Bug 1780023

Description of problem:

The VRF feature seems not usable at all in RHEL8.1 for 2 reasons:

1. It requires cgroupv2 which is Technology Preview

more important (assuming a customer can deal with this from support perspective)

2. VRF code is not SELinux aware, which is probably should, when used with "ip vrf exec <vrf> ..." command, this is what is described below.

---

In order to execute a service with VRF, the customer has to encapsulate the ExecStart command into "ip vrf exec" command, as shown in the example unit below (with httpd):

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
ExecStart=/usr/sbin/ip vrf exec vrf1 /usr/sbin/httpd $OPTIONS -DFOREGROUND
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Additionally, the unit file must have capabilities set:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# setcap 'cap_sys_admin=+epi' /path/to/service/unit.service
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Assuming SELinux is in permissive mode, we can then see that the executed process (here "httpd") will run as "ifconfig_t" context (the context of "ip" command).
This is incorrect. Instead "httpd" should run in "httpd_t" context.

This is due to missing Allow and Transitions rules, e.g.

1. We would need a "allow ifconfig_t httpd_exec_t:file { execute execute_no_trans open read }" rule to execute the binary, for now, only the following rules exist:
2. We would all need a rule to transition from "ifconfig_t" to "httpd_t", but it doesn't exist for now: only the following transitions exist:

Since any application requiring the network would potentially need this (not only httpd, almost everything in fact), we would basically want to let "ifconfig_t" domain be able to execute and transition to everything else, almost.

It hence looks like to me the "ip vrf exec" command was not designed with SELinux in mind, probably something smarter needs to be done, for example have "ip vrf exec" command switch to some special context similar to "init_t" so that it can then execute binaries safely. Not doing so would result in any "ip" or "ifconfig "command (running as "ifconfig_t") to be able to execute everything, which raises probably security concerns.


Version-Release number of selected component (if applicable):

iproute-4.18.0-15.el8


How reproducible:

Always


Steps to Reproduce (with "httpd" as an example):
1. Install "httpd" package

  # yum -y install httpd

2. Customize "httpd" service to run in a VRF

  # systemctl edit httpd --full

  Edit ExecStart and add ExecStartPre and ExecStopPost (for convenience) as shown below:

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  ExecStartPre=/usr/sbin/ip link add dev vrf1 type vrf table 256
  ExecStopPost=/usr/sbin/ip link delete dev vrf1
  ExecStart=/usr/sbin/ip vrf exec vrf1 /usr/sbin/httpd $OPTIONS -DFOREGROUND
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Enable capabilities

  # setcap 'cap_sys_admin=+epi' /etc/systemd/system/httpd.service

4. Move the system to Permissive and execute the service

  # setenforce permissive
  # systemctl start httpd

5. Check for httpd context and look at AVCs

  # ps -eafZ | grep httpd
  # ausearch -m avc -ts recent


Actual results:

We can see the wrong context:

system_u:system_r:ifconfig_t:s0 root      2556     1  0 10:20 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:ifconfig_t:s0 apache    2559  2556  0 10:20 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
...

and AVCs, due to httpd running as "ifconfig_t".

Expected results:

No AVCs and expected "httpd_t" context for "httpd"