summaryrefslogtreecommitdiffstats
path: root/recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch')
-rw-r--r--recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch275
1 files changed, 275 insertions, 0 deletions
diff --git a/recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch b/recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch
new file mode 100644
index 00000000..0da1be08
--- /dev/null
+++ b/recipes-containers/lxc/files/0001-container.conf-Add-option-to-set-keyring-SELinux-con.patch
@@ -0,0 +1,275 @@
1From 5dc7de13feab41e3847fed72fa0d0d9bed21fea5 Mon Sep 17 00:00:00 2001
2From: Maximilian Blenk <Maximilian.Blenk@bmw.de>
3Date: Wed, 29 Jan 2020 17:09:50 +0100
4Subject: [PATCH 2/3] container.conf: Add option to set keyring SELinux context
5
6lxc set's up a new session keyring for every container by default.
7If executed on an SELinux enabled system, by default, the keyring
8inherits the label of the creating process. If executed with the
9currently available SELinux policy, this means that the keyring
10is labeled with the lxc_t type. Applications inside the container,
11however, might expect that the keyring is labeled with a certain
12context (and will fail to access the keyring if it's not explicitly
13allowed in the global policy). This patch introduces the config
14option lxc.selinux.context.keyring which enables to specify the
15label of the newly created keyring. That is, the keyring can be
16labeled with the label expected by the started application.
17
18Signed-off-by: Maximilian Blenk <Maximilian.Blenk@bmw.de>
19---
20 config/selinux/lxc.te | 3 +++
21 src/lxc/conf.c | 10 +++++++++-
22 src/lxc/conf.h | 1 +
23 src/lxc/confile.c | 24 ++++++++++++++++++++++++
24 src/lxc/lsm/lsm.c | 13 +++++++++++++
25 src/lxc/lsm/lsm.h | 2 ++
26 src/lxc/lsm/selinux.c | 13 +++++++++++++
27 src/lxc/utils.c | 9 ++++++++-
28 src/lxc/utils.h | 2 +-
29 9 files changed, 74 insertions(+), 3 deletions(-)
30
31diff --git a/config/selinux/lxc.te b/config/selinux/lxc.te
32index bb4bfe3a8..d3f78d80b 100644
33--- a/config/selinux/lxc.te
34+++ b/config/selinux/lxc.te
35@@ -84,5 +84,8 @@ allow lxc_t self:packet_socket create_socket_perms;
36 allow lxc_t self:rawip_socket create_socket_perms;
37 allow lxc_t self:netlink_route_socket create_netlink_socket_perms;
38
39+# Needed to set label that the keyring will be created with
40+allow lxc_t self:process { setkeycreate };
41+
42 dontaudit lxc_t sysctl_kernel_t:file write;
43 dontaudit lxc_t sysctl_modprobe_t:file write;
44diff --git a/src/lxc/conf.c b/src/lxc/conf.c
45index 0f8b3c928..b06fbf047 100644
46--- a/src/lxc/conf.c
47+++ b/src/lxc/conf.c
48@@ -2758,6 +2758,7 @@ struct lxc_conf *lxc_conf_init(void)
49 new->lsm_aa_profile = NULL;
50 lxc_list_init(&new->lsm_aa_raw);
51 new->lsm_se_context = NULL;
52+ new->lsm_se_keyring_context = NULL;
53 new->tmp_umount_proc = false;
54 new->tmp_umount_proc = 0;
55 new->shmount.path_host = NULL;
56@@ -3549,6 +3550,7 @@ int lxc_setup(struct lxc_handler *handler)
57 int ret;
58 const char *lxcpath = handler->lxcpath, *name = handler->name;
59 struct lxc_conf *lxc_conf = handler->conf;
60+ char *keyring_context = NULL;
61
62 ret = lxc_setup_rootfs_prepare_root(lxc_conf, name, lxcpath);
63 if (ret < 0) {
64@@ -3564,7 +3566,13 @@ int lxc_setup(struct lxc_handler *handler)
65 }
66 }
67
68- ret = lxc_setup_keyring();
69+ if (lxc_conf->lsm_se_keyring_context) {
70+ keyring_context = lxc_conf->lsm_se_keyring_context;
71+ } else if (lxc_conf->lsm_se_context) {
72+ keyring_context = lxc_conf->lsm_se_context;
73+ }
74+
75+ ret = lxc_setup_keyring(keyring_context);
76 if (ret < 0)
77 return -1;
78
79diff --git a/src/lxc/conf.h b/src/lxc/conf.h
80index 2664a1527..bb47b720e 100644
81--- a/src/lxc/conf.h
82+++ b/src/lxc/conf.h
83@@ -295,6 +295,7 @@ struct lxc_conf {
84 unsigned int lsm_aa_allow_incomplete;
85 struct lxc_list lsm_aa_raw;
86 char *lsm_se_context;
87+ char *lsm_se_keyring_context;
88 bool tmp_umount_proc;
89 struct lxc_seccomp seccomp;
90 int maincmd_fd;
91diff --git a/src/lxc/confile.c b/src/lxc/confile.c
92index 36d62cbca..df184af73 100644
93--- a/src/lxc/confile.c
94+++ b/src/lxc/confile.c
95@@ -157,6 +157,7 @@ lxc_config_define(seccomp_allow_nesting);
96 lxc_config_define(seccomp_notify_cookie);
97 lxc_config_define(seccomp_notify_proxy);
98 lxc_config_define(selinux_context);
99+lxc_config_define(selinux_context_keyring);
100 lxc_config_define(signal_halt);
101 lxc_config_define(signal_reboot);
102 lxc_config_define(signal_stop);
103@@ -253,6 +254,7 @@ static struct lxc_config_t config_jump_table[] = {
104 { "lxc.seccomp.notify.proxy", set_config_seccomp_notify_proxy, get_config_seccomp_notify_proxy, clr_config_seccomp_notify_proxy, },
105 { "lxc.seccomp.profile", set_config_seccomp_profile, get_config_seccomp_profile, clr_config_seccomp_profile, },
106 { "lxc.selinux.context", set_config_selinux_context, get_config_selinux_context, clr_config_selinux_context, },
107+ { "lxc.selinux.context.keyring", set_config_selinux_context_keyring, get_config_selinux_context_keyring, clr_config_selinux_context_keyring },
108 { "lxc.signal.halt", set_config_signal_halt, get_config_signal_halt, clr_config_signal_halt, },
109 { "lxc.signal.reboot", set_config_signal_reboot, get_config_signal_reboot, clr_config_signal_reboot, },
110 { "lxc.signal.stop", set_config_signal_stop, get_config_signal_stop, clr_config_signal_stop, },
111@@ -1489,6 +1491,12 @@ static int set_config_selinux_context(const char *key, const char *value,
112 return set_config_string_item(&lxc_conf->lsm_se_context, value);
113 }
114
115+static int set_config_selinux_context_keyring(const char *key, const char *value,
116+ struct lxc_conf *lxc_conf, void *data)
117+{
118+ return set_config_string_item(&lxc_conf->lsm_se_keyring_context, value);
119+}
120+
121 static int set_config_log_file(const char *key, const char *value,
122 struct lxc_conf *c, void *data)
123 {
124@@ -3545,6 +3553,13 @@ static int get_config_selinux_context(const char *key, char *retv, int inlen,
125 return lxc_get_conf_str(retv, inlen, c->lsm_se_context);
126 }
127
128+static int get_config_selinux_context_keyring(const char *key, char *retv, int inlen,
129+ struct lxc_conf *c, void *data)
130+{
131+ return lxc_get_conf_str(retv, inlen, c->lsm_se_keyring_context);
132+}
133+
134+
135 /* If you ask for a specific cgroup value, i.e. lxc.cgroup.devices.list, then
136 * just the value(s) will be printed. Since there still could be more than one,
137 * it is newline-separated.
138@@ -4405,6 +4420,14 @@ static inline int clr_config_selinux_context(const char *key,
139 return 0;
140 }
141
142+static inline int clr_config_selinux_context_keyring(const char *key,
143+ struct lxc_conf *c, void *data)
144+{
145+ free(c->lsm_se_keyring_context);
146+ c->lsm_se_keyring_context = NULL;
147+ return 0;
148+}
149+
150 static inline int clr_config_cgroup_controller(const char *key,
151 struct lxc_conf *c, void *data)
152 {
153@@ -5944,6 +5967,7 @@ int lxc_list_subkeys(struct lxc_conf *conf, const char *key, char *retv,
154 strprint(retv, inlen, "dir\n");
155 } else if (!strcmp(key, "lxc.selinux")) {
156 strprint(retv, inlen, "context\n");
157+ strprint(retv, inlen, "context.keyring\n");
158 } else if (!strcmp(key, "lxc.mount")) {
159 strprint(retv, inlen, "auto\n");
160 strprint(retv, inlen, "entry\n");
161diff --git a/src/lxc/lsm/lsm.c b/src/lxc/lsm/lsm.c
162index 5538c9e84..48c22b700 100644
163--- a/src/lxc/lsm/lsm.c
164+++ b/src/lxc/lsm/lsm.c
165@@ -214,3 +214,16 @@ void lsm_process_cleanup(struct lxc_conf *conf, const char *lxcpath)
166
167 drv->cleanup(conf, lxcpath);
168 }
169+
170+int lsm_keyring_label_set(char *label) {
171+
172+ if (!drv) {
173+ ERROR("LSM driver not inited");
174+ return -1;
175+ }
176+
177+ if (!drv->keyring_label_set)
178+ return 0;
179+
180+ return drv->keyring_label_set(label);
181+}
182diff --git a/src/lxc/lsm/lsm.h b/src/lxc/lsm/lsm.h
183index dda740b3d..a645a2fa0 100644
184--- a/src/lxc/lsm/lsm.h
185+++ b/src/lxc/lsm/lsm.h
186@@ -38,6 +38,7 @@ struct lsm_drv {
187 char *(*process_label_get)(pid_t pid);
188 int (*process_label_set)(const char *label, struct lxc_conf *conf,
189 bool on_exec);
190+ int (*keyring_label_set)(char* label);
191 int (*prepare)(struct lxc_conf *conf, const char *lxcpath);
192 void (*cleanup)(struct lxc_conf *conf, const char *lxcpath);
193 };
194@@ -53,5 +54,6 @@ extern int lsm_process_label_fd_get(pid_t pid, bool on_exec);
195 extern int lsm_process_label_set_at(int label_fd, const char *label,
196 bool on_exec);
197 extern void lsm_process_cleanup(struct lxc_conf *conf, const char *lxcpath);
198+extern int lsm_keyring_label_set(char *label);
199
200 #endif /* __LXC_LSM_H */
201diff --git a/src/lxc/lsm/selinux.c b/src/lxc/lsm/selinux.c
202index 625bcae90..b3d95c310 100644
203--- a/src/lxc/lsm/selinux.c
204+++ b/src/lxc/lsm/selinux.c
205@@ -106,11 +106,24 @@ static int selinux_process_label_set(const char *inlabel, struct lxc_conf *conf,
206 return 0;
207 }
208
209+/*
210+ * selinux_keyring_label_set: Set SELinux context that will be assigned to the keyring
211+ *
212+ * @label : label string
213+ *
214+ * Returns 0 on success, < 0 on failure
215+ */
216+static int selinux_keyring_label_set(char *label)
217+{
218+ return setkeycreatecon_raw(label);
219+};
220+
221 static struct lsm_drv selinux_drv = {
222 .name = "SELinux",
223 .enabled = is_selinux_enabled,
224 .process_label_get = selinux_process_label_get,
225 .process_label_set = selinux_process_label_set,
226+ .keyring_label_set = selinux_keyring_label_set,
227 };
228
229 struct lsm_drv *lsm_selinux_drv_init(void)
230diff --git a/src/lxc/utils.c b/src/lxc/utils.c
231index bf4a9c2cb..90852eb87 100644
232--- a/src/lxc/utils.c
233+++ b/src/lxc/utils.c
234@@ -48,6 +48,7 @@
235
236 #include "config.h"
237 #include "log.h"
238+#include "lsm/lsm.h"
239 #include "lxclock.h"
240 #include "memory_utils.h"
241 #include "namespace.h"
242@@ -1832,11 +1833,17 @@ int recursive_destroy(char *dirname)
243 return r;
244 }
245
246-int lxc_setup_keyring(void)
247+int lxc_setup_keyring(char *keyring_label)
248 {
249 key_serial_t keyring;
250 int ret = 0;
251
252+ if (keyring_label) {
253+ if (lsm_keyring_label_set(keyring_label) < 0) {
254+ ERROR("Couldn't set keyring label");
255+ }
256+ }
257+
258 /* Try to allocate a new session keyring for the container to prevent
259 * information leaks.
260 */
261diff --git a/src/lxc/utils.h b/src/lxc/utils.h
262index dd6404f0b..7560711b7 100644
263--- a/src/lxc/utils.h
264+++ b/src/lxc/utils.h
265@@ -259,6 +259,6 @@ extern uint64_t lxc_find_next_power2(uint64_t n);
266 extern int lxc_set_death_signal(int signal, pid_t parent);
267 extern int fd_cloexec(int fd, bool cloexec);
268 extern int recursive_destroy(char *dirname);
269-extern int lxc_setup_keyring(void);
270+extern int lxc_setup_keyring(char *keyring_label);
271
272 #endif /* __LXC_UTILS_H */
273--
2742.24.1
275
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-14 23:37:18 +0000