Skip to content

lsm: treat unlabeled_t SELinux context as unlabeled for relabeling #2368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joelcapitao wants to merge 1 commit into
base: main
Choose a base branch
from
Open

lsm: treat unlabeled_t SELinux context as unlabeled for relabeling #2368

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion crates/lib/src/lsm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,17 @@ pub(crate) fn has_security_selinux(root: &Dir, path: &Utf8Path) -> Result<SELinu
let mut buf = [0u8; 2048];
let fdpath = format!("/proc/self/fd/{}/{path}", root.as_raw_fd());
match rustix::fs::lgetxattr(fdpath, "security.selinux", &mut buf) {
Ok(_) => Ok(SELinuxLabelState::Labeled),
Ok(len) => {
// Check if the label is unlabeled_t - treat it as unlabeled.
// This can happen when files are created with SELinux in permissive mode,
// where the kernel doesn't apply type transitions and assigns unlabeled_t.
Comment on lines +267 to +268

@cgwalters cgwalters Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it's true that permissive mode doesn't do type transitions

let label = std::str::from_utf8(&buf[..len]).unwrap_or("");

@cgwalters cgwalters Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Silently discarding non-UTF8 security contexts feels odd, we can just scan bytes

if label.contains(":unlabeled_t:") {

@cgwalters cgwalters Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not happy about parsing security contexts like this, there's official APIs for this

I also don't want to hardcode unlabeled_t ideally.

Hmmmmmm...I think what's giong on here is the kernel returns this type when the xattr is missing - maybe ideally we can figure out a way to query that state. I bet the stock selinux userspace tooling has code for this.

Ok(SELinuxLabelState::Unlabeled)
} else {
Ok(SELinuxLabelState::Labeled)
}
}
Err(rustix::io::Errno::OPNOTSUPP) => Ok(SELinuxLabelState::Unsupported),
Err(rustix::io::Errno::NODATA) => Ok(SELinuxLabelState::Unlabeled),
Err(e) => Err(e).with_context(|| format!("Failed to look up context for {path:?}")),
Expand Down
Loading