mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 09:50:04 +00:00
![Ondrej Mosnacek](/assets/img/avatar_default.png)
Before this patch, during a policy reload the sidtab would become frozen and trying to map a new context to SID would be unable to add a new entry to sidtab and fail with -ENOMEM. Such failures are usually propagated into userspace, which has no way of distignuishing them from actual allocation failures and thus doesn't handle them gracefully. Such situation can be triggered e.g. by the following reproducer: while true; do load_policy; echo -n .; sleep 0.1; done & for (( i = 0; i < 1024; i++ )); do runcon -l s0:c$i echo -n x || break # or: # chcon -l s0:c$i <some_file> || break done This patch overhauls the sidtab so it doesn't need to be frozen during policy reload, thus solving the above problem. The new SID table leverages the fact that SIDs are allocated sequentially and are never invalidated and stores them in linear buckets indexed by a tree structure. This brings several advantages: 1. Fast SID -> context lookup - this lookup can now be done in logarithmic time complexity (usually in less than 4 array lookups) and can still be done safely without locking. 2. No need to re-search the whole table on reverse lookup miss - after acquiring the spinlock only the newly added entries need to be searched, which means that reverse lookups that end up inserting a new entry are now about twice as fast. 3. No need to freeze sidtab during policy reload - it is now possible to handle insertion of new entries even during sidtab conversion. The tree structure of the new sidtab is able to grow automatically to up to about 2^31 entries (at which point it should not have more than about 4 tree levels). The old sidtab had a theoretical capacity of almost 2^32 entries, but half of that is still more than enough since by that point the reverse table lookups would become unusably slow anyway... The number of entries per tree node is selected automatically so that each node fits into a single page, which should be the easiest size for kmalloc() to handle. Note that the cache for reverse lookup is preserved with equivalent logic. The only difference is that instead of storing pointers to the hash table nodes it stores just the indices of the cached entries. The new cache ensures that the indices are loaded/stored atomically, but it still has the drawback that concurrent cache updates may mess up the contents of the cache. Such situation however only reduces its effectivity, not the correctness of lookups. Tested by selinux-testsuite and thoroughly tortured by this simple stress test: ``` function rand_cat() { echo $(( $RANDOM % 1024 )) } function do_work() { while true; do echo -n "system_u:system_r:kernel_t:s0:c$(rand_cat),c$(rand_cat)" \ >/sys/fs/selinux/context 2>/dev/null || true done } do_work >/dev/null & do_work >/dev/null & do_work >/dev/null & while load_policy; do echo -n .; sleep 0.1; done kill %1 kill %2 kill %3 ``` Link: https://github.com/SELinuxProject/selinux-kernel/issues/38 Reported-by: Orion Poplawski <orion@nwra.com> Reported-by: Li Kun <hw.likun@huawei.com> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: most of sidtab.c merged by hand due to conflicts] [PM: checkpatch fixes in mls.c, services.c, sidtab.c] Signed-off-by: Paul Moore <paul@paul-moore.com>
105 lines
2.8 KiB
C
105 lines
2.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Multi-level security (MLS) policy operations.
|
|
*
|
|
* Author : Stephen Smalley, <sds@tycho.nsa.gov>
|
|
*/
|
|
/*
|
|
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
*
|
|
* Support for enhanced MLS infrastructure.
|
|
*
|
|
* Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
|
|
*/
|
|
/*
|
|
* Updated: Hewlett-Packard <paul@paul-moore.com>
|
|
*
|
|
* Added support to import/export the MLS label from NetLabel
|
|
*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*/
|
|
|
|
#ifndef _SS_MLS_H_
|
|
#define _SS_MLS_H_
|
|
|
|
#include "context.h"
|
|
#include "policydb.h"
|
|
|
|
int mls_compute_context_len(struct policydb *p, struct context *context);
|
|
void mls_sid_to_context(struct policydb *p, struct context *context,
|
|
char **scontext);
|
|
int mls_context_isvalid(struct policydb *p, struct context *c);
|
|
int mls_range_isvalid(struct policydb *p, struct mls_range *r);
|
|
int mls_level_isvalid(struct policydb *p, struct mls_level *l);
|
|
|
|
int mls_context_to_sid(struct policydb *p,
|
|
char oldc,
|
|
char *scontext,
|
|
struct context *context,
|
|
struct sidtab *s,
|
|
u32 def_sid);
|
|
|
|
int mls_from_string(struct policydb *p, char *str, struct context *context,
|
|
gfp_t gfp_mask);
|
|
|
|
int mls_range_set(struct context *context, struct mls_range *range);
|
|
|
|
int mls_convert_context(struct policydb *oldp,
|
|
struct policydb *newp,
|
|
struct context *oldc,
|
|
struct context *newc);
|
|
|
|
int mls_compute_sid(struct policydb *p,
|
|
struct context *scontext,
|
|
struct context *tcontext,
|
|
u16 tclass,
|
|
u32 specified,
|
|
struct context *newcontext,
|
|
bool sock);
|
|
|
|
int mls_setup_user_range(struct policydb *p,
|
|
struct context *fromcon, struct user_datum *user,
|
|
struct context *usercon);
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void mls_export_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
void mls_import_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_export_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_import_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
#else
|
|
static inline void mls_export_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline void mls_import_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline int mls_export_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
static inline int mls_import_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
#endif
|
|
|
|
#endif /* _SS_MLS_H */
|
|
|