Re: [PATCH v2] selinux: remove unused initial SIDs and improve handling

[Stephen Smalley <sds@tycho.nsa.gov>]

On 2/14/20 7:46 AM, Ondrej Mosnacek wrote:
> On Wed, Jan 29, 2020 at 5:42 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
>> Fully decoupling the policy and kernel initial SID values will
>> require introducing a mapping between them and dyhamically
> 
> Nit: s/dyhamically/dynamically/

Ah, thanks; will fix if I need to re-spin.

>> -               if (c->sid[0] == SECSID_NULL || c->sid[0] > SECINITSID_NUM) {
>> -                       pr_err("SELinux:  Initial SID %s out of range.\n",
>> -                               c->u.name);
>> +               u32 sid = c->sid[0];
>> +               const char *name = security_get_initial_sid_context(sid);
>> +
>> +               if (sid == SECSID_NULL) {
>> +                       pr_err("SELinux:  SID null was assigned a context.\n");
>>                          sidtab_destroy(s);
>>                          goto out;
>>                  }
> 
> Your sentence "Stop treating it as an error if a policy defines
> additional initial SIDs unknown to the kernel." and the removed check
> for > SECINITSID_NUM suggest that you intend to not treat this
> condition as an error, but sidtab_set_initial() called bellow will
> reject such SID with -ENIVAL. Or am I misreading it and you just
> wanted to remove the duplicate check?

The comment and if statement below will cause it to ignore any initial 
SIDs unused by the kernel, whether they are ones <= SECINITSID_NUM whose 
names have been dropped and replaced by NULL or ones > SECINITSID_NUM. 
security_get_initial_sid_context() returns NULL for anything > 
SECINITSID_NUM.

> 
>> +
>> +               /* Ignore initial SIDs unused by this kernel. */
>> +               if (!name)
>> +                       continue;
>> +