTP id x21-20020aa7d6d5000000b00431b7c050c9mr5132849edr.62.1655202038318; Tue, 14 Jun 2022 03:20:38 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-001-087-232.77.1.pool.telefonica.de. [77.1.87.232]) by smtp.gmail.com with ESMTPSA id gv17-20020a170906f11100b006febc1e9fc8sm4871186ejb.47.2022.06.14.03.20.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jun 2022 03:20:37 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 3/4] filesystem: allow getfilecon(3) to pass test Date: Tue, 14 Jun 2022 12:20:28 +0200 Message-Id: <20220614102029.13006-3-cgzones@googlemail.com> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220614102029.13006-1-cgzones@googlemail.com> References: <20220614102029.13006-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org filesystem/ext4/test .. 67/83 getfilecon(3) Failed: Permission denied filesystem/ext4/test .. 71/83 filesystem/ext4/test .. 75/83 # Looks like you failed 1 test of 83. filesystem/ext4/test .. Dubious, test returned 1 (wstat 256, 0x100) type=PROCTITLE msg=audit(02/05/22 11:47:03.170:7047) : proctitle=/root/workspace/selinux/selinux-testsuite/tests/filesystem/ext4/check_mount_context -r -m /root/workspace/selinux/selinux-testsu type=PATH msg=audit(02/05/22 11:47:03.170:7047) : item=0 name=/root/workspace/selinux/selinux-testsuite/tests/filesystem/ext4/mntpoint/mp1 inode=390506 dev=fe:01 mode=dir,750 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:unlabeled_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/05/22 11:47:03.170:7047) : cwd=/root/workspace/selinux/selinux-testsuite/tests type=SYSCALL msg=audit(02/05/22 11:47:03.170:7047) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7ffcd27c5651 a1=0x7fec8529078d a2=0x645b39a13550 a3=0xff items=1 ppid=76535 pid=77228 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=1 comm=check_mount_con exe=/root/workspace/selinux/selinux-testsuite/tests/filesystem/check_mount_context subj=unconfined_u:unconfined_r:test_filesystem_context_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(02/05/22 11:47:03.170:7047) : avc: denied { getattr } for pid=77228 comm=check_mount_con name=mp1 dev="vda1" ino=390506 scontext=unconfined_u:unconfined_r:test_filesystem_context_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 Signed-off-by: Christian Göttsche --- policy/test_filesystem.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/test_filesystem.te b/policy/test_filesystem.te index 4e27134..46e3f1a 100644 --- a/policy/test_filesystem.te +++ b/policy/test_filesystem.te @@ -382,7 +382,7 @@ allow test_filesystem_fscontext_t test_filesystem_context_file_t:file { create g # For testing rootcontext= Set mountpoint to unlabeled first allow test_filesystem_context_t test_file_t:dir { relabelfrom }; -allow test_filesystem_context_t unlabeled_t:dir { mounton relabelto }; +allow test_filesystem_context_t unlabeled_t:dir { getattr mounton relabelto }; # ####################### Rules for nfs_filesystem/test ################### From patchwork Tue Jun 14 10:20:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12880894 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 059D9CCA47A for ; Tue, 14 Jun 2022 10:20:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353841AbiFNKUn (ORCPT ); Tue, 14 Jun 2022 06:20:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353999AbiFNKUm (ORCPT ); Tue, 14 Jun 2022 06:20:42 -0400 Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62B1F473B0 for ; Tue, 14 Jun 2022 03:20:40 -0700 (PDT) Received: by mail-ej1-x629.google.com with SMTP id u12so16191900eja.8 for ; Tue, 14 Jun 2022 03:20:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=vPxEEIZQ6+bg5HLSgefSYabNhEAPADjLC36hYzjMzgw=; b=G/qz1V56tHGk3BX8gS5LtSXwWMbjkz/QuWSl2IByKaECu6t2VHNlyyKjQQ0gfDQAMT gmP+Dv/6L6R7DxdLXQTrC4XhaLuly+o73nXEQaqz6cedtM9OHWVcBaifDYzTvFRf8jIb p25EnQBaxkWqWNC/UV8H8i46xLWuLtScKfBQJ8rd1ttLfuieF+7uHlY/00Tuqc7EA8Ml tocF1lXcbRCPGnxAHm8mzlRs/1GyaR4ufidg46IQ0A9/h9r5lnIY6j8cE9rPeqyvzjFS 1U/FnRtKjZqRTkVz6DfyU2zBfd0CMECx3pklvrOhPRsqlQyLd4HjJgEGSwqxl0TUeCJJ JdMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=vPxEEIZQ6+bg5HLSgefSYabNhEAPADjLC36hYzjMzgw=; b=yAD6yVPLf/0ZnzNQidxUMmz89q9F/NIQadC81jn/gFk0xnjqfxPL3v/FDICQ1YO2gK YTRpEMR7N4BnEJ07cf80oOxfPp5DCpOocvj4w/s94m3I3f650GufRK+ah20m/OpkCC6N vamfHwEBcaUAMwz5GyApQvJlbOPk6xAHKaU91P1Sy3rthh8xa+NsitOaRiMb3X72OqII fNSHNWhWUw7ByE6NI4wnG3H3qlHR2mxP6h6QsIl1qaWkRIy63pQfk63annvSlzVo9Lta 11uPS9Uda1nufnZ2TliiipAqp+DN8np+FU+xkEAYaS4qOWIHWX2hSwvv3c3JYf6Qim+/ Vwow== X-Gm-Message-State: AOAM531V5xcD8B75gn8PLcl/c/fxPtYmzL9jz1a/RFfhxphXSIwBfECI /jT+c/MVTs5MDHNUnQnzb0bRCNLHA0k= X-Google-Smtp-Source: AGRyM1tal5x8EhfbADb8ZuSVBVABPGiCnYQAIQRogn6bLU8CSATgmL7wvebn1DoUwKlrROOFmhBIlA== X-Received: by 2002:a17:907:6294:b0:6e1:ea4:74a3 with SMTP id nd20-20020a170907629400b006e10ea474a3mr3601788ejc.168.1655202038890; Tue, 14 Jun 2022 03:20:38 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-001-087-232.77.1.pool.telefonica.de. [77.1.87.232]) by smtp.gmail.com with ESMTPSA id gv17-20020a170906f11100b006febc1e9fc8sm4871186ejb.47.2022.06.14.03.20.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jun 2022 03:20:38 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 4/4] watchkey: skip if CONFIG_WATCH_QUEUE not set Date: Tue, 14 Jun 2022 12:20:29 +0200 Message-Id: <20220614102029.13006-4-cgzones@googlemail.com> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220614102029.13006-1-cgzones@googlemail.com> References: <20220614102029.13006-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Debian does not set CONFIG_WATCH_QUEUE, whereby pipe2(2) returns ENOPKG for the option O_NOTIFICATION_PIPE. Signed-off-by: Christian Göttsche --- tests/watchkey/test | 9 ++++++++- tests/watchkey/watchkey.c | 16 ++++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/tests/watchkey/test b/tests/watchkey/test index f61ff78..38cbb74 100755 --- a/tests/watchkey/test +++ b/tests/watchkey/test @@ -16,7 +16,14 @@ BEGIN { $v = " "; } - plan tests => 2; + $result = system "runcon -t test_watchkey_t $basedir/watchkey $v -c"; + if ( $result ne 0 ) { + plan skip_all => +"pipe2(2) does not support O_NOTIFICATION_PIPE; CONFIG_WATCH_QUEUE probably not set"; + } + else { + plan tests => 2; + } } $result = system "runcon -t test_watchkey_t $basedir/watchkey $v"; diff --git a/tests/watchkey/watchkey.c b/tests/watchkey/watchkey.c index c7f3274..4feba42 100644 --- a/tests/watchkey/watchkey.c +++ b/tests/watchkey/watchkey.c @@ -27,8 +27,9 @@ static long keyctl_watch_key(int key, int watch_fd, int watch_id) static void print_usage(char *progname) { fprintf(stderr, - "usage: %s [-v]\n" + "usage: %s [-cv]\n" "Where:\n\t" + "-c Check for availability.\n" "-v Print information.\n", progname); exit(-1); } @@ -37,10 +38,14 @@ int main(int argc, char **argv) { int opt, fd, pipefd[2], result, save_errno; char *context; + bool check = false; bool verbose = false; - while ((opt = getopt(argc, argv, "v")) != -1) { + while ((opt = getopt(argc, argv, "cv")) != -1) { switch (opt) { + case 'c': + check = true; + break; case 'v': verbose = true; break; @@ -60,6 +65,13 @@ int main(int argc, char **argv) free(context); } + if (check) { + result = pipe2(pipefd, O_NOTIFICATION_PIPE); + if (!result || errno != ENOPKG) + exit(0); + exit(-1); + } + result = pipe2(pipefd, O_NOTIFICATION_PIPE); if (result < 0) { fprintf(stderr, "Failed to create pipe2(2): %s\n",