Re: WARNING in apparmor_secid_to_secctx

From: Stephen Smalley
Date: Fri Aug 31 2018 - 12:15:59 EST


On 08/31/2018 12:16 PM, Stephen Smalley wrote:
On 08/31/2018 12:07 PM, Paul Moore wrote:
On Fri, Aug 31, 2018 at 12:01 PM Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
On 08/29/2018 10:21 PM, Dmitry Vyukov wrote:
On Wed, Aug 29, 2018 at 7:17 PM, syzbot
<syzbot+21016130b0580a9de3b5@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Hello,

syzbot found the following crash on:

HEAD commit:ÂÂÂ 817e60a7a2bb Merge branch 'nfp-add-NFP5000-support'
git tree:ÂÂÂÂÂÂ net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1536d296400000
kernel config: https://syzkaller.appspot.com/x/.config?x=531a917630d2a492
dashboard link: https://syzkaller.appspot.com/bug?extid=21016130b0580a9de3b5
compiler:ÂÂÂÂÂÂ gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+21016130b0580a9de3b5@xxxxxxxxxxxxxxxxxxxxxxxxx

Hi John, Tyler,

I've switched syzbot from selinux to apparmor as we discussed on lss:
https://github.com/google/syzkaller/commit/2c6cb254ae6c06f61e3aba21bb89ffb05b5db946

Sorry, does this mean that you are no longer testing selinux via syzbot?
 That seems unfortunate. SELinux is default-enabled and used in
Fedora, RHEL and all derivatives (e.g. CentOS), and mandatory in Android
(and seemingly getting some use in ChromeOS now as well, at least for
the Android container and possibly wider), so it seems unwise to drop it
from your testing altogether. I was under the impression that you were
just going to add apparmor to your testing matrix, not drop selinux
altogether.

It is also important to note that testing with SELinux enabled but no
policy loaded is not going to be very helpful (last we talked that is
what syzbot is/was doing). While syzbot did uncover some issues
relating to the enabled-no-policy case, those are much less
interesting and less relevant than the loaded-policy case.

I had thought that they had switched over to at least loading a policy but possibly left it in permissive mode because the base distribution didn't properly support SELinux out of the box. But I may be mistaken.
Regardless, the right solution is to migrate to testing with a policy loaded not to stop testing altogether.

Optimally, they'd test on at least one distribution/OS where SELinux is in fact supported out of the box, e.g. CentOS, Android, and/or ChromeOS.

Or Fedora, of course.