Why don't my domain transitions don't occur when the application binary is outside of the stardard binary directories?

Question

I'm trying to set up a custom SELinux policy, but I'm having trouble getting the domain transitions to occur when the application binary is outside of the standard binary directories such as /bin, /usr/bin, etc. It is necessary that the application binary is located outside of those directories.

For testing purposes, I have a program that simply prints the current SELinux domain. I have a domain my_domain_t, and a type my_domain_exec_t. A transition to my_domain_t is set up to occur when a process in the unconfined_t domain executes a file with the my_domain_exec_t context.

If I copy the test binary to the /data directory, set its context, and execute it, the domain does not change.

$ cp getcontext /data/getcontext
$ chcon -t my_domain_exec_t /data/getcontext
$ /data/getcontext
unconfined_t:unconfined_r:unconfined_t:s0-s0:c0.c1023

If I instead copy the test binary to the /usr/bin directory, set its context, and then execute it, the domain transition occurs correctly.

$ sudo cp getcontext /usr/bin/getcontext
$ sudo chcon -t my_domain_exec_t /usr/bin/getcontext
$ /usr/bin/getcontext
unconfined_t:unconfined_r:my_domain_t:s0-s0:c0.c1023

Through testing, I believe I've eliminated anything to do with the user running the files, the ownership of the files, or the security context of the parent directory. What else could be causing this difference?

Edit: /data is not NFS-mounted. The context of /data is system_u:object_r:default_t:s0. On another system I've been testing on I've also see /data labeled system_u:object_r:etc_runtime_t:s0.

policy_module(my_domain, 1.0.0)

require {
    type unconfined_t;
}

type my_domain_t;
type my_domain_exec_t;

role unconfined_r types my_domain_t;

allow unconfined_t my_domain_exec_t:file *;
allow my_domain_t my_domain_exec_t:file { rx_file_perms() };

allow unconfined_t my_domain_t:process { transition siginh setexec };
type_transition unconfined_t my_domain_exec_t: process my_domain_t;

This the simplest of the nearly 20 versions of the policy I've created, and it displays the described behavior. I've also tried the domain_trans, domain_auto_trans, and domain_entry_file macros, as well as generating the policy with the sepolgen tool, which used the domtrans_pattern macro.

Answer 1

SElinux does not really care so much about file paths.

I am unable to duplicate your problem. I am using a staff_r role and staff_t type on Fedora 20, but this seems to effectively replicate your issue.

My program:

#include <stdio.h>
#include <stdlib.h>
#include <selinux/selinux.h>

int main() {
  security_context_t con;

  if (getcon(&con) < 0) {
    perror("Cannot getcon");
    return 1;
  }

  printf("%s\n", con);
  freecon(con);

  return 0;
}

My policy.

policy_module(getcon, 1.0.0)

require {
  role staff_r;
  type staff_t;
}

## Type defs
type getcon_exec_t;
type getcon_t;
application_domain(getcon_t, getcon_exec_t)

## Role permits
role staff_r types getcon_t;

## Transitions
domain_auto_transition_pattern(staff_t, getcon_exec_t, getcon_t);

## Access vectors
allow getcon_t staff_t:process sigchld;

userdom_use_inherited_user_ptys(getcon_t);

To compile program:

gcc -o getcon getcon.c -lselinux

To compile and load policy:

make -f /usr/share/selinux/devel/Makefile load

Running without changing the context

$ ./getcon
staff_u:staff_r:staff_t:s0-s0:c0.c1023

Changing the context:

# chcon -t getcon_exec_t getcon
$ ./getcon
staff_u:staff_r:getcon_t:s0-s0:c0.c1023

Changing the parent directory to default_t:

# chcon -t . default_t; chcon -t getcon_exec_t getcon
$ ./getcon
staff_u:staff_r:getcon_t:s0-s0:c0.c1023

You can try using my policy as a basis if you like. But this doesn't seem to affect me.