selinux: enable per-file labeling for functionfs

This patch adds support for genfscon per-file labeling of functionfs
files as well as support for userspace to apply labels after new
functionfs endpoints are created.

This allows for separate labels and therefore access control on a
per-endpoint basis. An example use case would be for the default
endpoint EP0 used as a restricted control endpoint, and additional
usb endpoints to be used by other more permissive domains.

It should be noted that if there are multiple functionfs mounts on a
system, genfs file labels will apply to all mounts, and therefore will not
likely be as useful as the userspace relabeling portion of this patch -
the addition to selinux_is_genfs_special_handling().

This patch introduces the functionfs_seclabel policycap to maintain
existing functionfs genfscon behavior unless explicitly enabled.

Signed-off-by: Neill Kapron <nkapron@google.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
[PM: trim changelog, apply boolean logic fixup]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e474cd7398effd405a37e10018ce90a2062b4d8d..0e47b4bb8d4082e2bf3106ec2308c0067bd91556 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -476,7 +476,9 @@ static int selinux_is_genfs_special_handling(struct super_block *sb)
                !strcmp(sb->s_type->name, "rootfs") ||
                (selinux_policycap_cgroupseclabel() &&
                 (!strcmp(sb->s_type->name, "cgroup") ||
-                 !strcmp(sb->s_type->name, "cgroup2")));
+                 !strcmp(sb->s_type->name, "cgroup2"))) ||
+               (selinux_policycap_functionfs_seclabel() &&
+                !strcmp(sb->s_type->name, "functionfs"));
 }
 
 static int selinux_is_sblabel_mnt(struct super_block *sb)
@@ -741,7 +743,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
            !strcmp(sb->s_type->name, "binder") ||
            !strcmp(sb->s_type->name, "bpf") ||
            !strcmp(sb->s_type->name, "pstore") ||
-           !strcmp(sb->s_type->name, "securityfs"))
+           !strcmp(sb->s_type->name, "securityfs") ||
+           (selinux_policycap_functionfs_seclabel() &&
+            !strcmp(sb->s_type->name, "functionfs")))
                sbsec->flags |= SE_SBGENFS;
 
        if (!strcmp(sb->s_type->name, "sysfs") ||

diff --git a/security/selinux/include/policycap.h b/security/selinux/include/policycap.h
index 7405154e6c42c16773b6b157aabbe637fc7299cc..135a969f873cad612ec9c3756678d187579f9a1e 100644 (file)
--- a/security/selinux/include/policycap.h
+++ b/security/selinux/include/policycap.h
@@ -17,6 +17,7 @@ enum {
        POLICYDB_CAP_NETLINK_XPERM,
        POLICYDB_CAP_NETIF_WILDCARD,
        POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
+       POLICYDB_CAP_FUNCTIONFS_SECLABEL,
        __POLICYDB_CAP_MAX
 };
 #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)

diff --git a/security/selinux/include/policycap_names.h b/security/selinux/include/policycap_names.h
index d8962fcf2ff90090d6d00b3c6cf1f7c4e1fa159e..ff88828876517166cbd7ed2cff09a9820bd81c3c 100644 (file)
--- a/security/selinux/include/policycap_names.h
+++ b/security/selinux/include/policycap_names.h
@@ -20,6 +20,7 @@ const char *const selinux_policycap_names[__POLICYDB_CAP_MAX] = {
        "netlink_xperm",
        "netif_wildcard",
        "genfs_seclabel_wildcard",
+       "functionfs_seclabel",
 };
 /* clang-format on */
 

diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 7f19972f7922e9be5502d7877d4ad27227860e22..0f954a40d3fc7454429b6839f47cfb6a831f8021 100644 (file)
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -203,6 +203,12 @@ static inline bool selinux_policycap_netlink_xperm(void)
                selinux_state.policycap[POLICYDB_CAP_NETLINK_XPERM]);
 }
 
+static inline bool selinux_policycap_functionfs_seclabel(void)
+{
+       return READ_ONCE(
+               selinux_state.policycap[POLICYDB_CAP_FUNCTIONFS_SECLABEL]);
+}
+
 struct selinux_policy_convert_data;
 
 struct selinux_load_state {