Re: [PATCH] profiles: allow /proc/self writes for SELinux outside of SELinux profiles

Ionen Wolkens <[email protected]> writes:

> On Tue, May 26, 2026 at 12:46:48AM +0100, Sam James wrote:
>> When cross-compiling on a SELinux system where the profile has not yet
>> been set for the target (i.e. embedded profile) or where a non-SELinux
>> profile has been selected, writes to /proc/thread-self/attr/fscreate
>> will be prevented by the sandbox:
>> 
>> ```
>> >>> Completed installing sys-libs/timezone-data-2026b into /usr/alpha-unknown-linux-gnu/tmp/portage/sys-libs/timezone-data-2026b/image
>> 
>>  * Final size of build directory: 9820 KiB (9.5 MiB)
>>  * Final size of installed tree:  2720 KiB (2.6 MiB)
>> 
>>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
>> sed: warning: failed to set default file creation context to staff_u:object_r:usr_t:s0: Permission denied
>>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
>> strip: alpha-unknown-linux-gnu-strip --strip-unneeded -N __gentoo_check_ldflags__ -R .comment -R .GCC.command.line -R .note.gnu.gold-version
>>    /usr/bin/zdump
>> ```
>> 
>> I don't see a reason to not allow these through the sandbox on other profiles,
>> as it should be harmless.
>
> If we want it everywhere, wouldn't it make more sense to add these to
> /etc/sandbox.d/00default or sandbox.conf instead?
>

I'd mixed up which /etc/sandbox.d it looks at, for some reason I thought
it might look inside the target, which it doesn't.

So: yes, rescinding this patch in favour of some /etc/sandbox*
solution. Thanks.

> profile.bashrc isn't a pmspec-recognized thing anyway, using it beyond
> informational bits and sanity-checks isn't great.

This part I'm not too worried about, because the labeling functionality is
PM-specific anyway, at least right now.

sam

-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmoVGU4bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkLpl
AQDLdVGMK5KBeF+UpkNYLPNq5kmHE6Nlfbog7NJXjUXU5AEA+zTLVFFHOk1Reg6F
yLjVEuwhbqeBpl4slJp1RV8Mhgk=
=kFfl
-----END PGP SIGNATURE-----