[ubuntu-hardened] [PATCH] Initial policy load from load_policy

[Chad Sellers]

On 11/7/07 4:26 PM, "Stephen Smalley" <sds at tycho.nsa.gov> wrote:

> On Wed, 2007-11-07 at 16:17 -0500, Chad Sellers wrote:
>> The below patch adds a -i option to load_policy to perform the initial
>> policy load. The inital policy load is currently done in systems using
>> sysvinit by init itself, which then re-exec's itself. Ubuntu uses
>> upstart instead of sysvinit. In talks with the Ubuntu folks, they'd
>> prefer to load policy from initramfs before upstart starts rather than
>> patching upstart.
>> 
>> Signed-off-by: Chad Sellers <csellers at tresys.com>
>> ---
>> 
>> load_policy.8 |   19 ++++++++++++++++++-
>> load_policy.c |   29 +++++++++++++++++++++++++----
>> 2 files changed, 43 insertions(+), 5 deletions(-)
>> 
>> Index: policycoreutils/load_policy/load_policy.c
>> ===================================================================
>> --- policycoreutils/load_policy/load_policy.c    (revision 2679)
>> +++ policycoreutils/load_policy/load_policy.c    (working copy)
>> @@ -19,13 +19,13 @@
>>  
>>  void usage(char *progname)
>>  {
>> -    fprintf(stderr, _("usage:  %s [-q]\n"), progname);
>> +    fprintf(stderr, _("usage:  %s [-qi]\n"), progname);
>>      exit(1);
>>  }
>>  
>>  int main(int argc, char **argv)
>>  {
>> -    int ret, opt, quiet = 0, nargs;
>> +    int ret, opt, quiet = 0, nargs, init=0, enforce=0;
>>  
>>  #ifdef USE_NLS
>>      setlocale(LC_ALL, "");
>> @@ -33,7 +33,7 @@
>>      textdomain(PACKAGE);
>>  #endif
>>  
>> -    while ((opt = getopt(argc, argv, "bq")) > 0) {
>> +    while ((opt = getopt(argc, argv, "bqi")) > 0) {
>>          switch (opt) {
>>          case 'b':
>>              fprintf(stderr, "%s:  Warning! The -b option is no longer
>> supported, booleans are always preserved across reloads.  Continuing...\n",
>> @@ -43,6 +43,9 @@
>>              quiet = 1;
>>              sepol_debug(0);
>>              break;
>> +        case 'i':
>> +            init = 1;
>> +            break;
>>          default:
>>              usage(argv[0]);
>>          }
>> @@ -62,7 +65,25 @@
>>              argv[0], argv[optind++]);
>>      }
>>  
>> -    ret = selinux_mkload_policy(1);
>> +    if (init) {
>> +        if (is_selinux_enabled() == 1) {
>> +            /* SELinux is already enabled, we should not do an initial
>> load again */
>> +            fprintf(stderr,
>> +                _("%s:  Policy is already loaded and initial load
>> requested\n"),
>> +                argv[0]);
>> +            exit(2);
>> +        }
>> +        ret = selinux_init_load_policy(&enforce);
>> +        if (ret != 0 ) {
>> +             if (enforce > 0) {
>> +                /* SELinux in enforcing mode but load_policy failed */
> 
> An error message here would be helpful, assuming that such error
> messages are displayed at all on the console.
> 
I was planning to just display the error in the caller, as the caller will
be the one to halt the system (not load_policy).

> How do you plan to handle an error in the caller?  System should be
> halted in this case.
> 
I plan to check the return value in the caller and halt in this case. That's
why I added a new return value (3). Basically, something like this:

set +e
chroot /root load_policy -i
RET=$?
if [ $RET -eq 3 ]; then echo "SELinux policy load failed and enforcing mode
requested, halting now"; halt;
elif [ $RET -ne 0 ]; then echo "SELinux policy load failed, continuing";
fi

>> +                exit(3);
>> +            }
>> +        }
>> +    }
>> +    else {
>> +        ret = selinux_mkload_policy(1);
>> +    }
>>      if (ret < 0) {
>>          fprintf(stderr, _("%s:  Can't load policy:  %s\n"),
>>              argv[0], strerror(errno));
>> Index: policycoreutils/load_policy/load_policy.8
>> ===================================================================
>> --- policycoreutils/load_policy/load_policy.8    (revision 2679)
>> +++ policycoreutils/load_policy/load_policy.8    (working copy)
>> @@ -4,7 +4,7 @@
>>  
>>  .SH SYNOPSIS
>>  .B load_policy
>> -[-q]
>> +[-qi]
>>  .br
>>  .SH DESCRIPTION
>>  .PP
>> @@ -17,7 +17,24 @@
>>  .TP
>>  .B \-q
>>  suppress warning messages.
>> +.TP
>> +.B \-i
>> +inital policy load. Only use this if this is the first time policy is
>> being loaded since boot (usually called from initramfs).
>>  
>> +.SH "EXIT STATUS"
>> +.TP
>> +.B 0
>> +Success
>> +.TP
>> +.B 1
>> +Invalid option
>> +.TP
>> +.B 2
>> +Policy load failed
>> +.TP
>> +.B 3
>> +Initial policy load failed and enforcing mode requested
>> +
>>  .SH SEE ALSO
>>  .B booleans
>>  (8),
>> 
>> 
>> --
>> This message was distributed to subscribers of the selinux mailing list.
>> If you no longer wish to subscribe, send mail to majordomo at tycho.nsa.gov with
>> the words "unsubscribe selinux" without quotes as the message.