[Security] SELinux Operations Allow Command Injection and Use Assertions for Runtime Validation

[Muhammad-Ikhwan-Fathulloh]

Description

The SELinux operations module (src/pyinfra/operations/selinux.py) currently exposes two issues:

1. Command Injection Risk

Several SELinux operations construct shell commands using user-controlled values passed directly into StringCommand without wrapping them in QuoteString.

Affected operations and variables:

Operation	Variables
port	se_type, protocol, port_num
boolean	value_str
file_context	se_type
file_context_mapping	se_type

Because these values are not properly quoted, shell metacharacters may be interpreted by the shell, potentially allowing command injection.

Example

selinux.port(
    name="Add port",
    ports="80; rm -rf /",
    protocol="tcp",
    se_type="http_port_t",
)

Generated command:

semanage port -a -t http_port_t -p tcp 80; rm -rf /

The shell interprets ; as a command separator, causing unintended commands to execute.

Expected Behavior

All user-controlled values passed to StringCommand should be wrapped using QuoteString so they are treated as literal arguments.

Expected output:

semanage port -a -t 'http_port_t' -p 'tcp' '80; rm -rf /'

---

2. Runtime Validation Uses assert

The module also uses assert statements for type validation.

Example:

assert isinstance(port_num, str)

Assertions can be removed when Python is executed with optimization enabled (python -O), resulting in validation being skipped entirely.

Expected Behavior

Replace assertions used for runtime validation with explicit exceptions:

if not isinstance(port_num, str):
    raise TypeError(
        f"Expected str, got {type(port_num).__name__}"
    )

This ensures validation always occurs regardless of Python optimization settings.

---

Impact

Security

Potential command injection through SELinux operations when untrusted values are provided.

Reliability

Input validation may be silently disabled when Python is executed with optimization flags.

---

Suggested Fix

1. Wrap all user-controlled values passed into StringCommand with QuoteString.
2. Replace all runtime validation assertions with explicit exception handling (TypeError or ValueError as appropriate).
3. Add regression tests verifying malicious shell payloads are properly quoted and cannot alter generated commands.

Affected File

src/pyinfra/operations/selinux.py

Additional Notes

This issue affects the security posture of SELinux-related operations because generated commands may execute unintended shell instructions when supplied with malicious input. Proper quoting and explicit runtime validation would align the implementation with secure command construction practices and project coding standards.