Re: [RFC PATCH] xen/flask: estimate max sidtable size

[Jan Beulich <jbeulich@xxxxxxxx>]

On 04.07.2025 12:10, Sergiy Kibrik wrote:
> 01.07.25 13:42, Jan Beulich:
>> On 30.06.2025 10:55, Sergiy Kibrik wrote:
>>> @@ -54,4 +54,7 @@ $(obj)/policy.bin: FORCE
>>>             FLASK_BUILD_DIR=$(FLASK_BUILD_DIR) POLICY_FILENAME=$(POLICY_SRC)
>>>     cmp -s $(POLICY_SRC) $@ || cp $(POLICY_SRC) $@
>>>   
>>> +$(obj)/%/se_limits.h: $(obj)/policy.bin
>>> +   $(srcdir)/policy/mkselim.sh $^ $@
>>
>> Hmm, that's using the built-in policy, isn't it? What if later another
>> policy is loaded? Wouldn't it be possible to have ...
>>
>>> --- a/xen/xsm/flask/ss/sidtab.c
>>> +++ b/xen/xsm/flask/ss/sidtab.c
>>> @@ -13,6 +13,7 @@
>>>   #include "flask.h"
>>>   #include "security.h"
>>>   #include "sidtab.h"
>>> +#include "se_limits.h"
>>>   
>>>   #define SIDTAB_HASH(sid) ((sid) & SIDTAB_HASH_MASK)
>>>   
>>> @@ -228,7 +229,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct 
>>> context *context,
>>>           if ( sid )
>>>               goto unlock_out;
>>>           /* No SID exists for the context.  Allocate a new one. */
>>> -        if ( s->next_sid == UINT_MAX || s->shutdown )
>>> +        if ( s->next_sid == SEPOL_SID_LIMIT || s->shutdown )
>>
>> ... more than this many SIDs? What if CONFIG_XSM_FLASK_POLICY isn't even set?
>>
> 
> It's using a policy from tools/flask/policy, yes. But not a built-in 
> policy, just reusing a bit of code from that code. The idea is that we 
> can have CONFIG_XSM_FLASK_POLICY option disabled yet still be able to 
> calculate SEPOL_SID_LIMIT.
> 
> As for loading another policy at runtime -- the calculated 
> SEPOL_SID_LIMIT=384 for current master flask policy is still pretty big 
> limit. From what I can see -- much less No. contexts are being used on a 
> running system, because most of calculated combinations of 
> user/role/type are not really usable (e.g. contexts with xen_t or 
> xenboot_t types and user_1 user are not expected etc). So there should 
> be enough room even for more complex custom policies.

But still there could be odd ones. Imo such a static limit can then only be
introduced via Kconfig option.

Jan