From: Paul Moore <paul@paul-moore.com>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Ondrej Mosnacek <omosnace@redhat.com>,
Jeff Vander Stoep <jeffv@google.com>,
SElinux list <selinux@vger.kernel.org>,
Will Deacon <will@kernel.org>,
"Paul E. McKenney" <paulmck@kernel.org>,
rcu@vger.kernel.org, Jovana Knezevic <jovanak@google.com>
Subject: Re: [PATCH v9] selinux: sidtab: reverse lookup hash table
Date: Thu, 5 Dec 2019 19:50:24 -0500 [thread overview]
Message-ID: <CAHC9VhQOb5skqQofnrESFuAqfRE1+xq9OD48JcYzq77v0XJsog@mail.gmail.com> (raw)
In-Reply-To: <CAHC9VhREL17FH0XOUkvegY4yGeQu5p1qLdWEdnwvPw1W+bLfRA@mail.gmail.com>
On Thu, Dec 5, 2019 at 1:14 PM Paul Moore <paul@paul-moore.com> wrote:
> On Thu, Dec 5, 2019 at 1:10 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > On 12/5/19 12:41 PM, Paul Moore wrote:
> > > Hmm. I haven't done any debugging yet, but the BPF tests are failing
> > > (they pass with kernel-5.5.0-0.rc0.git5.1.2.secnext.fc32.x86_64):
...
> > They all pass for me (with your next-queue branch, using the
> > selinux-testsuite defconfig fragment merged with the Fedora config).
>
> Oh goodie, I'm special :/
>
> FWIW, my current test kernel is the next-queue branch rebased on top
> of Linus' current tree, using the latest config from the secnext
> kernel builds (Fedora Rawhide + stuff for the test suite).
>
> > The error above doesn't look SELinux-related; it looks like your kernel
> > is rejecting the trivial bpf program used in the test code as being
> > invalid for some reason.
>
> That's where I'm at as well, I'm building an instrumented kernel right
> now to try and track down the source. I'm sure it is something silly
> like a messed up kernel config or something, but I'd like to
> understand *why*.
I traced the "./bpf_test -p" failure down to a BTF check in the BPF
verifier, there is a comment in that code block which helpfully reads:
"Either gcc or pahole or kernel are broken.".
:/
The relevant commit is 8580ac9404f6 ("bpf: Process in-kernel BTF"),
and it appears to be new for v5.5; it isn't present in selinux/next or
selinux/next-queue. Recompiling with CONFIG_DEBUG_INFO_BTF disabled
does allow "./bpf_test -p" to succeed, but I hit other BPF test
failures further along. For reasons I don't understand, the secnext
kernel builds (which should have this code, and have
CONFIG_DEBUG_INFO_BTF enabled) are not hitting this problem, but that
may be due to differences in the build tools on the two systems
(although they *should* be the same).
Given that we haven't hit -rc1 yet, and everyone else's builds are
working just fine, I'm going to leave this alone for now. Whatever
the problems may be, they definitely don't appear to be SELinux
related.
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2019-12-06 0:50 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-22 9:33 [PATCH v9] selinux: sidtab: reverse lookup hash table Jeff Vander Stoep
2019-11-22 14:21 ` Stephen Smalley
2019-12-03 0:32 ` Paul Moore
2019-12-04 9:11 ` Ondrej Mosnacek
2019-12-04 15:48 ` Stephen Smalley
2019-12-04 23:52 ` Paul Moore
2019-12-05 11:48 ` Ondrej Mosnacek
2019-12-05 14:08 ` Paul Moore
2019-12-05 17:41 ` Paul Moore
2019-12-05 18:10 ` Stephen Smalley
2019-12-05 18:14 ` Paul Moore
2019-12-06 0:50 ` Paul Moore [this message]
2019-12-06 13:45 ` Stephen Smalley
2019-12-06 15:08 ` Paul Moore
2019-12-09 21:17 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhQOb5skqQofnrESFuAqfRE1+xq9OD48JcYzq77v0XJsog@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=jeffv@google.com \
--cc=jovanak@google.com \
--cc=omosnace@redhat.com \
--cc=paulmck@kernel.org \
--cc=rcu@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).