[RFC] change policy loading to initramfs

[Bill Nottingham]

We're looking to move to a different init system in Fedora - the
current work is going to be around upstart, most likely. upstart
does not have native code for loading the SELinux policy.

We could modify every possible init to load the policy... but
that would be painful. So we might as well move to having the
policy loaded from the initramfs. The attached patches are the
first quick cut at doing that.

The main patch is for mkinitrd/nash; there's a short patch for the
current init, as it will abort if policy is already loaded. We
can't actually remove the code from init to load the policy, as
there will always be older initramfses.

Comments? Ideas for different ways to do this? It's sort of ugly
with fork and chroot(), but to avoid that we'd have to reimplement
most, if not all, of libselinux's policy loading code directly.

Bill

[John Reiser]

>  So we might as well move to having the
>  policy loaded from the initramfs. 
How can this be debugged, particularly in the field?  During the Fedora 8
development cycle I had some success running anaconda under strace,
having booted with strace on a USB flash device, then going to a separate
console, attaching strace to anaconda, and piping several GB of strace output
through gzip onto the flash device.  I'd like to be able to do something
just as effective (or more) with loading policy from initramfs.

>  +        if (selinux_init_load_policy(&enforce) != 0) {
>  +            if (enforce > 0) {
>  +                eprintf("Unable to load SELinux policy (%m). Halting
> now.\n");
>  +                exit(1);
>  +            }
>  +            exit(0);
>  +        } 
Please enhance the error reporting so that when there is an error,
then the error message is exquisitely explicit, and gives some hint
of how to fix the problem.  It is extremely frustrating to see only
"There was an error.  Bye."  [Naturally, this is a joint effort between
selinux_init_load_policy and its caller.]

If the problem is a failed system call, then print the name of the
system call, the errno, and the error string.  (Even without national
language support, for instance.)  If the problem lies with a file or
directory, then include the literal pathname which failed.  I spent
many hours chasing a missing file whose name did not appear in
any message.

--

[Bill Nottingham]

John Reiser (jreiser(a)BitWagon.com) said: 
>  If the problem is a failed system call, then print the name of the
>  system call, the errno, and the error string.  (Even without national
>  language support, for instance.)  If the problem lies with a file or
>  directory, then include the literal pathname which failed.  I spent
>  many hours chasing a missing file whose name did not appear in
>  any message. 
The snippet you quoted *does* print strerror(errno)... there are
various other errors that the SELinux routines catch, but they
aren't propagated up in any way that that patch could catch.

Bill

[John Reiser]

Bill Nottingham wrote:
>  The snippet you quoted *does* print strerror(errno)... there are
>  various other errors that the SELinux routines catch, but they
>  aren't propagated up in any way that that patch could catch. 
So it looks like the message for a missing file might be:
   Unable to load SELinux policy (No such file or directory). Halting now.

This is exactly what happened to me in F8, and it was horrible:
   https://bugzilla.redhat.com/show_bug.cgi?id=343861
The ultimate cause was a bug in pungi:
   https://bugzilla.redhat.com/show_bug.cgi?id=343851
but the error was not discovered until install time (anaconda),
and the error message did not give the name of [any] missing file.

It is unacceptable to say "No such file or directory" unless
it also gives the full literal name of some such file that was
sought, and could have been used (if present and correctly formatted, etc.)

The missing filename turned out to be:
   /etc/selinux/targeted/policy/policy.21

*IF* that filename had appeared with the original message:
   Can't load policy: no such file or directory
then it would have been *very* much easier to debug and fix.

--

[Stephen Smalley]

On Wed, 2008-01-23 at 18:00 -0800, John Reiser wrote:
>  Bill Nottingham wrote:
>  > The snippet you quoted *does* print strerror(errno)... there are
>  > various other errors that the SELinux routines catch, but they
>  > aren't propagated up in any way that that patch could catch.
>  
>  So it looks like the message for a missing file might be:
>     Unable to load SELinux policy (No such file or directory). Halting now.
>  
>  This is exactly what happened to me in F8, and it was horrible:
>     https://bugzilla.redhat.com/show_bug.cgi?id=343861
>  The ultimate cause was a bug in pungi:
>     https://bugzilla.redhat.com/show_bug.cgi?id=343851
>  but the error was not discovered until install time (anaconda),
>  and the error message did not give the name of [any] missing file.
>  
>  It is unacceptable to say "No such file or directory" unless
>  it also gives the full literal name of some such file that was
>  sought, and could have been used (if present and correctly formatted, etc.)
>  
>  The missing filename turned out to be:
>     /etc/selinux/targeted/policy/policy.21
>  
>  *IF* that filename had appeared with the original message:
>     Can't load policy: no such file or directory
>  then it would have been *very* much easier to debug and fix. 
To do that, we'd need to modify the libselinux selinux_mkload_policy
function rather than the caller, as the libselinux function encapsulates
the policy file location these days.  Certainly doable, just needs a
patch to report that info on a failure.

-- 
Stephen Smalley
National Security Agency

[Stephen Smalley]

On Wed, 2008-01-23 at 17:29 -0500, Bill Nottingham wrote:
>  We're looking to move to a different init system in Fedora - the
>  current work is going to be around upstart, most likely. upstart
>  does not have native code for loading the SELinux policy.
>  
>  We could modify every possible init to load the policy... but
>  that would be painful. So we might as well move to having the
>  policy loaded from the initramfs. The attached patches are the
>  first quick cut at doing that.
>  
>  The main patch is for mkinitrd/nash; there's a short patch for the
>  current init, as it will abort if policy is already loaded. We
>  can't actually remove the code from init to load the policy, as
>  there will always be older initramfses.
>  
>  Comments? Ideas for different ways to do this? It's sort of ugly
>  with fork and chroot(), but to avoid that we'd have to reimplement
>  most, if not all, of libselinux's policy loading code directly. 
Hmm...Chad Sellers was working on similar support for Ubuntu, but did it
by adding a -i option to the load_policy program to perform an initial
policy load so that you can just execute it from a script rather than
requiring a direct patch to nash or anything else.  cc'ing him.  The
load_policy -i support is upstream and should be in Fedora devel /
rawhide too.

>  Bill
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
-- 
Stephen Smalley
National Security Agency

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stephen Smalley wrote:
>  On Wed, 2008-01-23 at 17:29 -0500, Bill Nottingham wrote:
> > We're looking to move to a different init system in Fedora - the
> > current work is going to be around upstart, most likely. upstart
> > does not have native code for loading the SELinux policy.
> >
> > We could modify every possible init to load the policy... but
> > that would be painful. So we might as well move to having the
> > policy loaded from the initramfs. The attached patches are the
> > first quick cut at doing that.
> >
> > The main patch is for mkinitrd/nash; there's a short patch for the
> > current init, as it will abort if policy is already loaded. We
> > can't actually remove the code from init to load the policy, as
> > there will always be older initramfses.
> >
> > Comments? Ideas for different ways to do this? It's sort of ugly
> > with fork and chroot(), but to avoid that we'd have to reimplement
> > most, if not all, of libselinux's policy loading code directly.
>  
>  Hmm...Chad Sellers was working on similar support for Ubuntu, but did it
>  by adding a -i option to the load_policy program to perform an initial
>  policy load so that you can just execute it from a script rather than
>  requiring a direct patch to nash or anything else.  cc'ing him.  The
>  load_policy -i support is upstream and should be in Fedora devel /
>  rawhide too.
>  
> > Bill
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
load_policy -i is
available in rawhide
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkeYr/gACgkQrlYvE4MpobN3QwCfd0uwUYidaa2vtko9hj6swa9e
> zeQAoN4kFHUtrS0wkUNDEOLuwcu0gfOd
> =wCNH
> -----END PGP SIGNATURE-----

[Bill Nottingham]

Stephen Smalley (sds(a)tycho.nsa.gov) said: 
>  Hmm...Chad Sellers was working on similar support for Ubuntu, but did
> it
>  by adding a -i option to the load_policy program to perform an initial
>  policy load so that you can just execute it from a script rather than
>  requiring a direct patch to nash or anything else.  cc'ing him.  The
>  load_policy -i support is upstream and should be in Fedora devel /
>  rawhide too. 
This would still need to be done chroot()ed into the system (there's no
way to set the base path for filename resoution), correct?

Bill

[Stephen Smalley]

On Thu, 2008-01-24 at 11:11 -0500, Bill Nottingham wrote:
>  Stephen Smalley (sds(a)tycho.nsa.gov) said: 
>  > Hmm...Chad Sellers was working on similar support for Ubuntu, but did it
>  > by adding a -i option to the load_policy program to perform an initial
>  > policy load so that you can just execute it from a script rather than
>  > requiring a direct patch to nash or anything else.  cc'ing him.  The
>  > load_policy -i support is upstream and should be in Fedora devel /
>  > rawhide too.
>  
>  This would still need to be done chroot()ed into the system (there's no
>  way to set the base path for filename resoution), correct? 
Not presently.

-- 
Stephen Smalley
National Security Agency

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bill Nottingham wrote:
>  Stephen Smalley (sds(a)tycho.nsa.gov) said: 
> > Hmm...Chad Sellers was working on similar support for Ubuntu, but did it
> > by adding a -i option to the load_policy program to perform an initial
> > policy load so that you can just execute it from a script rather than
> > requiring a direct patch to nash or anything else.  cc'ing him.  The
> > load_policy -i support is upstream and should be in Fedora devel /
> > rawhide too.
>  
>  This would still need to be done chroot()ed into the system (there's no
>  way to set the base path for filename resoution), correct?
>  
>  Bill
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
You would still want to
read the /etc/selinux/config file to figure out
which policy to load.

chroot PATH load_policy -i

should work.


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkeYyUgACgkQrlYvE4MpobMkGwCfd1bU2WGZnxwWc1FpTzu5if9v
> +NQAoMhIyXI+INgRUc+l8F5CoIJz2TbA
> =R9oH
> -----END PGP SIGNATURE-----

[Chad Sellers]

On 1/24/08 11:11 AM, "Bill Nottingham" <notting(a)redhat.com&gt; wrote:

>  Stephen Smalley (sds(a)tycho.nsa.gov) said:
> > Hmm...Chad Sellers was working on similar support for Ubuntu, but did it
> > by adding a -i option to the load_policy program to perform an initial
> > policy load so that you can just execute it from a script rather than
> > requiring a direct patch to nash or anything else.  cc'ing him.  The
> > load_policy -i support is upstream and should be in Fedora devel /
> > rawhide too.
>  
>  This would still need to be done chroot()ed into the system (there's no
>  way to set the base path for filename resoution), correct?
>   
Yes, I have to chroot to make this work. The current working initramfs
script that I've been using in Ubuntu looks like this (at least the
important parts):

set +e
chroot /root /usr/sbin/load_policy -i
RET=$?
if [ $RET -eq 3 ]; then echo "SELinux policy load failed and enforcing mode
requested, halting now"; kill -INT 1;
elif [ $RET -ne 0 ]; then echo "SELinux policy load failed, continuing";
fi

So, I just call load_policy -i from a chroot, and then save off the return
value. load_policy -i has a separate return value (3) if the system should
halt (i.e. enforcing requested but policy load failed). If that occurs, I
kill the initramfs init process. Note that Ubuntu uses busybox init for it's
initrd, which seems quite buggy when it comes to signal handling. It
apparently ignores SIGKILL, but dies on SIGINT. Eventually I plan to debug
this further to figure out why this is the case and send a patch to the
busybox guys, but I haven't had time yet.


----------------------
Chad Sellers
csellers(a)tresys.com
http://www.tresys.com

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bill Nottingham wrote:
>  We're looking to move to a different init system in Fedora - the
>  current work is going to be around upstart, most likely. upstart
>  does not have native code for loading the SELinux policy.
>  
>  We could modify every possible init to load the policy... but
>  that would be painful. So we might as well move to having the
>  policy loaded from the initramfs. The attached patches are the
>  first quick cut at doing that.
>  
>  The main patch is for mkinitrd/nash; there's a short patch for the
>  current init, as it will abort if policy is already loaded. We
>  can't actually remove the code from init to load the policy, as
>  there will always be older initramfses.
>  
>  Comments? Ideas for different ways to do this? It's sort of ugly
>  with fork and chroot(), but to avoid that we'd have to reimplement
>  most, if not all, of libselinux's policy loading code directly.
>  
>  Bill
>  
>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
We also have to worry about transitions.

init_t -> initrc_t -> httpd_t

If an init program (initng) does not do a fork/exec of the initrc_t
script then transitions will not work properly.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkeYsE4ACgkQrlYvE4MpobMGWACdEY83lBoOFrZOlrZ11gIPy5BK
> zB8AnRx6jJKOuleoAAyfQNqaYvkKPb6Z
> =o9RX
> -----END PGP SIGNATURE-----