particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: allow nnp and nosuid transitions

Browse source 
Allow osbuild_t to no_new_privs (nnp) and nosuid domain transition
into setfiles_mac_t and install_t. nnp is a inheritable per-thread
flag (PR_SET_NO_NEW_PRIVS, see prctl(2)), whereby a promise is made
by execve(2) to not grant any new privileges that could not have
been done without the execv call. This is on contrast to what can
be done via SELinux rules, i.e. in our case `setfiles_mac_t` and
`install_t` can set arbitrary SELinux labels, but `osbuild_t`
itself can not; but `osbuild_t` enables the transitioning of
`setfiles_mac_t` for the `setfiles` binary via execve(2) from a
process with `osbuild_t`. Related, the nosuid mount flag, prevents
the suid, sgid bits to be interpreted and thus are in the same
spirit as nnp, i.e. no new privs during execve(2).

Thus SELinux domain transitions stand in contrast with nnp and
nosuid transitions, and have therefore been de-coupled. See also
the corresponding kernel patch at [1] for more information.

bubblewrap (bwrap) in contrast to `systemd-nspawn` always sets the
nnp flag, as well as the nosuid option for all bind-mounts. Since
we no use bwrap to contain processes we need to allow the nnp and
nosuid transitions from `osbuild_t` to `setfiles_mac_t` and
`install_t`.

[1] https://patchwork.kernel.org/patch/9841441/
This commit is contained in:
Christian Kellner 2020-08-09 13:09:06 +02:00 • committed by David Rheinsberg
parent fdaa2e1a66
commit 3c556c3386
2 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
selinux/osbuild.if
View file

@ -93,3 +93,22 @@ interface(`osbuild_role',`
ps_process_pattern($2, osbuild_t)
allow $2 osbuild_t:process { signull signal sigkill };
')
########################################
## <summary>
## osbuild nnp / nosuid transitions to domain
## </summary>
## <param name="domain">
## <summary>
## Domain to be allowed to transition into.
## </summary>
## </param>
#
interface(`osbuild_nnp_nosuid_trans',`
gen_require(`
type osbuild_t;
class process2 { nnp_transition nosuid_transition };
')
allow osbuild_t $1:process2 {nnp_transition nosuid_transition};
')

2
selinux/osbuild.te
View file

@ -31,6 +31,7 @@ unconfined_domain(osbuild_t)
# execute setfiles in the setfiles_mac domain
# when in the osbuild_t domain
seutil_domtrans_setfiles_mac(osbuild_t)
osbuild_nnp_nosuid_trans(setfiles_mac_t)
# Allow sysadm and unconfined to run osbuild
optional_policy(`
@ -63,4 +64,5 @@ optional_policy(`
# allow transitioning to install_t (for ostree)
optional_policy(`
anaconda_domtrans_install(osbuild_t)
osbuild_nnp_nosuid_trans(install_t)
')