'selinux_child' return code

[alexey-tikhonov]

• fail immediately if set-id fails
• make it explicit that currently prepare_response() always sends '0' as a return code

[alexey-tikhonov]

Previously:

[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Starting under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [main] (0x0400): [RID#8] context initialized
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] seuser length: 12
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] seuser: unconfined_u
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] mls_range length: 14
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] mls_range: s0-s0:c0.c1023
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] username length: 5
[selinux_child[2795]] [unpack_buffer] (0x2000): [RID#8] username: test1
[selinux_child[2795]] [sss_set_cap_effective] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [main] (0x0020): [RID#8] setuid() failed: 1, selinux_child might not work!
[selinux_child[2795]] [sss_set_cap_effective] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [main] (0x0020): [RID#8] setgid() failed: 1, selinux_child might not work!
[selinux_child[2795]] [sss_drop_cap] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
...
[selinux_child[2795]] [sss_drop_cap] (0x0400): [RID#8] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Performing selinux operations under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [sss_is_selinux_managed] (0x0400): [RID#8] SELinux policy not managed via libsemanage
[selinux_child[2795]] [seuser_needs_update] (0x2000): [RID#8] sss_get_seuser: ret: 1432158259 seuser: unknown mls: unknown
[selinux_child[2795]] [seuser_needs_update] (0x0400): [RID#8] The SELinux user does not need an update
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] Sending response under ruid=997, euid=997, suid=997 : rgid=997, egid=997, sgid=997
[selinux_child[2795]] [sss_log_process_caps] (0x0100): [RID#8] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[2795]] [pack_buffer] (0x0400): [RID#8] result [1]
[selinux_child[2795]] [prepare_response] (0x4000): [RID#8] r->size: 4
[selinux_child[2795]] [main] (0x0400): [RID#8] selinux_child completed successfully


[be[test.openqa.fedoraproject.org]] [selinux_child_create_buffer] (0x4000): [RID#8] buffer size: 43
[be[test.openqa.fedoraproject.org]] [selinux_child_done] (0x0020): [RID#8] Error in selinux_child: [1][Operation not permitted]

[alexey-tikhonov]

Now:

[selinux_child[7931]] [sss_log_process_caps] (0x0100): [RID#24] Starting under ruid=990, euid=990, suid=990 : rgid=986, egid=986, sgid=986
[selinux_child[7931]] [sss_log_process_caps] (0x0100): [RID#24] With following capabilities:
                  CAP_SETGID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
                  CAP_SETUID: effective =  0 , permitted = *1*, inheritable =  0 , bounding = *1*
[selinux_child[7931]] [main] (0x0400): [RID#24] context initialized
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] seuser length: 7
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] seuser: staff_u
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] mls_range length: 14
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] mls_range: s0-s0:c0.c1023
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] username length: 9
[selinux_child[7931]] [unpack_buffer] (0x2000): [RID#24] username: testuser2
[selinux_child[7931]] [sss_set_cap_effective] (0x0400): [RID#24] cap_set_proc() failed: 13 ('Permission denied')
[selinux_child[7931]] [main] (0x0020): [RID#24] setresuid() failed: 1
[selinux_child[7931]] [main] (0x0020): [RID#24] selinux_child failed!


[be[subid.test]] [_read_pipe_handler] (0x0400): [RID#24] EOF received, client finished
[be[subid.test]] [selinux_child_done] (0x0020): [RID#24] selinux_child_parse_response failed: [22][Invalid argument]
[be[subid.test]] [dp_req_done] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Request handler finished [0]: Success
[be[subid.test]] [dp_req_done] (0x20000): [RID#24] DP Request [PAM SELinux #24]: Handling request took [96.056] milliseconds.
[be[subid.test]] [_dp_req_recv] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Receiving request data.
[be[subid.test]] [dp_req_destructor] (0x0400): [RID#24] DP Request [PAM SELinux #24]: Request removed.
[be[subid.test]] [dp_req_destructor] (0x0400): [RID#24] Number of active DP request: 0
[be[subid.test]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.pamHandler on /sssd from sssd.pam: Success
[be[subid.test]] [child_sig_handler] (0x1000): [RID#24] Waiting for child [7931].
[be[subid.test]] [child_sig_handler] (0x0020): [RID#24] child [7931] failed with status [1].

[pam] [pam_print_data] (0x0100): [CID#4] command: SSS_PAM_ACCT_MGMT
...
[pam] [pam_dp_send_req_done] (0x0200): [CID#4] received: [4 (System error)][subid.test]

Backend handling of non-zero 'selinux_child' exit status is a bit awkward but works.

Should we pack error code always in response and do exit(0) (barring cases of malloc failures)?

[ikerexxe]

LGTM! Can you check CI failures for Fedora 42 integration? Every other failure is unrelated, but I'm not sure about this one.

[alexey-tikhonov]

@ikerexxe,

LGTM!

thank you for the review.
But what do you think about some kind of "duplication": a return code in the response (that solely consist of this return code) and a process exit code?

I guess we can't get rid of process exit code because it's the only way to convey result if, for example, malloc fails.
On the other hand, I'm not sure if be[ipa]'s handling of selinux_child exit code is entirely correct...

[ikerexxe]

thank you for the review. But what do you think about some kind of "duplication": a return code in the response (that solely consist of this return code) and a process exit code?

I wouldn't object to that if it helps SSSD's backends to understand the failure reason and act accordingly.

I guess we can't get rid of process exit code because it's the only way to convey result if, for example, malloc fails. On the other hand, I'm not sure if be[ipa]'s handling of selinux_child exit code is entirely correct...

We should definitely not get rid of the process exit code.

[alexey-tikhonov]

I'll add one more patch to get rid of a response packet, so that sssd_be will rely solely on exit code.