SELinux: Use unknown perm handling to handle unknown netlink msg types
PATCH 1/1 SELinux: Use unknown perm handling to handle unknown netlink msg types
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
---
security/selinux/hooks.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
security/selinux/hooks.c +1 -1
@@ -4387,7 +4387,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)"SELinux: unrecognized netlink message" " type=%hu for sclass=%hu\n" , nlh->nlmsg_type, isec->sclass); -if (!selinux_enforcing) +if (!selinux_enforcing ||security_get_allow_unknown ()) err =0 ; }
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 18 lines · Eric Paris
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
Signed-off-by Eric Paris <[email protected]>---
security/selinux/hooks.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)security/selinux/hooks.c +0
-0@@ -4387,7 +4387,7 @@ static int selinux_nlmsg_perm(struct sock *sk,struct
sk_buff*skb) "SELinux: unrecognized netlink message"
security/selinux/hooks.c static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) · line 4392
Quoted 6 lines
security/selinux/hooks.c +1
-1" type=%hu for sclass=%hu\n" , nlh->nlmsg_type, isec->sclass); -if (!selinux_enforcing) +if (!selinux_enforcing ||security_get_allow_unknown ()) err =0 ; }
What about moving the security_get_allow_unknown() call to the default switch clause of selinux_nlmsg_lookup()? Something like this:
/* No messaging from userspace, or class unknown/unhandled */
default:
if (!security_get_allow_unknown())
err = -ENOENT;
break;This seems like a more natural fit to me (although maybe the audit message should be moved to selinux_nlmsg_lookup() too?) and it has the benefit of still checking the socket permissions via socket_has_perm() in the event that the netlink message is unknown.
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 35 lines · Paul Moore
Quoted 18 lines · Eric Paris
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
Signed-off-by Eric Paris <[email protected]>---
security/selinux/hooks.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)security/selinux/hooks.c +0
-0@@ -4387,7 +4387,7 @@ static int selinux_nlmsg_perm(struct sock *sk,struct
sk_buff*skb) "SELinux: unrecognized netlink message"security/selinux/hooks.c static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) · line 4392
Quoted 6 lines
security/selinux/hooks.c +1
-1" type=%hu for sclass=%hu\n" , nlh->nlmsg_type, isec->sclass); -if (!selinux_enforcing) +if (!selinux_enforcing ||security_get_allow_unknown ()) err =0 ; }What about moving the
security_get_allow_unknown()call to the default switch clause ofselinux_nlmsg_lookup()? Something like this:/* No messaging from userspace, or class unknown/unhandled */ default: if (!security_get_allow_unknown()) err = -ENOENT; break;
Quoted 4 lines
This seems like a more natural fit to me (although maybe the audit message should be moved to
selinux_nlmsg_lookup()too?) and it has the benefit of still checking the socket permissions viasocket_has_perm()in the event that the netlink message is unknown.
We already just blindly allow the case where a new/unknown sclass is used which is what this part of the switch statement hits. I wanted to get the case where a known class has a new mesg type (aka nlmsg_perm returns -EINVAL)
Not sure that the socket check is worth anything since I don't (in either case) know what perms to ask for.
I also considered making the case of unknown msg type return ALL of the perms for that entire socket class but I think what I did is the best/easiest way we can go....
-Eric
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 43 lines · Eric Paris
Quoted 37 lines · Paul Moore
Quoted 18 lines · Eric Paris
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
Signed-off-by Eric Paris <[email protected]>---
security/selinux/hooks.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)security/selinux/hooks.c +0
-0security/selinux/hooks.c static int selinux_nlmsg_perm(struct sock · line 4392
Quoted 7 lines
security/selinux/hooks.c +1
-1@@ -4387,7 +4387,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) "SELinux: unrecognized netlink message" " type=%hu for sclass=%hu\n", nlh->nlmsg_type, isec->sclass); -if (!selinux_enforcing) +if (!selinux_enforcing ||security_get_allow_unknown ()) err =0 ; }What about moving the
security_get_allow_unknown()call to the default switch clause ofselinux_nlmsg_lookup()? Something like this:/* No messaging from userspace, or class unknown/unhandled */ default: if (!security_get_allow_unknown()) err = -ENOENT; break;Quoted 4 lines
This seems like a more natural fit to me (although maybe the audit message should be moved to
selinux_nlmsg_lookup()too?) and it has the benefit of still checking the socket permissions viasocket_has_perm()in the event that the netlink message is unknown.
Quoted 4 lines
We already just blindly allow the case where a new/unknown sclass is used which is what this part of the switch statement hits. I wanted to get the case where a known class has a new mesg type (aka
nlmsg_permreturns-EINVAL)
Fair enough, I thought you were trying to solve a different problem.
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 6 lines · Eric Paris
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
Signed-off-by Eric Paris <[email protected]>
Quoted 20 lines
---
security/selinux/hooks.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)security/selinux/hooks.c +1
-1@@ -4387,7 +4387,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)"SELinux: unrecognized netlink message" " type=%hu for sclass=%hu\n" , nlh->nlmsg_type, isec->sclass); -if (!selinux_enforcing) +if (!selinux_enforcing ||security_get_allow_unknown ()) err =0 ; }
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 9 lines · Stephen Smalley
Quoted 6 lines · Eric Paris
Currently when SELinux has not been updated to handle a netlink message type the operation is denied with EINVAL. This patch will leave the audit/warning message so things get fixed but if policy chose to allow unknowns this will allow the netlink operation.
Signed-off-by Eric Paris <[email protected]>Acked-by Stephen Smalley <[email protected]>
Applied togit://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
Signature · 7 lines
James Morris <[email protected]> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.