Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

selinux_restore_tty: use fgetfilecon_raw/fsetfilecon_raw #17

Closed
doverride opened this issue Dec 11, 2019 · 3 comments
Closed

selinux_restore_tty: use fgetfilecon_raw/fsetfilecon_raw #17

doverride opened this issue Dec 11, 2019 · 3 comments

Comments

@doverride
Copy link

@doverride doverride commented Dec 11, 2019

Sudo uses fgetfilecon() and fsetfilecon() in selinux_restore_tty()
It should probably use fgetfilecon_raw() and fsetfilecon_raw() instead.

If you use mcstrans (a daemon that translates SELinux contexts to human readable strings), and you run shutdown -h now from a sudo -r sysadm.role -s shell then systemd will kill mcstrans before the sudo shell process gets killed.

Sudo, i think, still has the translated version of the context (retrieved with fgetfilecon()) in cache and tries to restore the context of the tty using the human readable version of the context. Since mcstrans is no longer present, that context is invalid prompting:

12:39 < grift> Dec 11 12:36:20 perfevent audit: SELINUX_ERR op=setxattr 
               invalid_context="wheel.id:wheel.role:users.terminals.pty.pty_file:SystemLow"
12:39 < grift> Dec 11 12:36:20 perfevent audit[859]: AVC avc:  denied  { mac_admin } for  pid=859 comm="sudo" capability=33  
               scontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tcontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tclass=capability2 permissive=0

By using fgetfilecon_raw() and fsetfilecon_raw() sudo would be using the "raw" context to restore the tty. This "raw" context is valid when mcstrans has been terminated.

@ToddMiller1

This comment has been minimized.

Copy link

@ToddMiller1 ToddMiller1 commented Dec 11, 2019

Can you try the attached patch? I don't have an SELinux policy that actually cares about file contexts.
fsetfilecon_raw.txt

@doverride

This comment has been minimized.

Copy link
Author

@doverride doverride commented Dec 11, 2019

Thanks, Yes this patch fixes the above issue for me.

@millert

This comment has been minimized.

Copy link
Collaborator

@millert millert commented Dec 12, 2019

I committed the patch; it will be in sudo the 1.8.30 release.

@millert millert closed this Dec 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.