Add packet filtering based on process'ssecurity context.
Subsystems (2)
PATCH 1/1 Add packet filtering based on process'ssecurity context.
sorry, I didn't notice that the netfilter-devel list address was the old one.
Quoted 7 lines · Tetsuo Handa
Hello.
Quoted 4 lines · James Morris
From memory, one approach under discussion was to add netfilter hooks to the transport layer, which could be invoked correctly by each type of protocol when the target process is selected.
Quoted 7 lines
Quoted 2 lines
If this is done for netfilter, then an LSM hook is probably not needed at all, as security modules can utilize netfilter hooks directly.
Patrick McHardy says (at http://marc.info/?l=linux-netdev&m=118495005800410&w=2 ) "Even with socket filters netfilter doesn't know the final receipient
process, that is not known until it calls recvmsg and the data is read, which is too late for netfilter."
Indeed, but there is another approach, using libnetfilter_queue. I have the same goal as TOMOYO, let the user decided filtering, with informations coming from LSM hook, which give more datas to the users, specially with the relationship between the socket and the user/process.
My approach is to get the informations regarding the socket from socket(), bind() and and accept() syscalls hooks.
Pushing this informations to userspace. Here the user can refuse or accept the sycalls.
Then, for incoming data, we are using libnetfilter_queue from userspace. And we can make a relation between the first delivered packet by netfilter with our informations from the LSM hooks at socket(), bind() and accept().
Let me get a example based on TCP/IP:
process X is executing this :
- userspace : socket()
- kernel : sys_socket()
- LSM : socket_create() -> pushing (process id, userid, protocol, IP/ports) infos to userspace
- userspace : bind()
- kernel : sys_bind()
- LSM : socket_bind() -> pushing (process id, userid, protocol, IP/ports) infos to userspace
- userspace : listen()
- kernel : sys_listen() -> pushing (process id, userid, protocol, IP/ports) infos to userspace
As now the application is listening on a port, we are waiting for the TCP SYN packet coming from remote side.
When TCP SYN arrive, we can capture it with libnetfilter_queue.
Then we can make a relation between informations in the hearders from the TCP SYN packet: (src/dst address IPs, dst/src/ ports, procotol) ie the netfilter tuple, and our informations from the LSM hooks, ie we know that process X did socket(), bind(), listen() on the same src address IP, src port and protocol.
Then we can decide to drop or accept this packet, with libnetfilter_queue.
this approach seems better because we already have *all* the tools from the kernel side, except form the managing LSM interface with userspace, but I already have some improvements on this (patch attached)
Please consider this approach as a better side because using netfilter for filtering packets is the best solution, and that we can make a relation between socket and packets with this idea, and this feature can stay in userspace.
FYI, this project is named "network events connector", some people from netfilter-devel list may already know it, because I made a talk about it for the last netfilter workshop.
thank you.
drivers/connector/Kconfig +8 -0
@@ -19,4 +19,12 @@ config PROC_EVENTS Provide a connector that reports process events to userspace. Send events such as fork, exec, id change (uid, gid, suid, etc), and exit. +config NET_EVENTS + boolean "Report network events to userspace" + depends on CONNECTOR=y && SECURITY_NETWORK + default y + ---help--- + Provide a connector that reports networking's events to userspace. + Send events such as DCCP/TCP listen/close and UDP bind/close. + endif # CONNECTOR
drivers/connector/Makefile +1 -0
@@ -1,4 +1,5 @@ obj-$(CONFIG_CONNECTOR) += cn.o obj-$(CONFIG_PROC_EVENTS) += cn_proc.o +obj-$(CONFIG_NET_EVENTS) += cn_net.o cn-y += cn_queue.o connector.o
drivers/connector/cn_net.c new file +1118 -0
1,118 lines not on this page · raw message
include/linux/cn_net.h new file +146 -0
146 lines not on this page · raw message
include/linux/connector.h +3 -2
@@ -36,9 +36,10 @@ #define CN_IDX_CIFS 0x2#define CN_VAL_CIFS 0x1#define CN_W1_IDX 0x3/* w1 communication */ #define CN_W1_VAL 0x1 +#define CN_IDX_NET 0x4 +#define CN_VAL_NET 0x1 - -#define CN_NETLINK_USERS 4 +#define CN_NETLINK_USERS 5/* * Maximum connector's message size.