<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear developers,</p>
<p>I'm proposing to add SELinux support into strace through using
"--secontext" option.</p>
<p>This is very useful when debugging SELinux issues, in particular
when a process runs in an unexpected context or didn't transition
properly, or when a file being opened has not the proper context
resulting in a EPERM.</p>
<p>Sub-option <code>--typeonly</code> may be used to only print the
type, as shown in the examples below:</p>
<ul>
<li>Without any option (standard strace, here used <code>-fttTvyy</code>
flags):</li>
</ul>
<blockquote>
<pre><code>118104 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys", O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> <0.000399>
</code></pre>
</blockquote>
<ul>
<li>With <code>--secontext</code> option, a new column is added
after PID, showing the context the PID is executing and each
PATH has its context associated (when file exists) :</li>
</ul>
<blockquote>
<pre><code>118104 [system_u:system_r:sshd_t:s0-s0:c0.c1023] 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 [system_u:system_r:sshd_t:s0-s0:c0.c1023] 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys" [system_u:object_r:nfs_t:s0], O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> [system_u:object_r:nfs_t:s0] <0.000399>
</code></pre>
</blockquote>
<ul>
<li>With <code>--typeonly</code> sub-option, same except only the
type is displayed (which is usually enough):</li>
</ul>
<blockquote>
<pre><code>118104 [sshd_t] 16:52:11.141122 select(9, [4<TCP:[0.0.0.0:22]> 6<TCPv6:[[::]:22]>], NULL, NULL, NULL) = 1 (in [4]) <1.845416>
119820 [sshd_t] 16:52:13.133319 openat(AT_FDCWD, "/home/rmetrich/.ssh/authorized_keys" [nfs_t], O_RDONLY|O_NONBLOCK) = 11</home/rmetrich/.ssh/authorized_keys> [nfs_t] <0.000399>
</code></pre>
</blockquote>
<p>The PR is here: <a class="moz-txt-link-freetext"
href="https://github.com/strace/strace/pull/121">https://github.com/strace/strace/pull/121</a></p>
<br>
<p>Best regards,</p>
<p>Renaud.<br>
</p>
</body>
</html>