Fix the SELinux dynamic network access controls
Subsystems (5)
v2 cover Fix the SELinux dynamic network access controls
A bump to v2 to incorporate Sergei's minor comment on the previous patchset. I've also gone ahead and dropped the "RFC" from the patchset as I didn't see any significant comments/concerns from anyone.
---
Paul Moore (2):
selinux: fix the labeled xfrm/IPsec reference count handling
xfrm: force a garbage collection after deleting a policy
include/linux/security.h | 26 ++- include/net/xfrm.h | 5 + net/key/af_key.c | 4 net/xfrm/xfrm_policy.c | 3 net/xfrm/xfrm_user.c | 2 security/capability.c | 15 +- security/security.c | 13 - security/selinux/hooks.c | 5 - security/selinux/include/xfrm.h | 8 + security/selinux/xfrm.c | 384 ++++++++++++++++++--------------------- 10 files changed, 230 insertions(+), 235 deletions(-)
PATCH v2 1/2 selinux: fix the labeled xfrm/IPsec reference count handling
The SELinux labeled IPsec code was improperly handling its reference counting, dropping a reference on a delete operation instead of on a free/release operation. This patch resolves this issue as well as some other related issues:
* Change the name of the xfrm LSM security_operations field members to match the LSM hook names, like most everywhere else
* Don't reuse security_operations member functions across security_xfrm_state_alloc() and security_xfrm_state_alloc_acquire()
* Move the xfrm_sec_ctx check into the LSM specific function
* General cleanup/janitorial work in security/selinux/xfrm.c
--- include/linux/security.h | 26 ++- security/capability.c | 15 +- security/security.c | 13 - security/selinux/hooks.c | 5 - security/selinux/include/xfrm.h | 8 + security/selinux/xfrm.c | 384 ++++++++++++++++++--------------------- 6 files changed, 217 insertions(+), 234 deletions(-)
include/linux/security.h +18 -8
@@ -1039,17 +1039,25 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* @xfrm_policy_delete_security: * @ctx contains the xfrm_sec_ctx. * Authorize deletion of xp->security. -* @xfrm_state_alloc_security: +* @xfrm_state_alloc: * @x contains the xfrm_state being added to the Security Association * Database by the XFRM system. * @sec_ctx contains the security context information being provided by * the user-level SA generation program (e.g., setkey or racoon). -* @secid contains the secid from which to take the mls portion of the context. * Allocate a security structure to the x->security field; the security * field is initialized to NULL when the xfrm_state is allocated. Set the -* context to correspond to either sec_ctx or polsec, with the mls portion -* taken from secid in the latter case. -* Return 0 if operation was successful (memory to allocate, legal context). +* context to correspond to sec_ctx. Return 0 if operation was successful +* (memory to allocate, legal context). +* @xfrm_state_alloc_acquire: +* @x contains the xfrm_state being added to the Security Association +* Database by the XFRM system. +* @polsec contains the policy's security context. +* @secid contains the secid from which to take the mls portion of the +* context. +* Allocate a security structure to the x->security field; the security +* field is initialized to NULL when the xfrm_state is allocated. Set the +* context to correspond to secid. Return 0 if operation was successful +* (memory to allocate, legal context). * @xfrm_state_free_security: * @x contains the xfrm_state. * Deallocate x->security.
@@ -1651,9 +1659,11 @@ struct security_operations {int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx,struct xfrm_sec_ctx **new_ctx);void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx); -int (*xfrm_state_alloc_security) (struct xfrm_state *x, -struct xfrm_user_sec_ctx *sec_ctx, -u32 secid); +int (*xfrm_state_alloc) (struct xfrm_state *x, +struct xfrm_user_sec_ctx *sec_ctx); +int (*xfrm_state_alloc_acquire) (struct xfrm_state *x, +struct xfrm_sec_ctx *polsec, +u32 secid);void (*xfrm_state_free_security) (struct xfrm_state *x);int (*xfrm_state_delete_security) (struct xfrm_state *x);int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx,u32 fl_secid,u8 dir);
security/capability.c +11 -4
@@ -767,9 +767,15 @@ static int cap_xfrm_policy_delete_security(struct xfrm_sec_ctx *ctx)return 0 ; } -static int cap_xfrm_state_alloc_security (struct xfrm_state *x, -struct xfrm_user_sec_ctx *sec_ctx, -u32 secid) +static int cap_xfrm_state_alloc (struct xfrm_state *x, +struct xfrm_user_sec_ctx *sec_ctx) +{ +return 0 ; +} + +static int cap_xfrm_state_alloc_acquire (struct xfrm_state *x, +struct xfrm_sec_ctx *polsec, +u32 secid) {return 0 ; }
@@ -1084,7 +1090,8 @@ void __init security_fixup_ops(struct security_operations *ops)set_to_cap_if_null (ops, xfrm_policy_clone_security);set_to_cap_if_null (ops, xfrm_policy_free_security);set_to_cap_if_null (ops, xfrm_policy_delete_security); -set_to_cap_if_null (ops, xfrm_state_alloc_security); +set_to_cap_if_null (ops, xfrm_state_alloc); +set_to_cap_if_null (ops, xfrm_state_alloc_acquire);set_to_cap_if_null (ops, xfrm_state_free_security);set_to_cap_if_null (ops, xfrm_state_delete_security);set_to_cap_if_null (ops, xfrm_policy_lookup);
security/security.c +4 -9
@@ -1322,22 +1322,17 @@ int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)return security_ops->xfrm_policy_delete_security (ctx); } -int security_xfrm_state_alloc (struct xfrm_state *x,struct xfrm_user_sec_ctx *sec_ctx) +int security_xfrm_state_alloc (struct xfrm_state *x, +struct xfrm_user_sec_ctx *sec_ctx) { -return security_ops->xfrm_state_alloc_security (x, sec_ctx,0 ); +return security_ops->xfrm_state_alloc (x, sec_ctx); }EXPORT_SYMBOL (security_xfrm_state_alloc);int security_xfrm_state_alloc_acquire (struct xfrm_state *x,struct xfrm_sec_ctx *polsec,u32 secid) { -if (!polsec) -return 0 ; -/* -* We want the context to be taken from secid which is usually -* from the sock. -*/ -return security_ops->xfrm_state_alloc_security (x,NULL , secid); +return security_ops->xfrm_state_alloc_acquire (x, polsec, secid); }int security_xfrm_state_delete (struct xfrm_state *x)
security/selinux/hooks.c +3 -2
@@ -5705,10 +5705,11 @@ static struct security_operations selinux_ops = {#ifdef CONFIG_SECURITY_NETWORK_XFRM .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc, - .xfrm_policy_clone_security = selinux_xfrm_policy_clone, + .xfrm_policy_clone_security = selinux_xfrm_clone, .xfrm_policy_free_security = selinux_xfrm_policy_free, .xfrm_policy_delete_security = selinux_xfrm_policy_delete, - .xfrm_state_alloc_security = selinux_xfrm_state_alloc, + .xfrm_state_alloc = selinux_xfrm_state_alloc, + .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire, .xfrm_state_free_security = selinux_xfrm_state_free, .xfrm_state_delete_security = selinux_xfrm_state_delete, .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
security/selinux/include/xfrm.h +5 -3
@@ -9,14 +9,16 @@#include <net/flow.h> +int selinux_xfrm_clone (struct xfrm_sec_ctx *old_ctx, +struct xfrm_sec_ctx **new_ctxp);int selinux_xfrm_policy_alloc (struct xfrm_sec_ctx **ctxp,struct xfrm_user_sec_ctx *sec_ctx); -int selinux_xfrm_policy_clone (struct xfrm_sec_ctx *old_ctx, -struct xfrm_sec_ctx **new_ctxp);void selinux_xfrm_policy_free (struct xfrm_sec_ctx *ctx);int selinux_xfrm_policy_delete (struct xfrm_sec_ctx *ctx);int selinux_xfrm_state_alloc (struct xfrm_state *x, -struct xfrm_user_sec_ctx *sec_ctx,u32 secid); +struct xfrm_user_sec_ctx *sec_ctx); +int selinux_xfrm_state_alloc_acquire (struct xfrm_state *x, +struct xfrm_sec_ctx *polsec,u32 secid);void selinux_xfrm_state_free (struct xfrm_state *x);int selinux_xfrm_state_delete (struct xfrm_state *x);int selinux_xfrm_policy_lookup (struct xfrm_sec_ctx *ctx,u32 fl_secid,u8 dir);
security/selinux/xfrm.c +176 -208
505 lines not on this page · raw message
PATCH v2 2/2 xfrm: force a garbage collection after deleting a policy
In reply to Paul MooreIn some cases after deleting a policy from the SPD the policy would remain in the dst/flow/route cache for an extended period of time which caused problems for SELinux as its dynamic network access controls key off of the number of XFRM policy and state entries. This patch corrects this problem by forcing a XFRM garbage collection whenever a policy is sucessfully removed.
--- include/net/xfrm.h | 5 +++++ net/key/af_key.c | 4 ++++ net/xfrm/xfrm_policy.c | 3 ++- net/xfrm/xfrm_user.c | 2 ++ 4 files changed, 13 insertions(+), 1 deletion(-)
include/net/xfrm.h +5 -0
@@ -1160,6 +1160,8 @@ static inline void xfrm_sk_free_policy(struct sock *sk) } } +extern void xfrm_garbage_collect (struct net *net); +#else static inline void xfrm_sk_free_policy (struct sock *sk) {}
@@ -1194,6 +1196,9 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, {return 1 ; } +static inline void xfrm_garbage_collect (struct net *net) +{ +}#endif static __inline__
net/key/af_key.c +4 -0
@@ -2366,6 +2366,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa out:xfrm_pol_put (xp); +if (err ==0 ) +xfrm_garbage_collect (net);return err; }
@@ -2615,6 +2617,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_ out:xfrm_pol_put (xp); +if (delete && err ==0 ) +xfrm_garbage_collect (net);return err; }
net/xfrm/xfrm_policy.c +2 -1
@@ -2557,11 +2557,12 @@ static void __xfrm_garbage_collect(struct net *net) } } -static void xfrm_garbage_collect (struct net *net) +void xfrm_garbage_collect (struct net *net) {flow_cache_flush ();__xfrm_garbage_collect (net); } +EXPORT_SYMBOL (xfrm_garbage_collect);static void xfrm_garbage_collect_deferred (struct net *net) {
net/xfrm/xfrm_user.c +2 -0
@@ -1681,6 +1681,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, out:xfrm_pol_put (xp); +if (delete && err ==0 ) +xfrm_garbage_collect (net);return err; }
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 10 lines · Paul Moore
A bump to v2 to incorporate Sergei's minor comment on the previous patchset. I've also gone ahead and dropped the "RFC" from the patchset as I didn't see any significant comments/concerns from anyone.
---
Paul Moore (2):
selinux: fix the labeled xfrm/IPsec reference count handling
xfrm: force a garbage collection after deleting a policy
Hi Dave, Eric,
I think we need to get this in for 3.10, assuming no objections from either one of you, who wants to pull it into their tree?
-Paul
P.S. Technically this could also be -stable material but I'm not pushing for that as this isn't really a panic issue, just a nuisance.
Signature · 8 lines
paul moore security and virtualization @ redhat -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
David Miller
maintainerFrom: Paul Moore <[email protected]>
Date: Fri, 24 May 2013 14:16:16 -0400
Quoted 4 lines
A bump to v2 to incorporate Sergei's minor comment on the previous patchset. I've also gone ahead and dropped the "RFC" from the patchset as I didn't see any significant comments/concerns from anyone.
Genuine bug fixes should be targetted at 'net' and not be mixed with random other cleanup, janitorial, etc. changes that belong in 'net-next' only.