Re: [PATCH] profiles: allow /proc/self writes for SELinux outside of SELinux profiles

Sam James <[email protected]> writes:

> Ionen Wolkens <[email protected]> writes:
>
>> On Tue, May 26, 2026 at 12:46:48AM +0100, Sam James wrote:
>>> When cross-compiling on a SELinux system where the profile has not yet
>>> been set for the target (i.e. embedded profile) or where a non-SELinux
>>> profile has been selected, writes to /proc/thread-self/attr/fscreate
>>> will be prevented by the sandbox:
>>> 
>>> ```
>>> >>> Completed installing sys-libs/timezone-data-2026b into /usr/alpha-unknown-linux-gnu/tmp/portage/sys-libs/timezone-data-2026b/image
>>> 
>>>  * Final size of build directory: 9820 KiB (9.5 MiB)
>>>  * Final size of installed tree:  2720 KiB (2.6 MiB)
>>> 
>>>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
>>> sed: warning: failed to set default file creation context to staff_u:object_r:usr_t:s0: Permission denied
>>>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
>>> strip: alpha-unknown-linux-gnu-strip --strip-unneeded -N __gentoo_check_ldflags__ -R .comment -R .GCC.command.line -R .note.gnu.gold-version
>>>    /usr/bin/zdump
>>> ```
>>> 
>>> I don't see a reason to not allow these through the sandbox on other profiles,
>>> as it should be harmless.
>>
>> If we want it everywhere, wouldn't it make more sense to add these to
>> /etc/sandbox.d/00default or sandbox.conf instead?
>>
>
> I'd mixed up which /etc/sandbox.d it looks at, for some reason I thought
> it might look inside the target, which it doesn't.
>
> So: yes, rescinding this patch in favour of some /etc/sandbox*
> solution. Thanks.

I filed https://bugs.gentoo.org/976051 to discuss it more.

>
>> profile.bashrc isn't a pmspec-recognized thing anyway, using it beyond
>> informational bits and sanity-checks isn't great.
>
> This part I'm not too worried about, because the labeling functionality is
> PM-specific anyway, at least right now.
>
> sam

-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmoVIj4bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkMPs
AP9E7KJHtiP5+E8WWN+kFfAOf42lmKwDvjhtUJg1VrPQwgEA7CAIdh/N+BNEWIBw
WE4BHWlwI96UzBW4Fpvng0R/OAk=
=MQIY
-----END PGP SIGNATURE-----