[Devel] Re: selinux prevents msgrcv on restore message queues?

[Serge E. Hallyn]

Quoting Nathan Lynch (ntl at pobox.com):
> On Tue, 2010-03-02 at 19:19 -0600, Serge E. Hallyn wrote:
> > Quoting Serge E. Hallyn (serue at us.ibm.com):
> > > Quoting Nathan Lynch (ntl at pobox.com):
> > > > Hi,
> > > > 
> > > > With ckpt-v19-rc3 the test-mq.sh testcase in cr_tests fails when SELinux
> > > > is enabled on my test system (64-bit powerpc kernel).  The testcase
> > > > sleeps in do_msgrcv after restart and never wakes up.  When SELinux is
> > > > disabled, the messages are received and the testcase passes.
> > > > 
> > > > I've established that the messages are being restored during restart --
> > > > msgctl(IPC_STAT) shows one message in each queue before calling msgrcv.
> > > > Adding the IPC_NOWAIT flag to the msgrcv calls gets ENOMSG, however.
> > > > 
> > > > I managed to narrow this down to security_msg_queue_msgrcv ->
> > > > selinux_msg_queue_msgrcv.  avc_has_perm(SECCLASS_MSG, MSG__RECEIVE) gets
> > > > -EACCESS, so I guess something is going awry in selinux restore hooks?
> > > > 
> > > > Any ideas?
> > > 
> > > Hmm, wait.  security_msg_msg_alloc() is being called after
> > > security_msg_msg_restore.  That may not be what is causing
> > > your troubles, but it's certainly not right.
> > 
> > Can you try the following patch?
> > 
> > Also, to actually restore the LSM labels you need to add -k to your
> > restart flags, but without the -k you should get a sane default
> > security label.
> 
> Thanks, the ipc/mq tests pass with this patch and restart -k.  Without
> -k the tests still fail in the same manner (msgrcv fails).  Is that the
> behavior you'd expect?

Not really - the test runs as unconfined_u right?  I'd expect the
msg to get created with the same type both when you just run the
original program and when you restart it.  If you just run the
checkpointed program and let it complete, doe sit also get a
denial at msgrcv?

-serge
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers