Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: udev: label device nodes #9779

Merged
merged 1 commit into from
Nov 22, 2024
Merged

feat: udev: label device nodes #9779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,6 +731,7 @@ COPY --chmod=0644 hack/containerd.toml /rootfs/etc/containerd/config.toml
COPY --chmod=0644 hack/cri-containerd.toml /rootfs/etc/cri/containerd.toml
COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
COPY --chmod=0644 hack/udevd/80-net-name-slot.rules /rootfs/usr/lib/udev/rules.d/
COPY --chmod=0644 hack/udevd/90-selinux.rules /rootfs/usr/lib/udev/rules.d/
COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
RUN <<END
ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
Expand Down Expand Up @@ -804,6 +805,7 @@ COPY --chmod=0644 hack/containerd.toml /rootfs/etc/containerd/config.toml
COPY --chmod=0644 hack/cri-containerd.toml /rootfs/etc/cri/containerd.toml
COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
COPY --chmod=0644 hack/udevd/80-net-name-slot.rules /rootfs/usr/lib/udev/rules.d/
COPY --chmod=0644 hack/udevd/90-selinux.rules /rootfs/usr/lib/udev/rules.d/
COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
RUN <<END
ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
Expand Down
11 changes: 11 additions & 0 deletions hack/udevd/90-selinux.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
SUBSYSTEM=="*",SECLABEL{selinux}="system_u:object_r:device_t:s0"
dsseng marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are these labels like standard? I guess devices can have standard labels

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently (fsuse trans devtmpfs (system_u object_r device_t (systemLow systemLow))) is not sufficient for this to be default


SUBSYSTEM=="rtc",SECLABEL{selinux}="system_u:object_r:rtc_device_t:s0"
SUBSYSTEM=="mtd",SECLABEL{selinux}="system_u:object_r:mtd_device_t:s0"
SUBSYSTEM=="tpm",SECLABEL{selinux}="system_u:object_r:tpm_device_t:s0"
SUBSYSTEM=="tpmrm",SECLABEL{selinux}="system_u:object_r:tpm_device_t:s0"

KERNEL=="watchdog",SECLABEL{selinux}="system_u:object_r:wdt_device_t:s0"
KERNEL=="watchdog*",SECLABEL{selinux}="system_u:object_r:wdt_device_t:s0"
KERNEL=="null",SECLABEL{selinux}="system_u:object_r:null_device_t:s0"
KERNEL=="zero",SECLABEL{selinux}="system_u:object_r:null_device_t:s0"
32 changes: 27 additions & 5 deletions internal/integration/api/selinux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,12 +119,25 @@ func (suite *SELinuxSuite) TestFileMountLabels() {
}
maps.Copy(expectedLabelsControlPlane, expectedLabelsWorker)

suite.checkFileLabels(workers, expectedLabelsWorker)
suite.checkFileLabels(controlplanes, expectedLabelsControlPlane)
// Devices labeled by subsystems, labeled by udev
expectedLabelsDevices := map[string]string{
"/dev/rtc0": "system_u:object_r:rtc_device_t:s0",
"/dev/tpm0": "system_u:object_r:tpm_device_t:s0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm /dev/tpm is not available by default on our qemu tests, right? only for secureboot i believe

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. I added an option for test to ignore when file doesn't exist

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually let's just enable tpm2 for all tests in CI, it shouldn't hurt, better than trying to match on error, probably can do in a different PR

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will do

"/dev/tpmrm0": "system_u:object_r:tpm_device_t:s0",
"/dev/watchdog": "system_u:object_r:wdt_device_t:s0",
"/dev/watchdog0": "system_u:object_r:wdt_device_t:s0",
"/dev/null": "system_u:object_r:null_device_t:s0",
"/dev/zero": "system_u:object_r:null_device_t:s0",
}

suite.checkFileLabels(workers, expectedLabelsWorker, false)
suite.checkFileLabels(controlplanes, expectedLabelsControlPlane, false)
suite.checkFileLabels(workers, expectedLabelsDevices, true)
suite.checkFileLabels(controlplanes, expectedLabelsDevices, true)
}

//nolint:gocyclo
func (suite *SELinuxSuite) checkFileLabels(nodes []string, expectedLabels map[string]string) {
func (suite *SELinuxSuite) checkFileLabels(nodes []string, expectedLabels map[string]string, allowMissing bool) {
paths := make([]string, 0, len(expectedLabels))
for k := range expectedLabels {
paths = append(paths, k)
Expand Down Expand Up @@ -154,7 +167,7 @@ func (suite *SELinuxSuite) checkFileLabels(nodes []string, expectedLabels map[st

suite.Require().NoError(err)

suite.Require().NoError(helpers.ReadGRPCStream(stream, func(info *machineapi.FileInfo, node string, multipleNodes bool) error {
err = helpers.ReadGRPCStream(stream, func(info *machineapi.FileInfo, node string, multipleNodes bool) error {
// E.g. /var/lib should inherit /var label, while /var/run is a new mountpoint
if slices.Contains(paths, info.Name) && info.Name != path {
return nil
Expand All @@ -178,7 +191,16 @@ func (suite *SELinuxSuite) checkFileLabels(nodes []string, expectedLabels map[st
suite.Require().True(found)

return nil
}))
})

if allowMissing {
if err != nil {
suite.Require().Contains(err.Error(), "lstat")
suite.Require().Contains(err.Error(), "no such file or directory")
}
} else {
suite.Require().NoError(err)
}
}
}
}
Expand Down
Binary file modified internal/pkg/selinux/policy/policy.33
View file
Open in desktop
Binary file not shown.
14 changes: 14 additions & 0 deletions internal/pkg/selinux/policy/selinux/services/udev.cil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,20 @@
; udevadm called by machined in its context
(allow init_t udev_t (unix_stream_socket (connectto)))

; Device subsystems, labeled by udev rules
; RTC is important for security verification
(type rtc_device_t)
(call protected_device_f (rtc_device_t))
; Could be exposed firmware storage
(type mtd_device_t)
(call protected_device_f (mtd_device_t))
; Could reset the system
(type wdt_device_t)
(call protected_device_f (wdt_device_t))
; Typically client pods must not access TPM
(type tpm_device_t)
(call protected_device_f (tpm_device_t))

(type modprobe_exec_t)
(call system_f (modprobe_exec_t))
(filecon "/sbin/modprobe" file (system_u object_r modprobe_exec_t (systemLow systemLow)))
Expand Down