In the current implementation, on policy load /sys/fs/selinux is updated
by deleting the previous contents of
/sys/fs/selinux/{class,booleans,policy_capabilities} and then recreating
them. This means that there is a period of time when the contents of
these directories do not exist which can cause race conditions as
userspace relies on them for information about the policy. In addition,
it means that error recovery in the event of failure is challenging.
This patch series follows the design outlined by Al Viro in a previous
e-mail to the list[1]. This approach is to first create the new
directory structures out of tree, then to perform the swapover, and
finally to delete the old directories. Not handled in this series is
error recovery in the event of failure.
Error recovery in the selinuxfs recreation is unhandled in the current
code, so this series will not cause any regression in this regard.
Handling directory recreation in this manner is a prerequisite to make
proper error handling possible.
In order to demonstrate the race condition that this series fixes, you
can use the following commands:
while true; do cat /sys/fs/selinux/class/service/perms/status
>/dev/null; done &
while true; do load_policy; done;
In the existing code, this will display errors fairly often as the class
lookup fails. (In normal operation from systemd, this would result in a
permission check which would be allowed or denied based on policy settings
around unknown object classes.) After applying this patch series you
should expect to no longer see such error messages.
This series is relative to https://patchwork.kernel.org/patch/11705743/,
Stephen Smalley's series to split policy loading into a prep and commit.
[1] https://lore.kernel.org/selinux/20181002155810.GP32577@xxxxxxxxxxxxxxxxxx/
Daniel Burgener (4):
selinux: Create function for selinuxfs directory cleanup
selinux: Refactor selinuxfs directory populating functions
selinux: Standardize string literal usage for selinuxfs directory
names
selinux: Create new booleans, class and policycap dirs out of tree
security/selinux/selinuxfs.c | 200 +++++++++++++++++++++++++++--------
1 file changed, 158 insertions(+), 42 deletions(-)
--
2.25.4
