Labeled networking patches for 2.6.28
Subsystems (7)
v6 cover Labeled networking patches for 2.6.28
Another revision to the patchset to fix two issues, one trivial, the other not so much. The trivial fix was to add some locking around the connection labeling operations, we're messing with the socket so we should make sure we lock it like we do everywhere else. The second fix was to ensure that we sync up a stream socket's MSS value when we add IP options to the socket. We were doing everything correctly on the client side, but the server side was a bit of a mess; I'm pretty happy with this fix as I think it actually makes the code a bit cleaner in some respects and I believe actually shrinks the size of the diff slightly (a good sign).
A special thanks to Joe Nall and John Wiseman for helping debug the MSS problem.
I've updated both the git trees earlier today so hopefully the next cut of the linux-next tree should have the latest bits.
* git://git.infradead.org/users/pcmoore/lblnet-2.6_testing
--
paul moore
linux @ hp
RFC PATCH v6 1/16 selinux: Cleanup the NetLabel glue code
We were doing a lot of extra work in selinux_netlbl_sock_graft() what wasn't necessary so this patch removes that code. It also removes the redundant second argument to selinux_netlbl_sock_setsid() which allows us to simplify a few other functions.
---
security/selinux/netlabel.c | 38 ++++++++++---------------------------- 1 files changed, 10 insertions(+), 28 deletions(-)
security/selinux/netlabel.c +10 -28
@@ -66,22 +66,24 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,/** * selinux_netlbl_sock_setsid - Label a socket using the NetLabel mechanism * @sk: the socket to label -* @sid: the SID to use * * Description: -* Attempt to label a socket using the NetLabel mechanism using the given -* SID. Returns zero values on success, negative values on failure. +* Attempt to label a socket using the NetLabel mechanism. Returns zero values +* on success, negative values on failure. * */ -static int selinux_netlbl_sock_setsid (struct sock *sk,u32 sid) +static int selinux_netlbl_sock_setsid (struct sock *sk) {int rc;struct sk_security_struct *sksec = sk->sk_security;struct netlbl_lsm_secattr secattr; +if (sksec->nlbl_state !=NLBL_REQUIRE ) +return 0 ; +netlbl_secattr_init (&secattr); - rc =security_netlbl_sid_to_secattr (sid, &secattr); + rc =security_netlbl_sid_to_secattr (sksec->sid, &secattr);if (rc !=0 ) goto sock_setsid_return; rc =netlbl_sock_setattr (sk, &secattr);
@@ -174,24 +176,10 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,*/ void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock) { -struct sk_security_struct *sksec = sk->sk_security; -struct netlbl_lsm_secattr secattr; -u32 nlbl_peer_sid; - -if (sksec->nlbl_state !=NLBL_REQUIRE ) -return ; - -netlbl_secattr_init (&secattr); -if (netlbl_sock_getattr (sk, &secattr) ==0 && - secattr.flags !=NETLBL_SECATTR_NONE && -security_netlbl_secattr_to_sid (&secattr, &nlbl_peer_sid) ==0 ) - sksec->peer_sid = nlbl_peer_sid; -netlbl_secattr_destroy (&secattr); -/* Try to set the NetLabel on the socket to save time later, if we fail * here we will pick up the pieces in later calls to * selinux_netlbl_inode_permission(). */ -selinux_netlbl_sock_setsid (sk, sksec->sid); +selinux_netlbl_sock_setsid (sk); }/**
@@ -205,13 +193,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)*/ int selinux_netlbl_socket_post_create (struct socket *sock) { -struct sock *sk = sock->sk; -struct sk_security_struct *sksec = sk->sk_security; - -if (sksec->nlbl_state !=NLBL_REQUIRE ) -return 0 ; - -return selinux_netlbl_sock_setsid (sk, sksec->sid); +return selinux_netlbl_sock_setsid (sock->sk); }/**
@@ -246,7 +228,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)local_bh_disable ();bh_lock_sock_nested (sk);if (likely (sksec->nlbl_state ==NLBL_REQUIRE )) - rc =selinux_netlbl_sock_setsid (sk, sksec->sid); + rc =selinux_netlbl_sock_setsid (sk);else rc =0 ;bh_unlock_sock (sk);
Re: [RFC PATCH v6 01/16] selinux: Cleanup the NetLabel glue code
Quoted 6 lines · Paul Moore
We were doing a lot of extra work in
selinux_netlbl_sock_graft()what wasn't necessary so this patch removes that code. It also removes the redundant second argument toselinux_netlbl_sock_setsid()which allows us to simplify a few other functions.Signed-off-by Paul Moore <[email protected]>
Nice cleanup :-)
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 01/16] selinux: Cleanup the NetLabel glue code
Quoted 7 lines · James Morris
Quoted 6 lines · Paul Moore
We were doing a lot of extra work in
selinux_netlbl_sock_graft()what wasn't necessary so this patch removes that code. It also removes the redundant second argument toselinux_netlbl_sock_setsid()which allows us to simplify a few other functions.
Quoted 5 lines
Quoted 1 line
Signed-off-by Paul Moore <[email protected]>Nice cleanup :-)
Acked-by James Morris <[email protected]>
Thanks, every once in a while I get lucky ;)
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
RFC PATCH v6 2/16 selinux: Correctly handle IPv4 packets on IPv6 sockets in all cases
In reply to Paul MooreWe did the right thing in a few cases but there were several areas where we determined a packet's address family based on the socket's address family which is not the right thing to do since we can get IPv4 packets on IPv6 sockets. This patch fixes these problems by either taking the address family directly from the packet.
---
security/selinux/hooks.c | 22 +++++++++++++++++----- 1 files changed, 17 insertions(+), 5 deletions(-)
security/selinux/hooks.c +17 -5
@@ -4207,10 +4207,12 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *u32 peer_secid =SECSID_NULL ;u16 family; -if (sock) +if (skb && skb->protocol ==htons (ETH_P_IP )) + family =PF_INET ; +else if (skb && skb->protocol ==htons (ETH_P_IPV6 )) + family =PF_INET6 ; +else if (sock) family = sock->sk->sk_family; -else if (skb && skb->sk) - family = skb->sk->sk_family;else goto out;
@@ -4277,10 +4279,15 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb, {struct sk_security_struct *sksec = sk->sk_security;int err; +u16 family = sk->sk_family;u32 newsid;u32 peersid; - err =selinux_skb_peerlbl_sid (skb, sk->sk_family, &peersid); +/* handle mapped IPv4 packets arriving via IPv6 sockets */ +if (family ==PF_INET6 && skb->protocol ==htons (ETH_P_IP )) + family =PF_INET ; + + err =selinux_skb_peerlbl_sid (skb, family, &peersid);if (err)return err;if (peersid ==SECSID_NULL ) {
@@ -4318,9 +4325,14 @@ static void selinux_inet_csk_clone(struct sock *newsk,static void selinux_inet_conn_established (struct sock *sk,struct sk_buff *skb) { +u16 family = sk->sk_family;struct sk_security_struct *sksec = sk->sk_security; -selinux_skb_peerlbl_sid (skb, sk->sk_family, &sksec->peer_sid); +/* handle mapped IPv4 packets arriving via IPv6 sockets */ +if (family ==PF_INET6 && skb->protocol ==htons (ETH_P_IP )) + family =PF_INET ; + +selinux_skb_peerlbl_sid (skb, family, &sksec->peer_sid); } static void selinux_req_classify_flow(const struct request_sock *req,
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [RFC PATCH v6 02/16] selinux: Correctly handle IPv4 packets on IPv6 sockets in all cases
Quoted 7 lines · Paul Moore
We did the right thing in a few cases but there were several areas where we determined a packet's address family based on the socket's address family which is not the right thing to do since we can get IPv4 packets on IPv6 sockets. This patch fixes these problems by either taking the address family directly from the packet.
Signed-off-by Paul Moore <[email protected]>
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 02/16] selinux: Correctly handle IPv4 packets on IPv6 sockets in all cases
Quoted 10 lines · James Morris
Quoted 7 lines · Paul Moore
We did the right thing in a few cases but there were several areas where we determined a packet's address family based on the socket's address family which is not the right thing to do since we can get IPv4 packets on IPv6 sockets. This patch fixes these problems by either taking the address family directly from the packet.
Signed-off-by Paul Moore <[email protected]>Acked-by James Morris <[email protected]>
Thanks for taking the time to review and comment on the patches, again. I'm adding all of your acks/review to the patches and will post an updated patchset once I've had the chance to sanity check the fixes.
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v6 3/16 netlabel: Remove unneeded in-kernel API functions
In reply to Paul MooreAfter some discussions with the Smack folks, well just Casey, I now have a better idea of what Smack wants out of NetLabel in the future so I think it is now safe to do some API "pruning". If another LSM comes along that needs this functionality we can always add it back in, but I don't see any LSMs on the horizon which might make use of these functions.
Thanks to Rami Rosen who suggested removing netlbl_cfg_cipsov4_del() back in February 2008.
---
include/net/netlabel.h | 13 ------- net/netlabel/netlabel_kapi.c | 84 ++++++++++++------------------------------ 2 files changed, 23 insertions(+), 74 deletions(-)
include/net/netlabel.h +0 -13
@@ -352,12 +352,9 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)int netlbl_cfg_map_del (const char *domain,struct netlbl_audit *audit_info);int netlbl_cfg_unlbl_add_map (const char *domain,struct netlbl_audit *audit_info); -int netlbl_cfg_cipsov4_add (struct cipso_v4_doi *doi_def, -struct netlbl_audit *audit_info);int netlbl_cfg_cipsov4_add_map (struct cipso_v4_doi *doi_def,const char *domain,struct netlbl_audit *audit_info); -int netlbl_cfg_cipsov4_del (u32 doi,struct netlbl_audit *audit_info);/* * LSM security attribute operations
@@ -404,22 +401,12 @@ static inline int netlbl_cfg_unlbl_add_map(const char *domain, {return -ENOSYS ; } -static inline int netlbl_cfg_cipsov4_add (struct cipso_v4_doi *doi_def, -struct netlbl_audit *audit_info) -{ -return -ENOSYS ; -}static inline int netlbl_cfg_cipsov4_add_map (struct cipso_v4_doi *doi_def,const char *domain,struct netlbl_audit *audit_info) {return -ENOSYS ; } -static inline int netlbl_cfg_cipsov4_del (u32 doi, -struct netlbl_audit *audit_info) -{ -return -ENOSYS ; -}static inline int netlbl_secattr_catmap_walk (struct netlbl_lsm_secattr_catmap *catmap,u32 offset)
net/netlabel/netlabel_kapi.c +23 -61
123 lines not on this page · raw message
Re: [RFC PATCH v6 03/16] netlabel: Remove unneeded in-kernel API functions
Quoted 10 lines · Paul Moore
After some discussions with the Smack folks, well just Casey, I now have a better idea of what Smack wants out of NetLabel in the future so I think it is now safe to do some API "pruning". If another LSM comes along that needs this functionality we can always add it back in, but I don't see any LSMs on the horizon which might make use of these functions.
Thanks to Rami Rosen who suggested removing
netlbl_cfg_cipsov4_del()back in February 2008.Signed-off-by Paul Moore <[email protected]>
Signature · 2 lines
James Morris <[email protected]>
RFC PATCH v6 4/16 selinux: Better local/forward check in selinux_ip_postroute()
In reply to Paul MooreIt turns out that checking to see if skb->sk is NULL is not a very good indicator of a forwarded packet as some locally generated packets also have skb->sk set to NULL. Fix this by not only checking the skb->sk field but also the IP[6]CB(skb)->flags field for the IP[6]SKB_FORWARDED flag. While we are at it, we are calling selinux_parse_skb() much earlier than we really should resulting in potentially wasted cycles parsing packets for information we might no use; so shuffle the code around a bit to fix this.
---
security/selinux/hooks.c | 126 ++++++++++++++++++++++++++++++---------------- 1 files changed, 81 insertions(+), 45 deletions(-)
security/selinux/hooks.c +81 -45
@@ -4070,20 +4070,28 @@ static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk, }static int selinux_sock_rcv_skb_compat (struct sock *sk,struct sk_buff *skb, -struct avc_audit_data *ad, -u16 family,char *addrp) +u16 family) {int err;struct sk_security_struct *sksec = sk->sk_security;u32 peer_sid;u32 sk_sid = sksec->sid; +struct avc_audit_data ad; +char *addrp; + +AVC_AUDIT_DATA_INIT (&ad,NET ); + ad.u.net.netif = skb->iif; + ad.u.net.family = family; + err =selinux_parse_skb (skb, &ad, &addrp,1 ,NULL ); +if (err) +return err;if (selinux_compat_net) - err =selinux_sock_rcv_skb_iptables_compat (sk, skb, ad, + err =selinux_sock_rcv_skb_iptables_compat (sk, skb, &ad, family, addrp);else err =avc_has_perm (sk_sid, skb->secmark,SECCLASS_PACKET , -PACKET__RECV , ad); +PACKET__RECV , &ad);if (err)return err;
@@ -4092,12 +4100,12 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,if (err)return err; err =avc_has_perm (sk_sid, peer_sid, -SECCLASS_PEER ,PEER__RECV , ad); +SECCLASS_PEER ,PEER__RECV , &ad); }else { - err =selinux_netlbl_sock_rcv_skb (sksec, skb, family, ad); + err =selinux_netlbl_sock_rcv_skb (sksec, skb, family, &ad);if (err)return err; - err =selinux_xfrm_sock_rcv_skb (sksec->sid, skb, ad); + err =selinux_xfrm_sock_rcv_skb (sksec->sid, skb, &ad); }return err;
@@ -4111,6 +4119,8 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)u32 sk_sid = sksec->sid;struct avc_audit_data ad;char *addrp; +u8 secmark_active; +u8 peerlbl_active;if (family !=PF_INET && family !=PF_INET6 )return 0 ;
@@ -4119,6 +4129,18 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)if (family ==PF_INET6 && skb->protocol ==htons (ETH_P_IP )) family =PF_INET ; +/* If any sort of compatibility mode is enabled then handoff processing +* to the selinux_sock_rcv_skb_compat() function to deal with the +* special handling. We do this in an attempt to keep this function +* as fast and as clean as possible. */ +if (selinux_compat_net || !selinux_policycap_netpeer) +return selinux_sock_rcv_skb_compat (sk, skb, family); + + secmark_active =selinux_secmark_enabled (); + peerlbl_active =netlbl_enabled () ||selinux_xfrm_enabled (); +if (!secmark_active && !peerlbl_active) +return 0 ; +AVC_AUDIT_DATA_INIT (&ad,NET ); ad.u.net.netif = skb->iif; ad.u.net.family = family;
@@ -4126,15 +4148,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)if (err)return err; -/* If any sort of compatibility mode is enabled then handoff processing -* to the selinux_sock_rcv_skb_compat() function to deal with the -* special handling. We do this in an attempt to keep this function -* as fast and as clean as possible. */ -if (selinux_compat_net || !selinux_policycap_netpeer) -return selinux_sock_rcv_skb_compat (sk, skb, &ad, - family, addrp); - -if (netlbl_enabled () ||selinux_xfrm_enabled ()) { +if (peerlbl_active) {u32 peer_sid; err =selinux_skb_peerlbl_sid (skb, family, &peer_sid);
@@ -4148,7 +4162,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) PEER__RECV, &ad); } -if (selinux_secmark_enabled ()) { +if (secmark_active) { err =avc_has_perm (sk_sid, skb->secmark,SECCLASS_PACKET ,PACKET__RECV , &ad);if (err)
@@ -4396,15 +4410,15 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,if (!secmark_active && !peerlbl_active)return NF_ACCEPT ; +if (selinux_skb_peerlbl_sid (skb, family, &peer_sid) !=0 ) +return NF_DROP ; +AVC_AUDIT_DATA_INIT (&ad,NET ); ad.u.net.netif = ifindex; ad.u.net.family = family;if (selinux_parse_skb (skb, &ad, &addrp,1 ,NULL ) !=0 )return NF_DROP ; -if (selinux_skb_peerlbl_sid (skb, family, &peer_sid) !=0 ) -return NF_DROP ; -if (peerlbl_active)if (selinux_inet_sys_rcv_skb (ifindex, addrp, family, peer_sid, &ad) !=0 )
@@ -4505,30 +4519,36 @@ static int selinux_ip_postroute_iptables_compat(struct sock *sk,static unsigned int selinux_ip_postroute_compat (struct sk_buff *skb,int ifindex, -struct avc_audit_data *ad, -u16 family, -char *addrp, -u8 proto) +u16 family) {struct sock *sk = skb->sk;struct sk_security_struct *sksec; +struct avc_audit_data ad; +char *addrp; +u8 proto;if (sk ==NULL )return NF_ACCEPT ; sksec = sk->sk_security; +AVC_AUDIT_DATA_INIT (&ad,NET ); + ad.u.net.netif = ifindex; + ad.u.net.family = family; +if (selinux_parse_skb (skb, &ad, &addrp,0 , &proto)) +return NF_DROP ; +if (selinux_compat_net) {if (selinux_ip_postroute_iptables_compat (skb->sk, ifindex, - ad, family, addrp)) + &ad, family, addrp))return NF_DROP ; }else {if (avc_has_perm (sksec->sid, skb->secmark, -SECCLASS_PACKET ,PACKET__SEND , ad)) +SECCLASS_PACKET ,PACKET__SEND , &ad))return NF_DROP ; }if (selinux_policycap_netpeer) -if (selinux_xfrm_postroute_last (sksec->sid, skb, ad, proto)) +if (selinux_xfrm_postroute_last (sksec->sid, skb, &ad, proto))return NF_DROP ;return NF_ACCEPT ;
@@ -4542,23 +4562,15 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,struct sock *sk;struct avc_audit_data ad;char *addrp; -u8 proto;u8 secmark_active;u8 peerlbl_active; -AVC_AUDIT_DATA_INIT (&ad,NET ); - ad.u.net.netif = ifindex; - ad.u.net.family = family; -if (selinux_parse_skb (skb, &ad, &addrp,0 , &proto)) -return NF_DROP ; -/* If any sort of compatibility mode is enabled then handoff processing * to the selinux_ip_postroute_compat() function to deal with the * special handling. We do this in an attempt to keep this function * as fast and as clean as possible. */ if (selinux_compat_net || !selinux_policycap_netpeer) -return selinux_ip_postroute_compat (skb, ifindex, &ad, - family, addrp, proto); +return selinux_ip_postroute_compat (skb, ifindex, family);/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec * packet transformation so allow the packet to pass without any checks
@@ -4574,21 +4586,45 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,if (!secmark_active && !peerlbl_active)return NF_ACCEPT ; -/* if the packet is locally generated (skb->sk != NULL) then use the -* socket's label as the peer label, otherwise the packet is being -* forwarded through this system and we need to fetch the peer label -* directly from the packet */ +/* if the packet is being forwarded then get the peer label from the +* packet itself; otherwise check to see if it is from a local +* application or the kernel, if from an application get the peer label +* from the sending socket, otherwise use the kernel's sid */ sk = skb->sk; -if (sk) { +if (sk ==NULL ) { +switch (family) { +case PF_INET : +if (IPCB (skb)->flags &IPSKB_FORWARDED ) + secmark_perm =PACKET__FORWARD_OUT ; +else + secmark_perm =PACKET__SEND ; +break ; +case PF_INET6 : +if (IP6CB (skb)->flags &IP6SKB_FORWARDED ) + secmark_perm =PACKET__FORWARD_OUT ; +else + secmark_perm =PACKET__SEND ; +break ; +default : +return NF_DROP ; + } +if (secmark_perm ==PACKET__FORWARD_OUT ) { +if (selinux_skb_peerlbl_sid (skb, family, &peer_sid)) +return NF_DROP ; + }else + peer_sid =SECINITSID_KERNEL ; + }else {struct sk_security_struct *sksec = sk->sk_security; peer_sid = sksec->sid; secmark_perm =PACKET__SEND ; - }else { -if (selinux_skb_peerlbl_sid (skb, family, &peer_sid)) -return NF_DROP ; - secmark_perm =PACKET__FORWARD_OUT ; } +AVC_AUDIT_DATA_INIT (&ad,NET ); + ad.u.net.netif = ifindex; + ad.u.net.family = family; +if (selinux_parse_skb (skb, &ad, &addrp,0 ,NULL )) +return NF_DROP ; +if (secmark_active)if (avc_has_perm (peer_sid, skb->secmark,SECCLASS_PACKET , secmark_perm, &ad))
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [RFC PATCH v6 04/16] selinux: Better local/forward check in selinux_ip_postroute()
Quoted 9 lines · Paul Moore
It turns out that checking to see if
skb->skis NULL is not a very good indicator of a forwarded packet as some locally generated packets also haveskb->skset to NULL. Fix this by not only checking theskb->skfield but also the IP[6]CB(skb)->flags field for the IP[6]SKB_FORWARDED flag. While we are at it, we are callingselinux_parse_skb()much earlier than we really should resulting in potentially wasted cycles parsing packets for information we might no use; so shuffle the code around a bit to fix this.Signed-off-by Paul Moore <[email protected]>
(Wow, this code is getting complex... :-)
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 04/16] selinux: Better local/forward check in selinux_ip_postroute()
Quoted 11 lines · James Morris
Quoted 10 lines · Paul Moore
It turns out that checking to see if
skb->skis NULL is not a very good indicator of a forwarded packet as some locally generated packets also haveskb->skset to NULL. Fix this by not only checking theskb->skfield but also the IP[6]CB(skb)->flags field for the IP[6]SKB_FORWARDED flag. While we are at it, we are callingselinux_parse_skb()much earlier than we really should resulting in potentially wasted cycles parsing packets for information we might no use; so shuffle the code around a bit to fix this.
Quoted 5 lines
Quoted 1 line
Signed-off-by Paul Moore <[email protected]>Acked-by James Morris <[email protected]>(Wow, this code is getting complex... :-)
Yeah, it is pretty surprising too (at least to me anyway). I beginning to think our common case is the existence of corner cases :)
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v6 5/16 selinux: Fix a problem in security_netlbl_sid_to_secattr()
In reply to Paul MooreCurrently when SELinux fails to allocate memory in security_netlbl_sid_to_secattr() the NetLabel LSM domain field is set to NULL which triggers the default NetLabel LSM domain mapping which may not always be the desired mapping. This patch fixes this by returning an error when the kernel is unable to allocate memory. This could result in more failures on a system with heavy memory pressure but it is the "correct" thing to do.
---
security/selinux/ss/services.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
security/selinux/ss/services.c +8 -2
@@ -2788,7 +2788,7 @@ netlbl_secattr_to_sid_return_cleanup:*/ int security_netlbl_sid_to_secattr (u32 sid,struct netlbl_lsm_secattr *secattr) { -int rc = -ENOENT ; +int rc;struct context *ctx;if (!ss_initialized)
@@ -2796,10 +2796,16 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)read_lock (&policy_rwlock); ctx =sidtab_search (&sidtab, sid); -if (ctx ==NULL ) +if (ctx ==NULL ) { + rc = -ENOENT ; goto netlbl_sid_to_secattr_failure; + } secattr->domain =kstrdup (policydb.p_type_val_to_name[ctx->type -1 ],GFP_ATOMIC ); +if (secattr->domain ==NULL ) { + rc = -ENOMEM ; + goto netlbl_sid_to_secattr_failure; + } secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY ;mls_export_netlbl_lvl (ctx, secattr); rc =mls_export_netlbl_cat (ctx, secattr);
RFC PATCH v6 6/16 selinux: Fix missing calls to netlbl_skbuff_err()
In reply to Paul MooreAt some point I think I messed up and dropped the calls to netlbl_skbuff_err() which are necessary for CIPSO to send error notifications to remote systems. This patch re-introduces the error handling calls into the SELinux code.
---
include/net/netlabel.h | 6 ++++-- net/netlabel/netlabel_kapi.c | 5 +++-- security/selinux/hooks.c | 19 +++++++++++++++---- security/selinux/include/netlabel.h | 9 +++++++++ security/selinux/netlabel.c | 20 +++++++++++++++++++- 5 files changed, 50 insertions(+), 9 deletions(-)
include/net/netlabel.h +4 -2
@@ -382,7 +382,7 @@ int netlbl_sock_getattr(struct sock *sk,int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr); -void netlbl_skbuff_err (struct sk_buff *skb,int error); +void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway);/* * LSM label mapping cache operations
@@ -454,7 +454,9 @@ static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, {return -ENOSYS ; } -static inline void netlbl_skbuff_err (struct sk_buff *skb,int error) +static inline void netlbl_skbuff_err (struct sk_buff *skb, +int error, +int gateway) {return ; }
net/netlabel/netlabel_kapi.c +3 -2
@@ -490,6 +490,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,* netlbl_skbuff_err - Handle a LSM error on a sk_buff * @skb: the packet * @error: the error code +* @gateway: true if host is acting as a gateway, false otherwise * * Description: * Deal with a LSM problem when handling the packet in @skb, typically this is
@@ -497,10 +498,10 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,* according to the packet's labeling protocol. * */ -void netlbl_skbuff_err (struct sk_buff *skb,int error) +void netlbl_skbuff_err (struct sk_buff *skb,int error,int gateway) {if (CIPSO_V4_OPTEXIST (skb)) -cipso_v4_error (skb, error,0 ); +cipso_v4_error (skb, error, gateway); }/**
security/selinux/hooks.c +15 -4
@@ -4101,6 +4101,8 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,return err; err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , &ad); +if (err) +selinux_netlbl_err (skb, err,0 ); }else { err =selinux_netlbl_sock_rcv_skb (sksec, skb, family, &ad);if (err)
@@ -4156,10 +4158,14 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)return err; err =selinux_inet_sys_rcv_skb (skb->iif, addrp, family, peer_sid, &ad); -if (err) +if (err) { +selinux_netlbl_err (skb, err,0 );return err; + } err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , &ad); +if (err) +selinux_netlbl_err (skb, err,0 ); }if (secmark_active) {
@@ -4396,6 +4402,7 @@ out:static unsigned int selinux_ip_forward (struct sk_buff *skb,int ifindex,u16 family) { +int err;char *addrp;u32 peer_sid;struct avc_audit_data ad;
@@ -4419,10 +4426,14 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,if (selinux_parse_skb (skb, &ad, &addrp,1 ,NULL ) !=0 )return NF_DROP ; -if (peerlbl_active) -if (selinux_inet_sys_rcv_skb (ifindex, addrp, family, - peer_sid, &ad) !=0 ) +if (peerlbl_active) { + err =selinux_inet_sys_rcv_skb (ifindex, addrp, family, + peer_sid, &ad); +if (err) { +selinux_netlbl_err (skb, err,1 );return NF_DROP ; + } + }if (secmark_active) if (avc_has_perm(peer_sid, skb->secmark,
security/selinux/include/netlabel.h +9 -0
@@ -39,6 +39,8 @@#ifdef CONFIG_NETLABEL void selinux_netlbl_cache_invalidate (void ); +void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway); +void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family);
@@ -63,6 +65,13 @@ static inline void selinux_netlbl_cache_invalidate(void)return ; } +static inline void selinux_netlbl_err (struct sk_buff *skb, +int error, +int gateway) +{ +return ; +} +static inline void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family)
security/selinux/netlabel.c +19 -1
@@ -108,6 +108,24 @@ void selinux_netlbl_cache_invalidate(void) }/** +* selinux_netlbl_err - Handle a NetLabel packet error +* @skb: the packet +* @error: the error code +* @gateway: true if host is acting as a gateway, false otherwise +* +* Description: +* When a packet is dropped due to a call to avc_has_perm() pass the error +* code to the NetLabel subsystem so any protocol specific processing can be +* done. This is safe to call even if you are unsure if NetLabel labeling is +* present on the packet, NetLabel is smart enough to only act when it should. +* +*/ +void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway) +{ +netlbl_skbuff_err (skb, error, gateway); +} + +/** * selinux_netlbl_sk_security_reset - Reset the NetLabel fields * @ssec: the sk_security_struct * @family: the socket family
@@ -289,7 +307,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,return 0 ;if (nlbl_sid !=SECINITSID_UNLABELED ) -netlbl_skbuff_err (skb, rc); +netlbl_skbuff_err (skb, rc,0 );return rc; }
RFC PATCH v6 7/16 smack: Fix missing calls to netlbl_skbuff_err()
In reply to Paul MooreSmack needs to call netlbl_skbuff_err() to let NetLabel do the necessary protocol specific error handling.
---
security/smack/smack_lsm.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)
security/smack/smack_lsm.c +4 -1
@@ -2179,7 +2179,10 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)* This is the simplist possible security model * for networking. */ -return smk_access (smack, ssp->smk_in,MAY_WRITE ); + rc =smk_access (smack, ssp->smk_in,MAY_WRITE ); +if (rc !=0 ) +netlbl_skbuff_err (skb, rc,0 ); +return rc; }/**
RFC PATCH v6 8/16 netlabel: Replace protocol/NetLabel linking with refrerence counts
In reply to Paul MooreNetLabel has always had a list of backpointers in the CIPSO DOI definition structure which pointed to the NetLabel LSM domain mapping structures which referenced the CIPSO DOI struct. The rationale for this was that when an administrator removed a CIPSO DOI from the system all of the associated NetLabel LSM domain mappings should be removed as well; a list of backpointers made this a simple operation.
Unfortunately, while the backpointers did make the removal easier they were a bit of a mess from an implementation point of view which was making further development difficult. Since the removal of a CIPSO DOI is a realtively rare event it seems to make sense to remove this backpointer list as the optimization was hurting us more then it was helping. However, we still need to be able to track when a CIPSO DOI definition is being used so replace the backpointer list with a reference count. In order to preserve the current functionality of removing the associated LSM domain mappings when a CIPSO DOI is removed we walk the LSM domain mapping table, removing the relevant entries.
---
include/net/cipso_ipv4.h | 21 ++- net/ipv4/cipso_ipv4.c | 235 +++++++++++++++--------------------- net/netlabel/netlabel_cipso_v4.c | 77 +++++++----- net/netlabel/netlabel_domainhash.c | 95 +++++++-------- net/netlabel/netlabel_domainhash.h | 2 net/netlabel/netlabel_kapi.c | 43 ++++--- net/netlabel/netlabel_mgmt.c | 24 +--- security/smack/smackfs.c | 4 - 8 files changed, 235 insertions(+), 266 deletions(-)
include/net/cipso_ipv4.h +11 -10
@@ -40,6 +40,7 @@#include <linux/net.h> #include <linux/skbuff.h> #include <net/netlabel.h> +#include <asm/atomic.h> /* known doi values */ #define CIPSO_V4_DOI_UNKNOWN 0x00000000
@@ -79,10 +80,9 @@ struct cipso_v4_doi { } map;u8 tags[CIPSO_V4_TAG_MAXCNT ]; -u32 valid; +atomic_t refcount;struct list_head list;struct rcu_head rcu; -struct list_head dom_list; };/* Standard CIPSO mapping table */
@@ -128,25 +128,26 @@ extern int cipso_v4_rbm_strictvalid;#ifdef CONFIG_NETLABEL int cipso_v4_doi_add (struct cipso_v4_doi *doi_def); -int cipso_v4_doi_remove (u32 doi, -struct netlbl_audit *audit_info, -void (*callback) (struct rcu_head * head)); +void cipso_v4_doi_free (struct cipso_v4_doi *doi_def); +int cipso_v4_doi_remove (u32 doi,struct netlbl_audit *audit_info);struct cipso_v4_doi *cipso_v4_doi_getdef (u32 doi); +void cipso_v4_doi_putdef (struct cipso_v4_doi *doi_def);int cipso_v4_doi_walk (u32 *skip_cnt,int (*callback) (struct cipso_v4_doi *doi_def,void *arg),void *cb_arg); -int cipso_v4_doi_domhsh_add (struct cipso_v4_doi *doi_def,const char *domain); -int cipso_v4_doi_domhsh_remove (struct cipso_v4_doi *doi_def, -const char *domain);#else static inline int cipso_v4_doi_add (struct cipso_v4_doi *doi_def) {return -ENOSYS ; } +static inline void cipso_v4_doi_free (struct cipso_v4_doi *doi_def) +{ +return ; +} +static inline int cipso_v4_doi_remove (u32 doi, -struct netlbl_audit *audit_info, -void (*callback) (struct rcu_head * head)) +struct netlbl_audit *audit_info) {return 0 ; }
net/ipv4/cipso_ipv4.c +98 -137
307 lines not on this page · raw message
net/netlabel/netlabel_cipso_v4.c +44 -33
127 lines not on this page · raw message
net/netlabel/netlabel_domainhash.c +47 -48
136 lines not on this page · raw message
net/netlabel/netlabel_domainhash.h +2 -0
@@ -61,6 +61,8 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry, struct netlbl_audit *audit_info);int netlbl_domhsh_add_default (struct netlbl_dom_map *entry,struct netlbl_audit *audit_info); +int netlbl_domhsh_remove_entry (struct netlbl_dom_map *entry, +struct netlbl_audit *audit_info);int netlbl_domhsh_remove (const char *domain,struct netlbl_audit *audit_info);int netlbl_domhsh_remove_default (struct netlbl_audit *audit_info);struct netlbl_dom_map *netlbl_domhsh_getentry (const char *domain);
net/netlabel/netlabel_kapi.c +24 -19
80 lines not on this page · raw message
net/netlabel/netlabel_mgmt.c +6 -18
@@ -122,18 +122,12 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info) goto add_failure; tmp_val =nla_get_u32 (info->attrs[NLBL_MGMT_A_CV4DOI ]); -/* We should be holding a rcu_read_lock() here while we hold -* the result but since the entry will always be deleted when -* the CIPSO DOI is deleted we aren't going to keep the -* lock. */ -rcu_read_lock (); entry->type_def.cipsov4 =cipso_v4_doi_getdef (tmp_val); -if (entry->type_def.cipsov4 ==NULL ) { -rcu_read_unlock (); +if (entry->type_def.cipsov4 ==NULL ) goto add_failure; - } ret_val =netlbl_domhsh_add (entry, &audit_info); -rcu_read_unlock (); +if (ret_val !=0 ) +cipso_v4_doi_putdef (entry->type_def.cipsov4);break ;default : goto add_failure;
@@ -294,18 +288,12 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info) goto adddef_failure; tmp_val =nla_get_u32 (info->attrs[NLBL_MGMT_A_CV4DOI ]); -/* We should be holding a rcu_read_lock() here while we hold -* the result but since the entry will always be deleted when -* the CIPSO DOI is deleted we aren't going to keep the -* lock. */ -rcu_read_lock (); entry->type_def.cipsov4 =cipso_v4_doi_getdef (tmp_val); -if (entry->type_def.cipsov4 ==NULL ) { -rcu_read_unlock (); +if (entry->type_def.cipsov4 ==NULL ) goto adddef_failure; - } ret_val =netlbl_domhsh_add_default (entry, &audit_info); -rcu_read_unlock (); +if (ret_val !=0 ) +cipso_v4_doi_putdef (entry->type_def.cipsov4);break ;default : goto adddef_failure;
security/smack/smackfs.c +3 -1
@@ -343,9 +343,11 @@ static void smk_cipso_doi(void) doip->tags[rc] =CIPSO_V4_TAG_INVALID ; rc =netlbl_cfg_cipsov4_add_map (doip,NULL , &audit_info); -if (rc !=0 ) +if (rc !=0 ) {printk (KERN_WARNING "%s:%d add rc = %d\n" , __func__, __LINE__, rc); +kfree (doip); + } }/**
Re: [RFC PATCH v6 08/16] netlabel: Replace protocol/NetLabel linking with refrerence counts
Quoted 18 lines · Paul Moore
NetLabel has always had a list of backpointers in the CIPSO DOI definition structure which pointed to the NetLabel LSM domain mapping structures which referenced the CIPSO DOI struct. The rationale for this was that when an administrator removed a CIPSO DOI from the system all of the associated NetLabel LSM domain mappings should be removed as well; a list of backpointers made this a simple operation.
Unfortunately, while the backpointers did make the removal easier they were a bit of a mess from an implementation point of view which was making further development difficult. Since the removal of a CIPSO DOI is a realtively rare event it seems to make sense to remove this backpointer list as the optimization was hurting us more then it was helping. However, we still need to be able to track when a CIPSO DOI definition is being used so replace the backpointer list with a reference count. In order to preserve the current functionality of removing the associated LSM domain mappings when a CIPSO DOI is removed we walk the LSM domain mapping table, removing the relevant entries.
Quoted 1 line
Signed-off-by Paul Moore <[email protected]>
Signature · 7 lines
James Morris <[email protected]> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
RFC PATCH v6 9/16 netlabel: Add a generic way to create ordered linked lists of network addrs
In reply to Paul MooreCreate an ordered IP address linked list mechanism similar to the core kernel's linked list construct. The idea behind this list functionality is to create an extensibile linked list ordered by IP address mask to ease the matching of network addresses. The linked list is ordered with larger address masks at the front of the list and shorter address masks at the end to facilitate overriding network entries with individual host or subnet entries.
---
net/netlabel/Makefile | 3 net/netlabel/netlabel_addrlist.c | 258 +++++++++++++++++++++++++++ net/netlabel/netlabel_addrlist.h | 174 ++++++++++++++++++ net/netlabel/netlabel_unlabeled.c | 350 ++++++++++++++----------------------- 4 files changed, 569 insertions(+), 216 deletions(-)
net/netlabel/Makefile +2 -1
@@ -5,7 +5,8 @@ # # base objects -obj-y := netlabel_user.o netlabel_kapi.o netlabel_domainhash.o +obj-y := netlabel_user.o netlabel_kapi.o +obj-y += netlabel_domainhash.o netlabel_addrlist.o # management objects obj-y += netlabel_mgmt.o
net/netlabel/netlabel_addrlist.c new file +258 -0
258 lines not on this page · raw message
net/netlabel/netlabel_addrlist.h new file +174 -0
174 lines not on this page · raw message
net/netlabel/netlabel_unlabeled.c +135 -215
565 lines not on this page · raw message
Re: [RFC PATCH v6 09/16] netlabel: Add a generic way to create ordered linked lists of network addrs
Quoted 10 lines · Paul Moore
Create an ordered IP address linked list mechanism similar to the core kernel's linked list construct. The idea behind this list functionality is to create an extensibile linked list ordered by IP address mask to ease the matching of network addresses. The linked list is ordered with larger address masks at the front of the list and shorter address masks at the end to facilitate overriding network entries with individual host or subnet entries.
Signed-off-by Paul Moore <[email protected]>
Signature · 2 lines
James Morris <[email protected]>
RFC PATCH v6 10/16 netlabel: Add network address selectors to the NetLabel/LSM domain mapping
In reply to Paul MooreThis patch extends the NetLabel traffic labeling capabilities to individual packets based not only on the LSM domain but the by the destination address as well. The changes here only affect the core NetLabel infrastructre, changes to the NetLabel KAPI and individial protocol engines are also required but are split out into a different patch to ease review.
---
include/net/netlabel.h | 7 - net/netlabel/netlabel_addrlist.c | 130 ++++++++++++ net/netlabel/netlabel_addrlist.h | 15 + net/netlabel/netlabel_domainhash.c | 290 +++++++++++++++++++++++--- net/netlabel/netlabel_domainhash.h | 38 +++ net/netlabel/netlabel_kapi.c | 7 + net/netlabel/netlabel_mgmt.c | 398 +++++++++++++++++++++++++++--------- net/netlabel/netlabel_mgmt.h | 59 +++++ net/netlabel/netlabel_unlabeled.c | 96 +-------- 9 files changed, 816 insertions(+), 224 deletions(-)
include/net/netlabel.h +5 -2
@@ -9,7 +9,7 @@*/ /* -* (c) Copyright Hewlett-Packard Development Company, L.P., 2006 +* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by
@@ -72,8 +72,9 @@ struct cipso_v4_doi;/* NetLabel NETLINK protocol version * 1: initial version * 2: added static labels for unlabeled connections +* 3: network selectors added to the NetLabel/LSM domain mapping */ -#define NETLBL_PROTO_VERSION 2 +#define NETLBL_PROTO_VERSION 3/* NetLabel NETLINK types/families */ #define NETLBL_NLTYPE_NONE 0
@@ -87,6 +88,8 @@ struct cipso_v4_doi;#define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6"#define NETLBL_NLTYPE_UNLABELED 5#define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" +#define NETLBL_NLTYPE_ADDRSELECT 6 +#define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL"/* * NetLabel - Kernel API for accessing the network packet label mappings.
net/netlabel/netlabel_addrlist.c +130 -0
151 lines not on this page · raw message
net/netlabel/netlabel_addrlist.h +15 -0
@@ -36,6 +36,7 @@#include <linux/rcupdate.h> #include <linux/list.h> #include <linux/in6.h> +#include <linux/audit.h> /** * struct netlbl_af4list - NetLabel IPv4 address list
@@ -116,6 +117,12 @@ struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,void netlbl_af4list_remove_entry (struct netlbl_af4list *entry);struct netlbl_af4list *netlbl_af4list_search (__be32 addr,struct list_head *head); +struct netlbl_af4list *netlbl_af4list_search_exact (__be32 addr, +__be32 mask, +struct list_head *head); +void netlbl_af4list_audit_addr (struct audit_buffer *audit_buf, +int src,const char *dev, +__be32 addr,__be32 mask);#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE )
@@ -169,6 +176,14 @@ struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,void netlbl_af6list_remove_entry (struct netlbl_af6list *entry);struct netlbl_af6list *netlbl_af6list_search (const struct in6_addr *addr,struct list_head *head); +struct netlbl_af6list *netlbl_af6list_search_exact (const struct in6_addr *addr, +const struct in6_addr *mask, +struct list_head *head); +void netlbl_af6list_audit_addr (struct audit_buffer *audit_buf, +int src, +const char *dev, +const struct in6_addr *addr, +const struct in6_addr *mask);#endif /* IPV6 */ #endif
net/netlabel/netlabel_domainhash.c +253 -37
343 lines not on this page · raw message
net/netlabel/netlabel_domainhash.h +36 -2
@@ -11,7 +11,7 @@*/ /* -* (c) Copyright Hewlett-Packard Development Company, L.P., 2006 +* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by
@@ -36,16 +36,43 @@#include <linux/rcupdate.h> #include <linux/list.h> +#include "netlabel_addrlist.h" +/* Domain hash table size */ /* XXX - currently this number is an uneducated guess */ #define NETLBL_DOMHSH_BITSIZE 7 -/* Domain mapping definition struct */ +/* Domain mapping definition structures */ +#define netlbl_domhsh_addr4_entry (iter) \ + container_of(iter, struct netlbl_domaddr4_map, list) +struct netlbl_domaddr4_map { +u32 type; +union { +struct cipso_v4_doi *cipsov4; + } type_def; + +struct netlbl_af4list list; +}; +#define netlbl_domhsh_addr6_entry (iter) \ + container_of(iter, struct netlbl_domaddr6_map, list) +struct netlbl_domaddr6_map { +u32 type; + +/* NOTE: no 'type_def' union needed at present since we don't currently +* support any IPv6 labeling protocols */ + +struct netlbl_af6list list; +}; +struct netlbl_domaddr_map { +struct list_head list4; +struct list_head list6; +};struct netlbl_dom_map {char *domain;u32 type;union {struct cipso_v4_doi *cipsov4; +struct netlbl_domaddr_map *addrsel; } type_def;u32 valid;
@@ -66,9 +93,16 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,int netlbl_domhsh_remove (const char *domain,struct netlbl_audit *audit_info);int netlbl_domhsh_remove_default (struct netlbl_audit *audit_info);struct netlbl_dom_map *netlbl_domhsh_getentry (const char *domain); +struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4 (const char *domain, +__be32 addr);int netlbl_domhsh_walk (u32 *skip_bkt,u32 *skip_chain,int (*callback) (struct netlbl_dom_map *entry,void *arg),void *cb_arg); +#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) +struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6 (const char *domain, +const struct in6_addr *addr); +#endif /* IPv6 */ +#endif
net/netlabel/netlabel_kapi.c +6 -1
@@ -419,7 +419,9 @@ int netlbl_enabled(void)* Attach the correct label to the given socket using the security attributes * specified in @secattr. This function requires exclusive access to @sk, * which means it either needs to be in the process of being created or locked. -* Returns zero on success, negative values on failure. +* Returns zero on success, -EDESTADDRREQ if the domain is configured to use +* network address selectors (can't blindly label the socket), and negative +* values on all other failures. * */ int netlbl_sock_setattr(struct sock *sk,
@@ -433,6 +435,9 @@ int netlbl_sock_setattr(struct sock *sk,if (dom_entry ==NULL ) goto socket_setattr_return;switch (dom_entry->type) { +case NETLBL_NLTYPE_ADDRSELECT : + ret_val = -EDESTADDRREQ ; +break ;case NETLBL_NLTYPE_CIPSOV4 : ret_val = cipso_v4_sock_setattr(sk, dom_entry->type_def.cipsov4,
net/netlabel/netlabel_mgmt.c +304 -94
492 lines not on this page · raw message
net/netlabel/netlabel_mgmt.h +54 -5
94 lines not on this page · raw message
net/netlabel/netlabel_unlabeled.c +13 -83
126 lines not on this page · raw message
Re: [RFC PATCH v6 10/16] netlabel: Add network address selectors to the NetLabel/LSM domain mapping
Quoted 7 lines · Paul Moore
This patch extends the NetLabel traffic labeling capabilities to individual packets based not only on the LSM domain but the by the destination address as well. The changes here only affect the core NetLabel infrastructre, changes to the NetLabel KAPI and individial protocol engines are also required but are split out into a different patch to ease review.
Signed-off-by Paul Moore <[email protected]>
Signature · 2 lines
James Morris <[email protected]>
RFC PATCH v6 11/16 netlabel: Add functionality to set the security attributes of a packet
In reply to Paul MooreThis patch builds upon the new NetLabel address selector functionality by providing the NetLabel KAPI and CIPSO engine support needed to enable the new packet-based labeling. The only new addition to the NetLabel KAPI at this point is shown below:
* int netlbl_skbuff_setattr(skb, family, secattr)
... and is designed to be called from a Netfilter hook after the packet's IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.
This patch also provides the necessary SELinux hooks to support this new functionality. Smack support is not currently included due to uncertainty regarding the permissions needed to expand the Smack network access controls.
---
include/net/cipso_ipv4.h | 16 +++ include/net/netlabel.h | 9 + net/ipv4/cipso_ipv4.c | 222 +++++++++++++++++++++++++++++------ net/netlabel/netlabel_kapi.c | 60 +++++++++ security/selinux/hooks.c | 50 ++++++++ security/selinux/include/netlabel.h | 9 + security/selinux/include/objsec.h | 1 security/selinux/netlabel.c | 68 ++++++++++- 8 files changed, 393 insertions(+), 42 deletions(-)
include/net/cipso_ipv4.h +16 -0
@@ -208,6 +208,10 @@ int cipso_v4_sock_setattr(struct sock *sk,const struct cipso_v4_doi *doi_def, const struct netlbl_lsm_secattr *secattr);int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int cipso_v4_skbuff_setattr (struct sk_buff *skb, +const struct cipso_v4_doi *doi_def, +const struct netlbl_lsm_secattr *secattr); +int cipso_v4_skbuff_delattr (struct sk_buff *skb);int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr);int cipso_v4_validate (unsigned char **option);
@@ -232,6 +236,18 @@ static inline int cipso_v4_sock_getattr(struct sock *sk,return -ENOSYS ; } +static inline int cipso_v4_skbuff_setattr (struct sk_buff *skb, +const struct cipso_v4_doi *doi_def, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +} + +static inline int cipso_v4_skbuff_delattr (struct sk_buff *skb) +{ +return -ENOSYS ; +} +static inline int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr) {
include/net/netlabel.h +9 -0
@@ -382,6 +382,9 @@ int netlbl_sock_setattr(struct sock *sk, const struct netlbl_lsm_secattr *secattr);int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int netlbl_skbuff_setattr (struct sk_buff *skb, +u16 family, +const struct netlbl_lsm_secattr *secattr);int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr);
@@ -451,6 +454,12 @@ static inline int netlbl_sock_getattr(struct sock *sk, {return -ENOSYS ; } +static inline int netlbl_skbuff_setattr (struct sk_buff *skb, +u16 family, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +}static inline int netlbl_skbuff_getattr (const struct sk_buff *skb,u16 family,struct netlbl_lsm_secattr *secattr)
net/ipv4/cipso_ipv4.c +183 -39
261 lines not on this page · raw message
net/netlabel/netlabel_kapi.c +60 -0
66 lines not on this page · raw message
security/selinux/hooks.c +49 -1
80 lines not on this page · raw message
security/selinux/include/netlabel.h +9 -0
@@ -48,6 +48,9 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,u16 family, u32 *type, u32 *sid); +int selinux_netlbl_skbuff_setsid (struct sk_buff *skb, +u16 family, +u32 sid);void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock);int selinux_netlbl_socket_post_create (struct socket *sock);
@@ -88,6 +91,12 @@ static inline int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, *sid =SECSID_NULL ;return 0 ; } +static inline int selinux_netlbl_skbuff_setsid (struct sk_buff *skb, +u16 family, +u32 sid) +{ +return 0 ; +}static inline void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock)
security/selinux/include/objsec.h +1 -0
@@ -117,6 +117,7 @@ struct sk_security_struct {NLBL_UNSET =0 ,NLBL_REQUIRE ,NLBL_LABELED , +NLBL_REQSKB , } nlbl_state;#endif };
security/selinux/netlabel.c +66 -2
99 lines not on this page · raw message
Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet
Quoted 7 lines · Paul Moore
This patch builds upon the new NetLabel address selector functionality by providing the NetLabel KAPI and CIPSO engine support needed to enable the new packet-based labeling. The only new addition to the NetLabel KAPI at this point is shown below:
* int
netlbl_skbuff_setattr(skb, family, secattr)
Quoted 8 lines
... and is designed to be called from a Netfilter hook after the packet's IP header has been populated such as in the FORWARD or
LOCAL_OUThooks.This patch also provides the necessary SELinux hooks to support this new functionality. Smack support is not currently included due to uncertainty regarding the permissions needed to expand the Smack network access controls.
Signed-off-by Paul Moore <[email protected]>
Quoted 5 lines
net/ipv4/cipso_ipv4.c +5
-0+/* we overwrite any existing options to ensure that we have enough +* room for the CIPSO option, the reason is that we _need_ to guarantee +* that the security label is applied to the packet - we do the same +* thing when using the socket options and it hasn't caused a problem, +* if we need to we can always revisit this choice later */
....
net/ipv4/cipso_ipv4.c int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) · line 1948
Quoted 5 lines
net/ipv4/cipso_ipv4.c +5
-0+/* we have to do the following because we are being called from a +* netfilter hook which means the packet already has had the header +* fields populated and the checksum calculated - yes this means we +* are doing more work than needed but we do it to keep the core +* stack clean and tidy */
It might be better in the long term to integrate this stuff more directly with the core networking.
- James
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 11/16] netlabel: Add functionality to set the security attributes of a packet
Quoted 2 lines · James Morris
It might be better in the long term to integrate this stuff more directly with the core networking.
Agreed. I did it the way I did because I wanted to impact the core stack as little as possible. I looked at potentially doing the work in ip_options_compile() but that was going to require a lot of tweaking and some rather ugly hacks to keep everything contained and off to the side. Tighter integration with the core stack can always be treated as an optimization at a later date; I want to see what our IPv6 needs will be first and I don't have a clear picture of that just yet.
On the plus side, only traffic coming from unconnected sockets is going to be hit by this and with most stuff using TCP these days I'm hopeful that the impact to the SELinux folks using labeled networking will be _relatively_ minimal.
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v6 12/16 selinux: Set socket NetLabel based on connection endpoint
In reply to Paul MoorePrevious work enabled the use of address based NetLabel selectors, which while highly useful, brought the potential for additional per-packet overhead when used. This patch attempts to solve that by applying NetLabel socket labels when sockets are connect()'d. This should alleviate the per-packet NetLabel labeling for all connected sockets (yes, it even works for connected DGRAM sockets).
---
include/net/cipso_ipv4.h | 5 + include/net/netlabel.h | 13 +++ net/ipv4/cipso_ipv4.c | 74 ++++++++++++++++++ net/netlabel/netlabel_kapi.c | 78 ++++++++++++++++++- security/selinux/hooks.c | 11 +-- security/selinux/include/netlabel.h | 19 ++++- security/selinux/include/objsec.h | 1 security/selinux/netlabel.c | 147 ++++++++++++++++++++++++++++------- 8 files changed, 311 insertions(+), 37 deletions(-)
include/net/cipso_ipv4.h +5 -0
@@ -207,6 +207,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);int cipso_v4_sock_setattr (struct sock *sk,const struct cipso_v4_doi *doi_def,const struct netlbl_lsm_secattr *secattr); +void cipso_v4_sock_delattr (struct sock *sk);int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); int cipso_v4_skbuff_setattr(struct sk_buff *skb, const struct cipso_v4_doi *doi_def,
@@ -230,6 +231,10 @@ static inline int cipso_v4_sock_setattr(struct sock *sk,return -ENOSYS ; } +static inline void cipso_v4_sock_delattr (struct sock *sk) +{ +} +static inline int cipso_v4_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr) {
include/net/netlabel.h +13 -0
@@ -380,8 +380,12 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,int netlbl_enabled (void );int netlbl_sock_setattr (struct sock *sk,const struct netlbl_lsm_secattr *secattr); +void netlbl_sock_delattr (struct sock *sk);int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int netlbl_conn_setattr (struct sock *sk, +struct sockaddr *addr, +const struct netlbl_lsm_secattr *secattr);int netlbl_skbuff_setattr (struct sk_buff *skb,u16 family,const struct netlbl_lsm_secattr *secattr);
@@ -449,11 +453,20 @@ static inline int netlbl_sock_setattr(struct sock *sk, {return -ENOSYS ; } +static inline void netlbl_sock_delattr (struct sock *sk) +{ +}static inline int netlbl_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr) {return -ENOSYS ; } +static inline int netlbl_conn_setattr (struct sock *sk, +struct sockaddr *addr, +const struct netlbl_lsm_secattr *secattr) +{ +return -ENOSYS ; +}static inline int netlbl_skbuff_setattr (struct sk_buff *skb,u16 family,const struct netlbl_lsm_secattr *secattr)
net/ipv4/cipso_ipv4.c +74 -0
80 lines not on this page · raw message
net/netlabel/netlabel_kapi.c +77 -1
96 lines not on this page · raw message
security/selinux/hooks.c +6 -5
@@ -3794,6 +3794,7 @@ out:static int selinux_socket_connect (struct socket *sock,struct sockaddr *address,int addrlen) { +struct sock *sk = sock->sk;struct inode_security_struct *isec;int err;
@@ -3807,7 +3808,6 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, isec =SOCK_INODE (sock)->i_security;if (isec->sclass ==SECCLASS_TCP_SOCKET || isec->sclass ==SECCLASS_DCCP_SOCKET ) { -struct sock *sk = sock->sk;struct avc_audit_data ad;struct sockaddr_in *addr4 =NULL ;struct sockaddr_in6 *addr6 =NULL ;
@@ -3841,6 +3841,8 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, goto out; } + err =selinux_netlbl_socket_connect (sk, address); + out:return err; }
@@ -4290,8 +4292,6 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent) sk->sk_family == PF_UNIX) isec->sid = sksec->sid; sksec->sclass = isec->sclass; - -selinux_netlbl_sock_graft (sk, parent); } static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
@@ -4342,8 +4342,7 @@ static void selinux_inet_csk_clone(struct sock *newsk,selinux_netlbl_sk_security_reset (newsksec, req->rsk_ops->family); } -static void selinux_inet_conn_established (struct sock *sk, -struct sk_buff *skb) +static void selinux_inet_conn_established (struct sock *sk,struct sk_buff *skb) {u16 family = sk->sk_family;struct sk_security_struct *sksec = sk->sk_security;
@@ -4353,6 +4352,8 @@ static void selinux_inet_conn_established(struct sock *sk, family =PF_INET ;selinux_skb_peerlbl_sid (skb, family, &sksec->peer_sid); + +selinux_netlbl_inet_conn_established (sk, family); } static void selinux_req_classify_flow(const struct request_sock *req,
security/selinux/include/netlabel.h +16 -3
@@ -52,7 +52,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,u16 family, u32 sid); -void selinux_netlbl_sock_graft (struct sock *sk,struct socket *sock); +void selinux_netlbl_inet_conn_established (struct sock *sk,u16 family);int selinux_netlbl_socket_post_create (struct socket *sock);int selinux_netlbl_inode_permission (struct inode *inode,int mask); int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
@@ -62,6 +62,8 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,int selinux_netlbl_socket_setsockopt (struct socket *sock,int level,int optname); +int selinux_netlbl_socket_connect (struct sock *sk,struct sockaddr *addr); +#else static inline void selinux_netlbl_cache_invalidate (void ) {
@@ -98,8 +100,14 @@ static inline int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,return 0 ; } -static inline void selinux_netlbl_sock_graft (struct sock *sk, -struct socket *sock) +static inline int selinux_netlbl_conn_setsid (struct sock *sk, +struct sockaddr *addr) +{ +return 0 ; +} + +static inline void selinux_netlbl_inet_conn_established (struct sock *sk, +u16 family) {return ; }
@@ -125,6 +133,11 @@ static inline int selinux_netlbl_socket_setsockopt(struct socket *sock, {return 0 ; } +static inline int selinux_netlbl_socket_connect (struct sock *sk, +struct sockaddr *addr) +{ +return 0 ; +}#endif /* CONFIG_NETLABEL */ #endif
security/selinux/include/objsec.h +1 -0
@@ -118,6 +118,7 @@ struct sk_security_struct {NLBL_REQUIRE ,NLBL_LABELED ,NLBL_REQSKB , +NLBL_CONNLABELED , } nlbl_state;#endif };
security/selinux/netlabel.c +119 -28
188 lines not on this page · raw message
Re: [RFC PATCH v6 12/16] selinux: Set socket NetLabel based on connection endpoint
Quoted 9 lines · Paul Moore
/**
+ *cipso_v4_sock_delattr- Delete the CIPSO option from a socket
+ * @sk: the socket
+ *
+ * Description:
+ * Removes the CIPSO option from a socket, if present.
+ *
+ */
+voidcipso_v4_sock_delattr(struct sock *sk)
Btw, what kind of testing has this patch had?
- James
Signature · 7 lines
James Morris <[email protected]> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [RFC PATCH v6 12/16] selinux: Set socket NetLabel based on connection endpoint
Quoted 12 lines · James Morris
Quoted 9 lines · Paul Moore
/**
+ *cipso_v4_sock_delattr- Delete the CIPSO option from a socket
+ * @sk: the socket
+ *
+ * Description:
+ * Removes the CIPSO option from a socket, if present.
+ *
+ */
+voidcipso_v4_sock_delattr(struct sock *sk)
Quoted 4 lines
Reviewed-by James Morris <[email protected]>Btw, what kind of testing has this patch had?
Paul generated a patch for us against 2.6.26-5 that we have on about 20 developer and test boxes with good results in MLS enforcing. We are adding IPSec between machines and static fallback labels to the test mix and will report any issues. We have a couple of 8 core machines I'll stress test on to look for SMP issues.
joe
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [RFC PATCH v6 12/16] selinux: Set socket NetLabel based on connection endpoint
Quoted 15 lines · Joe Nall
Quoted 14 lines · James Morris
Quoted 9 lines · Paul Moore
/**
+ *cipso_v4_sock_delattr- Delete the CIPSO option from a socket
+ * @sk: the socket
+ *
+ * Description:
+ * Removes the CIPSO option from a socket, if present.
+ *
+ */
+voidcipso_v4_sock_delattr(struct sock *sk)Reviewed-by James Morris <[email protected]>
Quoted 7 lines
Quoted 1 line
Btw, what kind of testing has this patch had?
Paul generated a patch for us against 2.6.26-5 that we have on about 20 developer and test boxes with good results in MLS enforcing. We are adding IPSec between machines and static fallback labels to the test mix and will report any issues. We have a couple of 8 core machines I'll stress test on to look for SMP issues.
Thanks Joe, however, I think James was talking specifically about the this patch, not the entire aggregate patchset, and the cipso_v4_sock_delattr() function in particular as it is not likely to be called often in normal use.
To answer that question, I was going to write a small little test program that would connect/disconnect UDP sockets and do writes in various states to ensure the wire traffic was labeled (or not) correctly. However, I had a bit of luck and Casey ended up using this function in Smack[1] in a manner that saw it in a relatively common code path so it got a decent test; in fact it was Casey who pointed out the bugs in the initial revision.
[1] The Smack bits are still a work in progress and not ready for 2.6.28 so they have been left out of this patchset, expect something in the 2.6.29 timeframe.
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v6 13/16 selinux: Cache NetLabel secattrs in the socket's security struct
In reply to Paul MoorePrevious work enabled the use of address based NetLabel selectors, which while highly useful, brought the potential for additional per-packet overhead when used. This patch attempts to mitigate some of that overhead by caching the NetLabel security attribute struct within the SELinux socket security structure. This should help eliminate the need to recreate the NetLabel secattr structure for each packet resulting in less overhead.
---
security/selinux/hooks.c | 1 security/selinux/include/netlabel.h | 7 ++ security/selinux/include/objsec.h | 7 +- security/selinux/netlabel.c | 115 ++++++++++++++++++++++++----------- 4 files changed, 91 insertions(+), 39 deletions(-)
security/selinux/hooks.c +1 -0
@@ -291,6 +291,7 @@ static void sk_free_security(struct sock *sk)struct sk_security_struct *ssec = sk->sk_security; sk->sk_security =NULL ; +selinux_netlbl_sk_security_free (ssec);kfree (ssec); }
security/selinux/include/netlabel.h +7 -0
@@ -41,6 +41,7 @@ void selinux_netlbl_cache_invalidate(void);void selinux_netlbl_err (struct sk_buff *skb,int error,int gateway); +void selinux_netlbl_sk_security_free (struct sk_security_struct *ssec);void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family);
@@ -77,6 +78,12 @@ static inline void selinux_netlbl_err(struct sk_buff *skb,return ; } +static inline void selinux_netlbl_sk_security_free ( +struct sk_security_struct *ssec) +{ +return ; +} +static inline void selinux_netlbl_sk_security_reset (struct sk_security_struct *ssec,int family)
security/selinux/include/objsec.h +4 -3
@@ -109,9 +109,6 @@ struct netport_security_struct { }; struct sk_security_struct { - u32 sid; /* SID of this object */ - u32 peer_sid; /* SID of peer */ - u16 sclass; /* sock security class */ #ifdef CONFIG_NETLABEL enum { /* NetLabel state */ NLBL_UNSET = 0,
@@ -120,7 +117,11 @@ struct sk_security_struct {NLBL_REQSKB ,NLBL_CONNLABELED , } nlbl_state; +struct netlbl_lsm_secattr *nlbl_secattr;/* NetLabel sec attributes */ #endif +u32 sid;/* SID of this object */ +u32 peer_sid;/* SID of peer */ +u16 sclass;/* sock security class */ }; struct key_security_struct {
security/selinux/netlabel.c +79 -36
210 lines not on this page · raw message
RFC PATCH v6 14/16 netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts
In reply to Paul MooreThis patch provides support for including the LSM's secid in addition to the LSM's MLS information in the NetLabel security attributes structure.
---
include/net/netlabel.h | 2 +- security/selinux/ss/services.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
include/net/netlabel.h +1 -1
@@ -203,7 +203,7 @@ struct netlbl_lsm_secattr {u32 type;char *domain;struct netlbl_lsm_cache *cache; - union { + struct { struct { struct netlbl_lsm_secattr_catmap *cat; u32 lvl;
security/selinux/ss/services.c +2 -1
@@ -2806,7 +2806,8 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) rc = -ENOMEM ; goto netlbl_sid_to_secattr_failure; } - secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY ; + secattr->attr.secid = sid; + secattr->flags |=NETLBL_SECATTR_DOMAIN_CPY |NETLBL_SECATTR_SECID ;mls_export_netlbl_lvl (ctx, secattr); rc =mls_export_netlbl_cat (ctx, secattr);if (rc !=0 )
RFC PATCH v6 15/16 cipso: Add support for native local labeling and fixup mapping names
In reply to Paul MooreThis patch accomplishes two minor tasks: add a new tag type for local labeling and rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS. The first change allows CIPSO to support full LSM labels/contexts, not just MLS attributes. The second change brings the mapping names inline with what userspace is using, compatibility is preserved since we don't actually change the value.
---
include/net/cipso_ipv4.h | 13 +++-- net/ipv4/cipso_ipv4.c | 107 ++++++++++++++++++++++++++++++++++---- net/ipv4/ip_options.c | 2 - net/netlabel/netlabel_cipso_v4.c | 14 ++--- net/netlabel/netlabel_cipso_v4.h | 4 + net/netlabel/netlabel_kapi.c | 4 + 6 files changed, 118 insertions(+), 26 deletions(-)
include/net/cipso_ipv4.h +9 -4
@@ -45,7 +45,7 @@/* known doi values */ #define CIPSO_V4_DOI_UNKNOWN 0x00000000 -/* tag types */ +/* standard tag types */ #define CIPSO_V4_TAG_INVALID 0#define CIPSO_V4_TAG_RBITMAP 1#define CIPSO_V4_TAG_ENUM 2
@@ -53,10 +53,14 @@#define CIPSO_V4_TAG_PBITMAP 6#define CIPSO_V4_TAG_FREEFORM 7 +/* non-standard tag types (tags > 127) */ +#define CIPSO_V4_TAG_LOCAL 128 +/* doi mapping types */ #define CIPSO_V4_MAP_UNKNOWN 0 -#define CIPSO_V4_MAP_STD 1 +#define CIPSO_V4_MAP_TRANS 1#define CIPSO_V4_MAP_PASS 2 +#define CIPSO_V4_MAP_LOCAL 3/* limits */ #define CIPSO_V4_MAX_REM_LVLS 255
@@ -215,7 +219,7 @@ int cipso_v4_skbuff_setattr(struct sk_buff *skb,int cipso_v4_skbuff_delattr (struct sk_buff *skb);int cipso_v4_skbuff_getattr (const struct sk_buff *skb,struct netlbl_lsm_secattr *secattr); -int cipso_v4_validate (unsigned char **option); +int cipso_v4_validate (const struct sk_buff *skb,unsigned char **option);#else static inline void cipso_v4_error(struct sk_buff *skb, int error,
@@ -259,7 +263,8 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,return -ENOSYS ; } -static inline int cipso_v4_validate (unsigned char **option) +static inline int cipso_v4_validate (const struct sk_buff *skb, +unsigned char **option) {return -ENOSYS ; }
net/ipv4/cipso_ipv4.c +97 -10
203 lines not on this page · raw message
net/ipv4/ip_options.c +1 -1
@@ -438,7 +438,7 @@ int ip_options_compile(struct net *net, goto error; } opt->cipso = optptr - iph; -if (cipso_v4_validate (&optptr)) { +if (cipso_v4_validate (skb, &optptr)) { pp_ptr = optptr; goto error; }
net/netlabel/netlabel_cipso_v4.c +7 -7
@@ -132,9 +132,9 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,* @info: the Generic NETLINK info block * * Description: -* Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message -* and add it to the CIPSO V4 engine. Return zero on success and non-zero on -* error. +* Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD +* message and add it to the CIPSO V4 engine. Return zero on success and +* non-zero on error. * */ static int netlbl_cipsov4_add_std (struct genl_info *info)
@@ -164,7 +164,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info) ret_val = -ENOMEM ; goto add_std_failure; } - doi_def->type =CIPSO_V4_MAP_STD ; + doi_def->type =CIPSO_V4_MAP_TRANS ; ret_val =netlbl_cipsov4_add_common (info, doi_def);if (ret_val !=0 )
@@ -393,8 +393,8 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) type =nla_get_u32 (info->attrs[NLBL_CIPSOV4_A_MTYPE ]);switch (type) { -case CIPSO_V4_MAP_STD : - type_str ="std" ; +case CIPSO_V4_MAP_TRANS : + type_str ="trans" ; ret_val =netlbl_cipsov4_add_std (info);break ;case CIPSO_V4_MAP_PASS :
@@ -497,7 +497,7 @@ list_start:nla_nest_end (ans_skb, nla_a);switch (doi_def->type) { -case CIPSO_V4_MAP_STD : +case CIPSO_V4_MAP_TRANS : nla_a =nla_nest_start (ans_skb,NLBL_CIPSOV4_A_MLSLVLLST );if (nla_a ==NULL ) { ret_val = -ENOMEM ;
net/netlabel/netlabel_cipso_v4.h +2 -2
@@ -45,7 +45,7 @@* NLBL_CIPSOV4_A_MTYPE * NLBL_CIPSOV4_A_TAGLST * -* If using CIPSO_V4_MAP_STD the following attributes are required: +* If using CIPSO_V4_MAP_TRANS the following attributes are required: * * NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST
@@ -76,7 +76,7 @@* NLBL_CIPSOV4_A_MTYPE * NLBL_CIPSOV4_A_TAGLST * -* If using CIPSO_V4_MAP_STD the following attributes are required: +* If using CIPSO_V4_MAP_TRANS the following attributes are required: * * NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST
net/netlabel/netlabel_kapi.c +2 -2
@@ -157,8 +157,8 @@ cfg_cipsov4_add_map_return: audit_info);if (audit_buf !=NULL ) {switch (doi_type) { -case CIPSO_V4_MAP_STD : - type_str ="std" ; +case CIPSO_V4_MAP_TRANS : + type_str ="trans" ;break ;case CIPSO_V4_MAP_PASS : type_str ="pass" ;
James Morris
maintainerRe: [RFC PATCH v6 15/16] cipso: Add support for native local labeling and fixup mapping names
Quoted 18 lines · Paul Moore
(quoted diff) +17
-0+/* Base length of the local tag (non-standard tag). + * Tag definition (may change between kernel versions) + * + * 0 8 16 24 32 + * +----------+----------+----------+----------+ + * | 10000000 | 00001000 | unused (zero fill) | + * +----------+----------+----------+----------+ + * | 32-bit secid value (host byte order) | + * +----------+----------+----------+----------+ + * + */ +#define CIPSO_V4_TAG_LOC_BLEN 8 + +static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def, + const struct netlbl_lsm_secattr *secattr, + unsigned char *buffer, + u32 buffer_len)
Review
Quoted 10 lines
(quoted diff) +10
-0+{ + if (!(secattr->flags & NETLBL_SECATTR_SECID)) + return -EPERM; + + buffer[0] = 0x80; + buffer[1] = 0x08; + *(u32 *)&buffer[4] = secattr->attr.secid; + + return 8; +}
Macros would be nice for these, and why specify zero filling? (Setting and testing that would be wasted cycles, if you enforced it).
- James
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 15/16] cipso: Add support for native local labeling and fixup mapping names
Quoted 15 lines · James Morris
Quoted 14 lines · Paul Moore
net/ipv4/cipso_ipv4.c +13
-0+/* Base length of the local tag (non-standard tag). +* Tag definition (may change between kernel versions) +* +* 0 8 16 24 32 +* +----------+----------+----------+----------+ +* | 10000000 | 00001000 | unused (zero fill) | +* +----------+----------+----------+----------+ +* | 32-bit secid value (host byte order) | +* +----------+----------+----------+----------+ +* +*/ +#define CIPSO_V4_TAG_LOC_BLEN 8 +
Quoted 16 lines
Quoted 4 lines
net/ipv4/cipso_ipv4.c +4
-0+static int cipso_v4_gentag_loc (const struct cipso_v4_doi *doi_def, +const struct netlbl_lsm_secattr *secattr, +unsigned char *buffer, +u32 buffer_len)net/ipv4/cipso_ipv4.c static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def, · line 1528
Quoted 10 lines
net/ipv4/cipso_ipv4.c +10
-0+{ +if (!(secattr->flags &NETLBL_SECATTR_SECID )) +return -EPERM ; + + buffer[0 ] =0x80 ; + buffer[1 ] =0x08 ; + *(u32 *)&buffer[4 ] = secattr->attr.secid; + +return 8 ; +}Macros would be nice for these ...
I assume you mean the "0x80" and "0x08" constants and not the function itself? I ask because I remember reading that (macros == evil) because of the lack of parameter type checking.
Quoted 2 lines
... and why specify zero filling? (Setting and testing that would be wasted cycles, if you enforced it).
Better alignment within the IP option field, the goal being to try and get the secid aligned on a 32bit boundary. However, it just occurred to me that by adding the two octets of padding I've actually pushed it out of alignment (I forgot about the obligatory IP option type and length octets).
Man I hate IPv4 options, what a parsing nightmare ...
Signature · 2 lines
paul moore linux @ hp
James Morris
maintainerRe: [RFC PATCH v6 15/16] cipso: Add support for native local labeling and fixup mapping names
Quoted 4 lines · Paul Moore
Quoted 1 line
Macros would be nice for these ...
I assume you mean the "
0x80" and "0x08" constants and not the function itself?
Yes.
Quoted 11 lines
I ask because I remember reading that (macros == evil) because of the lack of parameter type checking.
Quoted 2 lines
... and why specify zero filling? (Setting and testing that would be wasted cycles, if you enforced it).
Better alignment within the IP option field, the goal being to try and get the secid aligned on a 32bit boundary. However, it just occurred to me that by adding the two octets of padding I've actually pushed it out of alignment (I forgot about the obligatory IP option type and length octets).
I mean, why specify zero-filled rather than simply "unused" ?
Quoted 1 line
Man I hate IPv4 options, what a parsing nightmare ...
It was all fixed with IPv6, right? :-)
- James
Signature · 2 lines
James Morris <[email protected]>
Re: [RFC PATCH v6 15/16] cipso: Add support for native local labeling and fixup mapping names
Quoted 11 lines · James Morris
Quoted 8 lines · Paul Moore
Quoted 2 lines
... and why specify zero filling? (Setting and testing that would be wasted cycles, if you enforced it).
Better alignment within the IP option field, the goal being to try and get the secid aligned on a 32bit boundary. However, it just occurred to me that by adding the two octets of padding I've actually pushed it out of alignment (I forgot about the obligatory IP option type and length octets).
I mean, why specify zero-filled rather than simply "unused" ?
Gotcha. Yes, "unused" or "reserved" would be much better but it is kinda moot right now anyway since the Right Thing is to just remove the padding entirely.
Quoted 3 lines
Quoted 1 line
Man I hate IPv4 options, what a parsing nightmare ...
It was all fixed with IPv6, right? :-)
That is what the brochure says :)
Signature · 2 lines
paul moore linux @ hp
RFC PATCH v6 16/16 netlabel: Add configuration support for local labeling
In reply to Paul MooreAdd the necessary NetLabel support for the new CIPSO mapping, CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.
---
include/net/netlabel.h | 3 ++- net/netlabel/netlabel_cipso_v4.c | 41 ++++++++++++++++++++++++++++++++++++++ net/netlabel/netlabel_cipso_v4.h | 6 ++++-- net/netlabel/netlabel_kapi.c | 3 +++ 4 files changed, 50 insertions(+), 3 deletions(-)
include/net/netlabel.h +2 -1
@@ -72,7 +72,8 @@ struct cipso_v4_doi;/* NetLabel NETLINK protocol version * 1: initial version * 2: added static labels for unlabeled connections -* 3: network selectors added to the NetLabel/LSM domain mapping +* 3: network selectors added to the NetLabel/LSM domain mapping and the +* CIPSO_V4_MAP_LOCAL CIPSO mapping was added */ #define NETLBL_PROTO_VERSION 3
net/netlabel/netlabel_cipso_v4.c +41 -0
53 lines not on this page · raw message
net/netlabel/netlabel_cipso_v4.h +4 -2
@@ -50,7 +50,8 @@* NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST * -* If using CIPSO_V4_MAP_PASS no additional attributes are required. +* If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes +* are required. * * o REMOVE: * Sent by an application to remove a specific DOI mapping table from the
@@ -81,7 +82,8 @@* NLBL_CIPSOV4_A_MLSLVLLST * NLBL_CIPSOV4_A_MLSCATLST * -* If using CIPSO_V4_MAP_PASS no additional attributes are required. +* If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes +* are required. * * o LISTALL: * This message is sent by an application to list the valid DOIs on the
net/netlabel/netlabel_kapi.c +3 -0
@@ -163,6 +163,9 @@ cfg_cipsov4_add_map_return:case CIPSO_V4_MAP_PASS : type_str ="pass" ;break ; +case CIPSO_V4_MAP_LOCAL : + type_str ="local" ; +break ;default : type_str ="(unknown)" ; }
Re: [RFC PATCH v6 16/16] netlabel: Add configuration support for local labeling
Quoted 2 lines · Paul Moore
Add the necessary NetLabel support for the new CIPSO mapping,
CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.
Now, CIPSO is useful :-)
Signature · 7 lines
James Morris <[email protected]> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [RFC PATCH v6 16/16] netlabel: Add configuration support for local labeling
Quoted 5 lines · James Morris
Quoted 2 lines · Paul Moore
Add the necessary NetLabel support for the new CIPSO mapping,
CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.Now, CIPSO is useful :-)
:-P
I told you guys I'd make this compelling, I just needed a <cough>few</cough> years :)
Signature · 2 lines
paul moore linux @ hp
Quoted 11 lines · Paul Moore
Another revision to the patchset to fix two issues, one trivial, the other not so much. The trivial fix was to add some locking around the connection labeling operations, we're messing with the socket so we should make sure we lock it like we do everywhere else. The second fix was to ensure that we sync up a stream socket's MSS value when we add IP options to the socket. We were doing everything correctly on the client side, but the server side was a bit of a mess; I'm pretty happy with this fix as I think it actually makes the code a bit cleaner in some respects and I believe actually shrinks the size of the diff slightly (a good sign).
Quoted 7 lines
A special thanks to Joe Nall and John Wiseman for helping debug the MSS problem.
I've updated both the git trees earlier today so hopefully the next cut of the linux-next tree should have the latest bits.
*
git://git.infradead.org/users/pcmoore/lblnet-2.6_testing
I forgot to add, there is also a small fix to the cipso_v4_sock_delattr() function so that it correctly removes the CIPSO option and either adjust the option padding correctly or removes the options struct entirely from the socket if it is no longer needed.
Thanks to Casey Schaufler for finding this bug.
Signature · 2 lines
paul moore linux @ hp
Casey Schaufler
maintainerQuoted 19 lines · Paul Moore
Quoted 17 lines · Paul Moore
Another revision to the patchset to fix two issues, one trivial, the other not so much. The trivial fix was to add some locking around the connection labeling operations, we're messing with the socket so we should make sure we lock it like we do everywhere else. The second fix was to ensure that we sync up a stream socket's MSS value when we add IP options to the socket. We were doing everything correctly on the client side, but the server side was a bit of a mess; I'm pretty happy with this fix as I think it actually makes the code a bit cleaner in some respects and I believe actually shrinks the size of the diff slightly (a good sign).
A special thanks to Joe Nall and John Wiseman for helping debug the MSS problem.
I've updated both the git trees earlier today so hopefully the next cut of the linux-next tree should have the latest bits.
Quoted 6 lines
Quoted 2 lines
*
git://git.infradead.org/users/pcmoore/lblnet-2.6_testingI forgot to add, there is also a small fix to the
cipso_v4_sock_delattr()function so that it correctly removes the CIPSO option and either adjust the option padding correctly or removes the options struct entirely from the socket if it is no longer needed.Thanks to Casey Schaufler for finding this bug
Testing in progress. Thank you.
James Morris
maintainerI found some sparse warnings -- the last couple at least may need attention:
$ make C=2 CF="-D__cold__=" SUBDIRS=net/netlabel
CHECK net/netlabel/netlabel_user.c CC net/netlabel/netlabel_user.o CHECK net/netlabel/netlabel_kapi.c CC net/netlabel/netlabel_kapi.o CHECK net/netlabel/netlabel_domainhash.c
net/netlabel/netlabel_domainhash.c:143:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_domainhash.c:143:3: originally declared here net/netlabel/netlabel_domainhash.c:143:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_domainhash.c:143:3: originally declared here net/netlabel/netlabel_domainhash.c:635:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_domainhash.c:635:3: originally declared here net/netlabel/netlabel_domainhash.c:635:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_domainhash.c:635:3: originally declared here
CC net/netlabel/netlabel_domainhash.o CHECK net/netlabel/netlabel_addrlist.c CC net/netlabel/netlabel_addrlist.o CHECK net/netlabel/netlabel_mgmt.c CC net/netlabel/netlabel_mgmt.o CHECK net/netlabel/netlabel_unlabeled.c
net/netlabel/netlabel_unlabeled.c:265:2: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_unlabeled.c:265:2: originally declared herenet/netlabel/netlabel_unlabeled.c:265:2: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_unlabeled.c:265:2: originally declared herenet/netlabel/netlabel_unlabeled.c:1282:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_unlabeled.c:1282:3: originally declared herenet/netlabel/netlabel_unlabeled.c:1282:3: warning: symbol '_________p1' shadows an earlier one net/netlabel/netlabel_unlabeled.c:1282:3: originally declared here
CC net/netlabel/netlabel_unlabeled.o
CHECK net/netlabel/netlabel_cipso_v4.cnet/netlabel/netlabel_cipso_v4.c:686:21: warning: incorrect type in argument 1 (different signedness)net/netlabel/netlabel_cipso_v4.c:686:21: expected unsigned int
[usertype] *skip_cntnet/netlabel/netlabel_cipso_v4.c:686:21: got int *<noident>net/netlabel/netlabel_cipso_v4.c:622:2: warning: context imbalance in 'netlbl_cipsov4_list' - different lock contexts for basic block
CC net/netlabel/netlabel_cipso_v4.o
LD net/netlabel/built-in.o
Building modules, stage 2.
MODPOST 0 modules
Signature · 2 lines
James Morris <[email protected]>
Quoted 4 lines · James Morris
I found some sparse warnings -- the last couple at least may need attention:
$ make C=2 CF="-D__cold__=" SUBDIRS=net/netlabel
Ah ha!
At this point I have to admit a dirty little secret, I've never run sparse on any of my code before. It isn't for a lack of trying it is just that I had no idea how to do so and googling for "sparse" and all the relevant Linux modifiers didn't result in much. That command line helped quite a bit.
For others who may be interested you can find the sparse tool here:
* http://www.kernel.org/pub/software/devel/sparse
... and it looks like the magic incantation is "make C={1,2}". I have no idea what the "CF=..." bits do, James?
Quoted 40 lines
CHECK net/netlabel/netlabel_user.c CC net/netlabel/netlabel_user.o CHECK net/netlabel/netlabel_kapi.c CC net/netlabel/netlabel_kapi.o CHECK net/netlabel/netlabel_domainhash.c
net/netlabel/netlabel_domainhash.c:143:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_domainhash.c:143:3: originally declared herenet/netlabel/netlabel_domainhash.c:143:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_domainhash.c:143:3: originally declared herenet/netlabel/netlabel_domainhash.c:635:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_domainhash.c:635:3: originally declared herenet/netlabel/netlabel_domainhash.c:635:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_domainhash.c:635:3: originally declared here CC
net/netlabel/netlabel_domainhash.oCHECK net/netlabel/netlabel_addrlist.c CC net/netlabel/netlabel_addrlist.o CHECK net/netlabel/netlabel_mgmt.c CC net/netlabel/netlabel_mgmt.o CHECK net/netlabel/netlabel_unlabeled.c
net/netlabel/netlabel_unlabeled.c:265:2: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_unlabeled.c:265:2: originally declared herenet/netlabel/netlabel_unlabeled.c:265:2: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_unlabeled.c:265:2: originally declared herenet/netlabel/netlabel_unlabeled.c:1282:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_unlabeled.c:1282:3: originally declared herenet/netlabel/netlabel_unlabeled.c:1282:3: warning: symbol '_________p1' shadows an earlier onenet/netlabel/netlabel_unlabeled.c:1282:3: originally declared here CC
net/netlabel/netlabel_unlabeled.o
CHECKnet/netlabel/netlabel_cipso_v4.cnet/netlabel/netlabel_cipso_v4.c:686:21: warning: incorrect type in argument 1 (different signedness)net/netlabel/netlabel_cipso_v4.c:686:21: expected unsigned int
Quoted 8 lines
[usertype]
*skip_cntnet/netlabel/netlabel_cipso_v4.c:686:21: got int *<noident>net/netlabel/netlabel_cipso_v4.c:622:2: warning: context imbalance in 'netlbl_cipsov4_list' - different lock contexts for basic block CC
net/netlabel/netlabel_cipso_v4.o
LDnet/netlabel/built-in.o
Building modules, stage 2.
MODPOST 0 modules
Thanks, I went ahead and fixed all of the problems. I'll send an updated patchset later after I can do a quick sanity test.
Signature · 2 lines
paul moore linux @ hp
James Morris
maintainerQuoted 14 lines · Paul Moore
Quoted 4 lines · James Morris
I found some sparse warnings -- the last couple at least may need attention:
$ make C=2 CF="-D__cold__=" SUBDIRS=net/netlabelAh ha!
At this point I have to admit a dirty little secret, I've never run sparse on any of my code before. It isn't for a lack of trying it is just that I had no idea how to do so and googling for "sparse" and all the relevant Linux modifiers didn't result in much. That command line helped quite a bit.
Quoted 6 lines
For others who may be interested you can find the sparse tool here:
* http://www.kernel.org/pub/software/devel/sparse
... and it looks like the magic incantation is "make C={1,2}". I have no idea what the "CF=..." bits do, James?
This creates CFLAGS, which are needed to make the __cold__ thing go away (no idea what that is), which you'll see if you don't inlcude the -CF thing.
Signature · 2 lines
James Morris <[email protected]>