Skip to content

Revert selinux overlayfs mmap and mprotect access checks for kernel-6.12 and kernel-6.18 - #535

Merged
Sparksssj merged 4 commits into
bottlerocket-os:developfrom
Sparksssj:restore-selinux-overlayfs-revert
Aug 27, 2026
Merged

Revert selinux overlayfs mmap and mprotect access checks for kernel-6.12 and kernel-6.18#535
Sparksssj merged 4 commits into
bottlerocket-os:developfrom
Sparksssj:restore-selinux-overlayfs-revert

Conversation

@Sparksssj

@Sparksssj Sparksssj commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Description of changes:

  • Restore the selinux overlayfs mmap/mprotect revert (added in Bugfix/selinux #496, dropped in v8.0.0 Kernel update #526) for kernel-6.12 and kernel-6.18.
  • Without it, file:execmod on overlayfs is checked against the mounter (runtime_t) instead of the process, so UPX-packed/JIT container binaries are denied and crash at startup.
    kernel-6.1 is unaffected.

Testing done:
Built aws-k8s-1.35 (6.12.100) and aws-k8s-1.36 (6.18.41) AMIs from this branch and ran the execmod reproducer as control_t on overlayfs under SELinux enforcing. On both kernels the previously-failing sequence now passes:

  === test_execmod: mmap(R|W, MAP_PRIVATE) -> write (COW) -> mprotect(R|X) ===
  mprotect(R|X) SUCCEEDED (no denial here)
  Exit 0, no `avc: denied` in dmesg.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

@Sparksssj
Sparksssj force-pushed the restore-selinux-overlayfs-revert branch from a3f6c8d to c811da8 Compare August 26, 2026 21:30
@Sparksssj
Sparksssj marked this pull request as ready for review August 26, 2026 21:32
@darsh-shah-sh

Copy link
Copy Markdown

@Sparksssj Thanks for putting the fix. Do you know what the timeline on releasing this fix is?

@Sparksssj
Sparksssj force-pushed the restore-selinux-overlayfs-revert branch from c811da8 to e9d3814 Compare August 26, 2026 22:26
@Sparksssj
Sparksssj force-pushed the restore-selinux-overlayfs-revert branch from e9d3814 to b03feba Compare August 26, 2026 23:32
@Sparksssj
Sparksssj force-pushed the restore-selinux-overlayfs-revert branch from b03feba to f7044d0 Compare August 26, 2026 23:59
@Sparksssj
Sparksssj merged commit 15a3f07 into bottlerocket-os:develop Aug 27, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants