Re: [PATCH] lldpad_t tries to automatically disable LLDP on network card but is blocked

On 3/13/2025 10:29 AM, bmare wrote:
> When running lldp daemon on a server, you can have the following error 
> message:
> 
> """
> 
> i40e driver detected for ens10f1, disabling LLDP in firmware
> 
> cannot open /sys/kernel/debug/i40e/0000:0f:00.1/command to disable LLDP 
> in firmware for ens10f1: Permission Denied
> 
> """
> 
> In the selinux logs, you can see lldp is trying to open a specific file 
> and write to it
> 
> """
> 
> avc:  denied  { write } for  pid=2264219 comm="lldpd" name="command" 
> dev="debugfs" ino=109
> 
> avc:  denied  { open } for  pid=2264219 comm="lldpd" path="/sys/kernel/ 
> debug/i40e/0000:0f:00.0/command"
> 
> """
> 
>  > LLDP needs the following authorization: "allow lldpad_t 
> debugfs_t:file { open write };"
> 
> In fact, if you are trying to configure and run a local lldp daemon, you 
> don't wan't the network card to run LLDP as well, both will conflicts, 
> and lldp daemon is probably configured to give better informations for 
> network administrators (hostname of the server for example). It could be 
> a good idea to (optionally ?) allow lldp daemon to automatically 
> unconfigure LLDP on network cards.
> 
> I've tried to create a patch doing this (create a boolean, add 
> permissions to read and write do debugfs files). It could be simplified 
> to allow writing to debugfs without a boolean, but I feels like it could 
> be a security issue and an optional boolean enabled only if needed is a 
> better option.

I definitely agree that the debugfs use is problematic and we would want 
this to be conditional in the policy.

The fact that there is no standard interface for doing this, such as in 
sysfs, seems like an issue in the driver(s) too.  Configuring a device 
shouldn't go through debugfs AFAIK.


> --- policy/modules/services/lldpad.te.old	2025-03-13 15:16:38.982728194 +0100
> +++ policy/modules/services/lldpad.te.new	2025-03-13 15:17:03.111728930 +0100
> @@ -4,6 +4,16 @@
>  #
>  # Declarations
>  #
> +## <desc>
> +##      <p>
> +##      Allow lldp daemonn to write
> +##      to debugfs.
> +##      Permit lldp to automatically
> +##      disable LLDP on physical
> +##      network card
> +##      </p>
> +## </desc>
> +gen_tunable(allow_lldpad_write_debugfs, false)
>  
>  type lldpad_t;
>  type lldpad_exec_t;
> @@ -60,3 +70,8 @@
>  optional_policy(`
>  	fcoe_dgram_send_fcoemon(lldpad_t)
>  ')
> +
> +tunable_policy(`allow_lldpad_write_debugfs',`
> +        kernel_manage_debugfs(lldpad_t)

Based on the logs you provided, this is excessive access, so I'd make a 
new kernel_write_debugfs() interface with only write access.


-- 
Chris PeBenito