How should I run genfscon in my module?

[Dawid Gajownik]

Hi!
	I wanted to help resolving bug 
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=211767

During some investigation I found that after mounting ntfs partition 
files have context set to unlabeled_t. I downloaded selinux-policy.srpm 
and found in policy/modules/kernel/filesystem.te these lines:

#
# dosfs_t is the type for fat and vfat
# filesystems and their files.
#
type dosfs_t;
fs_noxattr_type(dosfs_t)
allow dosfs_t fs_t:filesystem associate;
genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)
genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)

I thought "Great, I need similar entry in my module!". I prepared this file:
[root@X ~]# cat ntfs3g.te
module ntfs3g 1.0;

require {
         class chr_file { getattr read write };
         class file execute_no_trans;
         type device_t;
         type dosfs_t;
         type mount_exec_t;
         type mount_t;
         role system_r;
};

genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
allow mount_t device_t:chr_file { getattr read write };
allow mount_t mount_exec_t:file execute_no_trans;
[root@X ~]#

As you can guess it does not compile ;-)

[root@X ~]# checkmodule -M -m -o ntfs3g.mod ntfs3g.te
checkmodule:  loading policy configuration from ntfs3g.te
(unknown source)::ERROR 'syntax error' at token 'genfscon' on line 13:

genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
checkmodule:  error(s) encountered while parsing configuration
[root@X ~]#

What I have done wrong?

(FC6, selinux-policy-targeted-2.4.1-3.fc6)

Regards,
	Dawid

-- 

   ^_*

[Joshua Brindle]

Dawid Gajownik wrote:
>  Hi!
>      I wanted to help resolving bug 
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=211767
>
>  During some investigation I found that after mounting ntfs partition 
>  files have context set to unlabeled_t. I downloaded 
>  selinux-policy.srpm and found in policy/modules/kernel/filesystem.te 
>  these lines:
>
>  #
>  # dosfs_t is the type for fat and vfat
>  # filesystems and their files.
>  #
>  type dosfs_t;
>  fs_noxattr_type(dosfs_t)
>  allow dosfs_t fs_t:filesystem associate;
>  genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)
>  genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)
>  genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
>  genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)
>
>  I thought "Great, I need similar entry in my module!". I prepared this 
>  file:
>  [root@X ~]# cat ntfs3g.te
>  module ntfs3g 1.0;
>
>  require {
>          class chr_file { getattr read write };
>          class file execute_no_trans;
>          type device_t;
>          type dosfs_t;
>          type mount_exec_t;
>          type mount_t;
>          role system_r;
>  };
>
>  genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
>  allow mount_t device_t:chr_file { getattr read write };
>  allow mount_t mount_exec_t:file execute_no_trans;
>  [root@X ~]#
>
>  As you can guess it does not compile ;-)
>
>  [root@X ~]# checkmodule -M -m -o ntfs3g.mod ntfs3g.te
>  checkmodule:  loading policy configuration from ntfs3g.te
>  (unknown source)::ERROR 'syntax error' at token 'genfscon' on line 13:
>
>  genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
>  checkmodule:  error(s) encountered while parsing configuration
>  [root@X ~]#
>
>  What I have done wrong?
>
>  (FC6, selinux-policy-targeted-2.4.1-3.fc6) 
Modules do not allow genfscon
statements, the grammar of modules is a 
subset of the base policy grammar. unfortunately you will have to add 
this entry to the base policy. Refpolicy's concept of module may be a 
little misleading, it doesn't convert to each one being able to compile 
as a policy module, there are several modules that are required to be 
part of base.

However, is this filesystem slated for upstream kernel? If so it should 
be added to refpolicy anyway, it would get the nfs_t type though, 
instead of dosfs_t

[Dawid Gajownik]

Dnia 10/29/2006 05:16 PM, Użytkownik Joshua Brindle napisał:
>  Modules do not allow genfscon statements, the grammar of modules is
> a
>   subset of the base policy grammar. 
Thanks for the clarification. I'll need to modify policy-selinux SRPM then.

>  However, is this filesystem slated for upstream kernel? 
 From what I read on upstream project page¹, it will be merged into
ntfsprogs package. I don't know what will happen then with ntfs module
included in kernel.

>  If so it should be added to refpolicy anyway, it would get the nfs_t
>   type though, instead of dosfs_t 
nfs_t? Well, in current policy ntfs filesystem type is marked as dosfs_t
type so I don't see a reason to mark ntfs-3g in a different way. ntfs-3g
is "just" a ntfs with write access² ;-)

Regards,
	Dawid

¹ http://www.linux-ntfs.org/
² http://wiki.linux-ntfs.org/doku.php?id=ntfs-3g

-- 

   ^_*

[Dawid Gajownik]

Dnia 10/29/2006 05:37 PM, Użytkownik Dawid Gajownik napisał:
> > Modules do not allow genfscon statements, the grammar of modules
> is a
> >  subset of the base policy grammar.
>  
>  Thanks for the clarification. I'll need to modify policy-selinux SRPM then. 
Ugh, I must have found some weird bug or something. Applying attached 
patch makes compilation fail with this message:

Compiling targeted base module
/usr/bin/checkmodule -M base.conf -o tmp/base.mod
/usr/bin/checkmodule:  loading policy configuration from base.conf
policy/modules/services/xserver.te:740:ERROR 'syntax error' at token 
'ntfs-3g' on line 1002121:
genfscon ntfs / system_u:object_r:dosfs_t:s0
genfscon ntfs-3g / system_u:object_r:dosfs_t:s0
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/base.mod] Error 1
error: Bad exit status from /var/tmp/rpm-tmp.45484 (%install)


RPM build errors:
     Bad exit status from /var/tmp/rpm-tmp.45484 (%install)
[rpm-build@X selinux-policy-2.4.1]$

I've been modifying selinux-policy-2.4.1-3.fc6.src.rpm package. It looks 
like checkmodule does not like dash, because after removing this 
character from the patch (that means s/ntfs-3g/ntfs3g/) compilation 
finishes cleanly.

What now? I would like to fix bug 211767 ASAP, because users start to 
turn off SELinux :(

Regards,
	Dawid

-- 

   ^_*

[Joshua Brindle]

>  From: Dawid Gajownik [mailto:[e-mail]] 
>  
>  Dnia 10/29/2006 05:37 PM, Użytkownik Dawid Gajownik napisał:
>  
>  RPM build errors:
>       Bad exit status from /var/tmp/rpm-tmp.45484 (%install)
>  [rpm-build@X selinux-policy-2.4.1]$
>  
>  I've been modifying selinux-policy-2.4.1-3.fc6.src.rpm 
>  package. It looks 
>  like checkmodule does not like dash, because after removing this 
>  character from the patch (that means s/ntfs-3g/ntfs3g/) compilation 
>  finishes cleanly.
>  
>  What now? I would like to fix bug 211767 ASAP, because users start to 
>  turn off SELinux :(
>   
Right, that's a hard fix I think, dashes aren't allowed in identifiers and they
are treated specially for use in MLS ranges.. Why are they putting a dash in a filesystem
name anyway?

[Dawid Gajownik]

Dnia 10/29/2006 06:33 PM, Użytkownik Joshua Brindle napisał:
>  Right, that's a hard fix I think, dashes aren't allowed in
>  identifiers and they are treated specially for use in MLS ranges.. 
Oh, that's really bad :( Without that line files on ntfs-3g filesystem 
have unlabeled_t type and I would need to give to many privileges to 
mount_t domain.

So there is no hope to fix it in the clean way?

>  Why are they putting a dash in a filesystem name anyway? 
I don't know -- I'm not the creator of ntfs-3g ;-)

-- 

   ^_*

[Stephen Smalley]

On Sun, 2006-10-29 at 21:06 +0100, Dawid Gajownik wrote:
>  Dnia 10/29/2006 06:33 PM, Użytkownik Joshua Brindle napisał:
>  > Right, that's a hard fix I think, dashes aren't allowed in
>  > identifiers and they are treated specially for use in MLS ranges..
>  
>  Oh, that's really bad :( Without that line files on ntfs-3g filesystem 
>  have unlabeled_t type and I would need to give to many privileges to 
>  mount_t domain.
>  
>  So there is no hope to fix it in the clean way? 
File it as a bug against checkpolicy.  

>  > Why are they putting a dash in a filesystem name anyway?
>  
>  I don't know -- I'm not the creator of ntfs-3g ;-)
>   
-- 
Stephen Smalley
National Security Agency

[Karl MacMillan]

On Tue, 2006-10-31 at 12:49 -0500, Stephen Smalley wrote:
>  On Sun, 2006-10-29 at 21:06 +0100, Dawid Gajownik wrote:
>  > Dnia 10/29/2006 06:33 PM, Użytkownik Joshua Brindle napisał:
>  > > Right, that's a hard fix I think, dashes aren't allowed in
>  > > identifiers and they are treated specially for use in MLS ranges..
>  > 
>  > Oh, that's really bad :( Without that line files on ntfs-3g filesystem 
>  > have unlabeled_t type and I would need to give to many privileges to 
>  > mount_t domain.
>  > 
>  > So there is no hope to fix it in the clean way?
>  
>  File it as a bug against checkpolicy.   
I looked at fixing this by changing genfscon to use user_identifier
instead of identifier (they are the same except user_identifier includes
"-"). This made checkpolicy generate a syntax error for all genfscon
statements - haven't tracked down what the problem is. The grammer still
seems to be unambiguous.

I'll try to get back to it soon, but thought I would post this in case
someone knows what the issue is off the top of their head.

Karl

[Stephen Smalley]

On Tue, 2006-10-31 at 16:48 -0500, Karl MacMillan wrote:
>  On Tue, 2006-10-31 at 12:49 -0500, Stephen Smalley wrote:
>  > On Sun, 2006-10-29 at 21:06 +0100, Dawid Gajownik wrote:
>  > > Dnia 10/29/2006 06:33 PM, Użytkownik Joshua Brindle napisał:
>  > > > Right, that's a hard fix I think, dashes aren't allowed in
>  > > > identifiers and they are treated specially for use in MLS ranges..
>  > > 
>  > > Oh, that's really bad :( Without that line files on ntfs-3g filesystem 
>  > > have unlabeled_t type and I would need to give to many privileges to 
>  > > mount_t domain.
>  > > 
>  > > So there is no hope to fix it in the clean way?
>  > 
>  > File it as a bug against checkpolicy.  
>  
>  I looked at fixing this by changing genfscon to use user_identifier
>  instead of identifier (they are the same except user_identifier includes
>  "-"). This made checkpolicy generate a syntax error for all genfscon
>  statements - haven't tracked down what the problem is. The grammer still
>  seems to be unambiguous. 
Use "user_id" instead.  Otherwise, you'll get a syntax error when the
token is classified as an IDENTIFIER (first match) and the grammar says
that it must be a USER_IDENTIFIER.  
>  
>  I'll try to get back to it soon, but thought I would post this in case
>  someone knows what the issue is off the top of their head.
>  
>  Karl 
-- 
Stephen Smalley
National Security Agency

[Dawid Gajownik]

Dnia 10/31/2006 06:49 PM, Użytkownik Stephen Smalley napisał:
> > So there is no hope to fix it in the clean way?
>  
>  File it as a bug against checkpolicy.   
d1 :-)
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=213339

-- 

   ^_*