gh-83074: Add preserve_security_context to shutil #23720
Conversation
Users typically don't have permission to modify the restricted `security` namespace of extended attributes. An LSM prevents root processes in confined contexts from changing `security` attributes, too. Any write attempt from a confined context is considered a security violation and logged in the system's security audit log. Therefore we cannot safely except and ignore exceptions without flooding the audit system. Linux coreutils has a similar workaround. Tools like `cp` skips `security.selinux` when it detects that SELinux is enabled (`preserve_security_context`). The (security) context is only copied with non-default `--preserve=context` or `--preserve=all`. `shutil.copy2()` now behaves mostly like `cp -p --preserve=xattr` by default. Signed-off-by: Christian Heimes <christian@python.org>
tiran
force-pushed
the
bpo-38893-copy-xattr
branch
from
4155ce1 to
559677f
Compare
|
Hm isn't this a breaking change? |
You could say that the PR changes behavior of the copy functions. In my opinion it fixes behavior of the copy function. In almost all cases it's conceptionally wrong to copy the SELinux context. Under SELinux, files are automatically labelled based on file name and context. In best case the old behavior would result in wrong context, which will eventually be fixed by |
- trusted namespace is only writable by processes with CAP_SYS_ADMIN. root check is not sufficient to detect the capabilitiy in containers. - /tmp on tmpfs does not permit user xattr namespace
tiran
force-pushed
the
bpo-38893-copy-xattr
branch
from
2f9186c to
0e0c4c0
Compare
|
The current PR disables copying "security.*" attributes for all platforms, even though the security namespace is a linux feature. In particular, macOS does not have this feature. |
|
This PR is stale because it has been open for 30 days with no activity. |
|
Hi @tiran wdyt about getting that to move? I don't have access to a macOS environment to try and fix that but I would really like this to be merged in cpython as it would avoid a number of monkey patching issues for running things like poetry under a k8s + SELinux environment. What can be done to help? |
|
Yeah, I'm also working on some containerized applications where simple |
|
It sounds like the security contexts should not be copied, and cpython's throwing errors because it's trying to copy something that it shouldn't. We need at least a non-default option to not copy the security context as intended. |
Nevermind, we can just |
|
We can but third party tools we can't fix so... this still needs to go
forward.
Le mar. 25 janv. 2022 à 19:05, Blair Neumann ***@***.***> a
écrit :
… It sounds like the security contexts should not be copied, and cpython's
throwing errors because it's trying to copy something that it shouldn't. We
need at least a non-default option to not copy the security context as
intended.
Nevermind, we can just shutil.copy and os.remove instead of shutil.move
—
Reply to this email directly, view it on GitHub
<#23720 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAYPFFWFLPIF6UQP7APQM73UX3Q5ZANCNFSM4UTUQVWA>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
|
Any proposed workaround for this until the issue gets fixed ? |
github-actions
bot
removed
the
stale
erlend-aasland
changed the title
Users typically don't have permission to modify the restricted
securitynamespace of extended attributes. An LSM preventsroot processes in confined contexts from changing
securityattributes, too.
Any write attempt from a confined context is considered a security
violation and logged in the system's security audit log. Therefore we
cannot safely except and ignore exceptions without flooding the audit
system.
Linux coreutils has a similar workaround. Tools like
cpskipssecurity.selinuxwhen it detects that SELinux is enabled(
preserve_security_context). The (security) context is only copiedwith non-default
--preserve=contextor--preserve=all.shutil.copy2()now behaves mostly likecp -p --preserve=xattrby default.Signed-off-by: Christian Heimes christian@python.org
shutil.moveneeds extra attention.https://bugs.python.org/issue38893