Bug 2000196
| Summary: | SELinux prevents WWAN ports being accessed (Qualcomm SDX55) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Peter Robinson <perobins> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.0 | CC: | dwalsh, extras-qa, grepl.miroslav, lvrabec, mmalik, omosnace, pbrobinson, perobins, roxenham, ssekidde, vmojzis, zpytela |
| Target Milestone: | rc | Keywords: | AutoVerified, Tracking, Triaged |
| Target Release: | 9.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-34.1.27-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1961571 | Environment: | |
| Last Closed: | 2022-05-17 15:49:48 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1961571, 2049128 | ||
| Bug Blocks: | 1269538 | ||
|
Description
Peter Robinson
2021-09-01 14:41:52 UTC
Ondrej,
I believe the proper type for these devices is modem_device_t, but I am not sure about the device file names: Will it always be the same or is it completely unpredictable?
Can this change in the near future?
Can you answer this or forward to someone else?
This is in Fedora 5.16 kernel:
drivers/net/wwan/wwan_core.c
229 /* ------- WWAN port management ------- */
230
231 static const struct {
232 const char * const name; /* Port type name */
233 const char * const devsuf; /* Port devce name suffix */
234 } wwan_port_types[WWAN_PORT_MAX + 1] = {
235 [WWAN_PORT_AT] = {
236 .name = "AT",
237 .devsuf = "at",
238 },
239 [WWAN_PORT_MBIM] = {
240 .name = "MBIM",
241 .devsuf = "mbim",
242 },
243 [WWAN_PORT_QMI] = {
244 .name = "QMI",
245 .devsuf = "qmi",
246 },
247 [WWAN_PORT_QCDM] = {
248 .name = "QCDM",
249 .devsuf = "qcdm",
250 },
251 [WWAN_PORT_FIREHOSE] = {
252 .name = "FIREHOSE",
253 .devsuf = "firehose",
254 },
255 };
include/linux/wwan.h:
14 /**
15 * enum wwan_port_type - WWAN port types
16 * @WWAN_PORT_AT: AT commands
17 * @WWAN_PORT_MBIM: Mobile Broadband Interface Model control
18 * @WWAN_PORT_QMI: Qcom modem/MSM interface for modem control
19 * @WWAN_PORT_QCDM: Qcom Modem diagnostic interface
20 * @WWAN_PORT_FIREHOSE: XML based command protocol
21 *
22 * @WWAN_PORT_MAX: Highest supported port types
23 * @WWAN_PORT_UNKNOWN: Special value to indicate an unknown port type
24 * @__WWAN_PORT_MAX: Internal use
25 */
26 enum wwan_port_type {
27 WWAN_PORT_AT,
28 WWAN_PORT_MBIM,
29 WWAN_PORT_QMI,
30 WWAN_PORT_QCDM,
31 WWAN_PORT_FIREHOSE,
32
33 /* Add new port types above this line */
34
35 __WWAN_PORT_MAX,
36 WWAN_PORT_MAX = __WWAN_PORT_MAX - 1,
37 WWAN_PORT_UNKNOWN,
38 };
In RHEL 9 there is kernel-5.14. We need to have solutions for both.
It seems that in kernel 5.13 (where this was introduced) the device name was of the form "/dev/wwan<WWAN_device_ID>p<unique_port_number><type>" (where <type> is one of "AT", "MBIM", "QMI", "QCDM", "FIREHOSE") and in 5.14 and later this changed to "/dev/wwan<WWAN_device_ID><type><unique_port_number>" (commit f458709ff40b), with <type> changing to lowercase (commit 392c26f7f133). There are also "/dev/wwan<WWAN_device_ID>" devices, which are parent devices of these port devices. AFAICT, <WWAN_device_ID> can range from 0 to INT_MAX and <unique_port_number> from 0 to PAGE_SIZE * 8. At least that's what I was able to read out of the kernel code... Not sure how likely the name format is to change again (I would hope they already settled on the right format...). New values for <type> are definitely possible, not sure how frequent. One way or another, it won't be possible to fully cover these devices by named type transition rules (unless we get prefix/suffix support). I agree with modem_device_t as the type. Commits to backport:
commit 51422c4a4277924046514a18b67a38b896d698f0 (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date: Fri Jan 28 17:40:25 2022 +0100
Allow ModemManager connect to the unconfined user domain
commit 80a2e3a855c20a6b1397837037e84c9657fd280f
Author: Zdenek Pytela <zpytela>
Date: Fri Jan 28 17:16:15 2022 +0100
Label /dev/wwan.+ with modem_manager_t
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: selinux-policy), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:3918 |