From: Stephen Smalley <sds@tycho.nsa.gov>
To: Nicolas Iooss <nicolas.iooss@m4x.org>, selinux@vger.kernel.org
Subject: Re: [PATCH 1/1] libselinux: do not dereference symlink with statfs in selinux_restorecon
Date: Fri, 18 Jan 2019 11:16:05 -0500 [thread overview]
Message-ID: <a72edea4-6285-2260-b3bf-f7d08f53767d@tycho.nsa.gov> (raw)
In-Reply-To: <20190116205710.30659-1-nicolas.iooss@m4x.org>
On 1/16/19 3:57 PM, Nicolas Iooss wrote:
> When selinux_restorecon() is used to relabel symlinks, it performs the
> following syscalls (as seen by running strace on restorecond):
>
> lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
> statfs("/root/symlink", 0x7ffd6bb4d090) = -1 ENOENT (No such file or directory)
> lstat("/root/symlink", {st_mode=S_IFLNK|0777, st_size=6, ...}) = 0
> lgetxattr("/root/symlink", "security.selinux", "sysadm_u:object_r:user_home_t", 255) = 30
>
> The second one triggers a SELinux check for lnk_file:read, as statfs()
> dereferences symbolic links. This call to statfs() is only used to find
> out whether "restoreconlast" xattr can be ignored, which is always the
> case for non-directory files (the first syscall, lstat(), is actually
> used to perform this check).
>
> Skip the call to statfs() when setrestoreconlast is already false.
>
> This silences an AVC denial that would otherwise be reported to
> audit.log (cf. https://github.com/SELinuxProject/refpolicy/pull/22).
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Thanks, merged via
https://github.com/SELinuxProject/selinux/pull/131
> ---
> libselinux/src/selinux_restorecon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 3df2d382d50b..42a48f5a1b0b 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -881,7 +881,7 @@ int selinux_restorecon(const char *pathname_orig,
> setrestoreconlast = false;
>
> /* Ignore restoreconlast on in-memory filesystems */
> - if (statfs(pathname, &sfsb) == 0) {
> + if (setrestoreconlast && statfs(pathname, &sfsb) == 0) {
> if (sfsb.f_type == RAMFS_MAGIC || sfsb.f_type == TMPFS_MAGIC)
> setrestoreconlast = false;
> }
>
prev parent reply other threads:[~2019-01-18 16:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-16 20:57 [PATCH 1/1] libselinux: do not dereference symlink with statfs in selinux_restorecon Nicolas Iooss
2019-01-16 21:29 ` Stephen Smalley
2019-01-18 16:16 ` Stephen Smalley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a72edea4-6285-2260-b3bf-f7d08f53767d@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=nicolas.iooss@m4x.org \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).