'selinux_child' return code

[alexey-tikhonov]

• fail immediately if set-id fails
• make it explicit that currently prepare_response() always sends '0' as a return code

[alexey-tikhonov]

Previously:

[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Starting under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [main] (0x0400): [RID#8] context initialized
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] seuser length: 12
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] seuser: unconfined_u
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] mls_range length: 14
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] mls_range: s0-s0:c0.c1023
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] username length: 5
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] username: test1
[selinux_child[2795]] [sss_set_cap_effective] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [main] (0x0020): [RID#8] setuid() failed: 1, selinux_child might not work!
[selinux_child[2795]] [sss_set_cap_effective] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [main] (0x0020): [RID#8] setgid() failed: 1, selinux_child might not work!
[selinux_child[2795]] [sss_drop_cap] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
...
[selinux_child[2795]] [sss_drop_cap] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Performing selinux operations under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [sss_is_selinux_managed] (0x0400): [RID#8] SELinux policy not managed via libsemanage
[selinux_child[2795]] [seuser_needs_update] (0x2000): [RID#8] sss_get_seuser: ret: 1432158259 seuser: unknown mls: unknown
[selinux_child[2795]] [seuser_needs_update] (0x0400): [RID#8] The SELinux user does not need an update
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Sending response under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [pack_buffer] (0x0400): [RID#8] result [1]
[selinux_child[2795]] [prepare_response] (0x4000): [RID#8] r->size: 4
[selinux_child[2795]] [main] (0x0400): [RID#8] selinux_child completed successfully


[be[test.openqa.fedoraproject.org]] [selinux_child_create_buffer] (0x4000): [RID#8] buffer size: 43
[be[test.openqa.fedoraproject.org]] [selinux_child_done] (0x0020): [RID#8] Error in selinux_child: [1][Operation not permitted]

[alexey-tikhonov]

Now:

[selinux_child[7931]] [sss_log_process_caps] (0x0100): [RID#24] Starting under ruid=990, euid=990, suid=990 : rgid=986, egid=986, sgid=986
[selinux_child[7931]] [sss_log_process_caps] (0x0100): [RID#24] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[7931]] [main] (0x0400): [RID#24] context initialized
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] seuser length: 7
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] seuser: staff_u
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] mls_range length: 14
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] mls_range: s0-s0:c0.c1023
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] username length: 9
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] username: testuser2
[selinux_child[7931]] [sss_set_cap_effective] (0x0400): [RID#24] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[7931]] [main] (0x0020): [RID#24] setresuid() failed: 1
[selinux_child[7931]] [main] (0x0020): [RID#24] selinux_child failed!


[be[subid.test]] [_read_pipe_handler] (0x0400): [RID#24] EOF received, client finished
[be[subid.test]] [selinux_child_done] (0x0020): [RID#24] selinux_child_parse_response failed: [22][Invalid argument]
[be[subid.test]] [dp_req_done] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Request handler finished [0]: Success
[be[subid.test]] [dp_req_done] (0x20000): [RID#24] DP Request [PAM SELinux #24]: Handling request took [96.056] milliseconds.
[be[subid.test]] [_dp_req_recv] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Receiving request data.
[be[subid.test]] [dp_req_destructor] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Request removed.
[be[subid.test]] [dp_req_destructor] (0x0400): [RID#24] Number of active DP request: 0
[be[subid.test]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.pamHandler on /sssd from sssd.pam: Success
[be[subid.test]] [child_sig_handler] (0x1000): [RID#24] Waiting for child [7931].
[be[subid.test]] [child_sig_handler] (0x0020): [RID#24] child [7931] failed with status [1].

[pam] [pam_print_data] (0x0100): [CID#4] command: SSS_PAM_ACCT_MGMT
...
[pam] [pam_dp_send_req_done] (0x0200): [CID#4] received: [4 (System error)][subid.test]

Backend handling of non-zero 'selinux_child' exit status is a bit awkward but works.

Should we pack error code always in response and do exit(0) (barring cases of malloc failures)?

[ikerexxe]

LGTM! Can you check CI failures for Fedora 42 integration? Every other failure is unrelated, but I'm not sure about this one.

[alexey-tikhonov]

@ikerexxe,

LGTM!

thank you for the review.
But what do you think about some kind of "duplication": a return code in the response (that solely consist of this return code) and a process exit code?

I guess we can't get rid of process exit code because it's the only way to convey result if, for example, malloc fails.
On the other hand, I'm not sure if be[ipa]'s handling of selinux_child exit code is entirely correct...

[ikerexxe]

thank you for the review. But what do you think about some kind of "duplication": a return code in the response (that solely consist of this return code) and a process exit code?

I wouldn't object to that if it helps SSSD's backends to understand the failure reason and act accordingly.

I guess we can't get rid of process exit code because it's the only way to convey result if, for example, malloc fails. On the other hand, I'm not sure if be[ipa]'s handling of selinux_child exit code is entirely correct...

We should definitely not get rid of the process exit code.

[alexey-tikhonov]

I'll add one more patch to get rid of a response packet, so that sssd_be will rely solely on exit code.

[alexey-tikhonov]

I'll add one more patch to get rid of a response packet, so that sssd_be will rely solely on exit code.

@sumit-bose, @ikerexxe, I added a patch to get rid of the response.
Please take a preliminary look if you are fine with the approach in general, before I spend time testing it thoroughly.

[ikerexxe]

At a first glance it looks good

[alexey-tikhonov]

Ok, I tested it manually.

'sssd_be' logs:

[dp_attach_req] (0x0400): [RID#11] DP Request [PAM SELinux #11]: REQ_TRACE: New request. [sssd.pam CID #1] Flags [0000].
...
(2025-01-14 14:55:05): [be[subid.test]] [ipa_selinux_process_seealso_maps] (0x0400): [RID#11] HBAC rule [ipaUniqueID=fbe5c91a-b0cf-11ef-b751-525400d6ec84,cn=h
bac,dc=subid,dc=test] matched, copying itsattributes to SELinux user map [ipaUniqueID=fbe5c91a-b0cf-11ef-b751-525400d6ec84,cn=hbac,dc=subid,dc=test]
(2025-01-14 14:55:05): [be[subid.test]] [selinux_child_create_buffer] (0x4000): [RID#11] buffer size: 42
(2025-01-14 14:55:05): [be[subid.test]] [child_handler_setup] (0x2000): [RID#11] Setting up signal handler up for pid [226242]
(2025-01-14 14:55:05): [be[subid.test]] [child_handler_setup] (0x2000): [RID#11] Signal handler set up for pid [226242]
(2025-01-14 14:55:05): [be[subid.test]] [sdap_process_result] (0x2000): Trace: sh[0x556deae5dfd0], connected[1], ops[(nil)], ldap[0x556deadd8700]
(2025-01-14 14:55:05): [be[subid.test]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
(2025-01-14 14:55:05): [be[subid.test]] [_write_pipe_handler] (0x0400): [RID#11] All data has been sent!
(2025-01-14 14:55:05): [be[subid.test]] [child_sig_handler] (0x1000): [RID#11] Waiting for child [226242].
(2025-01-14 14:55:05): [be[subid.test]] [child_sig_handler] (0x0100): [RID#11] child [226242] finished successfully.
(2025-01-14 14:55:05): [be[subid.test]] [dp_req_done] (0x0400): [RID#11] DP Request [PAM SELinux #11]: Request handler finished [0]: Success
(2025-01-14 14:55:05): [be[subid.test]] [dp_req_done] (0x20000): [RID#11] DP Request [PAM SELinux #11]: Handling request took [113.228] milliseconds.
(2025-01-14 14:55:05): [be[subid.test]] [_dp_req_recv] (0x0400): [RID#11] DP Request [PAM SELinux #11]: Receiving request data.
(2025-01-14 14:55:05): [be[subid.test]] [dp_req_destructor] (0x0400): [RID#11] DP Request [PAM SELinux #11]: Request removed.

'selinux_child' logs:

[sss_log_process_caps] (0x0100): [RID#11] Starting under ruid=990, euid=990, suid=990 : rgid=986, egid=986, sgid=986
[sss_log_process_caps] (0x0100): [RID#11] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[main] (0x0400): [RID#11] context initialized
[unpack_buffer] (0x2000): [RID#11] seuser length: 7
[unpack_buffer] (0x2000): [RID#11] seuser: staff_u
[unpack_buffer] (0x2000): [RID#11] mls_range length: 14
[unpack_buffer] (0x2000): [RID#11] mls_range: s0-s0:c0.c1023
[unpack_buffer] (0x2000): [RID#11] username length: 9
[unpack_buffer] (0x2000): [RID#11] username: testuser2
[sss_log_process_caps] (0x0100): [RID#11] Performing selinux operations under ruid=0, euid=0, suid=990 : rgid=0, egid=0, sgid=986
[sss_log_process_caps] (0x0100): [RID#11] With following capabilities:
   (nothing)
[seuser_needs_update] (0x2000): [RID#11] sss_get_seuser: ret: 0 seuser: staff_u mls: s0-s0:c0.c1023
[sss_seuser_exists] (0x0400): [RID#11] seuser exists: yes
[seuser_needs_update] (0x0400): [RID#11] The SELinux user does not need an update
[main] (0x0400): [RID#11] selinux_child completed successfully

[ikerexxe]

LGTM!

[sumit-bose]

Hi,

thanks for the updates, ACK.

bye,
Sumit

[alexey-tikhonov]

Pushed PR: #7762

• master
  • 6e66cbb - SELINUX: get rid of response as it was redundant and
  • 9516005 - SELINUX_CHILD: 'ret' argument of prepare_response() is always 0
  • 7ff2e48 - SELINUX_CHILD: fail immediately if set-id fails
• sssd-2-10
  • 033d8c4 - SELINUX: get rid of response as it was redundant and
  • 0007450 - SELINUX_CHILD: 'ret' argument of prepare_response() is always 0
  • 5b4f48e - SELINUX_CHILD: fail immediately if set-id fails