secid reconcialiation: Replace unlabeled_t with the network_t

PATCH In review Venkat Yekkirala 3 participants 5 messages Oct 4, 2006

Subsystems (3)

Networking Network drivers SELinux security module

lore

Share & tools

lore

Venkat Yekkirala

author

2006-10-04 02:41 UTC #0 lore raw

PATCH 1/1 secid reconcialiation: Replace unlabeled_t with the network_t

The following replaces unlabeled_t with network_t for better characterization of the flow out/in checks in SELinux, as well as to allow for mls packets to
flow out/in from the network since network_t would allow the full range of MLS labels, as opposed to the unlabeled init sid that only allows system-hi.

Signed-off-by Venkat Yekkirala <[email protected]>

---
This is an incremental patch the secid-reconcilation v4 patchset.

security/selinux/hooks.c +3 -2

@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
 	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
 	BUG_ON(err);
 
-	err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
+	err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
+					SECCLASS_PACKET,
 					PACKET__FLOW_IN, NULL);
 	if (err)
 		goto out;

@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
 				skb->secmark = sksec->sid;
 			}
 		}
-		err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
+		err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
 				   SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
 	}
 out:

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Paul Moore

2006-10-04 14:33 UTC #1 lore raw

Quoted 24 lines · Venkat Yekkirala

The following replaces unlabeled_t with network_t for better characterization of the flow out/in checks in SELinux, as well as to allow for mls packets to
flow out/in from the network since network_t would allow the full range of MLS labels, as opposed to the unlabeled init sid that only allows system-hi.
Signed-off-by Venkat Yekkirala <[email protected]>
---
This is an incremental patch the secid-reconcilation v4 patchset.
security/selinux/hooks.c +2 -1
@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
 	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
 	BUG_ON(err);
 
-	err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
+	err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
+					SECCLASS_PACKET,
 					PACKET__FLOW_IN, NULL);
 	if (err)
 		goto out;

security/selinux/hooks.c static unsigned int selinux_ip_postroute · line 3907

Quoted 8 lines

security/selinux/hooks.c +1 -1

@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
 				skb->secmark = sksec->sid;
 			}
 		}
-		err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
+		err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
 				   SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
 	}
 out:

Considering the above change, I wonder if it would also make sense to update the secmark to SECINITSID_UNLABELED in the abscence of any external labeling (labeled IPsec or NetLabel)?

Signature · 7 lines

paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Paul Moore

2006-10-04 14:43 UTC #2 lore raw

Quoted 31 lines · Paul Moore

Quoted 29 lines · Venkat Yekkirala
The following replaces unlabeled_t with network_t for better characterization of the flow out/in checks in SELinux, as well as to allow for mls packets to
flow out/in from the network since network_t would allow the full range of MLS labels, as opposed to the unlabeled init sid that only allows system-hi.
Signed-off-by Venkat Yekkirala <[email protected]>
---
This is an incremental patch the secid-reconcilation v4 patchset.
security/selinux/hooks.c +3 -2
@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
 	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
 	BUG_ON(err);
 
-	err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
+	err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
+					SECCLASS_PACKET,
 					PACKET__FLOW_IN, NULL);
 	if (err)
 		goto out;
@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
 				skb->secmark = sksec->sid;
 			}
 		}
-		err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
+		err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,

Quoted 9 lines

Quoted 3 lines
security/selinux/hooks.c +0 -0
 				   SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
 	}
out:
Considering the above change, I wonder if it would also make sense to update the secmark to SECINITSID_UNLABELED in the abscence of any external labeling (labeled IPsec or NetLabel)?

Ungh, my apologies ... I meant to say "SECINITSID_NETMSG" *not* "SECINITSID_UNLABELED".

Signature · 7 lines

paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Christopher J. PeBenito

2006-10-04 14:47 UTC #3 lore raw

In reply to Paul Moore

Quoted 29 lines · Paul Moore

Quoted 28 lines · Venkat Yekkirala
The following replaces unlabeled_t with network_t for better characterization of the flow out/in checks in SELinux, as well as to allow for mls packets to
flow out/in from the network since network_t would allow the full range of MLS labels, as opposed to the unlabeled init sid that only allows system-hi.
Signed-off-by Venkat Yekkirala <[email protected]>
---
This is an incremental patch the secid-reconcilation v4 patchset.
security/selinux/hooks.c +2 -2
@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
 	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
 	BUG_ON(err);
 
-	err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
+	err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
+					SECCLASS_PACKET,
 					PACKET__FLOW_IN, NULL);
 	if (err)
 		goto out;
@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
 				skb->secmark = sksec->sid;
 			}
 		}
-		err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,

Quoted 8 lines

security/selinux/hooks.c static unsigned int selinux_ip_postroute · line 3907
Quoted 4 lines
security/selinux/hooks.c +1 -0
+		err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
 				   SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
 	}
 out:
Considering the above change, I wonder if it would also make sense to update the secmark to SECINITSID_UNLABELED in the abscence of any external labeling (labeled IPsec or NetLabel)?

Wouldn't that make secmark useless in the non labeled networking case?

Signature · 9 lines

Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Paul Moore

2006-10-04 14:53 UTC #4 lore raw

Quoted 41 lines · Christopher J. PeBenito

Quoted 30 lines · Paul Moore
Quoted 28 lines · Venkat Yekkirala
The following replaces unlabeled_t with network_t for better characterization of the flow out/in checks in SELinux, as well as to allow for mls packets to
flow out/in from the network since network_t would allow the full range of MLS labels, as opposed to the unlabeled init sid that only allows system-hi.
Signed-off-by Venkat Yekkirala <[email protected]>
---
This is an incremental patch the secid-reconcilation v4 patchset.
security/selinux/hooks.c +2 -2
@@ -3703,7 +3703,8 @@ static int selinux_skb_flow_in(struct sk
 	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
 	BUG_ON(err);
 
-	err = avc_has_perm(xfrm_sid, skb->secmark, SECCLASS_PACKET,
+	err = avc_has_perm(xfrm_sid, skb->secmark? : SECINITSID_NETMSG,
+					SECCLASS_PACKET,
 					PACKET__FLOW_IN, NULL);
 	if (err)
 		goto out;
@@ -3900,7 +3901,7 @@ static unsigned int selinux_ip_postroute
 				skb->secmark = sksec->sid;
 			}
 		}
-		err = avc_has_perm(skb->secmark, SECINITSID_UNLABELED,
Quoted 8 lines
Quoted 4 lines
security/selinux/hooks.c +1 -0
+		err = avc_has_perm(skb->secmark, SECINITSID_NETMSG,
 				   SECCLASS_PACKET, PACKET__FLOW_OUT, &ad);
 	}
out:
Considering the above change, I wonder if it would also make sense to update the secmark to SECINITSID_UNLABELED in the abscence of any external labeling (labeled IPsec or NetLabel)?

Quoted 2 lines

Wouldn't that make secmark useless in the non labeled networking case?

Sorry, I didn't do a very good job explaining things in my first email so let me try it again ...

If there is no external labeling, i.e. labeled IPsec or NetLabel, *and* the secmark is equal to zero/SECSID_NULL I think it might be a good idea to set the secmark to SECINITSID_NETMSG.

This not affect either local or external labels if they are present, but if both are not it would give the secmark some meaningful value.

Signature · 7 lines

paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.