Add SELinux permissions for kernel 6.18#847
Conversation
mgsharm
changed the title
|
Please split this up into (at least) four commits:
Remember that SELinux answers questions of the form "is $subject allowed to do $verb to $object?" So for each "verb" that's being added, please summarize (in the commit message) the security relevant properties. For example: are some subjects gaining a new verb? Are some subjects losing access to a verb they previously had, and under what conditions? What was the behavior in previous kernels? What upstream kernel commit added the new LSM check? You need to make the case that you are not weakening the existing security boundary with this change, and also that you are not breaking current use cases by restricting something that wasn't previously restricted. You can look at past commits to the SELinux policy for examples. For testing, you additionally need to be sure this doesn't misbehave for older kernels (6.1, 6.12). |
Thanks for the feedback. Will address these accordingly. |
mgsharm
changed the title
Upstream commit c6ad9fdbd44b ("io_uring,lsm,selinux: add LSM hooks for
io_uring_setup()") added an LSM hook that checks a new "allowed"
permission on the io_uring security class.
Add the permission to the io_uring class and to the "processes interact"
classmapping. This grants it through the existing trust model: all
subjects can use io_uring on themselves, and privileged subjects can use
it on all subjects. This prevents a denial for an operation that was
previously unchecked.
Backward compatible: older kernels ignore the unknown permission.
Signed-off-by: Gaurav Sharma <mgsharm@amazon.com>
Upstream commit 7d90fb525319 ("selinux: add FILE__WATCH_MOUNTNS") added
a watch_mountns permission to the common file permission set, checked
when a process uses fanotify to watch mount namespace changes.
Add watch_mountns to common file permissions in class.cil and to all
load_* permission sets in files.cil. Add it to all mutate_* exclusion
lists so it is treated as a read-like operation, consistent with the
other watch_* permissions.
Backward compatible: older kernels ignore the unknown permission.
Signed-off-by: Gaurav Sharma <mgsharm@amazon.com>
bcressey
left a comment
bcressey
left a comment
There was a problem hiding this comment.
LGTM with a couple style nits
…kernel 6.18
Upstream commit 2c2b1e059792 ("selinux: add permission checks for
loading other kinds of kernel files") generalized the existing
module_load check to cover all kernel file types.
The firmware_load permission is required for NVIDIA GSP firmware loading
on kernel 6.18. Without it, the driver fails with EACCES when attempting
to load firmware via request_firmware().
Add firmware_load, kexec_image_load, kexec_initramfs_load, policy_load,
and x509_certificate_load to the system class. Restrict them to the
"systems manage" classmap and exclude them from "systems use", so only
privileged subjects can perform these operations. module_load is
intentionally left unchanged in "systems use".
Backward compatible: older kernels ignore the unknown permissions.
Signed-off-by: Gaurav Sharma <mgsharm@amazon.com>
Upstream commit d1d991efaf34 ("selinux: Add netlink xperm support")
introduced a generic nlmsg permission for fine-grained control over
individual netlink message types.
Add nlmsg to netlink_route_socket, netlink_tcpdiag_socket,
netlink_xfrm_socket, and netlink_audit_socket. The permission is
granted to all subjects through the existing "sockets use" classmap,
consistent with the existing nlmsg_read and nlmsg_write grants.
Backward compatible: older kernels ignore the unknown permission.
Signed-off-by: Gaurav Sharma <mgsharm@amazon.com>
4 participants
Issue number:
Closes #382
Related PRs
Description of changes:
Add SELinux permissions introduced in kernel 6.18 to the CIL policy files.
Commit 1: io_uring allowed permission
Commit 2: watch_mountns permission
Commit 3: firmware_load and related system permissions
The firmware_load permission is required for NVIDIA GSP firmware loading on kernel 6.18. Without it, the driver fails with EACCES when attempting to load firmware via request_firmware().
Commit 4: nlmsg permission
All changes are backward compatible — older kernels (6.1, 6.12) ignore unknown permissions.
Testing done:
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.