1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
|
From 5dc7de13feab41e3847fed72fa0d0d9bed21fea5 Mon Sep 17 00:00:00 2001
From: Maximilian Blenk <Maximilian.Blenk@bmw.de>
Date: Wed, 29 Jan 2020 17:09:50 +0100
Subject: [PATCH 2/3] container.conf: Add option to set keyring SELinux context
lxc set's up a new session keyring for every container by default.
If executed on an SELinux enabled system, by default, the keyring
inherits the label of the creating process. If executed with the
currently available SELinux policy, this means that the keyring
is labeled with the lxc_t type. Applications inside the container,
however, might expect that the keyring is labeled with a certain
context (and will fail to access the keyring if it's not explicitly
allowed in the global policy). This patch introduces the config
option lxc.selinux.context.keyring which enables to specify the
label of the newly created keyring. That is, the keyring can be
labeled with the label expected by the started application.
Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
---
config/selinux/lxc.te | 3 +++
src/lxc/conf.c | 10 +++++++++-
src/lxc/conf.h | 1 +
src/lxc/confile.c | 24 ++++++++++++++++++++++++
src/lxc/lsm/lsm.c | 13 +++++++++++++
src/lxc/lsm/lsm.h | 2 ++
src/lxc/lsm/selinux.c | 13 +++++++++++++
src/lxc/utils.c | 9 ++++++++-
src/lxc/utils.h | 2 +-
9 files changed, 74 insertions(+), 3 deletions(-)
diff --git a/config/selinux/lxc.te b/config/selinux/lxc.te
index bb4bfe3a8..d3f78d80b 100644
--- a/config/selinux/lxc.te
+++ b/config/selinux/lxc.te
@@ -84,5 +84,8 @@ allow lxc_t self:packet_socket create_socket_perms;
allow lxc_t self:rawip_socket create_socket_perms;
allow lxc_t self:netlink_route_socket create_netlink_socket_perms;
+# Needed to set label that the keyring will be created with
+allow lxc_t self:process { setkeycreate };
+
dontaudit lxc_t sysctl_kernel_t:file write;
dontaudit lxc_t sysctl_modprobe_t:file write;
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 0f8b3c928..b06fbf047 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2758,6 +2758,7 @@ struct lxc_conf *lxc_conf_init(void)
new->lsm_aa_profile = NULL;
lxc_list_init(&new->lsm_aa_raw);
new->lsm_se_context = NULL;
+ new->lsm_se_keyring_context = NULL;
new->tmp_umount_proc = false;
new->tmp_umount_proc = 0;
new->shmount.path_host = NULL;
@@ -3549,6 +3550,7 @@ int lxc_setup(struct lxc_handler *handler)
int ret;
const char *lxcpath = handler->lxcpath, *name = handler->name;
struct lxc_conf *lxc_conf = handler->conf;
+ char *keyring_context = NULL;
ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
if (ret < 0) {
@@ -3564,7 +3566,13 @@ int lxc_setup(struct lxc_handler *handler)
}
}
- ret = lxc_setup_keyring();
+ if (lxc_conf->lsm_se_keyring_context) {
+ keyring_context = lxc_conf->lsm_se_keyring_context;
+ } else if (lxc_conf->lsm_se_context) {
+ keyring_context = lxc_conf->lsm_se_context;
+ }
+
+ ret = lxc_setup_keyring(keyring_context);
if (ret < 0)
return -1;
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 2664a1527..bb47b720e 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -295,6 +295,7 @@ struct lxc_conf {
unsigned int lsm_aa_allow_incomplete;
struct lxc_list lsm_aa_raw;
char *lsm_se_context;
+ char *lsm_se_keyring_context;
bool tmp_umount_proc;
struct lxc_seccomp seccomp;
int maincmd_fd;
diff --git a/src/lxc/confile.c b/src/lxc/confile.c
index 36d62cbca..df184af73 100644
--- a/src/lxc/confile.c
+++ b/src/lxc/confile.c
@@ -157,6 +157,7 @@ lxc_config_define(seccomp_allow_nesting);
lxc_config_define(seccomp_notify_cookie);
lxc_config_define(seccomp_notify_proxy);
lxc_config_define(selinux_context);
+lxc_config_define(selinux_context_keyring);
lxc_config_define(signal_halt);
lxc_config_define(signal_reboot);
lxc_config_define(signal_stop);
@@ -253,6 +254,7 @@ static struct lxc_config_t config_jump_table[] = {
{ "lxc.seccomp.notify.proxy", set_config_seccomp_notify_proxy, get_config_seccomp_notify_proxy, clr_config_seccomp_notify_proxy, },
{ "lxc.seccomp.profile", set_config_seccomp_profile, get_config_seccomp_profile, clr_config_seccomp_profile, },
{ "lxc.selinux.context", set_config_selinux_context, get_config_selinux_context, clr_config_selinux_context, },
+ { "lxc.selinux.context.keyring", set_config_selinux_context_keyring, get_config_selinux_context_keyring, clr_config_selinux_context_keyring },
{ "lxc.signal.halt", set_config_signal_halt, get_config_signal_halt, clr_config_signal_halt, },
{ "lxc.signal.reboot", set_config_signal_reboot, get_config_signal_reboot, clr_config_signal_reboot, },
{ "lxc.signal.stop", set_config_signal_stop, get_config_signal_stop, clr_config_signal_stop, },
@@ -1489,6 +1491,12 @@ static int set_config_selinux_context(const char *key, const char *value,
return set_config_string_item(&lxc_conf->lsm_se_context, value);
}
+static int set_config_selinux_context_keyring(const char *key, const char *value,
+ struct lxc_conf *lxc_conf, void *data)
+{
+ return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
+}
+
static int set_config_log_file(const char *key, const char *value,
struct lxc_conf *c, void *data)
{
@@ -3545,6 +3553,13 @@ static int get_config_selinux_context(const char *key, char *retv, int inlen,
return lxc_get_conf_str(retv, inlen, c->lsm_se_context);
}
+static int get_config_selinux_context_keyring(const char *key, char *retv, int inlen,
+ struct lxc_conf *c, void *data)
+{
+ return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
+}
+
+
/* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
* just the value(s) will be printed. Since there still could be more than one,
* it is newline-separated.
@@ -4405,6 +4420,14 @@ static inline int clr_config_selinux_context(const char *key,
return 0;
}
+static inline int clr_config_selinux_context_keyring(const char *key,
+ struct lxc_conf *c, void *data)
+{
+ free(c->lsm_se_keyring_context);
+ c->lsm_se_keyring_context = NULL;
+ return 0;
+}
+
static inline int clr_config_cgroup_controller(const char *key,
struct lxc_conf *c, void *data)
{
@@ -5944,6 +5967,7 @@ int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
strprint(retv, inlen, "dir\n");
} else if (!strcmp(key, "lxc.selinux")) {
strprint(retv, inlen, "context\n");
+ strprint(retv, inlen, "context.keyring\n");
} else if (!strcmp(key, "lxc.mount")) {
strprint(retv, inlen, "auto\n");
strprint(retv, inlen, "entry\n");
diff --git a/src/lxc/lsm/lsm.c b/src/lxc/lsm/lsm.c
index 5538c9e84..48c22b700 100644
--- a/src/lxc/lsm/lsm.c
+++ b/src/lxc/lsm/lsm.c
@@ -214,3 +214,16 @@ void lsm_process_cleanup(struct lxc_conf *conf, const char *lxcpath)
drv->cleanup(conf, lxcpath);
}
+
+int lsm_keyring_label_set(char *label) {
+
+ if (!drv) {
+ ERROR("LSM driver not inited");
+ return -1;
+ }
+
+ if (!drv->keyring_label_set)
+ return 0;
+
+ return drv->keyring_label_set(label);
+}
diff --git a/src/lxc/lsm/lsm.h b/src/lxc/lsm/lsm.h
index dda740b3d..a645a2fa0 100644
--- a/src/lxc/lsm/lsm.h
+++ b/src/lxc/lsm/lsm.h
@@ -38,6 +38,7 @@ struct lsm_drv {
char *(*process_label_get)(pid_t pid);
int (*process_label_set)(const char *label, struct lxc_conf *conf,
bool on_exec);
+ int (*keyring_label_set)(char* label);
int (*prepare)(struct lxc_conf *conf, const char *lxcpath);
void (*cleanup)(struct lxc_conf *conf, const char *lxcpath);
};
@@ -53,5 +54,6 @@ extern int lsm_process_label_fd_get(pid_t pid, bool on_exec);
extern int lsm_process_label_set_at(int label_fd, const char *label,
bool on_exec);
extern void lsm_process_cleanup(struct lxc_conf *conf, const char *lxcpath);
+extern int lsm_keyring_label_set(char *label);
#endif /* __LXC_LSM_H */
diff --git a/src/lxc/lsm/selinux.c b/src/lxc/lsm/selinux.c
index 625bcae90..b3d95c310 100644
--- a/src/lxc/lsm/selinux.c
+++ b/src/lxc/lsm/selinux.c
@@ -106,11 +106,24 @@ static int selinux_process_label_set(const char *inlabel, struct lxc_conf *conf,
return 0;
}
+/*
+ * selinux_keyring_label_set: Set SELinux context that will be assigned to the keyring
+ *
+ * @label : label string
+ *
+ * Returns 0 on success, < 0 on failure
+ */
+static int selinux_keyring_label_set(char *label)
+{
+ return setkeycreatecon_raw(label);
+};
+
static struct lsm_drv selinux_drv = {
.name = "SELinux",
.enabled = is_selinux_enabled,
.process_label_get = selinux_process_label_get,
.process_label_set = selinux_process_label_set,
+ .keyring_label_set = selinux_keyring_label_set,
};
struct lsm_drv *lsm_selinux_drv_init(void)
diff --git a/src/lxc/utils.c b/src/lxc/utils.c
index bf4a9c2cb..90852eb87 100644
--- a/src/lxc/utils.c
+++ b/src/lxc/utils.c
@@ -48,6 +48,7 @@
#include "config.h"
#include "log.h"
+#include "lsm/lsm.h"
#include "lxclock.h"
#include "memory_utils.h"
#include "namespace.h"
@@ -1832,11 +1833,17 @@ int recursive_destroy(char *dirname)
return r;
}
-int lxc_setup_keyring(void)
+int lxc_setup_keyring(char *keyring_label)
{
key_serial_t keyring;
int ret = 0;
+ if (keyring_label) {
+ if (lsm_keyring_label_set(keyring_label) < 0) {
+ ERROR("Couldn't set keyring label");
+ }
+ }
+
/* Try to allocate a new session keyring for the container to prevent
* information leaks.
*/
diff --git a/src/lxc/utils.h b/src/lxc/utils.h
index dd6404f0b..7560711b7 100644
--- a/src/lxc/utils.h
+++ b/src/lxc/utils.h
@@ -259,6 +259,6 @@ extern uint64_t lxc_find_next_power2(uint64_t n);
extern int lxc_set_death_signal(int signal, pid_t parent);
extern int fd_cloexec(int fd, bool cloexec);
extern int recursive_destroy(char *dirname);
-extern int lxc_setup_keyring(void);
+extern int lxc_setup_keyring(char *keyring_label);
#endif /* __LXC_UTILS_H */
--
2.24.1
|
