selinux: support wildcard match in genfscon

Currently, genfscon only supports string prefix match to label files.
Thus, labeling numerous dynamic sysfs entries requires many specific
path rules. For example, labeling device paths such as
`/sys/devices/pci0000:00/0000:00:03.1/<...>/0000:04:00.1/wakeup`
requires listing all specific PCI paths, which is challenging to
maintain. While user-space restorecon can handle these paths with
regular expression rules, relabeling thousands of paths under sysfs
after it is mounted is inefficient compared to using genfscon.

This commit adds wildcard matching to genfscon to make rules more
efficient and expressive. This new behavior is enabled by
genfs_seclabel_wildcard capability. With this capability, genfscon does
wildcard matching instead of prefix matching. When multiple wildcard
rules match against a path, then the longest rule (determined by the
length of the rule string) will be applied. If multiple rules of the
same length match, the first matching rule encountered in the given
genfscon policy will be applied. Users are encouraged to write longer,
more explicit path rules to avoid relying on this behavior.

This change resulted in nice real-world performance improvements. For
example, boot times on test Android devices were reduced by 15%. This
improvement is due to the elimination of the "restorecon -R /sys" step
during boot, which takes more than two seconds in the worst case.

Signed-off-by: Takaya Saeki <takayas@chromium.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/include/policycap.h b/security/selinux/include/policycap.h
index bd402d3fd3ae977e9488fe30054f3bc2bef4f788..7405154e6c42c16773b6b157aabbe637fc7299cc 100644 (file)
--- a/security/selinux/include/policycap.h
+++ b/security/selinux/include/policycap.h
@@ -16,6 +16,7 @@ enum {
        POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT,
        POLICYDB_CAP_NETLINK_XPERM,
        POLICYDB_CAP_NETIF_WILDCARD,
+       POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
        __POLICYDB_CAP_MAX
 };
 #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)

diff --git a/security/selinux/include/policycap_names.h b/security/selinux/include/policycap_names.h
index ac1342d6d5bb206e7d61413b17d1aac7b48be015..d8962fcf2ff90090d6d00b3c6cf1f7c4e1fa159e 100644 (file)
--- a/security/selinux/include/policycap_names.h
+++ b/security/selinux/include/policycap_names.h
@@ -19,6 +19,7 @@ const char *const selinux_policycap_names[__POLICYDB_CAP_MAX] = {
        "userspace_initial_context",
        "netlink_xperm",
        "netif_wildcard",
+       "genfs_seclabel_wildcard",
 };
 /* clang-format on */
 

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index ec9ddfccc7ee0ab243fb0d84686661008586a46c..5309bb885576fe29978867efb1859b33b6a73e61 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -49,6 +49,7 @@
 #include <linux/parser.h>
 #include <linux/vmalloc.h>
 #include <linux/lsm_hooks.h>
+#include <linux/parser.h>
 #include <net/netlabel.h>
 
 #include "flask.h"
@@ -2872,6 +2873,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
        struct genfs *genfs;
        struct ocontext *c;
        int cmp = 0;
+       bool wildcard;
 
        while (path[0] == '/' && path[1] == '/')
                path++;
@@ -2888,11 +2890,20 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
        if (!genfs || cmp)
                return -ENOENT;
 
+       wildcard = ebitmap_get_bit(&policy->policydb.policycaps,
+                                  POLICYDB_CAP_GENFS_SECLABEL_WILDCARD);
        for (c = genfs->head; c; c = c->next) {
-               size_t len = strlen(c->u.name);
-               if ((!c->v.sclass || sclass == c->v.sclass) &&
-                   (strncmp(c->u.name, path, len) == 0))
-                       break;
+               if (!c->v.sclass || sclass == c->v.sclass) {
+                       if (wildcard) {
+                               if (match_wildcard(c->u.name, path))
+                                       break;
+                       } else {
+                               size_t len = strlen(c->u.name);
+
+                               if ((strncmp(c->u.name, path, len)) == 0)
+                                       break;
+                       }
+               }
        }
 
        if (!c)