RPCSEC_GSS3 full mode label kernel patch set

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 net/sunrpc/auth_gss/auth_gss.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

net/sunrpc/auth_gss/auth_gss.c +10 -0

index cdeb1d8..d8395ce 100644
@@ -1869,6 +1869,11 @@ gss_wrap_req(struct rpc_task *task,
 	case RPC_GSS_SVC_PRIVACY:
 		status = gss_wrap_req_priv(cred, ctx, encode, rqstp, p, obj);
 		break;
+	default:
+		status = -EIO;
+		pr_warn("RPC    Unsupported service level %d\n",
+			gss_cred->gc_service);
+		break;
 	}
 out:
 	gss_put_ctx(ctx);

@@ -1979,6 +1984,11 @@ gss_unwrap_resp(struct rpc_task *task,
 		if (status)
 			goto out;
 		break;
+	default:
+		status = -EIO;
+		pr_warn("RPC    Unsupported service level %d\n",
+			gss_cred->gc_service);
+		goto out;
 	}
 	/* take into account extra slack for integrity and privacy cases: */
 	cred->cr_auth->au_rslack = cred->cr_auth->au_verfsize + (p - savedp)

Signature · 1 line

2.9.3

From: Andy Adamson <[email protected]>

RPCSEC_GSS_CREATE and RPCSEC_GSS_LIST are RPCNULL calls with a payload

Signed-off-by Andy Adamson <[email protected]>

---
 include/linux/sunrpc/clnt.h |  3 +++
 net/sunrpc/clnt.c           | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

include/linux/sunrpc/clnt.h +3 -0

index 333ad11..6d9e4ac 100644
@@ -175,6 +175,9 @@ int		rpc_call_sync(struct rpc_clnt *clnt,
 			      const struct rpc_message *msg, int flags);
 struct rpc_task *rpc_call_null(struct rpc_clnt *clnt, struct rpc_cred *cred,
 			       int flags);
+struct rpc_task *rpc_call_null_payload(struct rpc_clnt *clnt,
+				struct rpc_cred *cred, int flags, void *argp,
+				void *resp, struct rpc_procinfo *pinfo);
 int		rpc_restart_call_prepare(struct rpc_task *);
 int		rpc_restart_call(struct rpc_task *);
 void		rpc_setbufsize(struct rpc_clnt *, unsigned int, unsigned int);

net/sunrpc/clnt.c +20 -0

index 1dc9f3b..c6f1d04 100644
@@ -2508,6 +2508,26 @@ static int rpcproc_decode_null(void *rqstp, struct xdr_stream *xdr, void *obj)
 	return 0;
 }
 
+struct rpc_task *
+rpc_call_null_payload(struct rpc_clnt *clnt, struct rpc_cred *cred, int flags,
+		      void *argp, void *resp, struct rpc_procinfo *pinfo)
+{
+	struct rpc_message msg = {
+		.rpc_proc = pinfo,
+		.rpc_argp = argp,
+		.rpc_resp = resp,
+		.rpc_cred = cred,
+	};
+	struct rpc_task_setup task_setup_data = {
+		.rpc_client = clnt,
+		.rpc_message = &msg,
+		.callback_ops = &rpc_default_ops,
+		.flags = flags,
+	};
+	return rpc_run_task(&task_setup_data);
+}
+EXPORT_SYMBOL_GPL(rpc_call_null_payload);
+
 static struct rpc_procinfo rpcproc_null = {
 	.p_encode = rpcproc_encode_null,
 	.p_decode = rpcproc_decode_null,

Signature · 1 line

2.9.3

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 include/linux/sunrpc/auth_gss.h |  1 +
 net/sunrpc/auth_gss/auth_gss.c  | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

include/linux/sunrpc/auth_gss.h +1 -0

index 8939db4..4ab63a9 100644
@@ -71,6 +71,7 @@ struct rpc_gss_init_res {
 
 struct gss_cl_ctx {
 	atomic_t		count;
+	u32			gc_v;
 	enum rpc_gss_proc	gc_proc;
 	u32			gc_seq;
 	spinlock_t		gc_seq_lock;

net/sunrpc/auth_gss/auth_gss.c +12 -4

index d8395ce..216a78e 100644
@@ -213,6 +213,7 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
 	unsigned int seclen;
 	unsigned int timeout;
 	unsigned long now = jiffies;
+	unsigned int gss_v;
 	u32 window_size;
 	int ret;
 

@@ -226,6 +227,13 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
 	if (timeout == 0)
 		timeout = GSSD_MIN_TIMEOUT;
 	ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
+
+	/* RPCSEC_GSS version used to obtain context */
+	p = simple_get_bytes(p, end, &gss_v, sizeof(gss_v));
+	if (IS_ERR(p))
+		goto err;
+	ctx->gc_v = gss_v;
+
 	/* Sequence number window. Determines the maximum number of
 	 * simultaneous requests
 	 */

@@ -1511,10 +1519,10 @@ gss_marshal(struct rpc_task *task, __be32 *p)
 	req->rq_seqno = ctx->gc_seq++;
 	spin_unlock(&ctx->gc_seq_lock);
 
-	*p++ = htonl((u32) RPC_GSS_VERSION);
-	*p++ = htonl((u32) ctx->gc_proc);
-	*p++ = htonl((u32) req->rq_seqno);
-	*p++ = htonl((u32) gss_cred->gc_service);
+	*p++ = htonl((u32)ctx->gc_v);
+	*p++ = htonl((u32)ctx->gc_proc);
+	*p++ = htonl((u32)req->rq_seqno);
+	*p++ = htonl((u32)gss_cred->gc_service);
 	p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
 	*cred_len = htonl((p - (cred_len + 1)) << 2);
 

Signature · 1 line

2.9.3

From: Andy Adamson <[email protected]>

The new GSS Version 3 reply verifier is taken over the same data as the call verifier, caveat REPLY direction

Verifier Data

   xid          tk_rqstp->rq_xid
   direction    REPLY (always a 1) RPC_REPLY
   rpcvers      RPC_VERSION
   prog         clnt->cl_prog
   vers         clnt->cl_vers
   proc         tk_msg.rpc_proc->p_proc
   credential
         flavor       RPC_AUTH_GSS
         length       cred_len is in gss_marshal (new gv_crlen)
         gss version  ctx->gc_v
         gss proc     ctx->gv_proc
         gss seq      tk_rqstp->rq_seqno
         gss svc      gss_cred->gc_service
         gss ctx len  ctx->gc_wire_ctx
         gss ctx data ctx->gc_wire_ctx

Signed-off-by Andy Adamson <[email protected]>

---
 net/sunrpc/auth_gss/auth_gss.c | 59 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 57 insertions(+), 2 deletions(-)

net/sunrpc/auth_gss/auth_gss.c +4 -0

index 216a78e..499cf99 100644
@@ -1624,6 +1624,53 @@ gss_refresh_null(struct rpc_task *task)
 	return 0;
 }
 
+/**
+ * gss3_reply_verifier: The new gssv3 verifier uses same data as call
+ * caveat REPLY direction - see rpc_encode_header
+ */

net/sunrpc/auth_gss/auth_gss.c +18 -0

+	len = (13 * 4) + ctx->gc_wire_ctx.len;
+	gss3_buf = kmalloc(len, GFP_NOFS);
+	if (!gss3_buf) {
+		gss3_buf = ERR_PTR(-EIO);
+		goto out;
+	}
+	ptr = (__be32 *)gss3_buf;
+
+	*ptr++ = htonl(task->tk_rqstp->rq_xid);
+	*ptr++ = htonl(RPC_REPLY);
+	*ptr++ = htonl(RPC_VERSION);
+	*ptr++ = htonl(task->tk_client->cl_prog);
+	*ptr++ = htonl(task->tk_client->cl_vers);
+	*ptr++ = htonl(task->tk_msg.rpc_proc->p_proc);
+	*ptr++ = htonl(RPC_AUTH_GSS);
+
+	/* credential */
+	crlen = ptr++;

net/sunrpc/auth_gss/auth_gss.c +14 -2

+out:
+	return gss3_buf;
+}
+
 static __be32 *
 gss_validate(struct rpc_task *task, __be32 *p)
 {

@@ -1633,6 +1680,7 @@ gss_validate(struct rpc_task *task, __be32 *p)
 	struct kvec	iov;
 	struct xdr_buf	verf_buf;
 	struct xdr_netobj mic;
+	void	*g3_buf = NULL;
 	u32		flav,len;
 	u32		maj_stat;
 	__be32		*ret = ERR_PTR(-EIO);

@@ -1648,14 +1696,21 @@ gss_validate(struct rpc_task *task, __be32 *p)
 	if (!seq)
 		goto out_bad;
 	*seq = htonl(task->tk_rqstp->rq_seqno);
-	iov.iov_base = seq;
-	iov.iov_len = 4;
+	if (ctx->gc_v == RPC_GSS_VERSION) {
+		iov.iov_base = seq;
+		iov.iov_len = 4;
+	} else if (ctx->gc_v == RPC_GSS3_VERSION) {
+		g3_buf = gss3_reply_verifier(cred, ctx, task, seq, &iov);
+		if (IS_ERR(g3_buf))
+			goto out_bad;
+	}
 	xdr_buf_from_iov(&iov, &verf_buf);
 	mic.data = (u8 *)p;
 	mic.len = len;
 
 	ret = ERR_PTR(-EACCES);
 	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
+	kfree(g3_buf);
 	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
 		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 	if (maj_stat) {

Signature · 1 line

2.9.3

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 include/linux/sunrpc/auth_gss.h |  54 ++++++++++++
 net/sunrpc/auth_gss/auth_gss.c  | 182 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 236 insertions(+)

include/linux/sunrpc/auth_gss.h +54 -0

index 4ab63a9..b2a5a61 100644
@@ -93,6 +93,60 @@ struct gss_cred {
 	unsigned long		gc_upcall_timestamp;
 };
 
+/** GSS3 */
+enum gss3_type {
+	GSS3_LABEL = 0,
+	GSS3_PRIVS = 1,
+};
+
+struct gss3_chan_binding {
+	u32	cb_len;
+	void	*cb_binding;
+};
+
+struct gss3_mp_auth {
+	u32	mp_handle_len;
+	void	*mp_handle;
+	u32	*mp_mic_len;
+	void	*mp_mic;	/* header mic */
+};
+
+struct gss3_label {
+	u32			la_lfs;
+	u32			la_pi;
+	struct xdr_netobj	la_label;
+};
+
+struct gss3_privs {
+	char	*pr_name;
+	u32	pr_num;
+	void	*pr_data;
+};
+
+struct gss3_assertion_u {
+	u32	au_type;
+	union {
+		struct gss3_label	au_label;
+		struct gss3_privs	au_privs;
+	} u;
+};
+
+struct gss3_create_args {
+	struct gss3_mp_auth		*ca_mp_auth;
+	struct gss3_chan_binding	*ca_chan_bind;
+	u32			ca_num;
+	struct gss3_assertion_u	*ca_assertions;
+};
+
+struct gss3_create_res {
+	u32		cr_hlen;
+	void		*cr_handle;
+	struct gss3_mp_auth		*cr_mp_auth;
+	struct gss3_chan_binding	*cr_chan_bind;
+	u32			cr_num;
+	struct gss3_assertion_u	*cr_assertions;
+};
+
 #endif /* __KERNEL__ */
 #endif /* _LINUX_SUNRPC_AUTH_GSS_H */
 

net/sunrpc/auth_gss/auth_gss.c +77 -0

index 499cf99..6ffb16d 100644
@@ -1591,6 +1591,188 @@ static int gss_cred_is_negative_entry(struct rpc_cred *cred)
 	return 0;
 }
 
+/**
+ * GSS3_createargs_maxsz and GSS3_createres_maxsz
+ * include no rgss3_assertion_u payload.
+ */
+#define GSS3_createargs_maxsz  (1 /* empty ca_mp_auth */ + \
+				1 /* empty ca_chan_bind */ + \
+				1 /* ca_num */ + \
+				1 /* au_type */)
+#define GSS3_createres_maxsz   (1 /* cr_hlen */ + \
+				XDR_QUADLEN(1024) /* cr_handle*/ + \
+				GSS3_createargs_maxsz)
+
+static void
+gss3_enc_create(struct rpc_rqst *req, struct xdr_stream *xdr,
+		const struct gss3_create_args *g3ca)
+{
+	u32 type;
+	__be32 *p;
+
+	p = xdr_reserve_space(xdr, GSS3_createargs_maxsz << 2);
+	*p++ = cpu_to_be32(0); /* NULL ca_mp_auth */
+	*p++ = cpu_to_be32(0); /* NULL ca_chan_bind */
+	*p++ = cpu_to_be32(g3ca->ca_num);
+	type = cpu_to_be32(g3ca->ca_assertions->au_type);
+	*p++ = type;
+	switch (type) {
+	case GSS3_LABEL:
+	case GSS3_PRIVS:
+	default:
+		/* drop through to return */
+		pr_warn("RPC    Unsupported gss3 create assertion %d\n", type);
+	}
+}
+
+static int
+gss3_dec_create(struct rpc_rqst *req, struct xdr_stream *xdr,
+		struct gss3_create_res *g3cr)
+{
+	u32 dummy, type;
+	__be32 *p;
+
+	p = xdr_inline_decode(xdr, 4);
+	if (unlikely(!p))
+		goto out_overflow;
+	g3cr->cr_hlen = be32_to_cpup(p++);
+
+	p = xdr_inline_decode(xdr, g3cr->cr_hlen + 16);
+	if (unlikely(!p))
+		goto out_overflow;
+
+	g3cr->cr_handle = kmemdup(p, g3cr->cr_hlen, GFP_KERNEL);
+	if (!g3cr->cr_handle)
+		goto out_err;
+
+	p += XDR_QUADLEN(g3cr->cr_hlen);
+
+	/* cr_mp_auth: not supported */
+	dummy = be32_to_cpup(p++);
+	if (dummy != 0) {
+		pr_warn("RPC    gss3 create cr_mp_auth not supported\n");
+		goto out_free_handle;
+	}
+
+	/* cr_chan_bind: not supported */
+	dummy = be32_to_cpup(p++);
+	if (dummy != 0) {
+		pr_warn("RPC    gss3 create cr_chan_bind not supported\n");
+		goto out_free_handle;
+	}
+
+	/* XXX Support one assertion */
+	g3cr->cr_num = be32_to_cpup(p++);
+	if (g3cr->cr_num != 1) {
+		pr_warn("RPC    gss3 multiple assertions %d unspported\n",
+			g3cr->cr_num);
+		goto out_free_handle;
+	}

net/sunrpc/auth_gss/auth_gss.c +95 -0

+	return 0;
+
+out_free_handle:
+	kfree(g3cr->cr_handle);
+out_err:
+	return -EIO;
+out_overflow:
+	pr_warn("RPC    %s End of receive buffer. Remaining len: %tu words.\n",
+		__func__, xdr->end - xdr->p);
+	goto out_err;
+}
+
+#define RPC_PROC_NULL 0
+
+struct rpc_procinfo gss3_label_assertion[] = {
+	[RPC_GSS_PROC_CREATE] = {
+		.p_proc		= RPC_PROC_NULL,
+		.p_encode	= (kxdreproc_t)gss3_enc_create,
+		.p_decode	= (kxdrdproc_t)gss3_dec_create,
+		.p_arglen	= GSS3_createargs_maxsz,
+		.p_replen	= GSS3_createres_maxsz,
+		.p_statidx	= RPC_GSS_PROC_CREATE,
+		.p_timer	= 0,
+		.p_name		= "GSS_PROC_CREATE",
+	},
+};
+
+/**
+ * RPC_GSS_PROC_CREATE operation
+ *
+ * Notes:
+ *    1) Spec says we MUST use integrity or privacy security service.
+ *    First pass; use rpc_gss_svc_none.
+ *    2) asserts are allocated by caller, and freed here.
+ */
+static int
+gss3_proc_create(struct rpc_cred *cred, struct gss3_assertion_u *asserts,
+		 int numasserts)
+{
+	struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth,
+						 rpc_auth);
+	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
+	struct rpc_task *task;
+	struct gss3_create_res cres = {
+		.cr_mp_auth = 0,
+	};
+	struct gss3_create_args *cargs = NULL;
+	int ret = -EINVAL;
+
+	if (!ctx || !asserts)
+		goto out;
+	/**
+	 * Take a reference to ensure the cred sticks around as we create
+	 * a child context
+	 * XXX does grabbing a reference to the context (gss_cred_get_ctx)
+	 * also keep the cred from being removed?
+	 * XXX do we need to keep this cred reference until the child context
+	 * handle and associated assertion is removed?
+	 */
+	get_rpccred(cred);
+
+	ret = -ENOMEM;
+	cargs = kzalloc(sizeof(*cargs), GFP_NOFS);
+	if (!cargs)
+		goto out_err;
+
+	cargs->ca_assertions = asserts;
+	cargs->ca_num = numasserts;
+	ctx->gc_proc = RPC_GSS_PROC_CREATE;
+	cred->cr_ops = &gss_credops;
+
+	/* Want a sync rpc call */
+	task = rpc_call_null_payload(gss_auth->client, cred, 0, cargs, &cres,
+				    &gss3_label_assertion[RPC_GSS_PROC_CREATE]);
+	if (IS_ERR(task)) {
+		ret = PTR_ERR(task);
+		goto out_free_assert;
+	}
+	if (task->tk_status != 0) {
+		ret = task->tk_status;
+		goto out_free_assert;
+	}
+	rpc_put_task(task);
+
+out_free_assert:
+	kfree(cargs->ca_assertions);
+	kfree(cargs);
+out_err:
+	ctx->gc_proc = RPC_GSS_PROC_DATA;
+	gss_put_ctx(ctx);
+	put_rpccred(cred);
+out:
+	return ret;
+}
+
 /*
 * Refresh credentials. XXX - finish
 */

Signature · 1 line

2.9.3

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 net/sunrpc/auth_gss/auth_gss.c | 140 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 138 insertions(+), 2 deletions(-)

net/sunrpc/auth_gss/auth_gss.c +118 -2

index 6ffb16d..98971cf 100644
@@ -52,9 +52,12 @@
 #include <linux/sunrpc/gss_api.h>
 #include <linux/uaccess.h>
 #include <linux/hashtable.h>
+#include <linux/security.h>
 
 #include "../netns.h"
 
+static int gss3_create_label(struct rpc_cred *cred, int gss_vers);
+
 static const struct rpc_authops authgss_ops;
 
 static const struct rpc_credops gss_credops;

@@ -128,6 +131,20 @@ gss_put_ctx(struct gss_cl_ctx *ctx)
 		gss_free_ctx(ctx);
 }
 
+/* gss3_label_enabled:
+ * Called to determine if Full Mode Mandatory Access Control (MAC)
+ * over a GSS connection is desired.
+ *
+ * Note:
+ * Currently Full Mode MAC is assuemed if SeLinux is enabled and
+ * RPCSEC_GSS version 3 is in use.
+ */
+static inline bool
+gss3_label_assertion_is_enabled(u32 rpcsec_version)
+{
+	return (rpcsec_version == RPC_GSS3_VERSION && selinux_is_enabled());
+}
+
 /* gss_cred_set_ctx:
  * called by gss_upcall_callback and gss_create_upcall in order
  * to set the gss context. The actual exchange of an old context

@@ -145,6 +162,7 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 	set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 	smp_mb__before_atomic();
 	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
+	gss3_create_label(cred, ctx->gc_v);
 }
 
 static const void *

@@ -1602,6 +1620,75 @@ static int gss_cred_is_negative_entry(struct rpc_cred *cred)
 #define GSS3_createres_maxsz   (1 /* cr_hlen */ + \
 				XDR_QUADLEN(1024) /* cr_handle*/ + \
 				GSS3_createargs_maxsz)
+#define GSS3_labelargs_maxsz	(1 /* la_lfs */ + \
+				 1 /* la_pi */ + \
+				 1 /* la_label.len */ + \
+				 XDR_QUADLEN(1024) /* la_label.data */)
+#define GSS3_labelres_maxsz	GSS3_labelargs_maxsz
+
+static void
+gss3_enc_label(struct rpc_rqst *req, struct xdr_stream *xdr,
+	       const struct gss3_create_args *g3ca)
+{
+	struct gss3_label *gl;
+	__be32 *p;
+
+	gl = &g3ca->ca_assertions[0].u.au_label;
+
+	dprintk("RPC: %5u encoding GSSv3 label %s:%d\n", req->rq_task->tk_pid,
+		(char *)gl->la_label.data, gl->la_label.len);
+
+	p = xdr_reserve_space(xdr, GSS3_labelargs_maxsz << 2);
+	*p++ = cpu_to_be32(0); /* la_lfs */
+	*p++ = cpu_to_be32(0); /* la_pi */
+	p = xdr_encode_netobj(p, &gl->la_label);
+}
+
+static int
+gss3_dec_label(struct rpc_rqst *req, struct xdr_stream *xdr,
+	       struct gss3_create_res *g3cr)
+{
+	struct gss3_label *gl;
+	struct gss3_assertion_u *g3a;
+	__be32 *p;
+
+	/* Used to store assertion in parent gss_cl_ctx */
+	g3a = kzalloc(sizeof(*g3a), GFP_KERNEL);
+	if (!g3a)
+		goto out_err;
+
+	g3a->au_type = GSS3_LABEL;
+	gl = &g3a->u.au_label;
+
+	p = xdr_inline_decode(xdr, 12);
+	if (unlikely(!p))
+		goto out_overflow;
+
+	gl->la_lfs = be32_to_cpup(p++);
+	gl->la_pi = be32_to_cpup(p++);
+	gl->la_label.len = be32_to_cpup(p++);
+
+	p = xdr_inline_decode(xdr, gl->la_label.len);
+	if (unlikely(!p))
+		goto out_overflow;
+
+	gl->la_label.data = kmemdup(p, gl->la_label.len, GFP_KERNEL);
+	if (!gl->la_label.data)
+		goto out_free_assert;
+
+	g3cr->cr_assertions = g3a;
+
+	return 0;
+
+out_free_assert:
+	kfree(g3a);
+out_err:
+	return -EIO;
+out_overflow:
+	pr_warn("RPC    %s End of receive buffer. Remaining len: %tu words.\n",
+		__func__, xdr->end - xdr->p);
+	goto out_free_assert;
+}
 
 static void
 gss3_enc_create(struct rpc_rqst *req, struct xdr_stream *xdr,

@@ -1618,6 +1705,8 @@ gss3_enc_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 	*p++ = type;
 	switch (type) {
 	case GSS3_LABEL:
+		gss3_enc_label(req, xdr, g3ca);
+		break;
 	case GSS3_PRIVS:
 	default:
 		/* drop through to return */

@@ -1673,6 +1762,9 @@ gss3_dec_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 	type = be32_to_cpup(p++);
 	switch (type) {
 	case GSS3_LABEL:
+		if (gss3_dec_label(req, xdr, g3cr) != 0)
+			goto out_free_handle;
+		break;
 	case GSS3_PRIVS:
 	default:
 		pr_warn("RPC    Unsupported gss3 create assertion %d\n", type);

@@ -1692,13 +1784,16 @@ gss3_dec_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 
 #define RPC_PROC_NULL 0
 
+#define GSS3_create_args_max	(GSS3_createargs_maxsz + GSS3_labelargs_maxsz)
+#define GSS3_create_res_max	(GSS3_createres_maxsz + GSS3_labelres_maxsz)
+
 struct rpc_procinfo gss3_label_assertion[] = {
 	[RPC_GSS_PROC_CREATE] = {
 		.p_proc		= RPC_PROC_NULL,
 		.p_encode	= (kxdreproc_t)gss3_enc_create,
 		.p_decode	= (kxdrdproc_t)gss3_dec_create,
-		.p_arglen	= GSS3_createargs_maxsz,
-		.p_replen	= GSS3_createres_maxsz,
+		.p_arglen	= GSS3_create_args_max,
+		.p_replen	= GSS3_create_res_max,
 		.p_statidx	= RPC_GSS_PROC_CREATE,
 		.p_timer	= 0,
 		.p_name		= "GSS_PROC_CREATE",

@@ -1773,6 +1868,47 @@ gss3_proc_create(struct rpc_cred *cred, struct gss3_assertion_u *asserts,
 	return ret;
 }
 
+/**
+ * GSS3 Label Assertion
+ *
+ * Support one label assertion
+ *
+ * XXX Return not checked. Should we fail nfs requests if
+ * a label fails to be created? I think the server enforcing
+ * Full Mode MAC will reject an NFS request that does not use
+ * a GSS3 (child) context with the correct label.
+ */
+static int
+gss3_create_label(struct rpc_cred *cred, int gss_vers)
+{
+	struct gss3_assertion_u *asserts;
+	struct gss3_label *gl;
+	int ret;
+
+	if (!gss3_label_assertion_is_enabled(gss_vers))
+		return -EINVAL;
+
+	asserts = kzalloc(sizeof(*asserts), GFP_NOFS);

net/sunrpc/auth_gss/auth_gss.c +10 -0

+	if (ret)
+		goto out_free_asserts;
+
+	return gss3_proc_create(cred, asserts, 1);
+
+out_free_asserts:
+	kfree(asserts);
+	return ret;
+}
+
 /*
 * Refresh credentials. XXX - finish
 */

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 net/sunrpc/auth_gss/auth_gss.c | 140 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 138 insertions(+), 2 deletions(-)

net/sunrpc/auth_gss/auth_gss.c +3 -0

index 6ffb16d..98971cf 100644
@@ -52,9 +52,12 @@
 #include <linux/sunrpc/gss_api.h>
 #include <linux/uaccess.h>
 #include <linux/hashtable.h>
+#include <linux/security.h>
 
 #include "../netns.h"
 
+static int gss3_create_label(struct rpc_cred *cred, int gss_vers);
+
 static const struct rpc_authops authgss_ops;
 
 static const struct rpc_credops gss_credops;

net/sunrpc/auth_gss/auth_gss.c +128 -2

+ */
+static inline bool
+gss3_label_assertion_is_enabled(u32 rpcsec_version)
+{
+	return (rpcsec_version == RPC_GSS3_VERSION && selinux_is_enabled());
+}
+
 /* gss_cred_set_ctx:
  * called by gss_upcall_callback and gss_create_upcall in order
  * to set the gss context. The actual exchange of an old context

@@ -145,6 +162,7 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 	set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 	smp_mb__before_atomic();
 	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
+	gss3_create_label(cred, ctx->gc_v);
 }
 
 static const void *

@@ -1602,6 +1620,75 @@ static int gss_cred_is_negative_entry(struct rpc_cred *cred)
 #define GSS3_createres_maxsz   (1 /* cr_hlen */ + \
 				XDR_QUADLEN(1024) /* cr_handle*/ + \
 				GSS3_createargs_maxsz)
+#define GSS3_labelargs_maxsz	(1 /* la_lfs */ + \
+				 1 /* la_pi */ + \
+				 1 /* la_label.len */ + \
+				 XDR_QUADLEN(1024) /* la_label.data */)
+#define GSS3_labelres_maxsz	GSS3_labelargs_maxsz
+
+static void
+gss3_enc_label(struct rpc_rqst *req, struct xdr_stream *xdr,
+	       const struct gss3_create_args *g3ca)
+{
+	struct gss3_label *gl;
+	__be32 *p;
+
+	gl = &g3ca->ca_assertions[0].u.au_label;
+
+	dprintk("RPC: %5u encoding GSSv3 label %s:%d\n", req->rq_task->tk_pid,
+		(char *)gl->la_label.data, gl->la_label.len);
+
+	p = xdr_reserve_space(xdr, GSS3_labelargs_maxsz << 2);
+	*p++ = cpu_to_be32(0); /* la_lfs */
+	*p++ = cpu_to_be32(0); /* la_pi */
+	p = xdr_encode_netobj(p, &gl->la_label);
+}
+
+static int
+gss3_dec_label(struct rpc_rqst *req, struct xdr_stream *xdr,
+	       struct gss3_create_res *g3cr)
+{
+	struct gss3_label *gl;
+	struct gss3_assertion_u *g3a;
+	__be32 *p;
+
+	/* Used to store assertion in parent gss_cl_ctx */
+	g3a = kzalloc(sizeof(*g3a), GFP_KERNEL);
+	if (!g3a)
+		goto out_err;
+
+	g3a->au_type = GSS3_LABEL;
+	gl = &g3a->u.au_label;
+
+	p = xdr_inline_decode(xdr, 12);
+	if (unlikely(!p))
+		goto out_overflow;
+
+	gl->la_lfs = be32_to_cpup(p++);
+	gl->la_pi = be32_to_cpup(p++);
+	gl->la_label.len = be32_to_cpup(p++);
+
+	p = xdr_inline_decode(xdr, gl->la_label.len);
+	if (unlikely(!p))
+		goto out_overflow;
+
+	gl->la_label.data = kmemdup(p, gl->la_label.len, GFP_KERNEL);
+	if (!gl->la_label.data)
+		goto out_free_assert;
+
+	g3cr->cr_assertions = g3a;
+
+	return 0;
+
+out_free_assert:
+	kfree(g3a);
+out_err:
+	return -EIO;
+out_overflow:
+	pr_warn("RPC    %s End of receive buffer. Remaining len: %tu words.\n",
+		__func__, xdr->end - xdr->p);
+	goto out_free_assert;
+}
 
 static void
 gss3_enc_create(struct rpc_rqst *req, struct xdr_stream *xdr,

@@ -1618,6 +1705,8 @@ gss3_enc_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 	*p++ = type;
 	switch (type) {
 	case GSS3_LABEL:
+		gss3_enc_label(req, xdr, g3ca);
+		break;
 	case GSS3_PRIVS:
 	default:
 		/* drop through to return */

@@ -1673,6 +1762,9 @@ gss3_dec_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 	type = be32_to_cpup(p++);
 	switch (type) {
 	case GSS3_LABEL:
+		if (gss3_dec_label(req, xdr, g3cr) != 0)
+			goto out_free_handle;
+		break;
 	case GSS3_PRIVS:
 	default:
 		pr_warn("RPC    Unsupported gss3 create assertion %d\n", type);

@@ -1692,13 +1784,16 @@ gss3_dec_create(struct rpc_rqst *req, struct xdr_stream *xdr,
 
 #define RPC_PROC_NULL 0
 
+#define GSS3_create_args_max	(GSS3_createargs_maxsz + GSS3_labelargs_maxsz)
+#define GSS3_create_res_max	(GSS3_createres_maxsz + GSS3_labelres_maxsz)
+
 struct rpc_procinfo gss3_label_assertion[] = {
 	[RPC_GSS_PROC_CREATE] = {
 		.p_proc		= RPC_PROC_NULL,
 		.p_encode	= (kxdreproc_t)gss3_enc_create,
 		.p_decode	= (kxdrdproc_t)gss3_dec_create,
-		.p_arglen	= GSS3_createargs_maxsz,
-		.p_replen	= GSS3_createres_maxsz,
+		.p_arglen	= GSS3_create_args_max,
+		.p_replen	= GSS3_create_res_max,
 		.p_statidx	= RPC_GSS_PROC_CREATE,
 		.p_timer	= 0,
 		.p_name		= "GSS_PROC_CREATE",

@@ -1773,6 +1868,47 @@ gss3_proc_create(struct rpc_cred *cred, struct gss3_assertion_u *asserts,
 	return ret;
 }
 
+/**
+ * GSS3 Label Assertion
+ *
+ * Support one label assertion
+ *
+ * XXX Return not checked. Should we fail nfs requests if
+ * a label fails to be created? I think the server enforcing
+ * Full Mode MAC will reject an NFS request that does not use
+ * a GSS3 (child) context with the correct label.
+ */
+static int
+gss3_create_label(struct rpc_cred *cred, int gss_vers)
+{
+	struct gss3_assertion_u *asserts;
+	struct gss3_label *gl;
+	int ret;
+
+	if (!gss3_label_assertion_is_enabled(gss_vers))
+		return -EINVAL;
+
+	asserts = kzalloc(sizeof(*asserts), GFP_NOFS);
+	if (!asserts)
+		return -ENOMEM;
+
+	/* NOTE: not setting la_lfs, la_pi. Do we even need them? */
+	asserts->au_type = GSS3_LABEL;
+	gl = &asserts->u.au_label;
+
+	ret = -EINVAL;
+	ret = security_current_sid_to_context((char **)&gl->la_label.data,
+					      &gl->la_label.len);
+	if (ret)
+		goto out_free_asserts;
+
+	return gss3_proc_create(cred, asserts, 1);
+
+out_free_asserts:
+	kfree(asserts);
+	return ret;
+}
+
 /*
 * Refresh credentials. XXX - finish
 */

Signature · 1 line

2.9.3

Quoted 25 lines · On Fri, Feb 24, 2017 at 05:19:44PM -0500, [email protected] wrote:

From: Andy Adamson <[email protected]>

Signed-off-by Andy Adamson <[email protected]>

---
 net/sunrpc/auth_gss/auth_gss.c | 140 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 138 insertions(+), 2 deletions(-)

net/sunrpc/auth_gss/auth_gss.c +3 -0

index 6ffb16d..98971cf 100644
@@ -52,9 +52,12 @@
 #include <linux/sunrpc/gss_api.h>
 #include <linux/uaccess.h>
 #include <linux/hashtable.h>
+#include <linux/security.h>
 
 #include "../netns.h"
 
+static int gss3_create_label(struct rpc_cred *cred, int gss_vers);
+
 static const struct rpc_authops authgss_ops;
 
 static const struct rpc_credops gss_credops;

net/sunrpc/auth_gss/auth_gss.c gss_put_ctx(struct gss_cl_ctx *ctx) · line 140

Quoted 10 lines

net/sunrpc/auth_gss/auth_gss.c +7 -0

@@ -128,6 +131,20 @@ gss_put_ctx(struct gss_cl_ctx *ctx)
 		gss_free_ctx(ctx);
 }
 
+/* gss3_label_enabled:
+ * Called to determine if Full Mode Mandatory Access Control (MAC)
+ * over a GSS connection is desired.
+ *
+ * Note:
+ * Currently Full Mode MAC is assuemed if SeLinux is enabled and
+ * RPCSEC_GSS version 3 is in use.

Eventually I guess we may want support for GSSv3-enabled copy without full MAC, so we'll want some way to configure this.

Also, do I understand right that currently it's gssd that decides whether to enable GSSv3, by passing down the new version number? How will the user choose whether to enable GSSv3 or not?

Should that be a mount option?

The mount option could then cause some "use_gss3" flag to be added in rpc_pipefs, in an info file or whatever. I think that'd also provide backwards compatibility (if you're not already handling that some other way), since gssd could use the presence of that flag to decide whether the kernel was new enough to support the new downcall.

From: Andy Adamson <[email protected]>

This patchset implements RFC 7861 RPCSEC_GSS Version 3 RPCSEC_GSS_CREATE operation with rgs3_label payloads to provide full mode Mandatory Access Control (MAC) when run with NFSv4.2 Labeled NFS using SeLinux.

A lot more testing is needed - and planned :)

Client was built on Trond's testing branch, 4.10.0 kernel. Server was built on Bruce's nfsd-next branch, 4.10.0-rc7 kernel

nfsd-next branch has these server required patches missing from Tronds testing branch:

1) svcrpc: free contexts immediately on PROC_DESTROY
2) nfsd: opt in to labeled nfs per export

Version-5.
---------
- responded to comments from Anna Schumaker
- refactored code to split generice RPCSEC_GSS_CREATE from label payload
- nfsd check for NFSEXP_SECURITY_LABEL export flag

Requires on Client:
-------------------
gssd patches: "RFC: GSSD changes for RPCSEC_GSS version 3" libtirpc patches "RFC: Libtirpc changes for RPCSEC_GSS version 3"

Implementation Features:
------------------------

GSSv3
- Negotiate GSS version - starts with GSSv3 then falls back to GSSv1 if GSSv3 is not supported.
- New GSSv3 reply verifier
- RPCSEC_GSS_CREATE operation generic code is separated from the payload code.
- rgss3_label assertion payload carries each client SeLinux thread label
- Supports one label assertion payload per RPCSEC_GSS_CREATE
- Kerberos pseudoflavor support (krb5, krb5i, krb5p)

TODO:
----
- Send all RPCSEC_GSS_CREATE calls with integrity or privacy
- Ensure SeLinux function exported in patch "SELINUX export security_current_sid_to_context" is OK with SeLinux experts.
- Perhaps add administrative ability on the client to indicate Full Mode MAC is desired and that NFSv4.2 Labeled NFS (LNFS) is used.

Prototype description:
---------------------
Parent GSS context: the normal GSS context
- "Normal" GSSv3 context is the same as a "normal" GSSv1 context except for the new GSS Version and new reply verifier. For GSSv3 this "normal" context is called the parent context.

Child GSS3 context: Is returned by a successful RPCSEC_GSS_CREATE operation
- Child context is associated with the parent context on both the client and the server.

If SeLinux is enabled and GSSv3 is in use, assume LNFS and GSSv3 full mode MAC.

When Full Mode MAC is used:
- Each new GSS3 context (parent) kicks off an RPCSEC_GSS_CREATE with the client thread's SeLinux label as a payload.
- Upon success, the RPCSEC_GSS_CREATE call creates a GSSv3 child context handle that asserts the thread label, and uses the parent context for encrytion services.
- CLIENT: Child context and assertion is stored in an assertion list off the struct gss_cl_ctx.
- SERVER: Child context has it's own rsc cache entry, and the child handle is stored in a list of children handles off the parent rsc entry.
- CLIENT and SERVER: child contexts are destroyed when parent context is destroyed.
- CLIENT: child context associated with the client NFS request thread is used for the NFS request.
- SERVER: Using the child context handle looks up the child rsc entry. Using the parent context handle stored in the child rsc entry looks up the parent rsc entry to use for MIC creation/verification, integrity (krb5i) and/or privacy (krb5p).
- SERVER: the label asserted by the NFS request child handle is imposed upon the NFSD thread servicing the request just like the UID/GIDs in the rpc credential.

Each time a call is made, the client makes a check in gss_match to see if the curren thread's SeLinux label has an associated GSS3 child context handle to use. If not, an RPCSEC_GSS_CREATE call is kicked off to establish the child context prior to the NFS request being sent. The NFS request then uses the child context that asserts the client NFS request thread label when sending the NFS request to the server.

Smoke Test;
----------
Setup:
- Ensure SeLinux is enabled on both client and server
- Turn on NFSv4.2 in client and server
- SERVER: in /etc/sysconfig/nfs: RPCNFSDARGS="-V 4.2" (not needed in Fedora 25 as NFSv4.2 is turned on)
- Fedora 25 SERVER export option "security_label" must be set:
/export *(sec=krb5:sys,rw,no_subtree_check,no_root_squash,security_label)
- CLIENT: mount -o v4.2 <server>:<export> <mntpoint>
- Note: LNFS sends the file label in the OPEN compound GETATTR.
- GSS3 sends the client thread label in the RPCSEC_GSS_CREATE call.
- Useful SeLinux commands
- getenforce (setenforce) will let you know if Selinux is enforced
- ls -Z (shows label and fetches it via GETATTR usin LNFS)
- ls -scontext (shows just the label)

Note: Server should be Fedora 25 as the nfs-utils-2.1.1.2.rc1.fc25 and kernel 5.9.10-200.fc25 supports the new "security_label" export option which needs to be set on an exported file system that wants to support LNFS and GSS3 labels.

Test: (run with wireshark capture)
Note: labels and conext values are from my setup. I restart gssd each test run.
Note: my server /etc/export is "/export *(sec=krb5:sys,rw,no_root_squash)"

- # mount -o v4.2,sec=krb5 <server>:<export> <mntpoint>

  # ls <mntpoint>
  - This will create a parent GSS context for kb5i (010000000000000 say 01),
    and a GSS3 child context for krb5i parent with the client thread
    label "system_u:system_r:kernel_t:s0" with handle 02.
   - The child handle 02 is used for the EXCHANGE_ID, CREATE_SESSION, and
     RECLAIM_COMPLETE calls.
  - Then a parent GSS handle is created for krb5 (03) and a GSS3 child
    context for the krb5 parent with hanel (04) for the client thread label
    "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
   - The child handle 04 is used for the PUTROOT_FH, all the mount GETATTRs
     and the LOOKUP of "/export"
   - A new GSS3 child context (05) is created for krb5 parent with label
     "system_u:system_r:kernel_t:s0"
     The child handle 05 is used for LOOKUP, ACCESS, READDIR, etc.

- # umount <mntpoint>
- This will create a new GSS3 child context (06) for krb5i parent with the client thread label "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
- The child handle 06 is used for DESTROY_SESSION and DESTROY_CLIENTID.
- RPCSEC_GSS_DESTROY messages are sent for the two parent contexts 01 and 03.
- CHILD: the parent contexts and associated child contexts are destroyed.
- SERVER: the parent context and associated child contexts are destroyed.

-->Andy

Andy Adamson (17):
SUNRPC handle unsupported RPCSEC_GSS security service
SUNRPC: RPCNULL call with payload for GSSv3
SELINUX export security_current_sid_to_context
SUNRPC GSSv3: base definitions
SUNRPC AUTH_GSS get RPCSEC_GSS version from gssd downcall SUNRPC AUTH_GSS gss3 reply verifier
SUNRPC AUTH_GSS RPCSEC_GSS_CREATE with no payload SUNRPC AUTH_GSS RPCSEC_GSS_CREATE with label payload SUNRPC AUTH_GSS store GSS3 assertions in parent gss_cl_ctx SUNRPC AUTH_GSS store and use gss3 label assertion SUNRPC AUTH_GSS free assertions
SUNRPC: AUTH_GSS add RPC_GSS_PROC_CREATE case for wrap and unwrap SUNRPC SVCAUTH_GSS allow RPCSEC_GSS version 1 or 3 SUNRPC SVCAUTH_GSS gss3 reply verifier
SUNRPC SVCAUTH_GSS gss3 create label
SUNRPC SVCAUTH_GSS set gss3 label on nfsd thread SUNRPC SVCAUTH_gss store gss3 child handles in parent rsc

 fs/nfsd/auth.c                     |  11 +-
 include/linux/selinux.h            |   7 +
 include/linux/sunrpc/auth_gss.h    |  76 ++++-
 include/linux/sunrpc/clnt.h        |   3 +
 include/linux/sunrpc/gss_api.h     |  11 +
 include/linux/sunrpc/svcauth.h     |   1 +
 include/linux/sunrpc/svcauth_gss.h |   1 +
 net/sunrpc/auth_gss/auth_gss.c     | 564 ++++++++++++++++++++++++++++++++++++-
 net/sunrpc/auth_gss/svcauth_gss.c  | 549 ++++++++++++++++++++++++++++++++++--
 net/sunrpc/clnt.c                  |  20 ++
 security/selinux/hooks.c           |  14 +
 11 files changed, 1217 insertions(+), 40 deletions(-)

Signature · 1 line

2.9.3

Quoted 5 lines · On Fri, Feb 24, 2017 at 05:19:36PM -0500, [email protected] wrote:

From: Andy Adamson <[email protected]>

This patchset implements RFC 7861 RPCSEC_GSS Version 3 RPCSEC_GSS_CREATE operation with rgs3_label payloads to provide full mode Mandatory Access Control (MAC) when run with NFSv4.2 Labeled NFS using SeLinux.

Is GSSv3 also still planned to be used for COPY? I lost track of that discussion.

--b.

Quoted 172 lines

A lot more testing is needed - and planned :)

Client was built on Trond's testing branch, 4.10.0 kernel. Server was built on Bruce's nfsd-next branch, 4.10.0-rc7 kernel

nfsd-next branch has these server required patches missing from Tronds testing branch:

1) svcrpc: free contexts immediately on PROC_DESTROY
2) nfsd: opt in to labeled nfs per export

Version-5.
---------
- responded to comments from Anna Schumaker
- refactored code to split generice RPCSEC_GSS_CREATE from label payload
- nfsd check for NFSEXP_SECURITY_LABEL export flag

Requires on Client:
-------------------
gssd patches: "RFC: GSSD changes for RPCSEC_GSS version 3" libtirpc patches "RFC: Libtirpc changes for RPCSEC_GSS version 3"

Implementation Features:
------------------------

GSSv3
- Negotiate GSS version - starts with GSSv3 then falls back to GSSv1 if GSSv3 is not supported.
- New GSSv3 reply verifier
- RPCSEC_GSS_CREATE operation generic code is separated from the payload code.
- rgss3_label assertion payload carries each client SeLinux thread label
- Supports one label assertion payload per RPCSEC_GSS_CREATE
- Kerberos pseudoflavor support (krb5, krb5i, krb5p)

TODO:
----
- Send all RPCSEC_GSS_CREATE calls with integrity or privacy
- Ensure SeLinux function exported in patch "SELINUX export security_current_sid_to_context" is OK with SeLinux experts.
- Perhaps add administrative ability on the client to indicate Full Mode MAC is desired and that NFSv4.2 Labeled NFS (LNFS) is used.

Prototype description:
---------------------
Parent GSS context: the normal GSS context
- "Normal" GSSv3 context is the same as a "normal" GSSv1 context except for the new GSS Version and new reply verifier. For GSSv3 this "normal" context is called the parent context.

Child GSS3 context: Is returned by a successful RPCSEC_GSS_CREATE operation
- Child context is associated with the parent context on both the client and the server.

If SeLinux is enabled and GSSv3 is in use, assume LNFS and GSSv3 full mode MAC.

When Full Mode MAC is used:
- Each new GSS3 context (parent) kicks off an RPCSEC_GSS_CREATE with the client thread's SeLinux label as a payload.
- Upon success, the RPCSEC_GSS_CREATE call creates a GSSv3 child context handle that asserts the thread label, and uses the parent context for encrytion services.
- CLIENT: Child context and assertion is stored in an assertion list off the struct gss_cl_ctx.
- SERVER: Child context has it's own rsc cache entry, and the child handle is stored in a list of children handles off the parent rsc entry.
- CLIENT and SERVER: child contexts are destroyed when parent context is destroyed.
- CLIENT: child context associated with the client NFS request thread is used for the NFS request.
- SERVER: Using the child context handle looks up the child rsc entry. Using the parent context handle stored in the child rsc entry looks up the parent rsc entry to use for MIC creation/verification, integrity (krb5i) and/or privacy (krb5p).
- SERVER: the label asserted by the NFS request child handle is imposed upon the NFSD thread servicing the request just like the UID/GIDs in the rpc credential.

Each time a call is made, the client makes a check in gss_match to see if the curren thread's SeLinux label has an associated GSS3 child context handle to use. If not, an RPCSEC_GSS_CREATE call is kicked off to establish the child context prior to the NFS request being sent. The NFS request then uses the child context that asserts the client NFS request thread label when sending the NFS request to the server.

Smoke Test;
----------
Setup:
- Ensure SeLinux is enabled on both client and server
- Turn on NFSv4.2 in client and server
- SERVER: in /etc/sysconfig/nfs: RPCNFSDARGS="-V 4.2" (not needed in Fedora 25 as NFSv4.2 is turned on)
- Fedora 25 SERVER export option "security_label" must be set:
/export *(sec=krb5:sys,rw,no_subtree_check,no_root_squash,security_label)
- CLIENT: mount -o v4.2 <server>:<export> <mntpoint>
- Note: LNFS sends the file label in the OPEN compound GETATTR.
- GSS3 sends the client thread label in the RPCSEC_GSS_CREATE call.
- Useful SeLinux commands
- getenforce (setenforce) will let you know if Selinux is enforced
- ls -Z (shows label and fetches it via GETATTR usin LNFS)
- ls -scontext (shows just the label)

Note: Server should be Fedora 25 as the nfs-utils-2.1.1.2.rc1.fc25 and kernel 5.9.10-200.fc25 supports the new "security_label" export option which needs to be set on an exported file system that wants to support LNFS and GSS3 labels.

Test: (run with wireshark capture)
Note: labels and conext values are from my setup. I restart gssd each test run.
Note: my server /etc/export is "/export *(sec=krb5:sys,rw,no_root_squash)"

- # mount -o v4.2,sec=krb5 <server>:<export> <mntpoint>

  # ls <mntpoint>
  - This will create a parent GSS context for kb5i (010000000000000 say 01),
    and a GSS3 child context for krb5i parent with the client thread
    label "system_u:system_r:kernel_t:s0" with handle 02.
   - The child handle 02 is used for the EXCHANGE_ID, CREATE_SESSION, and
     RECLAIM_COMPLETE calls.
  - Then a parent GSS handle is created for krb5 (03) and a GSS3 child
    context for the krb5 parent with hanel (04) for the client thread label
    "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
   - The child handle 04 is used for the PUTROOT_FH, all the mount GETATTRs
     and the LOOKUP of "/export"
   - A new GSS3 child context (05) is created for krb5 parent with label
     "system_u:system_r:kernel_t:s0"
     The child handle 05 is used for LOOKUP, ACCESS, READDIR, etc.

- # umount <mntpoint>
- This will create a new GSS3 child context (06) for krb5i parent with the client thread label "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023"
- The child handle 06 is used for DESTROY_SESSION and DESTROY_CLIENTID.
- RPCSEC_GSS_DESTROY messages are sent for the two parent contexts 01 and 03.
- CHILD: the parent contexts and associated child contexts are destroyed.
- SERVER: the parent context and associated child contexts are destroyed.

-->Andy

Andy Adamson (17):
SUNRPC handle unsupported RPCSEC_GSS security service
SUNRPC: RPCNULL call with payload for GSSv3
SELINUX export security_current_sid_to_context
SUNRPC GSSv3: base definitions
SUNRPC AUTH_GSS get RPCSEC_GSS version from gssd downcall SUNRPC AUTH_GSS gss3 reply verifier
SUNRPC AUTH_GSS RPCSEC_GSS_CREATE with no payload SUNRPC AUTH_GSS RPCSEC_GSS_CREATE with label payload SUNRPC AUTH_GSS store GSS3 assertions in parent gss_cl_ctx SUNRPC AUTH_GSS store and use gss3 label assertion SUNRPC AUTH_GSS free assertions
SUNRPC: AUTH_GSS add RPC_GSS_PROC_CREATE case for wrap and unwrap SUNRPC SVCAUTH_GSS allow RPCSEC_GSS version 1 or 3 SUNRPC SVCAUTH_GSS gss3 reply verifier
SUNRPC SVCAUTH_GSS gss3 create label
SUNRPC SVCAUTH_GSS set gss3 label on nfsd thread SUNRPC SVCAUTH_gss store gss3 child handles in parent rsc

 fs/nfsd/auth.c                     |  11 +-
 include/linux/selinux.h            |   7 +
 include/linux/sunrpc/auth_gss.h    |  76 ++++-
 include/linux/sunrpc/clnt.h        |   3 +
 include/linux/sunrpc/gss_api.h     |  11 +
 include/linux/sunrpc/svcauth.h     |   1 +
 include/linux/sunrpc/svcauth_gss.h |   1 +
 net/sunrpc/auth_gss/auth_gss.c     | 564 ++++++++++++++++++++++++++++++++++++-
 net/sunrpc/auth_gss/svcauth_gss.c  | 549 ++++++++++++++++++++++++++++++++++--
 net/sunrpc/clnt.c                  |  20 ++
 security/selinux/hooks.c           |  14 +
 11 files changed, 1217 insertions(+), 40 deletions(-)

Quoted 2 lines

--
2.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 7 lines · J. Bruce Fields

Quoted 5 lines · On Fri, Feb 24, 2017 at 05:19:36PM -0500, [email protected] wrote:

From: Andy Adamson <[email protected]>

This patchset implements RFC 7861 RPCSEC_GSS Version 3 RPCSEC_GSS_CREATE operation with rgs3_label payloads to provide full mode Mandatory Access Control (MAC) when run with NFSv4.2 Labeled NFS using SeLinux.

Quoted 2 lines

Is GSSv3 also still planned to be used for COPY? I lost track of that discussion.

Yes. I'm starting on that now.