* [RFC PATCH 0/1] libselinux: Save digest of all partial matches for directory
@ 2019-04-18 8:07 Richard Haines
0 siblings, 0 replies; 3+ messages in thread
From: Richard Haines @ 2019-04-18 8:07 UTC (permalink / raw)
To: selinux; +Cc: Richard Haines
This patch requires that patch [1] be installed first. [1] has been
implemented on Android and was sent to the selinux list, however its
merge has been defered. It will install the core hashing of file_context
entries.
This patch updates selinux_restorecon() replacing the per-mountpoint
security.restorecon_last attribute with a per-directory security.sehash
attribute computed from only those file contexts entries that partially
match the directory. This is to avoid the need to walk the entire tree
when any part of file_contexts changes, limiting relabels to only those
parts of the tree that could have changed.
One change is to add a new selabel_get_digests_all_partial_matches(3)
function that is explained in the man page. This could replace the Android
version of selabel_hash_all_partial_matches(3), that could then be
converted into a local function.
I've not updated restorecon(8) or restorecon_xattr(8) programs as they
work okay (although I could rework the "selabel_opt_digest" stuff). However
the man pages at least will need updating.
The patch still needs more testing (I've not tried all restorecon options),
however I will send a patch for the selinux-testsuite that will perform
some simple tests on the new code.
[1] https://lore.kernel.org/selinux/20190311222442.49824-1-xunchang@google.com/
Richard Haines (1):
libselinux: Save digest of all partial matches for directory
libselinux/include/selinux/label.h | 5 +
.../selabel_get_digests_all_partial_matches.3 | 69 ++++++
libselinux/src/label.c | 15 ++
libselinux/src/label_file.c | 51 +++++
libselinux/src/label_file.h | 4 +
libselinux/src/label_internal.h | 5 +
libselinux/src/selinux_restorecon.c | 204 +++++++++++++-----
libselinux/utils/.gitignore | 2 +
.../selabel_get_digests_all_partial_matches.c | 171 +++++++++++++++
.../utils/selabel_hash_all_partial_matches.c | 126 +++++++++++
10 files changed, 595 insertions(+), 57 deletions(-)
create mode 100644 libselinux/man/man3/selabel_get_digests_all_partial_matches.3
create mode 100644 libselinux/utils/selabel_get_digests_all_partial_matches.c
create mode 100644 libselinux/utils/selabel_hash_all_partial_matches.c
--
2.20.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [RFC PATCH 0/1] libselinux: Save digest of all partial matches for directory
@ 2019-04-18 8:38 Richard Haines
0 siblings, 0 replies; 3+ messages in thread
From: Richard Haines @ 2019-04-18 8:38 UTC (permalink / raw)
To: selinux; +Cc: Richard Haines
This patch requires that patch [1] be installed first. [1] has been
implemented on Android and was sent to the selinux list, however its
merge has been defered. It will install the core hashing of file_context
entries.
This patch updates selinux_restorecon() replacing the per-mountpoint
security.restorecon_last attribute with a per-directory security.sehash
attribute computed from only those file contexts entries that partially
match the directory. This is to avoid the need to walk the entire tree
when any part of file_contexts changes, limiting relabels to only those
parts of the tree that could have changed.
One change is to add a new selabel_get_digests_all_partial_matches(3)
function that is explained in the man page. This could replace the Android
version of selabel_hash_all_partial_matches(3), that could then be
converted into a local function.
I've not updated restorecon(8) or restorecon_xattr(8) programs as they
work okay (although I could rework the "selabel_opt_digest" stuff). However
the man pages at least will need updating.
The patch still needs more testing (I've not tried all restorecon options),
however I will send a patch for the selinux-testsuite that will perform
some simple tests on the new code.
[1] https://lore.kernel.org/selinux/20190311222442.49824-1-xunchang@google.com/
Richard Haines (1):
libselinux: Save digest of all partial matches for directory
libselinux/include/selinux/label.h | 5 +
.../selabel_get_digests_all_partial_matches.3 | 69 ++++++
libselinux/src/label.c | 15 ++
libselinux/src/label_file.c | 51 +++++
libselinux/src/label_file.h | 4 +
libselinux/src/label_internal.h | 5 +
libselinux/src/selinux_restorecon.c | 204 +++++++++++++-----
libselinux/utils/.gitignore | 2 +
.../selabel_get_digests_all_partial_matches.c | 171 +++++++++++++++
.../utils/selabel_hash_all_partial_matches.c | 126 +++++++++++
10 files changed, 595 insertions(+), 57 deletions(-)
create mode 100644 libselinux/man/man3/selabel_get_digests_all_partial_matches.3
create mode 100644 libselinux/utils/selabel_get_digests_all_partial_matches.c
create mode 100644 libselinux/utils/selabel_hash_all_partial_matches.c
--
2.20.1
^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <20190417105020.23803-1-richard_c_haines@btinternet.com>]
* Re: [RFC PATCH 0/1] libselinux: Save digest of all partial matches for directory
[not found] <20190417105020.23803-1-richard_c_haines@btinternet.com>
@ 2019-04-18 13:52 ` Stephen Smalley
0 siblings, 0 replies; 3+ messages in thread
From: Stephen Smalley @ 2019-04-18 13:52 UTC (permalink / raw)
To: Richard Haines, selinux; +Cc: xunchang
On 4/17/19 6:50 AM, Richard Haines wrote:
> This patch requires that patch [1] be installed first. [1] has been
> implemented on Android and was sent to the selinux list, however its
> merge has been defered. It will install the core hashing of file_context
> entries.
>
> This patch updates selinux_restorecon() replacing the per-mountpoint
> security.restorecon_last attribute with a per-directory security.sehash
> attribute computed from only those file contexts entries that partially
> match the directory. This is to avoid the need to walk the entire tree
> when any part of file_contexts changes, limiting relabels to only those
> parts of the tree that could have changed.
>
> One change is to add a new selabel_get_digests_all_partial_matches(3)
> function that is explained in the man page. This could replace the Android
> version of selabel_hash_all_partial_matches(3), that could then be
> converted into a local function.
>
> I've not updated restorecon(8) or restorecon_xattr(8) programs as they
> work okay (although I could rework the "selabel_opt_digest" stuff). However
> the man pages at least will need updating.
>
> The patch still needs more testing (I've not tried all restorecon options),
> however I will send a patch for the selinux-testsuite that will perform
> some simple tests on the new code.
>
> [1] https://lore.kernel.org/selinux/20190311222442.49824-1-xunchang@google.com/
I've seen some activity on AOSP suggesting that Android has had some
problems with this support, e.g. mismatches due to stem logic and
triggering CAP_SYS_ADMIN denials upon attempting to set security.sehash
attributes. There have been some follow-up commits to AOSP's libselinux
fork in that area and I'm not sure if the dust has entirely settled there.
>
> Richard Haines (1):
> libselinux: Save digest of all partial matches for directory
>
> libselinux/include/selinux/label.h | 5 +
> .../selabel_get_digests_all_partial_matches.3 | 69 ++++++
> libselinux/src/label.c | 15 ++
> libselinux/src/label_file.c | 51 +++++
> libselinux/src/label_file.h | 4 +
> libselinux/src/label_internal.h | 5 +
> libselinux/src/selinux_restorecon.c | 204 +++++++++++++-----
> libselinux/utils/.gitignore | 2 +
> .../selabel_get_digests_all_partial_matches.c | 171 +++++++++++++++
> .../utils/selabel_hash_all_partial_matches.c | 126 +++++++++++
> 10 files changed, 595 insertions(+), 57 deletions(-)
> create mode 100644 libselinux/man/man3/selabel_get_digests_all_partial_matches.3
> create mode 100644 libselinux/utils/selabel_get_digests_all_partial_matches.c
> create mode 100644 libselinux/utils/selabel_hash_all_partial_matches.c
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-04-18 23:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-18 8:07 [RFC PATCH 0/1] libselinux: Save digest of all partial matches for directory Richard Haines
2019-04-18 8:38 Richard Haines
[not found] <20190417105020.23803-1-richard_c_haines@btinternet.com>
2019-04-18 13:52 ` Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).