Deprecate setting “/sys/fs/selinux/checkreqprot” to 1. This flag was originally created to deal with legacy userspace and the READ_IMPLIES_EXEC personality flag. We changed the default from 1 to 0 back in Linux v4.4 and now we are taking the next step of deprecating it, at some point in the future we will take the final step of rejecting 1.

Allow kernfs symlinks to inherit the SELinux label of the parent directory. In order to preserve backwards compatibility this is protected by the “genfs_seclabel_symlinks” SELinux policy capability.

Fix a problem where we were not properly handling multiple netlink messages in a single message buffer. Unfortunately this could cause some netlink messages to escape the SELinux access controls. This issue was assigned the CVE number CVE-2020-10751.

Enable per-file labeling for the BPF filesystem.

Improve how we handle initial SIDs in the kernel and remove a number that were unused.

Optimize how we store filename transitions in the kernel, resulting in some significant improvements to policy load times.

We now do a better job calculating the sizes of the internal hash tables, which improved SELinux policy load times and likely general SELinux performance as well.

Ensure that we properly label NFS v4.2 filesystems to avoid a temporary unlabeled condition.

Add some missing XFS quota command types to the SELinux quota access controls.

Fix a problem where we were not properly handling all read operations in selinuxfs.

Convert several linked lists to arrays to help with performance and improve code simplicity.

Stop logging inode information when updating an audit file watch. Since we are not changing the inode, or the fact that we are watching the associated file, the inode information is just noise that we can do without.

Fix a problem where mandatory audit records were missing their accompanying audit records (e.g. SYSCALL records were missing). The missing records often meant that we didn’t have the necessary context to understand what was going on when the event occurred. [UPDATE August 4, 2020: this patch was reverted during the Linux v5.8-rcX phase due to problems, it should reappear at a later date]

Fix a problem where we were not properly checking the length of audit records generated by userspace programs allowed to submit audit records due to the CAP_AUDIT_WRITE capability.

Deprecate the CONFIG_SECURITY_SELINUX_DISABLE functionality. The code was originally developed to make it easier for Linux distributions to support architectures where adding parameters to the kernel command line was difficult. Unfortunately, supporting runtime disable meant we had to make some security trade-offs when it came to the LSM hooks, as documented in the Kconfig help text:

NOTE: selecting this option will disable the ‘__ro_after_init’ kernel hardening feature for security hooks. Please consider using the selinux=0 boot parameter instead of enabling this option.

Fortunately it looks as if that the original motivation for the runtime disable functionality is gone, and Fedora/RHEL appears to be the only major distribution enabling this capability at build time so we are now taking steps to remove it entirely from the kernel. The first step is to mark the functionality as deprecated and print an error when it is used (what this patch is doing). As Fedora/RHEL makes progress in transitioning the distribution away from runtime disable, we will introduce follow-up patches over several kernel releases which will block for increasing periods of time when the runtime disable is used. Finally we will remove the option entirely once we believe all users have moved to the kernel cmdline approach.

lockdown { integrity confidentiality }

Stephen Smalley, the patch author, provides a good explanation of the new controls in the patch description:

Implement a SELinux hook for lockdown. If the lockdown module is also enabled, then a denial by the lockdown module will take precedence over SELinux, so SELinux can only further restrict lockdown decisions. The SELinux hook only distinguishes at the granularity of integrity versus confidentiality similar to the lockdown module, but includes the full lockdown reason as part of the audit record as a hint in diagnosing what triggered the denial. To support this auditing, move the lockdown_reasons[] string array from being private to the lockdown module to the security framework so that it can be used by the lsm audit code and so that it is always available even when the lockdown module is disabled.

Note that the SELinux implementation allows the integrity and confidentiality reasons to be controlled independently from one another. Thus, in an SELinux policy, one could allow operations that specify an integrity reason while blocking operations that specify a confidentiality reason. The SELinux hook implementation is stricter than the lockdown module in validating the provided reason value.

Sample AVC audit output from denials:

avc:  denied  { integrity } for pid=3402 comm="fwupd"
lockdown_reason="/dev/mem,kmem,port" scontext=system_u:system_r:fwupd_t:s0
tcontext=system_u:system_r:fwupd_t:s0 tclass=lockdown permissive=0

avc:  denied  { confidentiality } for pid=4628 comm="cp"
lockdown_reason="/proc/kcore access"
scontext=unconfined_u:unconfined_r:test_lockdown_integrity_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:test_lockdown_integrity_t:s0-s0:c0.c1023
tclass=lockdown permissive=0

Add a new access control for the move_mount(2) syscall which reuses the “file { mounton }” permission.

Enable SELinux per-file labeling for binderfs.

Add SELinux support for the new netlink VLAN configuration messages RTM_NEWVLAN, RTM_DELVLAN, and RTM_GETVLAN.

Improve how we store and access SELinux security labels within the kernel by caching the kernel’s SID-to-string security label translation. Those systems with a large number of MLS/MCS categories in use and applications which often query the kernel for SELinux labels should see the biggest improvement in performance.

Improve the LSM and SELinux kernel build definitions such that the LSM auditing and SELinux InfiniBand code is only built when needed by the kernel’s build time configuration.

The LSM stacking changes introduced a SELinux bug when SELinux is disabled at runtime. We attempt to fix this in Linux v5.6 by reordering the SELinux hooks in the LSM configuration such that the data structures are properly managed. The real fix for this is to eventually remove the runtime disable functionality (see the CONFIG_SECURITY_SELINUX_DISABLE deprecation notice above) and use the kernel command line to disable SELinux at boot (e.g. “selinux=0”) if desired.

Fix a problem in the SELinux access control enforcement cache where we were not always cleaning up properly on error. In some extreme cases this could effectively shrink the access control cache and impact performance.

Multiple key internal SELinux data structures were marked with “__randomize_layout” to help harden the SELinux code in the kernel.

Fixed out of date references to the selinuxfs mount point in the kernel documentation. The kernel documentation should now correctly reference selinuxfs as being mounted on “/sys/fs/selinux”.

Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload event.

The only info really needed from BPF side is the globally unique prog ID where then audit user space tooling can query / dump all info needed about the specific BPF program right upon load event and enrich the record, thus these changes needed here can be kept small and non-intrusive to the core.

Raw example output:

# auditctl -D
# auditctl -a always,exit -F arch=x86_64 -S bpf
# ausearch --start recent -m 1334
...
----
time->Wed Nov 27 16:04:13 2019
type=PROCTITLE msg=audit(1574867053.120:84664): proctitle="./bpf"
type=SYSCALL msg=audit(1574867053.120:84664): arch=c000003e syscall=321 \
success=yes exit=3 a0=5 a1=7ffea484fbe0 a2=70 a3=0 items=0 ppid=7477    \
pid=12698 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001    \
egid=1001 sgid=1001 fsgid=1001 tty=pts2 ses=4 comm="bpf"                \
exe="/home/jolsa/auditd/audit-testsuite/tests/bpf/bpf"                  \
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=UNKNOWN[1334] msg=audit(1574867053.120:84664): prog-id=76 op=LOAD
----
time->Wed Nov 27 16:04:13 2019
type=UNKNOWN[1334] msg=audit(1574867053.120:84665): prog-id=76 op=UNLOAD
...

Commit 219ca39427bf (“audit: use union for audit_field values since they are mutually exclusive”) combined a number of separate fields in the audit_field struct into a single union. Generally this worked just fine because they are generally mutually exclusive. Unfortunately in audit_data_to_entry() the overlap can be a problem when a specific error case is triggered that causes the error path code to attempt to cleanup an audit_field struct and the cleanup involves attempting to free a stored LSM string (the lsm_str field). Currently the code always has a non-NULL value in the audit_field.lsm_str field as the top of the for-loop transfers a value into audit_field.val (both .lsm_str and .val are part of the same union); if audit_data_to_entry() fails and the audit_field struct is specified to contain a LSM string, but the audit_field.lsm_str has not yet been properly set, the error handling code will attempt to free the bogus audit_field.lsm_str value that was set with audit_field.val at the top of the for-loop.

This patch corrects this by ensuring that the audit_field.val is only set when needed (it is cleared when the audit_field struct is allocated with kcalloc()). It also corrects a few other issues to ensure that in case of error the proper error code is returned.

Fixed a problem where we were not always properly checking the length of audit netlink messages before parsing the messages in the kernel.

perf_event { open cpu kernel tracepoint read write }

The “cpu”, “kernel”, and “tracepoint” permissions are used to reflect their associated accesses requested while the “open” permission is described by this mailing list post. The “read” and “write” permissions are checked when I/O happens on the file descriptor returned by perf_event_open(2). In order to make use of the new controls some additional configuration is required as described by the patch author, Joel Fernandes:

To use this patch, we set the perf_event_paranoid sysctl to -1 and then apply selinux checking as appropriate (default deny everything, and then add policy rules to give access to domains that need it). In the future we can remove the perf_event_paranoid sysctl altogether.

A policy developer can now specify glblub as a default_range default and the computed transition will be the intersection of the mls range of the two contexts.

The glb (greatest lower bound) lub (lowest upper bound) of a range is calculated as the greater of the low sensitivities and the lower of the high sensitivities and the and of each category bitmap.

This can be used by MLS solution developers to compute a context that satisfies, for example, the range of a network interface and the range of a user logging in.

Some examples are:

User Permitted Range	Network Device Label	Computed Label
s0-s1:c0.c12	s0	s0
s0-s1:c0.c12	s0-s1:c0.c1023	s0-s1:c0.c12
s0-s4:c0.c512	s1-s1:c0.c1023	s1-s1:c0.c512
s0-s15:c0,c2	s4-s6:c0.c128	s4-s6:c0,c2
s0-s4	s2-s6	s2-s4
s0-s4	s5-s8	INVALID
s5-s8	s0-s4	INVALID

Allow SELinux file labeling before the policy is loaded into the kernel. This should ease some of the burden when the policy is initially loaded as there is no longer a need to relabel files, as well as help enable new system concepts which dynamically create the root filesystem durint boot in the initramfs.