: switch selinux and smack to pernet ops

PATCH New Florian Westphal 4 participants 13 messages Apr 21, 2017 – Jun 2, 2017

Subsystems (3)

SELinux security module Security (LSM) Smack security module

lore

Share & tools

lore

Florian Westphal

author

2017-04-21 09:49 UTC #0 lore raw

cover : switch selinux and smack to pernet ops

Back in the day we only had global netfilter hooks.

Nowadays netfilter hooks are per net namespace, but we still provide the old 'nf_register_hook' api, which will place the hooks in all current and future net namespaces.

smack and selinux are among the last users of the old api, this switches both over to pernet_ops.

This would also allow to only enable hooks in a netns when they are needed in that namespace, but this isn't done here.

The old api makes it necessary to keep rather ugly code in the netfilter core (e.g. iterating net namespaces under rtnl mutex...) and it has a race w. rmmod. We'd like to remove it.

If you prefer this gets merged via nf-next tree please ack and I'll resubmit (with acks) to netfilter-devel@ list.

 selinux/hooks.c         |   24 ++++++++++++++++++++----
 smack/smack_netfilter.c |   26 ++++++++++++++++++--------
 2 files changed, 38 insertions(+), 12 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Florian Westphal

author

2017-04-21 09:49 UTC #1 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

It will allow us to remove the old netfilter hook api in the near future.

Signed-off-by Florian Westphal <[email protected]>

---
 security/smack/smack_netfilter.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

security/smack/smack_netfilter.c +18 -8

index 205b785fb400..cdeb0f3243dd 100644
@@ -18,6 +18,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netdevice.h>
 #include <net/inet_sock.h>
+#include <net/net_namespace.h>
 #include "smack.h"
 
 #if IS_ENABLED(CONFIG_IPV6)

@@ -74,20 +75,29 @@ static struct nf_hook_ops smack_nf_ops[] = {
 #endif	/* IPV6 */
 };
 
-static int __init smack_nf_ip_init(void)
+static int __net_init smack_nf_register(struct net *net)
+{
+	return nf_register_net_hooks(net, smack_nf_ops,
+				     ARRAY_SIZE(smack_nf_ops));
+}
+
+static void __net_exit smack_nf_unregister(struct net *net)
 {
-	int err;
+	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
+}
 
+static struct pernet_operations smack_net_ops = {
+	.init = smack_nf_register,
+	.exit = smack_nf_unregister,
+};
+
+static int __init smack_nf_ip_init(void)
+{
 	if (smack_enabled == 0)
 		return 0;
 
 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
-
-	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
-	if (err)
-		pr_info("Smack: nf_register_hooks: error %d\n", err);
-
-	return 0;
+	return register_pernet_subsys(&smack_net_ops);
 }
 
 __initcall(smack_nf_ip_init);

Signature · 6 lines

2.10.2

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Casey Schaufler

maintainer

2017-04-21 16:42 UTC #2 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

Quoted 3 lines · Florian Westphal

It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>

I will test out this patch and report back.
If all goes well I will include it in the Smack
tree for 4.13.

Quoted 44 lines

---
 security/smack/smack_netfilter.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

security/smack/smack_netfilter.c +17 -2

index 205b785fb400..cdeb0f3243dd 100644
@@ -18,6 +18,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netdevice.h>
 #include <net/inet_sock.h>
+#include <net/net_namespace.h>
 #include "smack.h"
 
 #if IS_ENABLED(CONFIG_IPV6)

@@ -74,20 +75,29 @@ static struct nf_hook_ops smack_nf_ops[] = {
 #endif	/* IPV6 */
 };
 
-static int __init smack_nf_ip_init(void)
+static int __net_init smack_nf_register(struct net *net)
+{
+	return nf_register_net_hooks(net, smack_nf_ops,
+				     ARRAY_SIZE(smack_nf_ops));
+}
+
+static void __net_exit smack_nf_unregister(struct net *net)
 {
-	int err;
+	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
+}
 
+static struct pernet_operations smack_net_ops = {
+	.init = smack_nf_register,
+	.exit = smack_nf_unregister,
+};
+
+static int __init smack_nf_ip_init(void)
+{
 	if (smack_enabled == 0)
 		return 0;
 
 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");

security/smack/smack_netfilter.c static struct nf_hook_ops smack_nf_ops[] = { · line 103

Quoted 10 lines

security/smack/smack_netfilter.c +1 -6

-
-	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
-	if (err)
-		pr_info("Smack: nf_register_hooks: error %d\n", err);
-
-	return 0;
+	return register_pernet_subsys(&smack_net_ops);
 }
 
 __initcall(smack_nf_ip_init);

Casey Schaufler

maintainer

2017-04-21 17:57 UTC #3 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

In reply to Florian Westphal

Quoted 3 lines · Florian Westphal

It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>

Acked-by Casey Schaufler <[email protected]>

I will take this patch into the Smack tree from 4.13.

Thank you.

Quoted 44 lines

---
 security/smack/smack_netfilter.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

security/smack/smack_netfilter.c +17 -2

index 205b785fb400..cdeb0f3243dd 100644
@@ -18,6 +18,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netdevice.h>
 #include <net/inet_sock.h>
+#include <net/net_namespace.h>
 #include "smack.h"
 
 #if IS_ENABLED(CONFIG_IPV6)

@@ -74,20 +75,29 @@ static struct nf_hook_ops smack_nf_ops[] = {
 #endif	/* IPV6 */
 };
 
-static int __init smack_nf_ip_init(void)
+static int __net_init smack_nf_register(struct net *net)
+{
+	return nf_register_net_hooks(net, smack_nf_ops,
+				     ARRAY_SIZE(smack_nf_ops));
+}
+
+static void __net_exit smack_nf_unregister(struct net *net)
 {
-	int err;
+	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
+}
 
+static struct pernet_operations smack_net_ops = {
+	.init = smack_nf_register,
+	.exit = smack_nf_unregister,
+};
+
+static int __init smack_nf_ip_init(void)
+{
 	if (smack_enabled == 0)
 		return 0;
 
 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");

security/smack/smack_netfilter.c static struct nf_hook_ops smack_nf_ops[] = { · line 103

Quoted 10 lines

security/smack/smack_netfilter.c +1 -6

-
-	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
-	if (err)
-		pr_info("Smack: nf_register_hooks: error %d\n", err);
-
-	return 0;
+	return register_pernet_subsys(&smack_net_ops);
 }
 
 __initcall(smack_nf_ip_init);

Casey Schaufler

maintainer Applied

2017-06-01 16:44 UTC #4 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

In reply to Florian Westphal

Quoted 3 lines · Florian Westphal

It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>

I have applied this to git://github.com/cschaufler/smack-next#smack-for-4.13

Quoted 44 lines

---
 security/smack/smack_netfilter.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

security/smack/smack_netfilter.c +17 -2

index 205b785fb400..cdeb0f3243dd 100644
@@ -18,6 +18,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/netdevice.h>
 #include <net/inet_sock.h>
+#include <net/net_namespace.h>
 #include "smack.h"
 
 #if IS_ENABLED(CONFIG_IPV6)

@@ -74,20 +75,29 @@ static struct nf_hook_ops smack_nf_ops[] = {
 #endif	/* IPV6 */
 };
 
-static int __init smack_nf_ip_init(void)
+static int __net_init smack_nf_register(struct net *net)
+{
+	return nf_register_net_hooks(net, smack_nf_ops,
+				     ARRAY_SIZE(smack_nf_ops));
+}
+
+static void __net_exit smack_nf_unregister(struct net *net)
 {
-	int err;
+	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
+}
 
+static struct pernet_operations smack_net_ops = {
+	.init = smack_nf_register,
+	.exit = smack_nf_unregister,
+};
+
+static int __init smack_nf_ip_init(void)
+{
 	if (smack_enabled == 0)
 		return 0;
 
 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");

security/smack/smack_netfilter.c static struct nf_hook_ops smack_nf_ops[] = { · line 103

Quoted 10 lines

security/smack/smack_netfilter.c +1 -6

-
-	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
-	if (err)
-		pr_info("Smack: nf_register_hooks: error %d\n", err);
-
-	return 0;
+	return register_pernet_subsys(&smack_net_ops);
 }
 
 __initcall(smack_nf_ip_init);

Pablo Neira Ayuso

2017-06-02 08:33 UTC #5 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

Quoted 6 lines · Casey Schaufler

Quoted 3 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
I have applied this to git://github.com/cschaufler/smack-next#smack-for-4.13

Thanks Casey.

We're very much looking forward to getting rid of all these nf_register_hooks() calls all over the tree. This patch helps us going in that direction.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Florian Westphal

author

2017-06-02 08:48 UTC #6 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

Quoted 6 lines · Pablo Neira Ayuso

Quoted 5 lines · Casey Schaufler
Quoted 3 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>

Quoted 7 lines

Quoted 1 line
I have applied this to git://github.com/cschaufler/smack-next#smack-for-4.13
Thanks Casey.
We're very much looking forward to getting rid of all these nf_register_hooks() calls all over the tree. This patch helps us going in that direction.

selinux is the last user of this api left in the tree.
Once Paul applies my patch to convert to pernet_ops we only have to wait until all the changes are in linus tree.

Then you only need to merge linus tree into nf.git and then I will submit the the removal patch.

I think we can get rid of old api in 4.13.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Pablo Neira Ayuso

2017-06-02 09:07 UTC #7 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

Quoted 15 lines · Florian Westphal

Quoted 6 lines · Pablo Neira Ayuso
Quoted 5 lines · Casey Schaufler
Quoted 3 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
Quoted 7 lines
Quoted 1 line
I have applied this to git://github.com/cschaufler/smack-next#smack-for-4.13
Thanks Casey.
We're very much looking forward to getting rid of all these nf_register_hooks() calls all over the tree. This patch helps us going in that direction.

Quoted 8 lines

selinux is the last user of this api left in the tree.
Once Paul applies my patch to convert to pernet_ops we only have to wait until all the changes are in linus tree.
Then you only need to merge linus tree into nf.git and then I will submit the the removal patch.
I think we can get rid of old api in 4.13.

Great news.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Paul Moore

maintainer

2017-06-02 14:36 UTC #8 lore raw

PATCH 1/2 smack: use pernet operations for hook registration

In reply to Florian Westphal

Quoted 11 lines · Florian Westphal

Quoted 10 lines · Pablo Neira Ayuso
Quoted 6 lines · Casey Schaufler
Quoted 3 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
I have applied this to git://github.com/cschaufler/smack-next#smack-for-4.13
Thanks Casey.

Quoted 7 lines

Quoted 3 lines
We're very much looking forward to getting rid of all these nf_register_hooks() calls all over the tree. This patch helps us going in that direction.
selinux is the last user of this api left in the tree.
Once Paul applies my patch to convert to pernet_ops we only have to wait until all the changes are in linus tree.

Thanks for the reminder, since the SELinux patch didn't go to the SELinux mailing list it got "lost" during the post-merge-window merge. Regardless, it's merged into selinux/next and it should go upstream during the next merge window.

Signature · 6 lines

paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Florian Westphal

author

2017-04-21 09:49 UTC #9 lore raw

PATCH 2/2 selinux: use pernet operations for hook registration

In reply to Florian Westphal

It will allow us to remove the old netfilter hook api in the near future.

Signed-off-by Florian Westphal <[email protected]>

---
 security/selinux/hooks.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

security/selinux/hooks.c +20 -4

index e67a526d1f30..3aa4268525e2 100644
@@ -6448,6 +6448,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
 #endif	/* IPV6 */
 };
 
+static int __net_init selinux_nf_register(struct net *net)
+{
+	return nf_register_net_hooks(net, selinux_nf_ops,
+				     ARRAY_SIZE(selinux_nf_ops));
+}
+
+static void __net_exit selinux_nf_unregister(struct net *net)
+{
+	nf_unregister_net_hooks(net, selinux_nf_ops,
+				ARRAY_SIZE(selinux_nf_ops));
+}
+
+static struct pernet_operations selinux_net_ops = {
+	.init = selinux_nf_register,
+	.exit = selinux_nf_unregister,
+};
+
 static int __init selinux_nf_ip_init(void)
 {
 	int err;

@@ -6457,13 +6474,12 @@ static int __init selinux_nf_ip_init(void)
 
 	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
 
-	err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+	err = register_pernet_subsys(&selinux_net_ops);
 	if (err)
-		panic("SELinux: nf_register_hooks: error %d\n", err);
+		panic("SELinux: register_pernet_subsys: error %d\n", err);
 
 	return 0;
 }
-
 __initcall(selinux_nf_ip_init);
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE

@@ -6471,7 +6487,7 @@ static void selinux_nf_ip_exit(void)
 {
 	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
 
-	nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+	unregister_pernet_subsys(&selinux_net_ops);
 }
 #endif

Signature · 6 lines

2.10.2

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Paul Moore

maintainer

2017-04-26 20:46 UTC #10 lore raw

PATCH 2/2 selinux: use pernet operations for hook registration

Quoted 6 lines · Florian Westphal

It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
---
 security/selinux/hooks.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

Looks fine to me, I'm going to queue this up for after the v4.12 merge window.

Quoted 56 lines

security/selinux/hooks.c +20 -5

index e67a526d1f30..3aa4268525e2 100644
@@ -6448,6 +6448,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
 #endif /* IPV6 */
 };
 
+static int __net_init selinux_nf_register(struct net *net)
+{
+       return nf_register_net_hooks(net, selinux_nf_ops,
+                                    ARRAY_SIZE(selinux_nf_ops));
+}
+
+static void __net_exit selinux_nf_unregister(struct net *net)
+{
+       nf_unregister_net_hooks(net, selinux_nf_ops,
+                               ARRAY_SIZE(selinux_nf_ops));
+}
+
+static struct pernet_operations selinux_net_ops = {
+       .init = selinux_nf_register,
+       .exit = selinux_nf_unregister,
+};
+
 static int __init selinux_nf_ip_init(void)
 {
        int err;

@@ -6457,13 +6474,12 @@ static int __init selinux_nf_ip_init(void)
 
        printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
 
-       err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       err = register_pernet_subsys(&selinux_net_ops);
        if (err)
-               panic("SELinux: nf_register_hooks: error %d\n", err);
+               panic("SELinux: register_pernet_subsys: error %d\n", err);
 
        return 0;
 }
-
 __initcall(selinux_nf_ip_init);
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE

@@ -6471,7 +6487,7 @@ static void selinux_nf_ip_exit(void)
 {
        printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
 
-       nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       unregister_pernet_subsys(&selinux_net_ops);
 }
 #endif
 
--

2.10.2

Signature · 6 lines

paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Paul Moore

maintainer

2017-04-26 20:47 UTC #11 lore raw

PATCH 2/2 selinux: use pernet operations for hook registration

Quoted 9 lines · Paul Moore

Quoted 6 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
---
 security/selinux/hooks.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)
Looks fine to me, I'm going to queue this up for after the v4.12 merge window.

... and I just realized that the SELinux list wasn't CC'd on this patch, fixing that now.

Quoted 62 lines

Quoted 54 lines

security/selinux/hooks.c +20 -5

index e67a526d1f30..3aa4268525e2 100644
@@ -6448,6 +6448,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
 #endif /* IPV6 */
 };
 
+static int __net_init selinux_nf_register(struct net *net)
+{
+       return nf_register_net_hooks(net, selinux_nf_ops,
+                                    ARRAY_SIZE(selinux_nf_ops));
+}
+
+static void __net_exit selinux_nf_unregister(struct net *net)
+{
+       nf_unregister_net_hooks(net, selinux_nf_ops,
+                               ARRAY_SIZE(selinux_nf_ops));
+}
+
+static struct pernet_operations selinux_net_ops = {
+       .init = selinux_nf_register,
+       .exit = selinux_nf_unregister,
+};
+
 static int __init selinux_nf_ip_init(void)
 {
        int err;

@@ -6457,13 +6474,12 @@ static int __init selinux_nf_ip_init(void)
 
        printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
 
-       err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       err = register_pernet_subsys(&selinux_net_ops);
        if (err)
-               panic("SELinux: nf_register_hooks: error %d\n", err);
+               panic("SELinux: register_pernet_subsys: error %d\n", err);
 
        return 0;
 }
-
 __initcall(selinux_nf_ip_init);
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE

@@ -6471,7 +6487,7 @@ static void selinux_nf_ip_exit(void)
 {
        printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
 
-       nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       unregister_pernet_subsys(&selinux_net_ops);
 }
 #endif
 
--

Quoted 2 lines

2.10.2

--
paul moore
www.paul-moore.com

Signature · 6 lines

paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Paul Moore

maintainer Applied

2017-06-02 14:33 UTC #12 lore raw

PATCH 2/2 selinux: use pernet operations for hook registration

Quoted 9 lines · Paul Moore

Quoted 8 lines · Paul Moore
Quoted 6 lines · Florian Westphal
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by Florian Westphal <[email protected]>
---
 security/selinux/hooks.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

Quoted 4 lines

Quoted 1 line
Looks fine to me, I'm going to queue this up for after the v4.12 merge window.
... and I just realized that the SELinux list wasn't CC'd on this patch, fixing that now.

Merged, thanks.

Signature · 6 lines

paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html