|
Pid 1 process (with init_t) have the right to reap child in host,
but pid 1 process (such as spc_t, docker use spc_t as container's
default type)
may not have the right to reap child in container, if this condition occur, it will lead to soft lock up. The following will produce it, docker run -ti --rm -v /sys/fs/selinux:/sys/fs/selinux fedora:20 bash [root@b755018fb526 /]# yum install selinux-policy-targeted selinux-policy-devel perl-Test-Harness gcc libselinux-devel net-tools netlabel_tools iptables git cpan [root@b755018fb526 /]# git clone https://github.com/SELinuxProject/selinux-testsuite.git [root@b755018fb526 /]# setenforce 0 [root@b755018fb526 /]# runcon -t unconfined_t bash [root@b755018fb526 /]# genhomedircon [root@b755018fb526 /]# restorecon -R / [root@b755018fb526 /]# setenforce 1 [root@b755018fb526 /]# cd /root/selinux-testsuite/ [root@b755018fb526 selinux-testsuite]# make -C policy load [root@b755018fb526 selinux-testsuite]# make -C tests test [root@b755018fb526 selinux-testsuite]# exit #this will lead to soft lockup before exiting the container, we can also see some zombies： [root@b755018fb526 selinux-testsuite]# ps -eafZ LABEL UID PID PPID C STIME TTY TIME CMD ... unconfined_u:unconfined_r:test_fdreceive_server_t:s0 root 215 1 0 05:35 pts/0 00:00:00 [server] <defunct> unconfined_u:unconfined_r:test_ptrace_traced_t:s0 root 291 1 0 05:35 pts/0 00:00:00 [wait] <defunct> unconfined_u:unconfined_r:test_setnice_set_t:s0 root 374 1 0 05:35 pts/0 00:00:00 [child] <defunct> in kernel code, zap_pid_ns_processes { ... /* Firstly reap the EXIT_ZOMBIE children we may have. */ do { clear_thread_flag(TIF_SIGPENDING); rc = sys_wait4(-1, NULL, __WALL, NULL); //sys_wait4 -> do_wait-> wait_consider_task->security_task_wait->selinux_task_wait->avc_has_perm_flags->avc_has_perm_noaudit->avc_denied the return value is -EACCES, unable to return to the expected -ECHILD, and leading to the dead cycle. } while (rc != -ECHILD); } I have a hack like this, diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 57a2020..c10c58c 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3596,6 +3596,9 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info, static int selinux_task_wait(struct task_struct *p) { + if (pid_vnr(task_tgid(current)) == 1){ + return 0; + } return task_has_perm(p, current, PROCESS__SIGCHLD); } It work but it permit pid 1 process to reap child without selinux check. Can we have a better way to handle this problem? |
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
