DevConf.cz 2018

Another year, another DevConf.cz in the books. Thanks to everyone who attended, volunteered, and spoke; it was a great conference and I'm once again looking forward to next year. I should also mention that for the first time ever, DevConf will be expanding to two other locations in 2018: Boston and Bangalore, check the websites for more details.

At this year's DevConf.cz I gave a short talk on an effort we are calling "SELinux Modularity", a project where we are working on integrating SELinux into the larger Fedora Modularity effort.

2017 Year In Review

With 2017 coming to an end in a little over a week, it's a good time to look back on what the SELinux, audit, and libseccomp projects have accomplished this year, and recognize the contributors that made it all possible.

In 2017 we had five Linux Kernel releases, one SELinux userspace release, ten audit userspace releases, and two libseccomp releases.

An Open Source project is only as good as it's contributors, so I want to thank everyone who contributed code in 2017, as well as those who contributed code that hasn't yet made it into the main repositories (unfortunately not represented in the lists below).

Contributors to the SELinux kernel and userspace code bases (sorted by number of commits).

Nicolas Iooss
Stephen Smalley
James Carter
Petr Lautrbach
Markus Elfring
Alan Jenkins
Daniel Jurgens
Vit Mojzis
Jason Zaman
Richard Haines
Jan Zarsky
Dan Walsh
Steve Lawrence
James Morris
Colin Ian King
Florian Westphal
Patrick Steinhardt
Chenbo Feng
Corentin LABBE
Eric W. Biederman
Antonio Murdaca
Kees Cook
Luis Ressel
Jeff Vander Stoep
Matthias Kaehlcke
Ingo Molnar
Gary Tierney
Dan Cashman
Tom Cherry
Christian Göttsche
Miroslav Grepl
Nick Kralevich
Guido Trentalancia
Greg Kroah-Hartman
Paul Moore
Kyeongdon Kim
Richard Guy Briggs
Arvind Yadav
Michal Hocko
Julien Gomes
Scott Mayhew
Junil Lee
Al Viro
Tetsuo Handa
Eric Biggers
Dan Carpenter
David Ahern
Alexander Potapenko
Alexey Dobriyan
Dave Jiang
Krister Johansen
Casey Schaufler
Yongqin Liu
Lukas Vrabec
Grégoire Colbert
Laurent Bigonville
Bernhard M. Wiedemann
Colin Walters
Nikola Forró
Ville Skyttä
Lokesh Mandvekar
Thomas Petazzoni
Karl MacMillan
Sandeep Patil

Contributors to the audit kernel code base (sorted by number of commits). Unfortunately I'm unable to include the audit userspace contributors as the audit userspace git log is not a reliable source of contributor information for 2017.

Paul Moore
Jan Kara
Richard Guy Briggs
Elena Reshetova
Nicholas Mc Guire
Steve Grubb
Greg Kroah-Hartman
Deepa Dinamani
Casey Schaufler
Geliang Tang
Mel Gorman
Tyler Hicks
Shu Wang
Derek Robson
Johannes Berg

Contributors to the main libseccomp code base as well as the Golang and artwork repositories (sorted by number of commits).

Paul Moore
Tyler Hicks
Matthew Heon
Jay Guo
Tobias Klauser
Luca Bruno
valoq
Vladimir Rutsky
Justin Cormack
NODA, Kai
K.C. Wong
Kyle R. Conway

A big thanks from me to all of you! I hope you have a safe, happy, and exciting 2018.

Linux 4.14 Released

Linux v4.14 was released on Sunday, November 12th; this is a quick summary of the SELinux and audit changes.

SELinux

  • Driven by the increased use of the No New Privileges (NNP) functionality, a new mechanism was introduced which allows domain transitions when NNP is enabled, or when executing applications on a "nosuid" mounted filesystem. This new mechanism extends the "process" object class to the "process2" class, adding two new permissions to "process2": "nnp_transition" and "nosuid_transition". These new permissions allow the policy developer to specify when a domain transition is allowed under NNP or on a nosuid mount, bypassing the bounded relationship requirement. Example SELinux policy is shown below:

    allow <old_domain> <new_domain>:process2 { nnp_transition };
    allow <old_domain> <new_domain>:process2 { nosuid_transition };
    This new functionality is gated by the "nnp_nosuid_transition" policy capability; if the policy capability is disabled, the the existing behavior is preserved. You can check the status of the currently loaded SELinux policy with the following commands:
    # cd /sys/fs/selinux/policy_capabilities
    # ls
    always_check_network  extended_socket_class  nnp_nosuid_transition
    cgroup_seclabel       network_peer_controls  open_perms
    # cat nnp_nosuid_transition
    1
    For more information, you can read the patch's description:

    From: Stephen Smalley

    selinux: Generalize support for NNP/nosuid SELinux domain transitions

    As systemd ramps up enabling NNP (NoNewPrivileges) for system services, it is increasingly breaking SELinux domain transitions for those services and their descendants. systemd enables NNP not only for services whose unit files explicitly specify NoNewPrivileges=yes but also for services whose unit files specify any of the following options in combination with running without CAP_SYS_ADMIN (e.g. specifying User= or a CapabilityBoundingSet= without CAP_SYS_ADMIN): SystemCallFilter=, SystemCallArchitectures=, RestrictAddressFamilies=, RestrictNamespaces=, PrivateDevices=, ProtectKernelTunables=, ProtectKernelModules=, MemoryDenyWriteExecute=, or RestrictRealtime= as per the systemd.exec(5) man page.

    The end result is bad for the security of both SELinux-disabled and SELinux-enabled systems. Packagers have to turn off these options in the unit files to preserve SELinux domain transitions. For users who choose to disable SELinux, this means that they miss out on at least having the systemd-supported protections. For users who keep SELinux enabled, they may still be missing out on some protections because it isn't necessarily guaranteed that the SELinux policy for that service provides the same protections in all cases.

    commit 7b0d0b40cd78 ("selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID.") allowed bounded transitions under NNP in order to support limited usage for sandboxing programs. However, defining typebounds for all of the affected service domains is impractical to implement in policy, since typebounds requires us to ensure that each domain is allowed everything all of its descendant domains are allowed, and this has to be repeated for the entire chain of domain transitions. There is no way to clone all allow rules from descendants to their ancestors in policy currently, and doing so would be undesirable even if it were practical, as it requires leaking permissions to objects and operations into ancestor domains that could weaken their own security in order to allow them to the descendants (e.g. if a descendant requires execmem permission, then so do all of its ancestors; if a descendant requires execute permission to a file, then so do all of its ancestors; if a descendant requires read to a symbolic link or temporary file, then so do all of its ancestors...). SELinux domains are intentionally not hierarchical / bounded in this manner normally, and making them so would undermine their protections and least privilege.

    We have long had a similar tension with SELinux transitions and nosuid mounts, albeit not as severe. Users often have had to choose between retaining nosuid on a mount and allowing SELinux domain transitions on files within those mounts. This likewise leads to unfortunate tradeoffs in security.

    Decouple NNP/nosuid from SELinux transitions, so that we don't have to make a choice between them. Introduce a nnp_nosuid_transition policy capability that enables transitions under NNP/nosuid to be based on a permission (nnp_transition for NNP; nosuid_transition for nosuid) between the old and new contexts in addition to the current support for bounded transitions. Domain transitions can then be allowed in policy without requiring the parent to be a strict superset of all of its children.

    With this change, systemd unit files can be left unmodified from upstream. SELinux-disabled and SELinux-enabled users will benefit from retaining any of the systemd-provided protections. SELinux policy will only need to be adapted to enable the new policy capability and to allow the new permissions between domain pairs as appropriate.

    NB: Allowing nnp_transition between two contexts opens up the potential for the old context to subvert the new context by installing seccomp filters before the execve. Allowing nosuid_transition between two contexts domains are allowed, and this has to be repeated for the entire chain of domain transitions. There is no way to clone all allow rules from descendants to their ancestors in policy currently, and doing so would be undesirable even if it were practical, as it requires leaking permissions to objects and operations into ancestor domains that could weaken their own security in order to allow them to the descendants (e.g. if a descendant requires execmem permission, then so do all of its ancestors; if a descendant requires execute permission to a file, then so do all of its ancestors; if a descendant requires read to a symbolic link or temporary file, then so do all of its ancestors...). SELinux domains are intentionally not hierarchical / bounded in this manner normally, and making them so would undermine their protections and least privilege.

    We have long had a similar tension with SELinux transitions and nosuid mounts, albeit not as severe. Users often have had to choose between retaining nosuid on a mount and allowing SELinux domain transitions on files within those mounts. This likewise leads to unfortunate tradeoffs in security.

    Decouple NNP/nosuid from SELinux transitions, so that we don't have to make a choice between them. Introduce a nnp_nosuid_transition policy capability that enables transitions under NNP/nosuid to be based on a permission (nnp_transition for NNP; nosuid_transition for nosuid) between the old and new contexts in addition to the current support for bounded transitions. Domain transitions can then be allowed in policy without requiring the parent to be a strict superset of all of its children.

    With this change, systemd unit files can be left unmodified from upstream. SELinux-disabled and SELinux-enabled users will benefit from retaining any of the systemd-provided protections. SELinux policy will only need to be adapted to enable the new policy capability and to allow the new permissions between domain pairs as appropriate.

    NB: Allowing nnp_transition between two contexts opens up the potential for the old context to subvert the new context by installing seccomp filters before the execve. Allowing nosuid_transition between two contexts opens up the potential for a context transition to occur on a file from an untrusted filesystem (e.g. removable media or remote filesystem). Use with care.

  • Support for labeling of individual cgroup and cgroup2 files was added using the SELinux genfscon mechanism. In order to use this new functionality the cgroup, or cgroup2, filesystem must be mounted with the "xattr" mount option.

  • Fix a bug where AF_UNIX/SOCK_RAW sockets were not properly assigned the "unix_dgram_socket" object class. This should be noticeable to users of libpcap.

  • Minor small changes to the how the kernel allocates SELinux internal memory and how it protects a few internal data structures.

Audit

  • Previous work to make the audit subsystem year 2038 safe in Linux v4.12 resulted in the audit subsystem calling a rather heavyweight clock API in the kernel to generate the audit event timestamp. In this kernel release we return to using a more lightweight clock API, while still ensuring the code remains year 2038 safe.

  • The "AVC INITIALIZED" audit KERNEL record seen at boot on SELinux systems was removed. It did not provide any useful information that couldn't be found in other audit records emitted at boot.