<snip> This is getting too long for me. > > > > I don't have a strong opinion either way. If one were to allow this > > using a policy rule, it would result in a major policy breakage. The > > rule would turn on extended perm checks across the entire system, > > which the SELinux Reference Policy isn't written for. I can't speak > > to the Android policy, but I would imagine it would be the similar > > problem there too. > > Excuse me if I am wrong but AFAIK adding a xperm rule does not turn on > xperm checks across the entire system. It doesn't as you state below its target + class. > > If i am not mistaken it will turn on xperm checks only for the > operations that have the same source and target/target class. That's correct. > > This is also why i don't (with the exception TIOSCTI for termdev > chr_file) use xperms by default. > > 1. it is really easy to selectively filter ioctls by adding xperm rules > for end users (and since ioctls are often device/driver specific they > know best what is needed and what not) > >>> and FIONCLEX can be trivially bypassed unless fcntl(F_SETFD) > > 2. if you filter ioctls in upstream policy for example like i do with > TIOSCTI using for example (allowx foo bar (ioctl chr_file (not > (0xXXXX)))) then you cannot easily exclude additional ioctls later where source is > foo and target/tclass is bar/chr_file because there is already a rule in > place allowing the ioctl (and you cannot add rules) Currently, fcntl flag F_SETFD is never checked, it's silently allowed, but the equivalent FIONCLEX and FIOCLEX are checked. So if you wrote policy to block the FIO*CLEX flags, it would be bypassable through F_SETFD and FD_CLOEXEC. So the patch proposed makes the FIO flags behave like F_SETFD. Which means upstream policy users could drop this allow, which could then remove the target/class rule and allow all icotls. Which is easy to prevent and fix you could be a rule in to allowx 0 as documented in the wiki: https://selinuxproject.org/page/XpermRules The questions I think we have here are: 1. Do we agree that the behavior between SETFD and the FIO flags are equivalent? I think they are. 2. Do we want the interfaces to behave the same? I think they should. 3. Do upstream users of the policy construct care? The patch is backwards compat, but I don't want their to be cruft floating around with extra allowxperm rules.
