Selinux loading fix and warning cleanups #2781

keszybz · 2016-03-02T01:49:08Z

No description provided.

systemd#2508 (comment) Maybe fixes https://bugzilla.redhat.com/show_bug.cgi?id=1308771.

evverx · 2016-03-02T03:45:56Z

@keszybz , thanks for the test-selinux.
I've found a problem:

$ sudo ./test-selinux
...
mac_selinux_create_label_from_exe → 0 (No such file or directory), "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
...

$ sudo strace ./test-selinux
...
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
open("/sys/fs/selinux/create", O_RDWR)  = 3
write(3, "unconfined_u:unconfined_r:unconf"..., 88) = 88
read(3, "unconfined_u:unconfined_r:unconf"..., 4095) = 54
close(3)                                = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
writev(2, [{"mac_selinux_create_label_from_ex"..., 124}, {"\n", 1}], 2mac_selinux_create_label_from_exe → 0 (No such file or directory), "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
...

$ sudo systemctl start mcstransd.service
$ sudo ./test-selinux
...
mac_selinux_create_label_from_exe → 0 (Success), "unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh"
...

So, we use non-raw functions sometimes. It's not good: #1107

As suggested by Evgeny Vereshchagin as a follow up for systemd#2781 (comment).

…e results and timings

This helps to understand misleading gcc warnings about type mismatches.

It seems that it is signed both on i386 and arm. Avoids a stupid gcc warning on arm: src/udev/udevadm-monitor.c: In function ‘print_device’: src/udev/udevadm-monitor.c:44:16: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 3 has type ‘__time_t {aka long int}’ [-Wformat=] printf("%-6s[%"PRI_TIME".%06ld] %-8s %s (%s)\n", ^

evverx · 2016-03-02T20:06:16Z

src/basic/selinux-util.c

@@ -225,7 +217,7 @@ int mac_selinux_get_create_label_from_exe(const char *exe, char **label) {
                return -errno;

        sclass = string_to_security_class("process");
-        r = security_compute_create(mycon, fcon, sclass, (security_context_t *) label);
+        r = security_compute_create_raw(mycon, fcon, sclass, (security_context_t *) label);


@keszybz , thanks!
I'm running exec strace -D -ff -o strace-of-systemd /usr/lib/systemd/systemd as init:

bash-4.3# grep -F '.setrans-unix' /strace-of-systemd.1 connect(19, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(22, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(22, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(23, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(23, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(25, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(26, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(28, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(29, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(39, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(39, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(34, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(34, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(35, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(35, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(15, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory) connect(15, {sa_family=AF_LOCAL, sun_path="/var/run/setrans/.setrans-unix"}, 110) = -1 ENOENT (No such file or directory)

So, it's not so easy:)

I'm not seeing that here (running with 6f81773de7fe5ad4).

Hm, it's strange.
For example: systemd calls mac_selinux_setup. mac_selinux_setup calls setcon. setcon calls selinux_raw_to_trans_context.

I've prepared a PR: #2797

Selinux loading fix and warning cleanups

Very handy for early-boot debugging See systemd#2781 (comment)

As suggested by Evgeny Vereshchagin as a follow up for systemd/systemd#2781 (comment). (cherry picked from commit 5c5433a)

selinux: always try to load the full selinux db

c3dacc8

systemd#2508 (comment) Maybe fixes https://bugzilla.redhat.com/show_bug.cgi?id=1308771.

keszybz added selinux tests labels Mar 2, 2016

evverx mentioned this pull request Mar 2, 2016

selinux: always use *_raw API from libselinux #1107

Merged

keszybz added 4 commits March 2, 2016 10:42

selinux: use raw variants of security_compute_create and setfscreatecon

5c5433a

As suggested by Evgeny Vereshchagin as a follow up for systemd#2781 (comment).

test-selinux: add some simple tests which call functions and print th…

ada94e6

…e results and timings

test-sizeof: add a helper which prints variable sizes and signedness

fed527a

This helps to understand misleading gcc warnings about type mismatches.

keszybz force-pushed the selinux-and-warnings branch from 1e89074 to 6307c39 Compare March 2, 2016 15:48

keszybz mentioned this pull request Mar 2, 2016

Load SELinux labelling systemd in systemd-logind #2508

Merged

evverx reviewed Mar 2, 2016
View reviewed changes

poettering added a commit that referenced this pull request Mar 3, 2016

Merge pull request #2781 from keszybz/selinux-and-warnings

04c760d

Selinux loading fix and warning cleanups

poettering merged commit 04c760d into systemd:master Mar 3, 2016

keszybz deleted the selinux-and-warnings branch March 3, 2016 17:55

evverx added a commit to evverx/systemd that referenced this pull request Mar 4, 2016

tests: add create_strace_wrapper

45dbd7b

Very handy for early-boot debugging See systemd#2781 (comment)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Selinux loading fix and warning cleanups #2781

Selinux loading fix and warning cleanups #2781

keszybz commented Mar 2, 2016

evverx commented Mar 2, 2016

evverx Mar 2, 2016

keszybz Mar 3, 2016

evverx Mar 3, 2016

evverx Mar 4, 2016

Selinux loading fix and warning cleanups #2781

Selinux loading fix and warning cleanups #2781

Conversation

keszybz commented Mar 2, 2016

evverx commented Mar 2, 2016

evverx Mar 2, 2016

Choose a reason for hiding this comment

keszybz Mar 3, 2016

Choose a reason for hiding this comment

evverx Mar 3, 2016

Choose a reason for hiding this comment

evverx Mar 4, 2016

Choose a reason for hiding this comment