SELinux lead to soft lockup when pid 1 proceess reap child

[yangshukui <yangshukui@huawei.com>]

[-- Attachment #1: Type: text/plain, Size: 2686 bytes --]

Pid 1 process (with init_t)  have the right to reap child in host, but 
pid 1 process (such as spc_t, docker use spc_t as container's default type)
may not have the right to reap child in container, if this condition 
occur, it will lead to soft lock up. The following will produce it,

docker run -ti --rm -v /sys/fs/selinux:/sys/fs/selinux fedora:20 bash
[root@b755018fb526 /]# yum install selinux-policy-targeted 
selinux-policy-devel perl-Test-Harness gcc libselinux-devel net-tools 
netlabel_tools iptables git cpan
[root@b755018fb526 /]# git clone 
https://github.com/SELinuxProject/selinux-testsuite.git
[root@b755018fb526 /]# setenforce 0
[root@b755018fb526 /]# runcon -t unconfined_t bash
[root@b755018fb526 /]# genhomedircon
[root@b755018fb526 /]# restorecon -R /
[root@b755018fb526 /]# setenforce 1
[root@b755018fb526 /]# cd /root/selinux-testsuite/
[root@b755018fb526 selinux-testsuite]# make -C policy load
[root@b755018fb526 selinux-testsuite]# make -C tests test
[root@b755018fb526 selinux-testsuite]# exit  #this will lead to soft lockup

before exiting the container, we can also see some zombies：
[root@b755018fb526 selinux-testsuite]# ps -eafZ
LABEL                           UID        PID  PPID  C STIME 
TTY          TIME CMD
...
unconfined_u:unconfined_r:test_fdreceive_server_t:s0 root 215 1  0 05:35 
pts/0 00:00:00 [server] <defunct>
unconfined_u:unconfined_r:test_ptrace_traced_t:s0 root 291 1  0 05:35 
pts/0 00:00:00 [wait] <defunct>
unconfined_u:unconfined_r:test_setnice_set_t:s0 root 374 1  0 05:35 
pts/0 00:00:00 [child] <defunct>

in kernel code,
zap_pid_ns_processes {
       ...
       /* Firstly reap the EXIT_ZOMBIE children we may have. */
       do {
           clear_thread_flag(TIF_SIGPENDING);
           rc = sys_wait4(-1, NULL, __WALL, NULL);
           //sys_wait4 -> do_wait-> 
wait_consider_task->security_task_wait->selinux_task_wait->avc_has_perm_flags->avc_has_perm_noaudit->avc_denied
the return value is -EACCES, unable to return to the expected -ECHILD, 
and leading to the dead cycle.
     } while (rc != -ECHILD);
}

I have a hack like this,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 57a2020..c10c58c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3596,6 +3596,9 @@ static int selinux_task_kill(struct task_struct 
*p, struct siginfo *info,

  static int selinux_task_wait(struct task_struct *p)
  {
+       if (pid_vnr(task_tgid(current)) == 1){
+                return 0;
+       }
         return task_has_perm(p, current, PROCESS__SIGCHLD);
  }
It work but it permit pid 1 process to reap child without selinux check. 
Can we have a better way to handle this problem?

[-- Attachment #2: Type: text/html, Size: 3877 bytes --]