Re: BUG: selinux-testsuite binder tests fail with CONFIG_ANDROID_BINDER_IPC_RUST=y

[Stephen Smalley]

On Mon, Oct 19, 2026 at 12:58 PM Alice Ryhl <aliceryhl@xxxxxxxxxx> wrote:
>
> On Sun, Oct 18, 2026 at 06:53:49PM +0200, Greg Kroah-Hartman wrote:
> > On Sun, Oct 18, 2026 at 06:36:04PM +0200, Ondrej Mosnáček wrote:
> > > Hello Android binder maintainers,
> > >
> > > Fedora Linux has recently enabled CONFIG_ANDROID_BINDER_IPC_RUST [1],
> > > which turns out to cause the binder tests of selinux-testsuite [2] to
> > > fail.
> > >
> > > Minimal reproducer (no SELinux involved):
> > > # git clone https://github.com/SELinuxProject/selinux-testsuite
> > > # cd selinux-testsuite/tests/binder
> > > # make
> > > # ./init_binder.sh
> > > # setenforce 0   ### <-- may be needed if SELinux is enabled
> > > # ./manager -n &
> > > # sleep 1
> > > # ./service_provider -n &
> > > # sleep 1
> > > # ./client -n -c -r 3
> > > Client ioctl BINDER_WRITE_READ error: Invalid argument
> > > #
> > >
> > > With only CONFIG_ANDROID_BINDER_IPC=y the last command succeeds.
> > >
> > > The issue reproduces even on a kernel compiled from commit
> > > eafedbc7c050, so it seems to date back to the origin of the Rust
> > > implementation. I'm not sure if it's a bug in the new kernel code or
> > > some bug/wrong assumption in the testsuite code - can you please look
> > > into it?
> >
> > Given that the "real" binder client works, perhaps the test is wrong and
> > should be fixed?
>
> Apparently there is a divergence of behavior if the SELinux permission
> `binder { impersonate }` is granted to a process, though Android never
> uses this permission anywhere.
>
> Thanks for the report.

I would treat Android as authoritative here and fix the
selinux-testsuite to match unless you think there is an actual bug in
the Rust driver.
We originally implemented the binder impersonate check just to make
sure no one ever impersonated a different sender without us noticing.