Re: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX

From: William Roberts <bill.c.roberts@gmail.com>
To: Dominick Grift <dominick.grift@defensec.nl>
Cc: Chris PeBenito <chpebeni@linux.microsoft.com>,
	Paul Moore <paul@paul-moore.com>,
	Demi Marie Obenour <demiobenour@gmail.com>,
	Stephen Smalley <stephen.smalley.work@gmail.com>,
	Eric Paris <eparis@parisplace.org>,
	SElinux list <selinux@vger.kernel.org>,
	Linux kernel mailing list <linux-kernel@vger.kernel.org>,
	selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX
Date: Tue, 8 Feb 2022 08:17:25 -0600	[thread overview]
Message-ID: <CAFftDdo9JmbyPzPWRjOYgZBOS9b5d+OGKKf8egS8_ysbbWW87Q@mail.gmail.com> (raw)
In-Reply-To: <875ypt5zmz.fsf@defensec.nl>

<snip>

This is getting too long for me.

> >
> > I don't have a strong opinion either way.  If one were to allow this
> > using a policy rule, it would result in a major policy breakage.  The
> > rule would turn on extended perm checks across the entire system,
> > which the SELinux Reference Policy isn't written for.  I can't speak
> > to the Android policy, but I would imagine it would be the similar
> > problem there too.
>
> Excuse me if I am wrong but AFAIK adding a xperm rule does not turn on
> xperm checks across the entire system.

It doesn't as you state below its target + class.

>
> If i am not mistaken it will turn on xperm checks only for the
> operations that have the same source and target/target class.

That's correct.

>
> This is also why i don't (with the exception TIOSCTI for termdev
> chr_file) use xperms by default.
>
> 1. it is really easy to selectively filter ioctls by adding xperm rules
> for end users (and since ioctls are often device/driver specific they
> know best what is needed and what not)

> >>> and FIONCLEX can be trivially bypassed unless fcntl(F_SETFD)
>
> 2. if you filter ioctls in upstream policy for example like i do with
> TIOSCTI using for example (allowx foo bar (ioctl chr_file (not
> (0xXXXX)))) then you cannot easily exclude additional ioctls later where source is
> foo and target/tclass is bar/chr_file because there is already a rule in
> place allowing the ioctl (and you cannot add rules)

Currently, fcntl flag F_SETFD is never checked, it's silently allowed, but
the equivalent FIONCLEX and FIOCLEX are checked. So if you wrote policy
to block the FIO*CLEX flags, it would be bypassable through F_SETFD and
FD_CLOEXEC. So the patch proposed makes the FIO flags behave like
F_SETFD. Which means upstream policy users could drop this allow, which
could then remove the target/class rule and allow all icotls. Which is easy
to prevent and fix you could be a rule in to allowx 0 as documented in the
wiki: https://selinuxproject.org/page/XpermRules

The questions I think we have here are:
1. Do we agree that the behavior between SETFD and the FIO flags are equivalent?
  I think they are.
2. Do we want the interfaces to behave the same?
  I think they should.
3. Do upstream users of the policy construct care?
  The patch is backwards compat, but I don't want their to be cruft
floating around with extra allowxperm rules.