selinux: introduce an initial SID for early boot processes

Currently, SELinux doesn't allow distinguishing between kernel threads
and userspace processes that are started before the policy is first
loaded - both get the label corresponding to the kernel SID. The only
way a process that persists from early boot can get a meaningful label
is by doing a voluntary dyntransition or re-executing itself.

Reusing the kernel label for userspace processes is problematic for
several reasons:
1. The kernel is considered to be a privileged domain and generally
   needs to have a wide range of permissions allowed to work correctly,
   which prevents the policy writer from effectively hardening against
   early boot processes that might remain running unintentionally after
   the policy is loaded (they represent a potential extra attack surface
   that should be mitigated).
2. Despite the kernel being treated as a privileged domain, the policy
   writer may want to impose certain special limitations on kernel
   threads that may conflict with the requirements of intentional early
   boot processes. For example, it is a good hardening practice to limit
   what executables the kernel can execute as usermode helpers and to
   confine the resulting usermode helper processes. However, a
   (legitimate) process surviving from early boot may need to execute a
   different set of executables.
3. As currently implemented, overlayfs remembers the security context of
   the process that created an overlayfs mount and uses it to bound
   subsequent operations on files using this context. If an overlayfs
   mount is created before the SELinux policy is loaded, these "mounter"
   checks are made against the kernel context, which may clash with
   restrictions on the kernel domain (see 2.).

To resolve this, introduce a new initial SID (reusing the slot of the
former "init" initial SID) that will be assigned to any userspace
process started before the policy is first loaded. This is easy to do,
as we can simply label any process that goes through the
bprm_creds_for_exec LSM hook with the new init-SID instead of
propagating the kernel SID from the parent.

To provide backwards compatibility for existing policies that are
unaware of this new semantic of the "init" initial SID, introduce a new
policy capability "userspace_initial_context" and set the "init" SID to
the same context as the "kernel" SID unless this capability is set by
the policy.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d06e350fedee5f7936ce0e9bd33c8befd771f886..b8a8a4f0f2ad1f06d8f77a63108aaa98fe3d1a24 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2288,6 +2288,19 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
        new_tsec->keycreate_sid = 0;
        new_tsec->sockcreate_sid = 0;
 
+       /*
+        * Before policy is loaded, label any task outside kernel space
+        * as SECINITSID_INIT, so that any userspace tasks surviving from
+        * early boot end up with a label different from SECINITSID_KERNEL
+        * (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
+        */
+       if (!selinux_initialized()) {
+               new_tsec->sid = SECINITSID_INIT;
+               /* also clear the exec_sid just in case */
+               new_tsec->exec_sid = 0;
+               return 0;
+       }
+
        if (old_tsec->exec_sid) {
                new_tsec->sid = old_tsec->exec_sid;
                /* Reset exec SID on execve. */
@@ -4504,6 +4517,21 @@ static int sock_has_perm(struct sock *sk, u32 perms)
        if (sksec->sid == SECINITSID_KERNEL)
                return 0;
 
+       /*
+        * Before POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, sockets that
+        * inherited the kernel context from early boot used to be skipped
+        * here, so preserve that behavior unless the capability is set.
+        *
+        * By setting the capability the policy signals that it is ready
+        * for this quirk to be fixed. Note that sockets created by a kernel
+        * thread or a usermode helper executed without a transition will
+        * still be skipped in this check regardless of the policycap
+        * setting.
+        */
+       if (!selinux_policycap_userspace_initial_context() &&
+           sksec->sid == SECINITSID_INIT)
+               return 0;
+
        ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->sk = sk;

diff --git a/security/selinux/include/initial_sid_to_string.h b/security/selinux/include/initial_sid_to_string.h
index ecc6e74fa09bd09e4c2ade578d30bd8b7c144928..5e5f0993dac2fee42c9c496abf3b128ff971b8f1 100644 (file)
--- a/security/selinux/include/initial_sid_to_string.h
+++ b/security/selinux/include/initial_sid_to_string.h
@@ -10,7 +10,7 @@ static const char *const initial_sid_to_string[] = {
        NULL,
        "file",
        NULL,
-       NULL,
+       "init",
        "any_socket",
        "port",
        "netif",

diff --git a/security/selinux/include/policycap.h b/security/selinux/include/policycap.h
index f35d3458e71deddc1550d443ba56dbd3936e2410..c7373e6effe5d412d64d05727124f04beb52623f 100644 (file)
--- a/security/selinux/include/policycap.h
+++ b/security/selinux/include/policycap.h
@@ -12,6 +12,7 @@ enum {
        POLICYDB_CAP_NNP_NOSUID_TRANSITION,
        POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS,
        POLICYDB_CAP_IOCTL_SKIP_CLOEXEC,
+       POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT,
        __POLICYDB_CAP_MAX
 };
 #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)

diff --git a/security/selinux/include/policycap_names.h b/security/selinux/include/policycap_names.h
index 2a87fc3702b81a59f71e1eabc786ac8f1a305dd3..28e4c9ee239976deec70ddaa6debd03d508e1207 100644 (file)
--- a/security/selinux/include/policycap_names.h
+++ b/security/selinux/include/policycap_names.h
@@ -13,7 +13,8 @@ const char *const selinux_policycap_names[__POLICYDB_CAP_MAX] = {
        "cgroup_seclabel",
        "nnp_nosuid_transition",
        "genfs_seclabel_symlinks",
-       "ioctl_skip_cloexec"
+       "ioctl_skip_cloexec",
+       "userspace_initial_context",
 };
 
 #endif /* _SELINUX_POLICYCAP_NAMES_H_ */

diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 60eb161a0e5ab954ea7eff359ff718b11223b716..665c4e5bae99dc41bf4af812942b817bbbb972af 100644 (file)
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -189,6 +189,12 @@ static inline bool selinux_policycap_ioctl_skip_cloexec(void)
                selinux_state.policycap[POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]);
 }
 
+static inline bool selinux_policycap_userspace_initial_context(void)
+{
+       return READ_ONCE(
+               selinux_state.policycap[POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT]);
+}
+
 struct selinux_policy_convert_data;
 
 struct selinux_load_state {

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 31b08b34c72249b635a87a1424c405dce50b31fb..cfe77ef24ee280af5c6f7c81d169cc31a8d99437 100644 (file)
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -863,6 +863,8 @@ void policydb_destroy(struct policydb *p)
 int policydb_load_isids(struct policydb *p, struct sidtab *s)
 {
        struct ocontext *head, *c;
+       bool isid_init_supported = ebitmap_get_bit(&p->policycaps,
+                                                  POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT);
        int rc;
 
        rc = sidtab_init(s);
@@ -886,6 +888,13 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
                if (!name)
                        continue;
 
+               /*
+                * Also ignore SECINITSID_INIT if the policy doesn't declare
+                * support for it
+                */
+               if (sid == SECINITSID_INIT && !isid_init_supported)
+                       continue;
+
                rc = sidtab_set_initial(s, sid, &c->context[0]);
                if (rc) {
                        pr_err("SELinux:  unable to load initial SID %s.\n",
@@ -893,6 +902,24 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
                        sidtab_destroy(s);
                        return rc;
                }
+
+               /*
+                * If the policy doesn't support the "userspace_initial_context"
+                * capability, set SECINITSID_INIT to the same context as
+                * SECINITSID_KERNEL. This ensures the same behavior as before
+                * the reintroduction of SECINITSID_INIT, where all tasks
+                * started before policy load would initially get the context
+                * corresponding to SECINITSID_KERNEL.
+                */
+               if (sid == SECINITSID_KERNEL && !isid_init_supported) {
+                       rc = sidtab_set_initial(s, SECINITSID_INIT, &c->context[0]);
+                       if (rc) {
+                               pr_err("SELinux:  unable to load initial SID %s.\n",
+                                      name);
+                               sidtab_destroy(s);
+                               return rc;
+                       }
+               }
        }
        return 0;
 }