[RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[Ritesh Harjani]

Hi All, 

This patchset implements the selinux context labelling support
in mkfs.ubifs utility which was discussed here [1].
Patchset is based upon previous work done by John [2].
Commit texts should explain about the change description.

I have tested this on my 4.9 kernel NAND based internal device with
UBIFS and selinux enabled. With this we are able to set the
respective selinux labels based on the input file_context provided
in mkfs.ubifs command.

[1]:- http://lists.infradead.org/pipermail/linux-mtd/2018-May/081138.html
[2]:- http://lists.infradead.org/pipermail/linux-mtd/2014-February/052136.html

Ritesh Harjani (2):
  mkfs.ubifs: add_xattr is not depending on host XATTR support
  mkfs.ubifs: Implement selinux labelling support in mkfs.ubifs.

 Makefile.am                         |   4 +
 configure.ac                        |  27 +++++
 ubifs-utils/Makemodule.am           |   4 +-
 ubifs-utils/mkfs.ubifs/mkfs.ubifs.c | 197 ++++++++++++++++++++++++++++--------
 4 files changed, 189 insertions(+), 43 deletions(-)

-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, 
a Linux Foundation Collaborative Project.

[RFC PATCH 1/2] mkfs.ubifs: add_xattr is not depending on host XATTR support

[Ritesh Harjani]

add_xattr adds the xattr to the ubifs image and has nothing
to do with host XATTR support.

Now that we are adding support where selinux interfaces
may use this API even when host OS(where ubi/ubifs image
is being created) does not support XATTR -so remove it
from WITHOUT_XATTR #ifdef.

Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
---
 ubifs-utils/mkfs.ubifs/mkfs.ubifs.c | 80 ++++++++++++++++++-------------------
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c b/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
index 6323dd4..2333dde 100644
--- a/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
+++ b/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
@@ -1007,46 +1007,6 @@ static int add_node(union ubifs_key *key, char *name, void *node, int len)
 	return 0;
 }
 
-#ifdef WITHOUT_XATTR
-static inline int create_inum_attr(ino_t inum, const char *name)
-{
-	(void)inum;
-	(void)name;
-
-	return 0;
-}
-
-static inline int inode_add_xattr(struct ubifs_ino_node *host_ino,
-				  const char *path_name, struct stat *st, ino_t inum)
-{
-	(void)host_ino;
-	(void)path_name;
-	(void)st;
-	(void)inum;
-
-	return 0;
-}
-#else
-static int create_inum_attr(ino_t inum, const char *name)
-{
-	char *str;
-	int ret;
-
-	if (!do_create_inum_attr)
-		return 0;
-
-	ret = asprintf(&str, "%llu", (unsigned long long)inum);
-	if (ret < 0)
-		return -1;
-
-	ret = lsetxattr(name, "user.image-inode-number", str, ret, 0);
-
-	free(str);
-
-	return ret;
-}
-
-
 static int add_xattr(struct stat *st, ino_t inum, const void *data,
 		     unsigned int data_len, struct qstr *nm)
 {
@@ -1117,6 +1077,46 @@ out:
 	return ret;
 }
 
+#ifdef WITHOUT_XATTR
+static inline int create_inum_attr(ino_t inum, const char *name)
+{
+	(void)inum;
+	(void)name;
+
+	return 0;
+}
+
+static inline int inode_add_xattr(struct ubifs_ino_node *host_ino,
+				  const char *path_name,
+				  struct stat *st, ino_t inum)
+{
+	(void)host_ino;
+	(void)path_name;
+	(void)st;
+	(void)inum;
+
+	return 0;
+}
+#else
+static int create_inum_attr(ino_t inum, const char *name)
+{
+	char *str;
+	int ret;
+
+	if (!do_create_inum_attr)
+		return 0;
+
+	ret = asprintf(&str, "%llu", (unsigned long long)inum);
+	if (ret < 0)
+		return ret;
+
+	ret = lsetxattr(name, "user.image-inode-number", str, ret, 0);
+
+	free(str);
+
+	return ret;
+}
+
 static int inode_add_xattr(struct ubifs_ino_node *host_ino,
 			   const char *path_name, struct stat *st, ino_t inum)
 {
-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, 
a Linux Foundation Collaborative Project.

[RFC PATCH 2/2] mkfs.ubifs: Implement selinux labelling support in mkfs.ubifs.

[Ritesh Harjani]

This implements/adds selinux labelling support to mkfs.ubifs
utility. It adds an extra option in configure to enable
selinux labelling support and then finally in mkfs.ubifs adds
an extra option to pass the file_contexts which is looked up
for filesystem file labels.

- Default behavior is kept without selinux so as to not break existing
support where selinux library/headers may not be present.

- If this is configured with --with-selinux then XATTR from the
file_contexts(passed with --selinux option while mkfs.ubifs)
will be taken and not from the host file's xattr.
This is done to avoid the problem where the host OS may have
selinux enabled and hence same xattr names will be present in both
host filesystem files and from the --selinux=file passed.
So the existing behavior is kept mutually exclusive and preference
is given to selinux xattrs (if configured with --with-selinux).

Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
---
 Makefile.am                         |   4 ++
 configure.ac                        |  27 +++++++++
 ubifs-utils/Makemodule.am           |   4 +-
 ubifs-utils/mkfs.ubifs/mkfs.ubifs.c | 117 +++++++++++++++++++++++++++++++++++-
 4 files changed, 149 insertions(+), 3 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 5a6e77c..391edef 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -10,6 +10,10 @@ if WITHOUT_LZO
 AM_CPPFLAGS += -DWITHOUT_LZO
 endif
 
+if WITH_SELINUX
+AM_CPPFLAGS += -DWITH_SELINUX
+endif
+
 sbin_PROGRAMS =
 sbin_SCRIPTS =
 check_PROGRAMS =
diff --git a/configure.ac b/configure.ac
index 1ac45c7..2b1668f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -59,6 +59,7 @@ need_zlib="no"
 need_lzo="no"
 need_xattr="no"
 need_cmocka="no"
+need_selinux="no"
 
 
 AM_COND_IF([UNIT_TESTS], [
@@ -144,6 +145,15 @@ AC_ARG_WITH([lzo],
 	*) AC_MSG_ERROR([bad value ${withval} for --without-lzo]) ;;
 	esac])
 
+AC_ARG_WITH([selinux],
+	[AS_HELP_STRING([--with-selinux],
+		[Enable support for selinux extended attributes])],
+	[case "${withval}" in
+	yes) need_selinux="yes";;
+	no) ;;
+	*) AC_MSG_ERROR([bad value ${withval} for --with-selinux]) ;;
+	esac])
+
 ##### search for dependencies #####
 
 clock_gettime_missing="no"
@@ -153,11 +163,16 @@ zlib_missing="no"
 lzo_missing="no"
 xattr_missing="no"
 cmocka_missing="no"
+selinux_missing="no"
 
 if test "x$need_zlib" = "xyes"; then
 	PKG_CHECK_MODULES(ZLIB, [zlib], [], [zlib_missing="yes"])
 fi
 
+if test "x$need_selinux" = "xyes"; then
+	PKG_CHECK_MODULES(LIBSELINUX, [libselinux], [], [selinux_missing="yes"])
+fi
+
 if test "x$need_uuid" = "xyes"; then
 	PKG_CHECK_MODULES(UUID, [uuid], [], [uuid_missing="yes"])
 fi
@@ -186,6 +201,11 @@ if test "x$need_xattr" = "xyes"; then
 	AC_CHECK_HEADERS([sys/acl.h], [], [xattr_missing="yes"])
 fi
 
+if test "x$need_selinux" = "xyes"; then
+	AC_CHECK_HEADERS([selinux/selinux.h], [], [selinux_missing="yes"])
+	AC_CHECK_HEADERS([selinux/label.h], [], [selinux_missing="yes"])
+fi
+
 if test "x$need_cmocka" = "xyes"; then
 	PKG_CHECK_MODULES(CMOCKA, [cmocka], [], [cmocka_missing="yes"])
 fi
@@ -235,6 +255,12 @@ if test "x$xattr_missing" = "xyes"; then
 	need_xattr="no"
 fi
 
+if test "x$selinux_missing" = "xyes"; then
+	AC_MSG_WARN([cannot find headers for selinux library])
+	AC_MSG_WARN([disabling SELINUX support])
+	need_selinux="no"
+fi
+
 if test "x$cmocka_missing" = "xyes"; then
 	AC_MSG_WARN([cannot find CMocka library required for unit tests])
 	AC_MSG_NOTICE([unit tests can optionally be disabled])
@@ -249,6 +275,7 @@ fi
 
 AM_CONDITIONAL([WITHOUT_LZO], [test "x$need_lzo" != "xyes"])
 AM_CONDITIONAL([WITHOUT_XATTR], [test "x$need_xattr" != "xyes"])
+AM_CONDITIONAL([WITH_SELINUX], [test "x$need_selinux" == "xyes"])
 
 AC_CHECK_SIZEOF([off_t])
 AC_CHECK_SIZEOF([loff_t])
diff --git a/ubifs-utils/Makemodule.am b/ubifs-utils/Makemodule.am
index 5862afb..879f91a 100644
--- a/ubifs-utils/Makemodule.am
+++ b/ubifs-utils/Makemodule.am
@@ -16,8 +16,8 @@ mkfs_ubifs_SOURCES = \
 	ubifs-utils/mkfs.ubifs/hashtable/hashtable.c \
 	ubifs-utils/mkfs.ubifs/hashtable/hashtable_itr.c \
 	ubifs-utils/mkfs.ubifs/devtable.c
-mkfs_ubifs_LDADD = libmtd.a libubi.a $(ZLIB_LIBS) $(LZO_LIBS) $(UUID_LIBS) -lm
-mkfs_ubifs_CPPFLAGS = $(AM_CPPFLAGS) $(ZLIB_CFLAGS) $(LZO_CFLAGS) $(UUID_CFLAGS) \
+mkfs_ubifs_LDADD = libmtd.a libubi.a $(ZLIB_LIBS) $(LZO_LIBS) $(UUID_LIBS) $(LIBSELINUX_LIBS) -lm
+mkfs_ubifs_CPPFLAGS = $(AM_CPPFLAGS) $(ZLIB_CFLAGS) $(LZO_CFLAGS) $(UUID_CFLAGS) $(LIBSELINUX_CFLAGS)\
 	-I$(top_srcdir)/ubi-utils/include -I$(top_srcdir)/ubifs-utils/mkfs.ubifs/
 
 UBIFS_BINS = \
diff --git a/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c b/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
index 2333dde..f0518b9 100644
--- a/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
+++ b/ubifs-utils/mkfs.ubifs/mkfs.ubifs.c
@@ -30,6 +30,11 @@
 #include <sys/xattr.h>
 #endif
 
+#ifdef WITH_SELINUX
+#include <selinux/selinux.h>
+#include <selinux/label.h>
+#endif
+
 /* Size (prime number) of hash table for link counting */
 #define HASH_TABLE_SIZE 10099
 
@@ -40,6 +45,13 @@
 /* Default time granularity in nanoseconds */
 #define DEFAULT_TIME_GRAN 1000000000
 
+
+#ifdef WITH_SELINUX
+#define XATTR_NAME_SELINUX "security.selinux"
+static struct selabel_handle *sehnd;
+static char *secontext;
+#endif
+
 /**
  * struct idx_entry - index entry.
  * @next: next index entry (NULL at end of list)
@@ -116,6 +128,9 @@ static int out_fd;
 static int out_ubi;
 static int squash_owner;
 static int do_create_inum_attr;
+static char *context;
+static int context_len;
+static struct stat context_st;
 
 /* The 'head' (position) which nodes are written */
 static int head_lnum;
@@ -163,6 +178,7 @@ static const struct option longopts[] = {
 	{"orph-lebs",          1, NULL, 'p'},
 	{"squash-uids" ,       0, NULL, 'U'},
 	{"set-inode-attr",     0, NULL, 'a'},
+	{"selinux",            1, NULL, 's'},
 	{NULL, 0, NULL, 0}
 };
 
@@ -206,6 +222,7 @@ static const char *helptext =
 "-a, --set-inum-attr      create user.image-inode-number extended attribute on files\n"
 "                         added to the image. The attribute will contain the inode\n"
 "                         number the file has in the generated image.\n"
+"-s, --selinux=FILE       Selinux context file\n"
 "-h, --help               display this help text\n\n"
 "Note, SIZE is specified in bytes, but it may also be specified in Kilobytes,\n"
 "Megabytes, and Gigabytes if a KiB, MiB, or GiB suffix is used.\n\n"
@@ -638,7 +655,18 @@ static int get_options(int argc, char**argv)
 		case 'a':
 			do_create_inum_attr = 1;
 			break;
-
+		case 's':
+			context_len = strlen(optarg);
+			context = (char *) xmalloc(context_len + 1);
+			if (!context)
+				return err_msg("xmalloc failed\n");
+			memcpy(context, optarg, context_len);
+
+			/* Make sure root directory exists */
+			if (stat(context, &context_st))
+				return sys_err_msg("bad file context %s\n",
+								   context);
+			break;
 		}
 	}
 
@@ -725,6 +753,7 @@ static int get_options(int argc, char**argv)
 		printf("\tfanout:       %d\n", c->fanout);
 		printf("\torph_lebs:    %d\n", c->orph_lebs);
 		printf("\tspace_fixup:  %d\n", c->space_fixup);
+		printf("\tselinux file: %s\n", context);
 	}
 
 	if (validate_options())
@@ -1202,6 +1231,70 @@ out_free:
 }
 #endif
 
+#ifdef WITH_SELINUX
+static int inode_add_selinux_xattr(struct ubifs_ino_node *host_ino,
+			   const char *path_name, struct stat *st, ino_t inum)
+{
+	int ret;
+	char *sepath = NULL;
+	char *name;
+	struct qstr nm;
+	unsigned int con_size;
+
+	if (!context || !sehnd) {
+		secontext = NULL;
+		con_size = 0;
+		return 0;
+	}
+
+	if (path_name[strlen(root)] == '/')
+		sepath = strdup(&path_name[strlen(root)]);
+
+	else if (asprintf(&sepath, "/%s", &path_name[strlen(root)]) < 0)
+		sepath = NULL;
+
+	if (!sepath)
+		return sys_err_msg("could not get sepath\n");
+
+	if (selabel_lookup(sehnd, &secontext, sepath, st->st_mode) < 0) {
+		/* Failed to lookup context, assume unlabeled */
+		secontext = strdup("system_u:object_r:unlabeled_t:s0");
+		dbg_msg(2, "missing context: %s\t%s\t%d\n", secontext, sepath,
+				st->st_mode);
+	}
+
+	dbg_msg(2, "appling selinux context on sepath=%s, secontext=%s\n",
+			sepath, secontext);
+	free(sepath);
+	con_size = strlen(secontext) + 1;
+	name = strdup(XATTR_NAME_SELINUX);
+
+	nm.name = name;
+	nm.len = strlen(name);
+	host_ino->xattr_cnt++;
+	host_ino->xattr_size += CALC_DENT_SIZE(nm.len);
+	host_ino->xattr_size += CALC_XATTR_BYTES(con_size);
+	host_ino->xattr_names += nm.len;
+
+	ret = add_xattr(st, inum, secontext, con_size, &nm);
+	if (ret < 0)
+		dbg_msg(2, "add_xattr failed %d\n", ret);
+	return ret;
+}
+
+#else
+static inline int inode_add_selinux_xattr(struct ubifs_ino_node *host_ino,
+			   const char *path_name, struct stat *st, ino_t inum)
+{
+	(void)host_ino;
+	(void)path_name;
+	(void)st;
+	(void)inum;
+
+	return 0;
+}
+#endif
+
 /**
  * add_inode - write an inode.
  * @st: stat information of source inode
@@ -1260,7 +1353,11 @@ static int add_inode(struct stat *st, ino_t inum, void *data,
 	len = UBIFS_INO_NODE_SZ + data_len;
 
 	if (xattr_path) {
+#ifdef WITH_SELINUX
+		ret = inode_add_selinux_xattr(ino, xattr_path, st, inum);
+#else
 		ret = inode_add_xattr(ino, xattr_path, st, inum);
+#endif
 		if (ret < 0)
 			return ret;
 	}
@@ -2415,6 +2512,18 @@ static int init(void)
 	if (err)
 		return err;
 
+#ifdef WITH_SELINUX
+	if (context) {
+		struct selinux_opt seopts[] = {
+			{ SELABEL_OPT_PATH, context }
+		};
+
+		sehnd = selabel_open(SELABEL_CTX_FILE, seopts, 1);
+		if (!sehnd)
+			return err_msg("could not open selinux context\n");
+	}
+#endif
+
 	return 0;
 }
 
@@ -2439,6 +2548,12 @@ static void destroy_hash_table(void)
  */
 static void deinit(void)
 {
+
+#ifdef WITH_SELINUX
+	if (sehnd)
+		selabel_close(sehnd);
+#endif
+
 	free(c->lpt);
 	free(c->ltab);
 	free(leb_buf);
-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, 
a Linux Foundation Collaborative Project.

Re: [RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[Ritesh Harjani]

Gentle reminder!!

Regards

Ritesh


On 6/6/2018 3:08 PM, Ritesh Harjani wrote:
> Hi All,
>
> This patchset implements the selinux context labelling support
> in mkfs.ubifs utility which was discussed here [1].
> Patchset is based upon previous work done by John [2].
> Commit texts should explain about the change description.
>
> I have tested this on my 4.9 kernel NAND based internal device with
> UBIFS and selinux enabled. With this we are able to set the
> respective selinux labels based on the input file_context provided
> in mkfs.ubifs command.
>
> [1]:- http://lists.infradead.org/pipermail/linux-mtd/2018-May/081138.html
> [2]:- http://lists.infradead.org/pipermail/linux-mtd/2014-February/052136.html
>
> Ritesh Harjani (2):
>    mkfs.ubifs: add_xattr is not depending on host XATTR support
>    mkfs.ubifs: Implement selinux labelling support in mkfs.ubifs.
>
>   Makefile.am                         |   4 +
>   configure.ac                        |  27 +++++
>   ubifs-utils/Makemodule.am           |   4 +-
>   ubifs-utils/mkfs.ubifs/mkfs.ubifs.c | 197 ++++++++++++++++++++++++++++--------
>   4 files changed, 189 insertions(+), 43 deletions(-)
>

Re: [RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[Richard Weinberger]

Am Montag, 11. Juni 2018, 06:27:20 CEST schrieb Ritesh Harjani:
> Gentle reminder!!

"gentle" with two exclamation marks? ...

Please give David at least a full week before pushing.

Thanks,
//richard

Re: [RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[Ritesh Harjani]

On 6/11/2018 12:30 PM, Richard Weinberger wrote:
> Am Montag, 11. Juni 2018, 06:27:20 CEST schrieb Ritesh Harjani:
>> Gentle reminder!!
> "gentle" with two exclamation marks? ...
This was just out of habit.
>
> Please give David at least a full week before pushing.
Sorry about that. No intention of pushing :)

Thanks
Ritesh

Re: [RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[David Oberhollenzer]

Hi,


sorry for the delay. I was quite busy during the last week and got a little
less done than I expected. Also, it took me a little more time for closer
inspection, since the patch set conflicted with another big mkfs.ubifs
patch set that I have lying around on my end.

The changes look good to me so far. I pushed it to mtd-utils.git master.


Thanks,

David

Re: [RFC PATCH 0/2] mkfs.ubifs: Implement selinux labelling support

[Ritesh Harjani]

On 6/14/2018 1:03 PM, David Oberhollenzer wrote:
> Hi,
>
>
> sorry for the delay. I was quite busy during the last week and got a little
> less done than I expected. Also, it took me a little more time for closer
> inspection, since the patch set conflicted with another big mkfs.ubifs
> patch set that I have lying around on my end.
Np. Thanks for the review.
>
> The changes look good to me so far. I pushed it to mtd-utils.git master.
Sure thanks.
>
>
> Thanks,
>
> David
>
>
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/