data/selinux, tests: refactor SELinux policy, add minimal tests #6270

bboozzoo · 2018-12-06T14:37:34Z

Followup on #6238. The PR contains a refactored SELinux policy for snapd.

A week long crash course in SELinux gave birth to this larg(-ish) branch that introduces a minimal SELinux support and does a major refactoring to SELinux targeted policy for snapd.

Major changes:

policy introduces a separate domain for snapd and each type of helper (mount, confine, cli)
each domain has a separate policy and allows only specific transitions
there is a separate file type for data in mounted snap images (snappy_snap_t, for the lack of a better name)

Some notes about transitions and starting snaps. When a regular user starts a snap, they are typically in unconfined_u:unconfined_r:unconfined_t context. This proceeds without any special transitions or limitations, since the user is already unconfined, and there is no targeted policy to close it down. The snaps that are started by systemd end up transitioning to system_u:system_r:unconfined_service_t domain, where they should not raise any more denials. While doing so, the transitions are:

init_t -> snappy_cli_t (snap run ..) -> snappy_confine_t -> ..
   ... -> snappy_mount_t (snap-update-ns) and back -> 
   ... -> unconfined_service_t

Domains permissions are limited to just the things each tool does. With the split in place, it's way easier to track which piece is doing what.

(cc @Conan-Kudo)

Refactor SELinux policy for snapd and helpers. To make it more manageable, split snapd and the helpers into separate domains: snappy_t (snapd), snappy_mount_t (snap-{update,discard}-ns), and snappy_cli_t (snap{,ctl}). Add separate local policy for each helper, trying to keep it minimal where possible. Also update file contexts so that they can be properly relabeled. Introuduce a separate file type for snap data, snappy_snap_t which is aimed to be used a mount context for snap images. This ensures that the snaps will be properly labeled and we can write policy that uses this type. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…grade Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Add domain transitions for directories created by snap tools when invoked by a regular user who is typically in unconfined_t domain. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Conan-Kudo

Some small issues...

Conan-Kudo · 2018-12-06T14:41:20Z

data/selinux/snappy.fc

@@ -18,30 +18,38 @@


 HOME_DIR/snap(/.*)?			gen_context(system_u:object_r:snappy_home_t,s0)
+/root/snap(/.*)?			gen_context(system_u:object_r:snappy_home_t,s0)


This should not be necessary, since HOME_DIR applies to /root too.

I wasn't sure about that. I recall seeing separate rules for both HOME_DIR and /root in the core policy.

Right here: https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/services/ssh.fc

tests/main/selinux-data-context/task.yaml

Conan-Kudo · 2018-12-06T14:44:33Z

tests/upgrade/selinux-relabel/task.yaml

+summary: Check that correct SELinux file contexts were assigned on upgrade
+
+# TODO: enable centos once we build the policy there too
+systems: [fedora-*]


We should be able to build the policy for CentOS now.

This looks like the only thing that's left that needs to be fixed here...

We need to land this https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b240f3418f to enable this test.

I told it to be pushed, so it should sync out within the next 20 hours.

Thanks! I'll update the test once the package is available.

Or not... I forgot to switch the build to the one with backported EL7 fixes. It needs a single +1 karma to make it go into stable now.

Though since 2.36.3 is out, I should go ahead and build that and update everybody...

Even better. Ping me when you upload a new update. I'll play with it in a VM and will post karma.

snapd 2.36.3 is in the EPEL7 repo now.

Conan-Kudo · 2018-12-06T14:46:29Z

data/selinux/snappy.fc

+/usr/libexec/snapd/snapctl		--	gen_context(system_u:object_r:snappy_cli_exec_t,s0)
+/usr/libexec/snapd/snap-confine		--	gen_context(system_u:object_r:snappy_confine_exec_t,s0)
+/usr/libexec/snapd/snap-update-ns		--	gen_context(system_u:object_r:snappy_mount_exec_t,s0)
+/usr/libexec/snapd/snap-discard-ns		--	gen_context(system_u:object_r:snappy_mount_exec_t,s0)
 /usr/libexec/snapd/.*		--	gen_context(system_u:object_r:snappy_exec_t,s0)


Would the ordering matter here? Should the generic entry be first, and then the specific entries after?

No, the order doesn't matter AFAIK. I'd leave the /usr/libexec/snapd/.* last to not confuse people.

Conan-Kudo · 2018-12-06T14:46:39Z

data/selinux/snappy.fc

+/usr/lib/snapd/snapctl		--	gen_context(system_u:object_r:snappy_cli_exec_t,s0)
+/usr/lib/snapd/snap-confine		--	gen_context(system_u:object_r:snappy_confine_exec_t,s0)
+/usr/lib/snapd/snap-update-ns		--	gen_context(system_u:object_r:snappy_mount_exec_t,s0)
+/usr/lib/snapd/snap-discard-ns		--	gen_context(system_u:object_r:snappy_mount_exec_t,s0)
 /usr/lib/snapd/.*  		--	gen_context(system_u:object_r:snappy_exec_t,s0)


Would the ordering matter here? Should the generic entry be first, and then the specific entries after?

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

The SELinux core policy shipped by RHEL7.6 (3.13.1-229.el7_6.6) is older than what is in Fedora 29 (3.14.2-42.fc29) and some interfaces are missing. Update snapd type enforcement so that it can be built with the older policy. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Now that we build the policy on CentOS too, the test can be run there too. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

…-policy-refactor

…s files and directories Add a snap that generates files and directories under $SNAP_COMMON and $SNAP_DATA both in the service and in the hook. This is to probe for problems with SELinux policy. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Extend the test to cover snaps with services and hooks inside. The hook is started from snapd, while the service is started by systems. This may uncover potential issues with policy transitions. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

The output of `ls -Zd` differs between versions of coreutils. $ mkdir foo; ln -s foo bar On CentOS 7.6, coreutils 8.22: $ ls -Zd foo bar lrwxrwxrwx. root root unconfined_u:object_r:home_root_t:s0 bar -> foo drwxr-xr-x. root root unconfined_u:object_r:home_root_t:s0 foo On Fedora 29, coreutils 8.30: $ ls -Zd foo bar unconfined_u:object_r:user_home_t:s0 bar unconfined_u:object_r:user_home_t:s0 foo Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Systemd caches SELinux context information and when a policy is updated, the changes are not applied by systemd until a reboot or daemon reexecs (thus reloading the policy) Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Socket activation is finnicky. Make sure that the socket is created with proper label. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Update and tweak the policy. Relevant fixes: - allow snapd to run binaries from core - specifically, add rules for running fc-cache and link to a bug in selinux-policy - allow snapd to run journalctl and transition to journalctl_t domain - tweak snap-{update,discard}-ns profile - allow snap-confine to setuid(), setgid() - allow snap to poke policy to restore context of ~/snap - allow systemd to create sockets in snappy_var_t, and sockets for snappy_cli_t, IOW make socket activation work Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

snapd is in EPEL now Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

Workaround differnt ls -Z output in old coreutils (CentOS). Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…zoo/selinux-policy-refactor

…licy-refactor

stolowski

Looks good! As discussed, it can land provided that we also land a solution to migrate currently running services on rpm update.

stolowski · 2019-02-27T08:26:41Z

tests/upgrade/selinux-relabel/task.yaml

@@ -0,0 +1,33 @@
+summary: Check that correct SELinux file contexts were assigned on upgrade


stolowski · 2019-02-27T08:29:39Z

tests/main/selinux-data-context/task.yaml

@@ -0,0 +1,78 @@
+summary: Check that SELinux file context transitions work


Great test!

…licy-refactor

bboozzoo · 2019-03-11T14:19:48Z

@Conan-Kudo I hope to be able to start landing this stuff now. Can you take a look again at this PR and #6238 ?

snapd can be installed from EPEL on CentOS Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…licy-refactor

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Conan-Kudo · 2019-03-14T14:50:29Z

🎆

bboozzoo · 2019-03-14T14:51:34Z

Yeah, the first bit is out. Now I need to push the rest.

bboozzoo added 3 commits December 6, 2018 13:43

tests/upgrade/selinux-relabel: spread test to verify relabeling on up…

97c266a

…grade Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

data/selinux: add transitions for unconfined_t

aec78a1

Add domain transitions for directories created by snap tools when invoked by a regular user who is typically in unconfined_t domain. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo added the SELinux label Dec 6, 2018

Conan-Kudo suggested changes Dec 6, 2018

View reviewed changes

tests/main/selinux-data-context: test for verify directory transitions

0cd3b80

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo force-pushed the bboozzoo/selinux-policy-refactor branch from 76bb0cc to 0cd3b80 Compare December 6, 2018 16:34

bboozzoo mentioned this pull request Dec 7, 2018

centos: enable SELinux support on CentOS 7 #6273

Merged

bboozzoo added 4 commits December 10, 2018 07:28

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

8873e65

…licy-refactor

tests/main/selinux-data-context: enable CentOS

cc87d1a

Now that we build the policy on CentOS too, the test can be run there too. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

tests/upgrade/selinux-relabel: improve the note about systems

5ce5e4e

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo mentioned this pull request Dec 11, 2018

cmd/snap: attempt to restore SELinux context of snap user directories #6265

Merged

bboozzoo added 3 commits December 11, 2018 12:03

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

f8489a3

…licy-refactor

Merge branch 'bboozzoo/spread-log-upgrade-runs' into bboozzoo/selinux…

e9cdfe9

…-policy-refactor

Merge branch 'bboozzoo/spread-log-upgrade-runs' into bboozzoo/selinux…

548d668

…-policy-refactor

bboozzoo mentioned this pull request Dec 12, 2018

spread: record each tests/upgrade job #6292

Merged

bboozzoo added 2 commits December 12, 2018 14:38

bboozzoo mentioned this pull request Dec 12, 2018

selinux: package to query SELinux status and verify/restore file contexts #6285

Merged

bboozzoo added 7 commits December 13, 2018 08:04

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

913a209

…licy-refactor

tests/main/selinux-data-context: verify socket labels

260eee2

Socket activation is finnicky. Make sure that the socket is created with proper label. Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

89232de

…licy-refactor

tests/main/selinux-data-context: tell shellcheck not to complain

44e38ec

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo mentioned this pull request Jan 7, 2019

cmd/snap-confine, packaging: support SELinux #6329

Merged

bboozzoo added 2 commits January 7, 2019 10:54

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

b5311da

…licy-refactor

tests/upgrade/selinux-relabel: enable CentOS

917ca21

snapd is in EPEL now Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo added 4 commits January 7, 2019 11:29

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

9fc726f

…licy-refactor

tests/upgrade/selinux-relabel: workaround old coreutils

fd8fd93

Workaround differnt ls -Z output in old coreutils (CentOS). Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Merge branch 'master' of https://github.com/snapcore/snapd into bbooz…

2ece12d

…zoo/selinux-policy-refactor

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

6edd0b9

…licy-refactor

stolowski approved these changes Feb 27, 2019

View reviewed changes

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

f68f587

…licy-refactor

Conan-Kudo approved these changes Mar 12, 2019

View reviewed changes

bboozzoo added 3 commits March 13, 2019 09:12

tests/upgrade/basic: enable CentOS

64415a3

snapd can be installed from EPEL on CentOS Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Merge remote-tracking branch 'origin/master' into bboozzoo/selinux-po…

f4c65bc

…licy-refactor

tests/upgrade/basic: extra push for CentOS

061f1c6

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

bboozzoo merged commit 104d50b into snapcore:master Mar 14, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

data/selinux, tests: refactor SELinux policy, add minimal tests #6270

data/selinux, tests: refactor SELinux policy, add minimal tests #6270

bboozzoo commented Dec 6, 2018

Conan-Kudo left a comment

Conan-Kudo Dec 6, 2018

bboozzoo Dec 6, 2018

bboozzoo Dec 6, 2018

Conan-Kudo Dec 6, 2018

Conan-Kudo Dec 6, 2018

Conan-Kudo Dec 18, 2018

bboozzoo Dec 18, 2018

Conan-Kudo Dec 18, 2018

bboozzoo Dec 18, 2018

Conan-Kudo Dec 18, 2018

Conan-Kudo Dec 18, 2018

bboozzoo Dec 18, 2018

Conan-Kudo Jan 3, 2019

Conan-Kudo Dec 6, 2018

bboozzoo Dec 10, 2018

Conan-Kudo Dec 6, 2018

stolowski left a comment

stolowski Feb 27, 2019

stolowski Feb 27, 2019

bboozzoo commented Mar 11, 2019

Conan-Kudo commented Mar 14, 2019

bboozzoo commented Mar 14, 2019

		@@ -18,30 +18,38 @@


		HOME_DIR/snap(/.*)? gen_context(system_u:object_r:snappy_home_t,s0)
		/root/snap(/.*)? gen_context(system_u:object_r:snappy_home_t,s0)

		@@ -0,0 +1,33 @@
		summary: Check that correct SELinux file contexts were assigned on upgrade

		@@ -0,0 +1,78 @@
		summary: Check that SELinux file context transitions work

data/selinux, tests: refactor SELinux policy, add minimal tests #6270

data/selinux, tests: refactor SELinux policy, add minimal tests #6270

Conversation

bboozzoo commented Dec 6, 2018

Conan-Kudo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stolowski left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bboozzoo commented Mar 11, 2019

Conan-Kudo commented Mar 14, 2019

bboozzoo commented Mar 14, 2019