[tests/selinux] pr775-checkpolicy-revdeps: Add coverage for the hardening of executing binaries by the kernel

[tests/selinux] pr775-checkpolicy-revdeps: Add coverage for the hardening of executing binaries by the kernel

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : e70a8df7c857ccc4ca913c932a1e74c5b588f892
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2022-12-09T10:40:36+00:00
            Stats  : +160/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/e70a8df7c857ccc4ca913c932a1e74c5b588f892?branch=pr775-checkpolicy-revdeps

            Log:
            Add coverage for the hardening of executing binaries by the kernel

See the test description/Bugzilla for more details.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf
new file mode 100644
index 0000000..17584b2
--- /dev/null
+++ b/selinux-policy/kernel-confined-exec/main.fmf
@@ -0,0 +1,25 @@
+summary: Test that kernel cannot execute arbitrary helper binaries
+description: |
+  Ensures that the kernel is not allowed to execute unauthorized binaries
+  and that a transition to a confined domain is enforced on those that it
+  can execute, so that overwriting usermode helper paths doesn't lead to
+  an exploitable privilege escalation.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - selinux-policy
+framework: beakerlib
+require:
+  - library(selinux-policy/common)
+  - policycoreutils
+  - gcc
+environment:
+  AVC_ERROR: +no_avc_check
+duration: 20m
+tier: 2
+enabled: true
+adjust:
+  - enabled: false
+    when: distro < fedora-38
+    because: This hardening applies only to F38+
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579

diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh
new file mode 100755
index 0000000..35f0b58
--- /dev/null
+++ b/selinux-policy/kernel-confined-exec/runtest.sh
@@ -0,0 +1,129 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+function trigger_modprobe() {
+    # ensure gre modules are unloaded
+    modprobe -r ip_gre gre || return 2
+    ip link add mygre type gretap local 127.0.0.1 remote 127.0.0.1
+    ret=$?
+    ip link del mygre 2>/dev/null
+    if [ $ret -eq 0 ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlImport 'selinux-policy/common'
+
+        rlAssertRpm selinux-policy
+        rlAssertRpm selinux-policy-targeted
+
+        rlSESetEnforce
+        rlSEStatus
+
+        original_modprobe="$(sysctl -nb kernel.modprobe)"
+        original_core_pattern="$(sysctl -nb kernel.core_pattern)"
+
+        rlRun "gcc -o trigger_segfault trigger_segfault.c"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Policy rules"
+        rlLog "kernel_t shouldn't be allowed to execute any file without transition"
+
+        rlSESearchRule "allow kernel_t file_type:file { execute_no_trans } []" 1 \
+            "kernel_t shouldn't be allowed to execute any file without transition"
+        rlSESearchRule "allow kernel_t user_home_t:file { execute entrypoint }" 1 \
+            "kernel_t shouldn't be allowed to execute files in user home directories"
+        rlSESearchRule "allow kernel_t user_tmp_t:file { execute entrypoint }" 1 \
+            "kernel_t shouldn't be allowed to execute user temporary files"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Legit modprobe"
+        rlLog "Should work with no AVCs"
+
+        rlSESetTimestamp
+        sleep 1
+        rlRun "trigger_modprobe"
+        sleep 1
+        rlSECheckAVC
+    rlPhaseEnd
+
+    rlPhaseStartTest "Modprobe set to /usr/bin/true"
+        rlLog "Should fail but cause no AVCs"
+
+        rlRun "sysctl kernel.modprobe=/usr/bin/true" 0 \
+            "Set kernel.modprobe to /usr/bin/true"
+        rlSESetTimestamp
+        sleep 1
+        rlRun "trigger_modprobe" 1
+        sleep 1
+        rlSECheckAVC
+        rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \
+            "Reset kernel.modprobe to default"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Modprobe set to /usr/sbin/load_policy"
+        rlLog "Should fail with AVCs denying the execution"
+
+        rlRun "sysctl kernel.modprobe=/usr/sbin/load_policy" 0 \
+            "Set kernel.modprobe to /usr/sbin/load_policy"
+        rlSESetTimestamp
+        sleep 1
+        rlRun "trigger_modprobe" 1
+        sleep 1
+        rlRun "rlSEAVCCheck" 1
+        rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \
+            "Reset kernel.modprobe to default"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Modprobe relabeled to bin_t"
+        rlLog "Should fail with AVCs denying operation after transition"
+        rlRun "chcon -t bin_t \"\$(readlink -f \"\$original_modprobe\")\"" 0 \
+            "Set kernel.modprobe to /usr/sbin/load_policy"
+        rlSESetTimestamp
+        sleep 1
+        rlRun "trigger_modprobe" 1
+        sleep 1
+        rlRun "rlSEAVCCheck" 1
+        rlRun "restorecon \"\$(readlink -f \"\$original_modprobe\")\"" 0 \
+            "Reset kernel.modprobe to default"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Legit coredump helper"
+        rlLog "Should work with no AVCs"
+
+        rlSESetTimestamp
+        sleep 1
+        rlRun "./trigger_segfault" 139
+        sleep 2
+        rlSECheckAVC
+    rlPhaseEnd
+
+    rlPhaseStartTest "Core pattern set to |/usr/sbin/load_policy"
+        rlLog "Should fail with AVCs denying the execution"
+
+        rlRun "sysctl kernel.core_pattern='|/usr/sbin/load_policy'" 0 \
+            "Set kernel.core_pattern to |/usr/sbin/load_policy"
+        rlSESetTimestamp
+        sleep 1
+        rlRun "./trigger_segfault" 139
+        sleep 1
+        rlRun "rlSEAVCCheck" 1
+        rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \
+            "Reset kernel.core_pattern to default"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f trigger_segfault"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

diff --git a/selinux-policy/kernel-confined-exec/trigger_segfault.c b/selinux-policy/kernel-confined-exec/trigger_segfault.c
new file mode 100644
index 0000000..0ee0ab4
--- /dev/null
+++ b/selinux-policy/kernel-confined-exec/trigger_segfault.c
@@ -0,0 +1,6 @@
+#include <stdlib.h>
+
+int main(void)
+{
+	return *(int *)NULL;
+}