From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id DDF2A5A0275; Wed, 16 Aug 2023 20:17:30 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH v2 3/7] selinux: Fix user namespace creation after breaking kernel change Date: Wed, 16 Aug 2023 20:17:26 +0200 Message-Id: <20230816181730.2165306-4-sbrivio@redhat.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230816181730.2165306-1-sbrivio@redhat.com> References: <20230816181730.2165306-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: PV3OZ2RAT57F532DQEMXQLYK6F6TMAFN X-Message-ID-Hash: PV3OZ2RAT57F532DQEMXQLYK6F6TMAFN X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "'Richard W . M . Jones'" X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Kernel commit ed5d44d42c95 ("selinux: Implement userns_create hook") seems to just introduce a new functionality, but given that SELinux implements a form of mandatory access control, introducing the new permission breaks any application (shipping with SELinux policies) that needs to create user namespaces, such as passt and pasta for sandboxing purposes. Add the new 'allow' rules. They appear to be backward compatible, kernel-wise, and the policy now requires the new 'user_namespace' class to build, but that's something distributions already ship. Reported-by: Richard W.M. Jones Signed-off-by: Stefano Brivio Reviewed-by: Richard W.M. Jones --- contrib/selinux/passt.te | 2 ++ contrib/selinux/pasta.te | 2 ++ 2 files changed, 4 insertions(+) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 687ae40..5868a41 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -51,6 +51,7 @@ require { class capability sys_tty_config; class cap_userns { setpcap sys_admin sys_ptrace }; + class user_namespace create; } type passt_t; @@ -90,6 +91,7 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service }; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; +allow passt_t self:user_namespace create; allow passt_t proc_net_t:file read; allow passt_t net_conf_t:file { open read }; diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 367d09f..645ccee 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -80,6 +80,7 @@ require { type init_t; class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; + class user_namespace create; } type pasta_t; @@ -104,6 +105,7 @@ init_daemon_domain(pasta_t, pasta_exec_t) allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource }; allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service }; +allow pasta_t self:user_namespace create; allow pasta_t bin_t:file { execute execute_no_trans map }; allow pasta_t nsfs_t:file { open read }; -- 2.39.2