netlabel: Pass a family parameter to netlbl_skbuff_err().
Subsystems (6)
RFC PATCH v3 16/19 netlabel: Pass a family parameter to netlbl_skbuff_err().
This makes it possible to route the error to the appropriate labelling engine. CALIPSO is far less verbose than CIPSO when encountering a bogus packet, so there is no need for a CALIPSO error handler.
Signed-off-by Huw Davies <[email protected]>
--- include/net/netlabel.h | 2 +- net/netlabel/netlabel_kapi.c | 11 ++++++++--- security/selinux/hooks.c | 6 +++--- security/selinux/include/netlabel.h | 4 +++- security/selinux/netlabel.c | 6 +++--- security/smack/smack_lsm.c | 2 +- 6 files changed, 19 insertions(+), 12 deletions(-)
include/net/netlabel.h +1 -1
@@ -488,7 +488,7 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr); -void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway); +void netlbl_skbuff_err (struct sk_buff *skb,u16 family,int error,int gateway);/* * LSM label mapping cache operations
net/netlabel/netlabel_kapi.c +8 -3
@@ -1250,6 +1250,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,/** * netlbl_skbuff_err - Handle a LSM error on a sk_buff * @skb: the packet +* @family: the family * @error: the error code * @gateway: true if host is acting as a gateway, false otherwise *
@@ -1259,10 +1260,14 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,* according to the packet's labeling protocol. * */ -void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway) +void netlbl_skbuff_err (struct sk_buff *skb,u16 family,int error,int gateway) { -if (cipso_v4_optptr (skb)) -cipso_v4_error (skb, error, gateway); +switch (family) { +case AF_INET : +if (cipso_v4_optptr (skb)) +cipso_v4_error (skb, error, gateway); +break ; + } }/**
security/selinux/hooks.c +3 -3
@@ -4539,13 +4539,13 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) err =selinux_inet_sys_rcv_skb (sock_net (sk), skb->skb_iif, addrp, family, peer_sid, &ad);if (err) { -selinux_netlbl_err (skb, err,0 ); +selinux_netlbl_err (skb, family, err,0 );return err; } err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , &ad);if (err) { -selinux_netlbl_err (skb, err,0 ); +selinux_netlbl_err (skb, family, err,0 );return err; } }
@@ -4911,7 +4911,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, err =selinux_inet_sys_rcv_skb (dev_net (indev), indev->ifindex, addrp, family, peer_sid, &ad);if (err) { -selinux_netlbl_err (skb, err,1 ); +selinux_netlbl_err (skb, family, err,1 );return NF_DROP ; } }
security/selinux/include/netlabel.h +3 -1
@@ -40,7 +40,8 @@#ifdef CONFIG_NETLABEL void selinux_netlbl_cache_invalidate (void ); -void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway); +void selinux_netlbl_err (struct sk_buff *skb,u16 family,int error, +int gateway);void selinux_netlbl_sk_security_free (struct sk_security_struct *sksec);void selinux_netlbl_sk_security_reset (struct sk_security_struct *sksec);
@@ -72,6 +73,7 @@ static inline void selinux_netlbl_cache_invalidate(void) }static inline void selinux_netlbl_err (struct sk_buff *skb, +u16 family,int error,int gateway) {
security/selinux/netlabel.c +3 -3
@@ -151,9 +151,9 @@ void selinux_netlbl_cache_invalidate(void)* present on the packet, NetLabel is smart enough to only act when it should. * */ -void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway) +void selinux_netlbl_err (struct sk_buff *skb,u16 family,int error,int gateway) { -netlbl_skbuff_err (skb, error, gateway); +netlbl_skbuff_err (skb, family, error, gateway); }/**
@@ -405,7 +405,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,return 0 ;if (nlbl_sid !=SECINITSID_UNLABELED ) -netlbl_skbuff_err (skb, rc,0 ); +netlbl_skbuff_err (skb, family, rc,0 );return rc; }
security/smack/smack_lsm.c +1 -1
@@ -3996,7 +3996,7 @@ access_check: rc =smk_bu_note ("IPv4 delivery" , skp, ssp->smk_in,MAY_WRITE , rc);if (rc !=0 ) -netlbl_skbuff_err (skb, rc,0 ); +netlbl_skbuff_err (skb, sk->sk_family, rc,0 );break ;#if IS_ENABLED (CONFIG_IPV6 )case PF_INET6 :
Signature · 1 line
2.7.0