Labeled networking patches for 2.6.28
Subsystems (7)
v3 cover Labeled networking patches for 2.6.28
Another update to the labeled networking patches for 2.6.28. This revision adds some small fixes, the dead-code removal patch posted earlier, and the big addition ... wait for it ... full LSM label/context support for local connections. This is accomplished by creating a new, private CIPSO tag type (allowed by the spec with a tag number > 127) which carries the LSM's secid value, allowing full LSM contexts to be carried across local connections without the headaches of labeled IPsec.
For those of you interested in testing this out, you will need the latest from the netlabel_tools addrsel branch, revision 74 or higher should work. If you enable the new local labeling you will almost certainly need to run SELinux in permissive mode since I'm fairly certain the current policies don't have the necessary allow rules. With that said, enabling the new local labeling is pretty easy ...
1. Add a CIPSO DOI which uses the new local labeling tag type, note you do not have to specify the tags
# netlabelctl cipsov4 add local doi:2 # netlabelctl -p cipsov4 list
2. Setup the default mapping to use the CIPSO DOI we just created for localhost, keeping in mind we have to remove the existing mapping first. Of course you don't have to use the default mapping, you can create your own domain specific mappings.
# netlabelctl map del default # netlabelctl -p map list # netlabelctl map add default address:0.0.0.0/0 protocol:unlbl # netlabelctl map add default address:127.0.0.1 protocol:cipsov4,2 # netlabelctl -p map list
3. Enjoy!
This should be the last bit of functionality for 2.6.28, the one possible exception being a small patch to expose the static/fallback labeling mechanism to Smack via the NetLabel KAPI. Casey is still working on the Smack portion of that effort and I'll only submit the NetLabel side once Smack is ready for it. Assuming no major problems are uncovered in the next week I'll probably add the missing sign-offs and submit this to the linux-next tree for further exposure and testing.
Thanks.
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v3 1/13 netlabel: Remove unneeded in-kernel API functions
After some discussions with the Smack folks, well just Casey, I now have a better idea of what Smack wants out of NetLabel in the future so I think it is now safe to do some API "pruning". If another LSM comes along that needs this functionality we can always add it back in, but I don't see any LSMs on the horizon which might make use of these functions.
Thanks to Rami Rosen who suggested removing netlbl_cfg_cipsov4_del() back in February 2008.
---
include/net/netlabel.h | 13 ------- net/netlabel/netlabel_kapi.c | 80 +++++++++++------------------------------- 2 files changed, 21 insertions(+), 72 deletions(-)
include/net/netlabel.h +0 -13
@@ -352,12 +352,9 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)int netlbl_cfg_map_del (const char *domain,struct netlbl_audit *audit_info);int netlbl_cfg_unlbl_add_map (const char *domain,struct netlbl_audit *audit_info); -int netlbl_cfg_cipsov4_add (struct cipso_v4_doi *doi_def, -struct netlbl_audit *audit_info);int netlbl_cfg_cipsov4_add_map (struct cipso_v4_doi *doi_def,const char *domain,struct netlbl_audit *audit_info); -int netlbl_cfg_cipsov4_del (u32 doi,struct netlbl_audit *audit_info);/* * LSM security attribute operations
@@ -404,22 +401,12 @@ static inline int netlbl_cfg_unlbl_add_map(const char *domain, {return -ENOSYS ; } -static inline int netlbl_cfg_cipsov4_add (struct cipso_v4_doi *doi_def, -struct netlbl_audit *audit_info) -{ -return -ENOSYS ; -}static inline int netlbl_cfg_cipsov4_add_map (struct cipso_v4_doi *doi_def,const char *domain,struct netlbl_audit *audit_info) {return -ENOSYS ; } -static inline int netlbl_cfg_cipsov4_del (u32 doi, -struct netlbl_audit *audit_info) -{ -return -ENOSYS ; -}static inline int netlbl_secattr_catmap_walk (struct netlbl_lsm_secattr_catmap *catmap,u32 offset)
net/netlabel/netlabel_kapi.c +21 -59
110 lines not on this page · raw message
RFC PATCH v3 2/13 selinux: Fix a problem in security_netlbl_sid_to_secattr()
In reply to Paul MooreCurrently when SELinux fails to allocate memory in security_netlbl_sid_to_secattr() the NetLabel LSM domain field is set to NULL which triggers the default NetLabel LSM domain mapping which may not always be the desired mapping. This patch fixes this by returning an error when the kernel is unable to allocate memory. This could result in more failures on a system with heavy memory pressure but it is the "correct" thing to do.
---
security/selinux/ss/services.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
security/selinux/ss/services.c +8 -2
@@ -2788,7 +2788,7 @@ netlbl_secattr_to_sid_return_cleanup:*/ int security_netlbl_sid_to_secattr (u32 sid,struct netlbl_lsm_secattr *secattr) { -int rc = -ENOENT ; +int rc;struct context *ctx;if (!ss_initialized)
@@ -2796,10 +2796,16 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)read_lock (&policy_rwlock); ctx =sidtab_search (&sidtab, sid); -if (ctx ==NULL ) +if (ctx ==NULL ) { + rc = -ENOENT ; goto netlbl_sid_to_secattr_failure; + } secattr->domain =kstrdup (policydb.p_type_val_to_name[ctx->type -1 ],GFP_ATOMIC ); +if (secattr->domain ==NULL ) { + rc = -ENOMEM ; + goto netlbl_sid_to_secattr_failure; + } secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY ;mls_export_netlbl_lvl (ctx, secattr); rc =mls_export_netlbl_cat (ctx, secattr);
RFC PATCH v3 3/13 selinux: Fix missing calls to netlbl_skbuff_err()
In reply to Paul MooreAt some point I think I messed up and dropped the calls to netlbl_skbuff_err() which are necessary for CIPSO to send error notifications to remote systems. This patch re-introduces the error handling calls into the SELinux code.
---
include/net/netlabel.h | 6 ++++-- net/netlabel/netlabel_kapi.c | 5 +++-- security/selinux/hooks.c | 19 +++++++++++++++---- security/selinux/include/netlabel.h | 9 +++++++++ security/selinux/netlabel.c | 20 +++++++++++++++++++- 5 files changed, 50 insertions(+), 9 deletions(-)
include/net/netlabel.h +4 -2
@@ -382,7 +382,7 @@ int netlbl_sock_getattr(struct sock *sk,int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr); -void netlbl_skbuff_err (struct sk_buff *skb,int error); +void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway);/* * LSM label mapping cache operations
@@ -454,7 +454,9 @@ static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, {return -ENOSYS ; } -static inline void netlbl_skbuff_err (struct sk_buff *skb,int error) +static inline void netlbl_skbuff_err (struct sk_buff *skb, +int error, +int gateway) {return ; }
net/netlabel/netlabel_kapi.c +3 -2
@@ -490,6 +490,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,* netlbl_skbuff_err - Handle a LSM error on a sk_buff * @skb: the packet * @error: the error code +* @gateway: true if host is acting as a gateway, false otherwise * * Description: * Deal with a LSM problem when handling the packet in @skb, typically this is
@@ -497,10 +498,10 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,* according to the packet's labeling protocol. * */ -void netlbl_skbuff_err (struct sk_buff *skb,int error) +void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway) {if (CIPSO_V4_OPTEXIST (skb)) -cipso_v4_error (skb, error,0 ); +cipso_v4_error (skb, error, gateway); }/**
security/selinux/hooks.c +15 -4
@@ -4093,6 +4093,8 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,return err; err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , ad); +if (err) +selinux_netlbl_err (skb, err,0 ); }else { err =selinux_netlbl_sock_rcv_skb (sksec, skb, family, ad);if (err)
@@ -4142,10 +4144,14 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)return err; err =selinux_inet_sys_rcv_skb (skb->iif, addrp, family, peer_sid, &ad); -if (err) +if (err) { +selinux_netlbl_err (skb, err,0 );return err; + } err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , &ad); +if (err) +selinux_netlbl_err (skb, err,0 ); }if (selinux_secmark_enabled ()) {
@@ -4370,6 +4376,7 @@ out:static unsigned int selinux_ip_forward (struct sk_buff *skb,int ifindex,u16 family) { +int err;char *addrp;u32 peer_sid;struct avc_audit_data ad;
@@ -4393,10 +4400,14 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,if (selinux_skb_peerlbl_sid (skb, family, &peer_sid) !=0 )return NF_DROP ; -if (peerlbl_active) -if (selinux_inet_sys_rcv_skb (ifindex, addrp, family, - peer_sid, &ad) !=0 ) +if (peerlbl_active) { + err =selinux_inet_sys_rcv_skb (ifindex, addrp, family, + peer_sid, &ad); +if (err) { +selinux_netlbl_err (skb, err,1 );return NF_DROP ; + } + }if (secmark_active) if (avc_has_perm(peer_sid, skb->secmark,
security/selinux/include/netlabel.h +9 -0
@@ -39,6 +39,8 @@#ifdef CONFIG_NETLABEL void selinux_netlbl_cache_invalidate (void ); +void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway); +void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family);
@@ -63,6 +65,13 @@ static inline void selinux_netlbl_cache_invalidate(void)return ; } +static inline void void selinux_netlbl_err(struct sk_buff *skb, +int error, +int gateway) +{ +return ; +} +static inline void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family)
security/selinux/netlabel.c +19 -1
@@ -106,6 +106,24 @@ void selinux_netlbl_cache_invalidate(void) }/** +* selinux_netlbl_err - Handle a NetLabel packet error +* @skb: the packet +* @error: the error code +* @gateway: true if host is acting as a gateway, false otherwise +* +* Description: +* When a packet is dropped due to a call to avc_has_perm() pass the error +* code to the NetLabel subsystem so any protocol specific processing can be +* done. This is safe to call even if you are unsure if NetLabel labeling is +* present on the packet, NetLabel is smart enough to only act when it should. +* +*/ +void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway) +{ +netlbl_skbuff_err (skb, error, gateway); +} + +/** * selinux_netlbl_sk_security_reset - Reset the NetLabel fields * @ssec: the sk_security_struct * @family: the socket family
@@ -307,7 +325,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,return 0 ;if (nlbl_sid !=SECINITSID_UNLABELED ) -netlbl_skbuff_err (skb, rc); +netlbl_skbuff_err (skb, rc,0 );return rc; }
RFC PATCH v3 4/13 smack: Fix missing calls to netlbl_skbuff_err()
In reply to Paul MooreSmack needs to call netlbl_skbuff_err() to let NetLabel do the necessary protocol specific error handling.
---
security/smack/smack_lsm.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)
security/smack/smack_lsm.c +4 -1
@@ -2179,7 +2179,10 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)* This is the simplist possible security model * for networking. */ -return smk_access (smack, ssp->smk_in,MAY_WRITE ); + rc =smk_access (smack, ssp->smk_in,MAY_WRITE ); +if (rc !=0 ) +netlbl_skbuff_err (skb, rc,0 ); +return rc; }/**
RFC PATCH v3 5/13 netlabel: Replace protocol/NetLabel linking with refrerence counts
In reply to Paul MooreNetLabel has always had a list of backpointers in the CIPSO DOI definition structure which pointed to the NetLabel LSM domain mapping structures which referenced the CIPSO DOI struct. The rationale for this was that when an administrator removed a CIPSO DOI from the system all of the associated NetLabel LSM domain mappings should be removed as well; a list of backpointers made this a simple operation.
Unfortunately, while the backpointers did make the removal easier they were a bit of a mess from an implementation point of view which was making further development difficult. Since the removal of a CIPSO DOI is a realtively rare event it seems to make sense to remove this backpointer list as the optimization was hurting us more then it was helping. However, we still need to be able to track when a CIPSO DOI definition is being used so replace the backpointer list with a reference count. In order to preserve the current functionality of removing the associated LSM domain mappings when a CIPSO DOI is removed we walk the LSM domain mapping table, removing the relevant entries.
---
include/net/cipso_ipv4.h | 21 ++- net/ipv4/cipso_ipv4.c | 235 +++++++++++++++--------------------- net/netlabel/netlabel_cipso_v4.c | 77 +++++++----- net/netlabel/netlabel_domainhash.c | 95 +++++++-------- net/netlabel/netlabel_domainhash.h | 2 net/netlabel/netlabel_kapi.c | 46 ++++--- net/netlabel/netlabel_mgmt.c | 24 +--- security/smack/smackfs.c | 4 - 8 files changed, 237 insertions(+), 267 deletions(-)
include/net/cipso_ipv4.h +11 -10
@@ -40,6 +40,7 @@#include <linux/net.h> #include <linux/skbuff.h> #include <net/netlabel.h> +#include <asm/atomic.h> /* known doi values */ #define CIPSO_V4_DOI_UNKNOWN 0x00000000
@@ -79,10 +80,9 @@ struct cipso_v4_doi { } map;u8 tags[CIPSO_V4_TAG_MAXCNT ]; -u32 valid; +atomic_t refcount;struct list_head list;struct rcu_head rcu; -struct list_head dom_list; };/* Standard CIPSO mapping table */
@@ -128,25 +128,26 @@ extern int cipso_v4_rbm_strictvalid;#ifdef CONFIG_NETLABEL int cipso_v4_doi_add (struct cipso_v4_doi *doi_def); -int cipso_v4_doi_remove (u32 doi, -struct netlbl_audit *audit_info, -void (*callback) (struct rcu_head * head)); +void cipso_v4_doi_free (struct cipso_v4_doi *doi_def); +int cipso_v4_doi_remove (u32 doi,struct netlbl_audit *audit_info);struct cipso_v4_doi *cipso_v4_doi_getdef (u32 doi); +void cipso_v4_doi_putdef (struct cipso_v4_doi *doi_def);int cipso_v4_doi_walk (u32 *skip_cnt,int (*callback) (struct cipso_v4_doi *doi_def,void *arg),void *cb_arg); -int cipso_v4_doi_domhsh_add (struct cipso_v4_doi *doi_def,const char *domain); -int cipso_v4_doi_domhsh_remove (struct cipso_v4_doi *doi_def, -const char *domain);#else static inline int cipso_v4_doi_add (struct cipso_v4_doi *doi_def) {return -ENOSYS ; } +static inline void cipso_v4_doi_free (struct cipso_v4_doi *doi_def) +{ +return ; +} +static inline int cipso_v4_doi_remove (u32 doi, -struct netlbl_audit *audit_info, -void (*callback) (struct rcu_head * head)) +struct netlbl_audit *audit_info) {return 0 ; }
net/ipv4/cipso_ipv4.c +98 -137
307 lines not on this page · raw message
net/netlabel/netlabel_cipso_v4.c +44 -33
127 lines not on this page · raw message
net/netlabel/netlabel_domainhash.c +47 -48
136 lines not on this page · raw message
net/netlabel/netlabel_domainhash.h +2 -0
@@ -61,6 +61,8 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry, struct netlbl_audit *audit_info);int netlbl_domhsh_add_default (struct netlbl_dom_map *entry,struct netlbl_audit *audit_info); +int netlbl_domhsh_remove_entry (struct netlbl_dom_map *entry, +struct netlbl_audit *audit_info);int netlbl_domhsh_remove (const char *domain,struct netlbl_audit *audit_info);int netlbl_domhsh_remove_default (struct netlbl_audit *audit_info);struct netlbl_dom_map *netlbl_domhsh_getentry (const char *domain);
net/netlabel/netlabel_kapi.c +26 -20
82 lines not on this page · raw message
net/netlabel/netlabel_mgmt.c +6 -18
@@ -122,18 +122,12 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info) goto add_failure; tmp_val =nla_get_u32 (info->attrs[NLBL_MGMT_A_CV4DOI ]); -/* We should be holding a rcu_read_lock() here while we hold -* the result but since the entry will always be deleted when -* the CIPSO DOI is deleted we aren't going to keep the -* lock. */ -rcu_read_lock (); entry->type_def.cipsov4 =cipso_v4_doi_getdef (tmp_val); -if (entry->type_def.cipsov4 ==NULL ) { -rcu_read_unlock (); +if (entry->type_def.cipsov4 ==NULL ) goto add_failure; - } ret_val =netlbl_domhsh_add (entry, &audit_info); -rcu_read_unlock (); +if (ret_val !=0 ) +cipso_v4_doi_putdef (entry->type_def.cipsov4);break ;default : goto add_failure;
@@ -294,18 +288,12 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info) goto adddef_failure; tmp_val =nla_get_u32 (info->attrs[NLBL_MGMT_A_CV4DOI ]); -/* We should be holding a rcu_read_lock() here while we hold -* the result but since the entry will always be deleted when -* the CIPSO DOI is deleted we aren't going to keep the -* lock. */ -rcu_read_lock (); entry->type_def.cipsov4 =cipso_v4_doi_getdef (tmp_val); -if (entry->type_def.cipsov4 ==NULL ) { -rcu_read_unlock (); +if (entry->type_def.cipsov4 ==NULL ) goto adddef_failure; - } ret_val =netlbl_domhsh_add_default (entry, &audit_info); -rcu_read_unlock (); +if (ret_val !=0 ) +cipso_v4_doi_putdef (entry->type_def.cipsov4);break ;default : goto adddef_failure;
security/smack/smackfs.c +3 -1
@@ -343,9 +343,11 @@ static void smk_cipso_doi(void) doip->tags[rc] =CIPSO_V4_TAG_INVALID ; rc =netlbl_cfg_cipsov4_add_map (doip,NULL , &audit_info); -if (rc !=0 ) +if (rc !=0 ) {printk (KERN_WARNING "%s:%d add rc = %d\n" , __func__, __LINE__, rc); +kfree (doip); + } }/**
RFC PATCH v3 6/13 netlabel: Add a generic way to create ordered linked lists of network addrs
In reply to Paul MooreCreate an ordered IP address linked list mechanism similar to the core kernel's linked list construct. The idea behind this list functionality is to create an extensibile linked list ordered by IP address mask to ease the matching of network addresses. The linked list is ordered with larger address masks at the front of the list and shorter address masks at the end to facilitate overriding network entries with individual host or subnet entries.
---
net/netlabel/Makefile | 3 net/netlabel/netlabel_addrlist.c | 258 +++++++++++++++++++++++++++++ net/netlabel/netlabel_addrlist.h | 162 ++++++++++++++++++ net/netlabel/netlabel_unlabeled.c | 331 +++++++++++++------------------------ 4 files changed, 539 insertions(+), 215 deletions(-)
net/netlabel/Makefile +2 -1
@@ -5,7 +5,8 @@ # # base objects -obj-y := netlabel_user.o netlabel_kapi.o netlabel_domainhash.o +obj-y := netlabel_user.o netlabel_kapi.o +obj-y += netlabel_domainhash.o netlabel_addrlist.o # management objects obj-y += netlabel_mgmt.o
net/netlabel/netlabel_addrlist.c new file +258 -0
258 lines not on this page · raw message
net/netlabel/netlabel_addrlist.h new file +162 -0
162 lines not on this page · raw message
net/netlabel/netlabel_unlabeled.c +117 -214
537 lines not on this page · raw message
RFC PATCH v3 7/13 netlabel: Add network address selectors to the NetLabel/LSM domain mapping
In reply to Paul MooreThis patch extends the NetLabel traffic labeling capabilities to individual packets based not only on the LSM domain but the by the destination address as well. The changes here only affect the core NetLabel infrastructre, changes to the NetLabel KAPI and individial protocol engines are also required but are split out into a different patch to ease review.
---
include/net/netlabel.h | 7 - net/netlabel/netlabel_addrlist.c | 130 ++++++++++++ net/netlabel/netlabel_addrlist.h | 15 + net/netlabel/netlabel_domainhash.c | 286 +++++++++++++++++++++++---- net/netlabel/netlabel_domainhash.h | 38 +++- net/netlabel/netlabel_kapi.c | 7 + net/netlabel/netlabel_mgmt.c | 387 +++++++++++++++++++++++++++--------- net/netlabel/netlabel_mgmt.h | 59 +++++ net/netlabel/netlabel_unlabeled.c | 96 +-------- 9 files changed, 801 insertions(+), 224 deletions(-)
include/net/netlabel.h +5 -2
@@ -9,7 +9,7 @@*/ /* -* (c) Copyright Hewlett-Packard Development Company, L.P., 2006 +* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by
@@ -72,8 +72,9 @@ struct cipso_v4_doi;/* NetLabel NETLINK protocol version * 1: initial version * 2: added static labels for unlabeled connections +* 3: network selectors added to the NetLabel/LSM domain mapping */ -#define NETLBL_PROTO_VERSION 2 +#define NETLBL_PROTO_VERSION 3/* NetLabel NETLINK types/families */ #define NETLBL_NLTYPE_NONE 0
@@ -87,6 +88,8 @@ struct cipso_v4_doi;#define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6"#define NETLBL_NLTYPE_UNLABELED 5#define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" +#define NETLBL_NLTYPE_ADDRSELECT 6 +#define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL"/* * NetLabel - Kernel API for accessing the network packet label mappings.
net/netlabel/netlabel_addrlist.c +130 -0
151 lines not on this page · raw message
net/netlabel/netlabel_addrlist.h +15 -0
@@ -36,6 +36,7 @@#include <linux/rcupdate.h> #include <linux/list.h> #include <linux/in6.h> +#include <linux/audit.h> /* XXX - needs documentation */ struct netlbl_af4list {
@@ -104,6 +105,12 @@ struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,void netlbl_af4list_remove_entry (struct netlbl_af4list *entry);struct netlbl_af4list *netlbl_af4list_search (__be32 addr,struct list_head *head); +struct netlbl_af4list *netlbl_af4list_search_exact (__be32 addr, +__be32 mask, +struct list_head *head); +void netlbl_af4list_audit_addr (struct audit_buffer *audit_buf, +int src,const char *dev, +__be32 addr,__be32 mask);#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE )
@@ -157,6 +164,14 @@ struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,void netlbl_af6list_remove_entry (struct netlbl_af6list *entry);struct netlbl_af6list *netlbl_af6list_search (const struct in6_addr *addr,struct list_head *head); +struct netlbl_af6list *netlbl_af6list_search_exact (const struct in6_addr *addr, +const struct in6_addr *mask, +struct list_head *head); +void netlbl_af6list_audit_addr (struct audit_buffer *audit_buf, +int src, +const char *dev, +const struct in6_addr *addr, +const struct in6_addr *mask);#endif /* IPV6 */ #endif
net/netlabel/netlabel_domainhash.c +249 -37
339 lines not on this page · raw message
net/netlabel/netlabel_domainhash.h +36 -2
@@ -11,7 +11,7 @@*/ /* -* (c) Copyright Hewlett-Packard Development Company, L.P., 2006 +* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by
@@ -36,16 +36,43 @@#include <linux/rcupdate.h> #include <linux/list.h> +#include "netlabel_addrlist.h" +/* Domain hash table size */ /* XXX - currently this number is an uneducated guess */ #define NETLBL_DOMHSH_BITSIZE 7 -/* Domain mapping definition struct */ +/* Domain mapping definition structures */ +#define netlbl_domhsh_addr4_entry (iter) \ + container_of(iter, struct netlbl_domaddr4_map, list) +struct netlbl_domaddr4_map { +u32 type; +union { +struct cipso_v4_doi *cipsov4; + } type_def; + +struct netlbl_af4list list; +}; +#define netlbl_domhsh_addr6_entry (iter) \ + container_of(iter, struct netlbl_domaddr6_map, list) +struct netlbl_domaddr6_map { +u32 type; + +/* NOTE: no 'type_def' union needed at present since we don't currently +* support any IPv6 labeling protocols */ + +struct netlbl_af6list list; +}; +struct netlbl_domaddr_map { +struct list_head list4; +struct list_head list6; +};struct netlbl_dom_map {char *domain;u32 type;union {struct cipso_v4_doi *cipsov4; +struct netlbl_domaddr_map *addrsel; } type_def;u32 valid;
@@ -66,9 +93,16 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,int netlbl_domhsh_remove (const char *domain,struct netlbl_audit *audit_info);int netlbl_domhsh_remove_default (struct netlbl_audit *audit_info);struct netlbl_dom_map *netlbl_domhsh_getentry (const char *domain); +struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4 (const char *domain, +__be32 addr);int netlbl_domhsh_walk (u32 *skip_bkt,u32 *skip_chain,int (*callback) (struct netlbl_dom_map *entry,void *arg),void *cb_arg); +#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) +struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6 (const char *domain, +const struct in6_addr *addr); +#endif /* IPv6 */ +#endif
net/netlabel/netlabel_kapi.c +6 -1
@@ -420,7 +420,9 @@ int netlbl_enabled(void)* Attach the correct label to the given socket using the security attributes * specified in @secattr. This function requires exclusive access to @sk, * which means it either needs to be in the process of being created or locked. -* Returns zero on success, negative values on failure. +* Returns zero on success, -EDESTADDRREQ if the domain is configured to use +* network address selectors (can't blindly label the socket), and negative +* values on all other failures. * */ int netlbl_sock_setattr(struct sock *sk,
@@ -434,6 +436,9 @@ int netlbl_sock_setattr(struct sock *sk,if (dom_entry ==NULL ) goto socket_setattr_return;switch (dom_entry->type) { +case NETLBL_NLTYPE_ADDRSELECT : + ret_val = -EDESTADDRREQ ; +break ;case NETLBL_NLTYPE_CIPSOV4 : ret_val = cipso_v4_sock_setattr(sk, dom_entry->type_def.cipsov4,
net/netlabel/netlabel_mgmt.c +293 -94
481 lines not on this page · raw message
net/netlabel/netlabel_mgmt.h +54 -5
94 lines not on this page · raw message
net/netlabel/netlabel_unlabeled.c +13 -83
126 lines not on this page · raw message
RFC PATCH v3 8/13 netlabel: Add functionality to set the security attributes of a packet
In reply to Paul MooreThis patch builds upon the new NetLabel address selector functionality by providing the NetLabel KAPI and CIPSO engine support needed to enable the new packet-based labeling. The only new addition to the NetLabel KAPI at this point is shown below:
* int netlbl_skbuff_setattr(skb, family, secattr)
... and is designed to be called from a Netfilter hook after the packet's IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.
This patch also provides the necessary SELinux hooks to support this new functionality. Smack support is not currently included due to uncertainty regarding the permissions needed to expand the Smack network access controls.
---
include/net/cipso_ipv4.h | 16 +++ include/net/netlabel.h | 9 + net/ipv4/cipso_ipv4.c | 222 +++++++++++++++++++++++++++++------ net/netlabel/netlabel_kapi.c | 60 +++++++++ security/selinux/hooks.c | 46 +++++++ security/selinux/include/netlabel.h | 10 ++ security/selinux/include/objsec.h | 1 security/selinux/netlabel.c | 50 ++++++++ 8 files changed, 372 insertions(+), 42 deletions(-)
include/net/cipso_ipv4.h +16 -0
@@ -208,6 +208,10 @@ int cipso_v4_sock_setattr(struct sock *sk,const struct cipso_v4_doi *doi_def, const struct netlbl_lsm_secattr *secattr);int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int cipso_v4_skbuff_setattr (struct sk_buff *skb, +const struct cipso_v4_doi *doi_def, +const struct netlbl_lsm_secattr *secattr); +int cipso_v4_skbuff_delattr (struct sk_buff *skb);int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr);int cipso_v4_validate (unsigned char **option);
@@ -232,6 +236,18 @@ static inline int cipso_v4_sock_getattr(struct sock *sk,return -ENOSYS ; } +static inline int cipso_v4_skbuff_setattr (struct sk_buff *skb, +const struct cipso_v4_doi *doi_def, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +} + +static inline int cipso_v4_skbuff_delattr (struct sk_buff *skb) +{ +return -ENOSYS ; +} +static inline int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr) {
include/net/netlabel.h +9 -0
@@ -382,6 +382,9 @@ int netlbl_sock_setattr(struct sock *sk, const struct netlbl_lsm_secattr *secattr);int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int netlbl_skbuff_setattr (struct sk_buff *skb, +u16 family, +const struct netlbl_lsm_secattr *secattr);int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr);
@@ -451,6 +454,12 @@ static inline int netlbl_sock_getattr(struct sock *sk, {return -ENOSYS ; } +static inline int netlbl_skbuff_setattr (struct sk_buff *skb, +u16 family, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +}static inline int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr)
net/ipv4/cipso_ipv4.c +183 -39
261 lines not on this page · raw message
net/netlabel/netlabel_kapi.c +60 -0
66 lines not on this page · raw message
security/selinux/hooks.c +45 -1
76 lines not on this page · raw message
security/selinux/include/netlabel.h +10 -0
@@ -48,6 +48,9 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,u16 family, u32 *type, u32 *sid); +int selinux_netlbl_skbuff_setsid (struct sk_buff *skb, +u16 family, +u32 sid);void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock);int selinux_netlbl_socket_post_create (struct socket *sock);
@@ -89,6 +92,13 @@ static inline int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,return 0 ; } +static inline int selinux_netlbl_skbuff_setsid (struct sk_buff *skb, + u16 family + u32 sid) +{ +return 0 ; +} +static inline void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock) {
security/selinux/include/objsec.h +1 -0
@@ -117,6 +117,7 @@ struct sk_security_struct {NLBL_UNSET =0 ,NLBL_REQUIRE ,NLBL_LABELED , +NLBL_REQSKB } nlbl_state;#endif };
security/selinux/netlabel.c +48 -2
69 lines not on this page · raw message
RFC PATCH v3 9/13 selinux: Set socket NetLabel based on connection endpoint
In reply to Paul MoorePrevious work enabled the use of address based NetLabel selectors, which while highly useful, brought the potential for additional per-packet overhead when used. This patch attempts to solve that by applying NetLabel socket labels when sockets are connect()'d. This should alleviate the per-packet NetLabel labeling for all connected sockets (yes, it even works for connected DGRAM sockets).
---
include/net/cipso_ipv4.h | 5 ++ include/net/netlabel.h | 13 ++++++ net/ipv4/cipso_ipv4.c | 47 +++++++++++++++++++++ net/netlabel/netlabel_kapi.c | 77 +++++++++++++++++++++++++++++++++++ security/selinux/hooks.c | 4 +- security/selinux/include/netlabel.h | 8 ++++ security/selinux/include/objsec.h | 3 + security/selinux/netlabel.c | 48 +++++++++++++++++++++- 8 files changed, 201 insertions(+), 4 deletions(-)
include/net/cipso_ipv4.h +5 -0
@@ -207,6 +207,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);int cipso_v4_sock_setattr (struct sock *sk,const struct cipso_v4_doi *doi_def,const struct netlbl_lsm_secattr *secattr); +void cipso_v4_sock_delattr (struct sock *sk);int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); int cipso_v4_skbuff_setattr(struct sk_buff *skb, const struct cipso_v4_doi *doi_def,
@@ -230,6 +231,10 @@ static inline int cipso_v4_sock_setattr(struct sock *sk,return -ENOSYS ; } +static inline void cipso_v4_sock_delattr (struct sock *sk) +{ +} +static inline int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr) {
include/net/netlabel.h +13 -0
@@ -380,8 +380,12 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,int netlbl_enabled (void );int netlbl_sock_setattr (struct sock *sk,const struct netlbl_lsm_secattr *secattr); +void netlbl_sock_delattr (struct sock *sk);int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int netlbl_conn_setattr (struct sock *sk, +struct sockaddr *addr, +const struct netlbl_lsm_secattr *secattr);int netlbl_skbuff_setattr (struct sk_buff *skb,u16 family,const struct netlbl_lsm_secattr *secattr);
@@ -449,11 +453,20 @@ static inline int netlbl_sock_setattr(struct sock *sk, {return -ENOSYS ; } +static inline void netlbl_sock_delattr (struct sock *sk) +{ +}static inline int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr) {return -ENOSYS ; } +static inline int netlbl_conn_setattr (struct sock *sk, +struct sockaddr *addr, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +}static inline int netlbl_skbuff_setattr (struct sk_buff *skb,u16 family,const struct netlbl_lsm_secattr *secattr)
net/ipv4/cipso_ipv4.c +47 -0
53 lines not on this page · raw message
net/netlabel/netlabel_kapi.c +76 -1
95 lines not on this page · raw message
security/selinux/hooks.c +3 -1
@@ -3794,6 +3794,7 @@ out:static int selinux_socket_connect (struct socket *sock,struct sockaddr *address,int addrlen) { +struct sock *sk = sock->sk;struct inode_security_struct *isec;int err;
@@ -3807,7 +3808,6 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, isec =SOCK_INODE (sock)->i_security;if (isec->sclass ==SECCLASS_TCP_SOCKET || isec->sclass ==SECCLASS_DCCP_SOCKET ) { -struct sock *sk = sock->sk;struct avc_audit_data ad;struct sockaddr_in *addr4 =NULL ;struct sockaddr_in6 *addr6 =NULL ;
@@ -3841,6 +3841,8 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, goto out; } + err =selinux_netlbl_conn_setsid (sk, address); + out:return err; }
security/selinux/include/netlabel.h +8 -0
@@ -51,6 +51,8 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,int selinux_netlbl_skbuff_setsid (struct sk_buff *skb,u16 family,u32 sid); +int selinux_netlbl_conn_setsid (struct sock *sk, +struct sockaddr *addr);void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock);int selinux_netlbl_socket_post_create (struct socket *sock);
@@ -99,6 +101,12 @@ static inline int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,return 0 ; } +static inline int selinux_netlbl_conn_setsid (struct sock *sk, +struct sockaddr *addr) +{ +return 0 ; +} +static inline void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock) {
security/selinux/include/objsec.h +2 -1
@@ -117,7 +117,8 @@ struct sk_security_struct {NLBL_UNSET =0 ,NLBL_REQUIRE ,NLBL_LABELED , -NLBL_REQSKB +NLBL_REQSKB , +NLBL_CONNLABELED } nlbl_state;#endif };
security/selinux/netlabel.c +47 -1
60 lines not on this page · raw message
RFC PATCH v3 10/13 selinux: Cache NetLabel secattrs in the socket's security struct
In reply to Paul MoorePrevious work enabled the use of address based NetLabel selectors, which while highly useful, brought the potential for additional per-packet overhead when used. This patch attempts to mitigate some of that overhead by caching the NetLabel security attribute struct within the SELinux socket security structure. This should help eliminate the need to recreate the NetLabel secattr structure for each packet resulting in less overhead.
---
security/selinux/hooks.c | 1 security/selinux/include/netlabel.h | 7 ++ security/selinux/include/objsec.h | 7 +- security/selinux/netlabel.c | 101 ++++++++++++++++++++++++++--------- 4 files changed, 86 insertions(+), 30 deletions(-)
security/selinux/hooks.c +1 -0
@@ -291,6 +291,7 @@ static void sk_free_security(struct sock *sk)struct sk_security_struct *ssec = sk->sk_security; sk->sk_security =NULL ; +selinux_netlbl_sk_security_free (ssec);kfree (ssec); }
security/selinux/include/netlabel.h +7 -0
@@ -41,6 +41,7 @@ void selinux_netlbl_cache_invalidate(void);void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway); +void selinux_netlbl_sk_security_free (struct sk_security_struct *ssec);void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family);
@@ -77,6 +78,12 @@ static inline void void selinux_netlbl_err(struct sk_buff *skb,return ; } +static inline void selinux_netlbl_sk_security_free ( +struct sk_security_struct *ssec) +{ +return ; +} +static inline void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family)
security/selinux/include/objsec.h +4 -3
@@ -109,9 +109,6 @@ struct netport_security_struct { }; struct sk_security_struct { - u32 sid; /* SID of this object */ - u32 peer_sid; /* SID of peer */ - u16 sclass; /* sock security class */ #ifdef CONFIG_NETLABEL enum { /* NetLabel state */ NLBL_UNSET = 0,
@@ -120,7 +117,11 @@ struct sk_security_struct {NLBL_REQSKB ,NLBL_CONNLABELED } nlbl_state; +struct netlbl_lsm_secattr *nlbl_secattr;/* NetLabel sec attributes */ #endif +u32 sid;/* SID of this object */ +u32 peer_sid;/* SID of peer */ +u16 sclass;/* sock security class */ }; struct key_security_struct {
security/selinux/netlabel.c +74 -27
156 lines not on this page · raw message
RFC PATCH v3 11/13 netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts
In reply to Paul MooreThis patch provides support for including the LSM's secid in addition to the LSM's MLS information in the NetLabel security attributes structure.
---
include/net/netlabel.h | 2 +- security/selinux/ss/services.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
include/net/netlabel.h +1 -1
@@ -203,7 +203,7 @@ struct netlbl_lsm_secattr {u32 type;char *domain;struct netlbl_lsm_cache *cache; - union { + struct { struct { struct netlbl_lsm_secattr_catmap *cat; u32 lvl;
security/selinux/ss/services.c +2 -1
@@ -2806,7 +2806,8 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) rc = -ENOMEM ; goto netlbl_sid_to_secattr_failure; } - secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY ; + secattr->attr.secid = sid; + secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY |NETLBL_SECATTR_SECID ;mls_export_netlbl_lvl (ctx, secattr); rc =mls_export_netlbl_cat (ctx, secattr);if (rc !=0 )
RFC PATCH v3 12/13 cipso: Add support for native local labeling and fixup mapping names
In reply to Paul MooreThis patch accomplishes two minor tasks: add a new tag type for local labeling and rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS. The first change allows CIPSO to support full LSM labels/contexts, not just MLS attributes. The second change brings the mapping names inline with what userspace is using, compatibility is preserved since we don't actually change the value.
---
include/net/cipso_ipv4.h | 13 +++-- net/ipv4/cipso_ipv4.c | 107 ++++++++++++++++++++++++++++++++++---- net/ipv4/ip_options.c | 2 - net/netlabel/netlabel_cipso_v4.c | 14 ++--- net/netlabel/netlabel_cipso_v4.h | 4 + net/netlabel/netlabel_kapi.c | 4 + 6 files changed, 118 insertions(+), 26 deletions(-)
include/net/cipso_ipv4.h +9 -4
@@ -45,7 +45,7 @@/* known doi values */ #define CIPSO_V4_DOI_UNKNOWN 0x00000000 -/* tag types */ +/* standard tag types */ #define CIPSO_V4_TAG_INVALID 0#define CIPSO_V4_TAG_RBITMAP 1#define CIPSO_V4_TAG_ENUM 2
@@ -53,10 +53,14 @@#define CIPSO_V4_TAG_PBITMAP 6#define CIPSO_V4_TAG_FREEFORM 7 +/* non-standard tag types (tags > 127) */ +#define CIPSO_V4_TAG_LOCAL 128 +/* doi mapping types */ #define CIPSO_V4_MAP_UNKNOWN 0 -#define CIPSO_V4_MAP_STD 1 +#define CIPSO_V4_MAP_TRANS 1#define CIPSO_V4_MAP_PASS 2 +#define CIPSO_V4_MAP_LOCAL 3/* limits */ #define CIPSO_V4_MAX_REM_LVLS 255
@@ -215,7 +219,7 @@ int cipso_v4_skbuff_setattr(struct sk_buff *skb,int cipso_v4_skbuff_delattr (struct sk_buff *skb);int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr); -int cipso_v4_validate (unsigned char **option); +int cipso_v4_validate (const struct sk_buff *skb,unsigned char **option);#else static inline void cipso_v4_error(struct sk_buff *skb, int error,
@@ -259,7 +263,8 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,return -ENOSYS ; } -static inline int cipso_v4_validate (unsigned char **option) +static inline int cipso_v4_validate (const struct sk_buff *skb, +unsigned char **option) {return -ENOSYS ; }
net/ipv4/cipso_ipv4.c +97 -10
203 lines not on this page · raw message
net/ipv4/ip_options.c +1 -1
@@ -438,7 +438,7 @@ int ip_options_compile(struct net *net, goto error; } opt->cipso = optptr - iph; -if (cipso_v4_validate (&optptr)) { +if (cipso_v4_validate (skb, &optptr)) { pp_ptr = optptr; goto error; }
net/netlabel/netlabel_cipso_v4.c +7 -7
@@ -132,9 +132,9 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,* @info: the Generic NETLINK info block * * Description: -* Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message -* and add it to the CIPSO V4 engine. Return zero on success and non-zero on -* error. +* Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD +* message and add it to the CIPSO V4 engine. Return zero on success and +* non-zero on error. * */ static int netlbl_cipsov4_add_std (struct genl_info *info)
@@ -164,7 +164,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info) ret_val = -ENOMEM ; goto add_std_failure; } - doi_def->type =CIPSO_V4_MAP_STD ; + doi_def->type =CIPSO_V4_MAP_TRANS ; ret_val =netlbl_cipsov4_add_common (info, doi_def);if (ret_val !=0 )
@@ -393,8 +393,8 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) type =nla_get_u32 (info->attrs[NLBL_CIPSOV4_A_MTYPE ]);switch (type) { -case CIPSO_V4_MAP_STD : - type_str ="std" ; +case CIPSO_V4_MAP_TRANS : + type_str ="trans" ; ret_val =netlbl_cipsov4_add_std (info);break ;case CIPSO_V4_MAP_PASS :
@@ -497,7 +497,7 @@ list_start:nla_nest_end (ans_skb, nla_a);switch (doi_def->type) { -case CIPSO_V4_MAP_STD : +case CIPSO_V4_MAP_TRANS : nla_a =nla_nest_start (ans_skb,NLBL_CIPSOV4_A_MLSLVLLST );if (nla_a ==NULL ) { ret_val = -ENOMEM ;
net/netlabel/netlabel_cipso_v4.h +2 -2
@@ -45,7 +45,7 @@* NLBL_CIPSOV4_A_MTYPE * NLBL_CIPSOV4_A_TAGLST * -* If using CIPSO_V4_MAP_STD the following attributes are required: +* If using CIPSO_V4_MAP_TRANS the following attributes are required: * * NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST
@@ -76,7 +76,7 @@* NLBL_CIPSOV4_A_MTYPE * NLBL_CIPSOV4_A_TAGLST * -* If using CIPSO_V4_MAP_STD the following attributes are required: +* If using CIPSO_V4_MAP_TRANS the following attributes are required: * * NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST
net/netlabel/netlabel_kapi.c +2 -2
@@ -157,8 +157,8 @@ cfg_cipsov4_add_map_return: audit_info);if (audit_buf !=NULL ) {switch (doi_type) { -case CIPSO_V4_MAP_STD : - type_str ="std" ; +case CIPSO_V4_MAP_TRANS : + type_str ="trans" ;break ;case CIPSO_V4_MAP_PASS : type_str ="pass" ;
RFC PATCH v3 13/13 netlabel: Add configuration support for local labeling
In reply to Paul MooreAdd the necessary NetLabel support for the new CIPSO mapping, CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.
---
net/netlabel/netlabel_cipso_v4.c | 41 ++++++++++++++++++++++++++++++++++++++ net/netlabel/netlabel_cipso_v4.h | 6 ++++-- net/netlabel/netlabel_kapi.c | 3 +++ 3 files changed, 48 insertions(+), 2 deletions(-)
net/netlabel/netlabel_cipso_v4.c +41 -0
@@ -365,6 +365,43 @@ add_pass_failure: }/** +* netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition +* @info: the Generic NETLINK info block +* +* Description: +* Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD +* message and add it to the CIPSO V4 engine. Return zero on success and +* non-zero on error. +* +*/ +static int netlbl_cipsov4_add_local (struct genl_info *info) +{ +int ret_val; +struct cipso_v4_doi *doi_def =NULL ; + +if (!info->attrs[NLBL_CIPSOV4_A_TAGLST ]) +return -EINVAL ; + + doi_def =kmalloc (sizeof (*doi_def),GFP_KERNEL ); +if (doi_def ==NULL ) +return -ENOMEM ; + doi_def->type =CIPSO_V4_MAP_LOCAL ; + + ret_val =netlbl_cipsov4_add_common (info, doi_def); +if (ret_val !=0 ) + goto add_local_failure; + + ret_val =cipso_v4_doi_add (doi_def); +if (ret_val !=0 ) + goto add_local_failure; +return 0 ; + +add_local_failure: +cipso_v4_doi_free (doi_def); +return ret_val; +} + +/** * netlbl_cipsov4_add - Handle an ADD message * @skb: the NETLINK buffer * @info: the Generic NETLINK info block
@@ -401,6 +438,10 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) type_str ="pass" ; ret_val =netlbl_cipsov4_add_pass (info);break ; +case CIPSO_V4_MAP_LOCAL : + type_str ="local" ; + ret_val =netlbl_cipsov4_add_local (info); +break ; }if (ret_val ==0 )atomic_inc (&netlabel_mgmt_protocount);
net/netlabel/netlabel_cipso_v4.h +4 -2
@@ -50,7 +50,8 @@* NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST * -* If using CIPSO_V4_MAP_PASS no additional attributes are required. +* If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes +* are required. * * o REMOVE: * Sent by an application to remove a specific DOI mapping table from the
@@ -81,7 +82,8 @@* NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST * -* If using CIPSO_V4_MAP_PASS no additional attributes are required. +* If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes +* are required. * * o LISTALL: * This message is sent by an application to list the valid DOIs on the
net/netlabel/netlabel_kapi.c +3 -0
@@ -163,6 +163,9 @@ cfg_cipsov4_add_map_return:case CIPSO_V4_MAP_PASS : type_str ="pass" ;break ; +case CIPSO_V4_MAP_LOCAL : + type_str ="local" ; +break ;default : type_str ="(unknown)" ; }
Quoted 8 lines · Paul Moore
Another update to the labeled networking patches for 2.6.28. This revision adds some small fixes, the dead-code removal patch posted earlier, and the big addition ... wait for it ... full LSM label/context support for local connections. This is accomplished by creating a new, private CIPSO tag type (allowed by the spec with a tag number > 127) which carries the LSM's secid value, allowing full LSM contexts to be carried across local connections without the headaches of labeled IPsec.
Quoted 6 lines
For those of you interested in testing this out, you will need the latest from the
netlabel_toolsaddrsel branch, revision 74 or higher should work. If you enable the new local labeling you will almost certainly need to run SELinux in permissive mode since I'm fairly certain the current policies don't have the necessary allow rules. With that said, enabling the new local labeling is pretty easy ...
Paul created a 2.6.26 patch which I've been testing with excellent results in Fedora 9. Local (lo and ethN) labeled networking is more reliable than the IPSec equivalent and does not have the IPSec SA creation latency. I'll push this to a larger set of developers and testers next week and report any issues.
joe