2005-04-17 00:20:36 +02:00
|
|
|
/*
|
|
|
|
* NSA Security-Enhanced Linux (SELinux) security module
|
|
|
|
*
|
|
|
|
* This file contains the SELinux hook function implementations.
|
|
|
|
*
|
|
|
|
* Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
|
* Chris Vance, <cvance@nai.com>
|
|
|
|
* Wayne Salamon, <wsalamon@nai.com>
|
|
|
|
* James Morris <jmorris@redhat.com>
|
|
|
|
*
|
|
|
|
* Copyright (C) 2001,2002 Networks Associates Technology, Inc.
|
|
|
|
* Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
|
|
|
* Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
|
|
|
|
* <dgoeddel@trustedcs.com>
|
2008-01-29 14:49:27 +01:00
|
|
|
* Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
|
|
|
|
* Paul Moore <paul.moore@hp.com>
|
2007-09-14 02:27:07 +02:00
|
|
|
* Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
|
|
|
|
* Yuichi Nakamura <ynakam@hitachisoft.jp>
|
2005-04-17 00:20:36 +02:00
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2,
|
|
|
|
* as published by the Free Software Foundation.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/ptrace.h>
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/sched.h>
|
|
|
|
#include <linux/security.h>
|
|
|
|
#include <linux/xattr.h>
|
|
|
|
#include <linux/capability.h>
|
|
|
|
#include <linux/unistd.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/mman.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/pagemap.h>
|
|
|
|
#include <linux/swap.h>
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/syscalls.h>
|
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/namei.h>
|
|
|
|
#include <linux/mount.h>
|
|
|
|
#include <linux/ext2_fs.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/kd.h>
|
|
|
|
#include <linux/netfilter_ipv4.h>
|
|
|
|
#include <linux/netfilter_ipv6.h>
|
|
|
|
#include <linux/tty.h>
|
|
|
|
#include <net/icmp.h>
|
2007-10-11 02:30:46 +02:00
|
|
|
#include <net/ip.h> /* for local_port_range[] */
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
|
2008-01-29 14:38:23 +01:00
|
|
|
#include <net/net_namespace.h>
|
2008-01-29 14:43:36 +01:00
|
|
|
#include <net/netlabel.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <asm/uaccess.h>
|
|
|
|
#include <asm/ioctls.h>
|
2008-01-29 14:43:36 +01:00
|
|
|
#include <asm/atomic.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/bitops.h>
|
|
|
|
#include <linux/interrupt.h>
|
|
|
|
#include <linux/netdevice.h> /* for network interface checks */
|
|
|
|
#include <linux/netlink.h>
|
|
|
|
#include <linux/tcp.h>
|
|
|
|
#include <linux/udp.h>
|
2006-11-14 01:09:01 +01:00
|
|
|
#include <linux/dccp.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/quota.h>
|
|
|
|
#include <linux/un.h> /* for Unix socket types */
|
|
|
|
#include <net/af_unix.h> /* for Unix socket types */
|
|
|
|
#include <linux/parser.h>
|
|
|
|
#include <linux/nfs_mount.h>
|
|
|
|
#include <net/ipv6.h>
|
|
|
|
#include <linux/hugetlb.h>
|
|
|
|
#include <linux/personality.h>
|
|
|
|
#include <linux/sysctl.h>
|
|
|
|
#include <linux/audit.h>
|
2005-06-30 11:58:51 +02:00
|
|
|
#include <linux/string.h>
|
[AF_UNIX]: Datagram getpeersec
This patch implements an API whereby an application can determine the
label of its peer's Unix datagram sockets via the auxiliary data mechanism of
recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of the peer of a Unix datagram socket. The application
can then use this security context to determine the security context for
processing on behalf of the peer who sent the packet.
Patch design and implementation:
The design and implementation is very similar to the UDP case for INET
sockets. Basically we build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message). To retrieve the security
context, the application first indicates to the kernel such desire by
setting the SO_PASSSEC option via getsockopt. Then the application
retrieves the security context using the auxiliary data mechanism.
An example server application for Unix datagram socket should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_SOCKET, SO_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_SOCKET &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
sock_setsockopt is enhanced with a new socket option SOCK_PASSSEC to allow
a server socket to receive security context of the peer.
Testing:
We have tested the patch by setting up Unix datagram client and server
applications. We verified that the server can retrieve the security context
using the auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-29 21:27:47 +02:00
|
|
|
#include <linux/selinux.h>
|
2006-09-26 08:32:01 +02:00
|
|
|
#include <linux/mutex.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
#include "avc.h"
|
|
|
|
#include "objsec.h"
|
|
|
|
#include "netif.h"
|
2008-01-29 14:38:13 +01:00
|
|
|
#include "netnode.h"
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
#include "xfrm.h"
|
2007-02-28 21:14:23 +01:00
|
|
|
#include "netlabel.h"
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
#define XATTR_SELINUX_SUFFIX "selinux"
|
|
|
|
#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
#define NUM_SEL_MNT_OPTS 4
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
extern unsigned int policydb_loaded_version;
|
|
|
|
extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
extern int selinux_compat_net;
|
2007-10-17 08:31:32 +02:00
|
|
|
extern struct security_operations *security_ops;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:43:36 +01:00
|
|
|
/* SECMARK reference count */
|
|
|
|
atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
|
|
|
|
int selinux_enforcing = 0;
|
|
|
|
|
|
|
|
static int __init enforcing_setup(char *str)
|
|
|
|
{
|
|
|
|
selinux_enforcing = simple_strtol(str,NULL,0);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
__setup("enforcing=", enforcing_setup);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
|
|
|
|
int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
|
|
|
|
|
|
|
|
static int __init selinux_enabled_setup(char *str)
|
|
|
|
{
|
|
|
|
selinux_enabled = simple_strtol(str, NULL, 0);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
__setup("selinux=", selinux_enabled_setup);
|
2006-05-03 16:52:36 +02:00
|
|
|
#else
|
|
|
|
int selinux_enabled = 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* Original (dummy) security module. */
|
|
|
|
static struct security_operations *original_ops = NULL;
|
|
|
|
|
|
|
|
/* Minimal support for a secondary security module,
|
|
|
|
just to allow the use of the dummy or capability modules.
|
|
|
|
The owlsm module can alternatively be used as a secondary
|
|
|
|
module as long as CONFIG_OWLSM_FD is not enabled. */
|
|
|
|
static struct security_operations *secondary_ops = NULL;
|
|
|
|
|
|
|
|
/* Lists of inode and superblock security structures initialized
|
|
|
|
before the policy was loaded. */
|
|
|
|
static LIST_HEAD(superblock_security_head);
|
|
|
|
static DEFINE_SPINLOCK(sb_security_lock);
|
|
|
|
|
2006-12-07 05:33:20 +01:00
|
|
|
static struct kmem_cache *sel_inode_cache;
|
2006-03-22 09:09:22 +01:00
|
|
|
|
2008-01-29 14:43:36 +01:00
|
|
|
/**
|
|
|
|
* selinux_secmark_enabled - Check to see if SECMARK is currently enabled
|
|
|
|
*
|
|
|
|
* Description:
|
|
|
|
* This function checks the SECMARK reference counter to see if any SECMARK
|
|
|
|
* targets are currently configured, if the reference counter is greater than
|
|
|
|
* zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
|
|
|
|
* enabled, false (0) if SECMARK is disabled.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
static int selinux_secmark_enabled(void)
|
|
|
|
{
|
|
|
|
return (atomic_read(&selinux_secmark_refcount) > 0);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Allocate and free functions for each kind of security blob. */
|
|
|
|
|
|
|
|
static int task_alloc_security(struct task_struct *task)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!tsec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
tsec->task = task;
|
|
|
|
tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
|
|
|
|
task->security = tsec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void task_free_security(struct task_struct *task)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = task->security;
|
|
|
|
task->security = NULL;
|
|
|
|
kfree(tsec);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int inode_alloc_security(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
|
2008-04-04 00:35:05 +02:00
|
|
|
isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!isec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2006-09-26 08:32:01 +02:00
|
|
|
mutex_init(&isec->lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
INIT_LIST_HEAD(&isec->list);
|
|
|
|
isec->inode = inode;
|
|
|
|
isec->sid = SECINITSID_UNLABELED;
|
|
|
|
isec->sclass = SECCLASS_FILE;
|
2006-02-01 12:05:56 +01:00
|
|
|
isec->task_sid = tsec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
inode->i_security = isec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void inode_free_security(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
struct superblock_security_struct *sbsec = inode->i_sb->s_security;
|
|
|
|
|
|
|
|
spin_lock(&sbsec->isec_lock);
|
|
|
|
if (!list_empty(&isec->list))
|
|
|
|
list_del_init(&isec->list);
|
|
|
|
spin_unlock(&sbsec->isec_lock);
|
|
|
|
|
|
|
|
inode->i_security = NULL;
|
2006-03-22 09:09:22 +01:00
|
|
|
kmem_cache_free(sel_inode_cache, isec);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int file_alloc_security(struct file *file)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
struct file_security_struct *fsec;
|
|
|
|
|
2006-02-01 12:05:55 +01:00
|
|
|
fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!fsec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
fsec->file = file;
|
2006-02-01 12:05:56 +01:00
|
|
|
fsec->sid = tsec->sid;
|
|
|
|
fsec->fown_sid = tsec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
file->f_security = fsec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void file_free_security(struct file *file)
|
|
|
|
{
|
|
|
|
struct file_security_struct *fsec = file->f_security;
|
|
|
|
file->f_security = NULL;
|
|
|
|
kfree(fsec);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int superblock_alloc_security(struct super_block *sb)
|
|
|
|
{
|
|
|
|
struct superblock_security_struct *sbsec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!sbsec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2006-09-26 08:32:02 +02:00
|
|
|
mutex_init(&sbsec->lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
INIT_LIST_HEAD(&sbsec->list);
|
|
|
|
INIT_LIST_HEAD(&sbsec->isec_head);
|
|
|
|
spin_lock_init(&sbsec->isec_lock);
|
|
|
|
sbsec->sb = sb;
|
|
|
|
sbsec->sid = SECINITSID_UNLABELED;
|
|
|
|
sbsec->def_sid = SECINITSID_FILE;
|
2006-07-10 13:43:53 +02:00
|
|
|
sbsec->mntpoint_sid = SECINITSID_UNLABELED;
|
2005-04-17 00:20:36 +02:00
|
|
|
sb->s_security = sbsec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void superblock_free_security(struct super_block *sb)
|
|
|
|
{
|
|
|
|
struct superblock_security_struct *sbsec = sb->s_security;
|
|
|
|
|
|
|
|
spin_lock(&sb_security_lock);
|
|
|
|
if (!list_empty(&sbsec->list))
|
|
|
|
list_del_init(&sbsec->list);
|
|
|
|
spin_unlock(&sb_security_lock);
|
|
|
|
|
|
|
|
sb->s_security = NULL;
|
|
|
|
kfree(sbsec);
|
|
|
|
}
|
|
|
|
|
2005-10-21 09:20:43 +02:00
|
|
|
static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct sk_security_struct *ssec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
ssec = kzalloc(sizeof(*ssec), priority);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!ssec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ssec->sk = sk;
|
|
|
|
ssec->peer_sid = SECINITSID_UNLABELED;
|
2006-08-05 08:08:56 +02:00
|
|
|
ssec->sid = SECINITSID_UNLABELED;
|
2005-04-17 00:20:36 +02:00
|
|
|
sk->sk_security = ssec;
|
|
|
|
|
2006-08-30 02:53:48 +02:00
|
|
|
selinux_netlbl_sk_security_init(ssec, family);
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void sk_free_security(struct sock *sk)
|
|
|
|
{
|
|
|
|
struct sk_security_struct *ssec = sk->sk_security;
|
|
|
|
|
|
|
|
sk->sk_security = NULL;
|
|
|
|
kfree(ssec);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* The security server must be initialized before
|
|
|
|
any labeling or access decisions can be provided. */
|
|
|
|
extern int ss_initialized;
|
|
|
|
|
|
|
|
/* The file system's label must be initialized prior to use. */
|
|
|
|
|
|
|
|
static char *labeling_behaviors[6] = {
|
|
|
|
"uses xattr",
|
|
|
|
"uses transition SIDs",
|
|
|
|
"uses task SIDs",
|
|
|
|
"uses genfs_contexts",
|
|
|
|
"not configured for labeling",
|
|
|
|
"uses mountpoint labeling",
|
|
|
|
};
|
|
|
|
|
|
|
|
static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
|
|
|
|
|
|
|
|
static inline int inode_doinit(struct inode *inode)
|
|
|
|
{
|
|
|
|
return inode_doinit_with_dentry(inode, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
enum {
|
2007-09-19 23:19:12 +02:00
|
|
|
Opt_error = -1,
|
2005-04-17 00:20:36 +02:00
|
|
|
Opt_context = 1,
|
|
|
|
Opt_fscontext = 2,
|
2007-11-30 19:00:35 +01:00
|
|
|
Opt_defcontext = 3,
|
|
|
|
Opt_rootcontext = 4,
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
static match_table_t tokens = {
|
|
|
|
{Opt_context, "context=%s"},
|
|
|
|
{Opt_fscontext, "fscontext=%s"},
|
|
|
|
{Opt_defcontext, "defcontext=%s"},
|
2006-07-10 13:43:55 +02:00
|
|
|
{Opt_rootcontext, "rootcontext=%s"},
|
2007-09-19 23:19:12 +02:00
|
|
|
{Opt_error, NULL},
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
|
|
|
|
|
2006-07-10 13:43:53 +02:00
|
|
|
static int may_context_mount_sb_relabel(u32 sid,
|
|
|
|
struct superblock_security_struct *sbsec,
|
|
|
|
struct task_security_struct *tsec)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__RELABELFROM, NULL);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__RELABELTO, NULL);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2006-07-10 13:43:55 +02:00
|
|
|
static int may_context_mount_inode_relabel(u32 sid,
|
|
|
|
struct superblock_security_struct *sbsec,
|
|
|
|
struct task_security_struct *tsec)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__RELABELFROM, NULL);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__ASSOCIATE, NULL);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
static int sb_finish_set_opts(struct super_block *sb)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct superblock_security_struct *sbsec = sb->s_security;
|
2007-11-30 19:00:35 +01:00
|
|
|
struct dentry *root = sb->s_root;
|
|
|
|
struct inode *root_inode = root->d_inode;
|
|
|
|
int rc = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
|
|
|
|
/* Make sure that the xattr handler exists and that no
|
|
|
|
error other than -ENODATA is returned by getxattr on
|
|
|
|
the root directory. -ENODATA is ok, as this may be
|
|
|
|
the first boot of the SELinux kernel before we have
|
|
|
|
assigned xattr values to the filesystem. */
|
|
|
|
if (!root_inode->i_op->getxattr) {
|
|
|
|
printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
|
|
|
|
"xattr support\n", sb->s_id, sb->s_type->name);
|
|
|
|
rc = -EOPNOTSUPP;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
|
|
|
|
if (rc < 0 && rc != -ENODATA) {
|
|
|
|
if (rc == -EOPNOTSUPP)
|
|
|
|
printk(KERN_WARNING "SELinux: (dev %s, type "
|
|
|
|
"%s) has no security xattr handler\n",
|
|
|
|
sb->s_id, sb->s_type->name);
|
|
|
|
else
|
|
|
|
printk(KERN_WARNING "SELinux: (dev %s, type "
|
|
|
|
"%s) getxattr errno %d\n", sb->s_id,
|
|
|
|
sb->s_type->name, -rc);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
sbsec->initialized = 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
|
|
|
|
printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
|
|
|
|
sb->s_id, sb->s_type->name);
|
|
|
|
else
|
|
|
|
printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
|
|
|
|
sb->s_id, sb->s_type->name,
|
|
|
|
labeling_behaviors[sbsec->behavior-1]);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/* Initialize the root inode. */
|
|
|
|
rc = inode_doinit_with_dentry(root_inode, root);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/* Initialize any other inodes associated with the superblock, e.g.
|
|
|
|
inodes created prior to initial policy load or inodes created
|
|
|
|
during get_sb by a pseudo filesystem that directly
|
|
|
|
populates itself. */
|
|
|
|
spin_lock(&sbsec->isec_lock);
|
|
|
|
next_inode:
|
|
|
|
if (!list_empty(&sbsec->isec_head)) {
|
|
|
|
struct inode_security_struct *isec =
|
|
|
|
list_entry(sbsec->isec_head.next,
|
|
|
|
struct inode_security_struct, list);
|
|
|
|
struct inode *inode = isec->inode;
|
|
|
|
spin_unlock(&sbsec->isec_lock);
|
|
|
|
inode = igrab(inode);
|
|
|
|
if (inode) {
|
|
|
|
if (!IS_PRIVATE(inode))
|
|
|
|
inode_doinit(inode);
|
|
|
|
iput(inode);
|
|
|
|
}
|
|
|
|
spin_lock(&sbsec->isec_lock);
|
|
|
|
list_del_init(&isec->list);
|
|
|
|
goto next_inode;
|
|
|
|
}
|
|
|
|
spin_unlock(&sbsec->isec_lock);
|
|
|
|
out:
|
|
|
|
return rc;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/*
|
|
|
|
* This function should allow an FS to ask what it's mount security
|
|
|
|
* options were so it can use those later for submounts, displaying
|
|
|
|
* mount options, or whatever.
|
|
|
|
*/
|
|
|
|
static int selinux_get_mnt_opts(const struct super_block *sb,
|
2008-03-05 16:31:54 +01:00
|
|
|
struct security_mnt_opts *opts)
|
2007-11-30 19:00:35 +01:00
|
|
|
{
|
|
|
|
int rc = 0, i;
|
|
|
|
struct superblock_security_struct *sbsec = sb->s_security;
|
|
|
|
char *context = NULL;
|
|
|
|
u32 len;
|
|
|
|
char tmp;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
security_init_mnt_opts(opts);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (!sbsec->initialized)
|
|
|
|
return -EINVAL;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (!ss_initialized)
|
|
|
|
return -EINVAL;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/*
|
|
|
|
* if we ever use sbsec flags for anything other than tracking mount
|
|
|
|
* settings this is going to need a mask
|
|
|
|
*/
|
|
|
|
tmp = sbsec->flags;
|
|
|
|
/* count the number of mount options for this sb */
|
|
|
|
for (i = 0; i < 8; i++) {
|
|
|
|
if (tmp & 0x01)
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->num_mnt_opts++;
|
2007-11-30 19:00:35 +01:00
|
|
|
tmp >>= 1;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
|
|
|
|
if (!opts->mnt_opts) {
|
2007-11-30 19:00:35 +01:00
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_free;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
|
|
|
|
if (!opts->mnt_opts_flags) {
|
2007-11-30 19:00:35 +01:00
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_free;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
i = 0;
|
|
|
|
if (sbsec->flags & FSCONTEXT_MNT) {
|
|
|
|
rc = security_sid_to_context(sbsec->sid, &context, &len);
|
|
|
|
if (rc)
|
|
|
|
goto out_free;
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[i] = context;
|
|
|
|
opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (sbsec->flags & CONTEXT_MNT) {
|
|
|
|
rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
|
|
|
|
if (rc)
|
|
|
|
goto out_free;
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[i] = context;
|
|
|
|
opts->mnt_opts_flags[i++] = CONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (sbsec->flags & DEFCONTEXT_MNT) {
|
|
|
|
rc = security_sid_to_context(sbsec->def_sid, &context, &len);
|
|
|
|
if (rc)
|
|
|
|
goto out_free;
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[i] = context;
|
|
|
|
opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (sbsec->flags & ROOTCONTEXT_MNT) {
|
|
|
|
struct inode *root = sbsec->sb->s_root->d_inode;
|
|
|
|
struct inode_security_struct *isec = root->i_security;
|
2006-07-10 13:43:55 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
rc = security_sid_to_context(isec->sid, &context, &len);
|
|
|
|
if (rc)
|
|
|
|
goto out_free;
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[i] = context;
|
|
|
|
opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
BUG_ON(i != opts->num_mnt_opts);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
out_free:
|
2008-03-05 16:31:54 +01:00
|
|
|
security_free_mnt_opts(opts);
|
2007-11-30 19:00:35 +01:00
|
|
|
return rc;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
static int bad_option(struct superblock_security_struct *sbsec, char flag,
|
|
|
|
u32 old_sid, u32 new_sid)
|
|
|
|
{
|
|
|
|
/* check if the old mount command had the same options */
|
|
|
|
if (sbsec->initialized)
|
|
|
|
if (!(sbsec->flags & flag) ||
|
|
|
|
(old_sid != new_sid))
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
/* check if we were passed the same options twice,
|
|
|
|
* aka someone passed context=a,context=b
|
|
|
|
*/
|
|
|
|
if (!sbsec->initialized)
|
|
|
|
if (sbsec->flags & flag)
|
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
2008-03-05 16:31:54 +01:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/*
|
|
|
|
* Allow filesystems with binary mount data to explicitly set mount point
|
|
|
|
* labeling information.
|
|
|
|
*/
|
2008-03-05 16:31:54 +01:00
|
|
|
static int selinux_set_mnt_opts(struct super_block *sb,
|
|
|
|
struct security_mnt_opts *opts)
|
2007-11-30 19:00:35 +01:00
|
|
|
{
|
|
|
|
int rc = 0, i;
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
struct superblock_security_struct *sbsec = sb->s_security;
|
|
|
|
const char *name = sb->s_type->name;
|
|
|
|
struct inode *inode = sbsec->sb->s_root->d_inode;
|
|
|
|
struct inode_security_struct *root_isec = inode->i_security;
|
|
|
|
u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
|
|
|
|
u32 defcontext_sid = 0;
|
2008-03-05 16:31:54 +01:00
|
|
|
char **mount_options = opts->mnt_opts;
|
|
|
|
int *flags = opts->mnt_opts_flags;
|
|
|
|
int num_opts = opts->num_mnt_opts;
|
2007-11-30 19:00:35 +01:00
|
|
|
|
|
|
|
mutex_lock(&sbsec->lock);
|
|
|
|
|
|
|
|
if (!ss_initialized) {
|
|
|
|
if (!num_opts) {
|
|
|
|
/* Defer initialization until selinux_complete_init,
|
|
|
|
after the initial policy is loaded and the security
|
|
|
|
server is ready to handle calls. */
|
|
|
|
spin_lock(&sb_security_lock);
|
|
|
|
if (list_empty(&sbsec->list))
|
|
|
|
list_add(&sbsec->list, &superblock_security_head);
|
|
|
|
spin_unlock(&sb_security_lock);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING "Unable to set superblock options before "
|
|
|
|
"the security server is initialized\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
goto out;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
/*
|
|
|
|
* Binary mount data FS will come through this function twice. Once
|
|
|
|
* from an explicit call and once from the generic calls from the vfs.
|
|
|
|
* Since the generic VFS calls will not contain any security mount data
|
|
|
|
* we need to skip the double mount verification.
|
|
|
|
*
|
|
|
|
* This does open a hole in which we will not notice if the first
|
|
|
|
* mount using this sb set explict options and a second mount using
|
|
|
|
* this sb does not set any security options. (The first options
|
|
|
|
* will be used for both mounts)
|
|
|
|
*/
|
|
|
|
if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
|
|
|
|
&& (num_opts == 0))
|
|
|
|
goto out;
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/*
|
|
|
|
* parse the mount options, check if they are valid sids.
|
|
|
|
* also check if someone is trying to mount the same sb more
|
|
|
|
* than once with different security options.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < num_opts; i++) {
|
|
|
|
u32 sid;
|
|
|
|
rc = security_context_to_sid(mount_options[i],
|
|
|
|
strlen(mount_options[i]), &sid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (rc) {
|
|
|
|
printk(KERN_WARNING "SELinux: security_context_to_sid"
|
|
|
|
"(%s) failed for (dev %s, type %s) errno=%d\n",
|
2007-11-30 19:00:35 +01:00
|
|
|
mount_options[i], sb->s_id, name, rc);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
switch (flags[i]) {
|
|
|
|
case FSCONTEXT_MNT:
|
|
|
|
fscontext_sid = sid;
|
|
|
|
|
|
|
|
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
|
|
|
|
fscontext_sid))
|
|
|
|
goto out_double_mount;
|
|
|
|
|
|
|
|
sbsec->flags |= FSCONTEXT_MNT;
|
|
|
|
break;
|
|
|
|
case CONTEXT_MNT:
|
|
|
|
context_sid = sid;
|
|
|
|
|
|
|
|
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
|
|
|
|
context_sid))
|
|
|
|
goto out_double_mount;
|
|
|
|
|
|
|
|
sbsec->flags |= CONTEXT_MNT;
|
|
|
|
break;
|
|
|
|
case ROOTCONTEXT_MNT:
|
|
|
|
rootcontext_sid = sid;
|
|
|
|
|
|
|
|
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
|
|
|
|
rootcontext_sid))
|
|
|
|
goto out_double_mount;
|
|
|
|
|
|
|
|
sbsec->flags |= ROOTCONTEXT_MNT;
|
|
|
|
|
|
|
|
break;
|
|
|
|
case DEFCONTEXT_MNT:
|
|
|
|
defcontext_sid = sid;
|
|
|
|
|
|
|
|
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
|
|
|
|
defcontext_sid))
|
|
|
|
goto out_double_mount;
|
|
|
|
|
|
|
|
sbsec->flags |= DEFCONTEXT_MNT;
|
|
|
|
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
rc = -EINVAL;
|
|
|
|
goto out;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if (sbsec->initialized) {
|
|
|
|
/* previously mounted with options, but not on this attempt? */
|
|
|
|
if (sbsec->flags && !num_opts)
|
|
|
|
goto out_double_mount;
|
|
|
|
rc = 0;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (strcmp(sb->s_type->name, "proc") == 0)
|
|
|
|
sbsec->proc = 1;
|
|
|
|
|
|
|
|
/* Determine the labeling behavior to use for this filesystem type. */
|
|
|
|
rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
|
|
|
|
if (rc) {
|
|
|
|
printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
|
|
|
|
__FUNCTION__, sb->s_type->name, rc);
|
|
|
|
goto out;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/* sets the context of the superblock for the fs being mounted. */
|
|
|
|
if (fscontext_sid) {
|
|
|
|
|
|
|
|
rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (rc)
|
2007-11-30 19:00:35 +01:00
|
|
|
goto out;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
sbsec->sid = fscontext_sid;
|
2006-07-10 13:43:53 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Switch to using mount point labeling behavior.
|
|
|
|
* sets the label used on all file below the mountpoint, and will set
|
|
|
|
* the superblock context if not already set.
|
|
|
|
*/
|
2007-11-30 19:00:35 +01:00
|
|
|
if (context_sid) {
|
|
|
|
if (!fscontext_sid) {
|
|
|
|
rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
|
2006-07-14 09:24:33 +02:00
|
|
|
if (rc)
|
2007-11-30 19:00:35 +01:00
|
|
|
goto out;
|
|
|
|
sbsec->sid = context_sid;
|
2006-07-14 09:24:33 +02:00
|
|
|
} else {
|
2007-11-30 19:00:35 +01:00
|
|
|
rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
|
2006-07-14 09:24:33 +02:00
|
|
|
if (rc)
|
2007-11-30 19:00:35 +01:00
|
|
|
goto out;
|
2006-07-14 09:24:33 +02:00
|
|
|
}
|
2007-11-30 19:00:35 +01:00
|
|
|
if (!rootcontext_sid)
|
|
|
|
rootcontext_sid = context_sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
sbsec->mntpoint_sid = context_sid;
|
2006-07-10 13:43:53 +02:00
|
|
|
sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (rootcontext_sid) {
|
|
|
|
rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
|
2006-07-10 13:43:55 +02:00
|
|
|
if (rc)
|
2007-11-30 19:00:35 +01:00
|
|
|
goto out;
|
2006-07-10 13:43:55 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
root_isec->sid = rootcontext_sid;
|
|
|
|
root_isec->initialized = 1;
|
2006-07-10 13:43:55 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (defcontext_sid) {
|
|
|
|
if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING "SELinux: defcontext option is "
|
|
|
|
"invalid for this filesystem type\n");
|
|
|
|
goto out;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (defcontext_sid != sbsec->def_sid) {
|
|
|
|
rc = may_context_mount_inode_relabel(defcontext_sid,
|
|
|
|
sbsec, tsec);
|
|
|
|
if (rc)
|
|
|
|
goto out;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
sbsec->def_sid = defcontext_sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
rc = sb_finish_set_opts(sb);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
2007-11-30 19:00:35 +01:00
|
|
|
mutex_unlock(&sbsec->lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
return rc;
|
2007-11-30 19:00:35 +01:00
|
|
|
out_double_mount:
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
|
|
|
|
"security settings for (dev %s, type %s)\n", sb->s_id, name);
|
|
|
|
goto out;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
|
|
|
|
struct super_block *newsb)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2007-11-30 19:00:35 +01:00
|
|
|
const struct superblock_security_struct *oldsbsec = oldsb->s_security;
|
|
|
|
struct superblock_security_struct *newsbsec = newsb->s_security;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
|
|
|
|
int set_context = (oldsbsec->flags & CONTEXT_MNT);
|
|
|
|
int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/* we can't error, we can't save the info, this shouldn't get called
|
|
|
|
* this early in the boot process. */
|
|
|
|
BUG_ON(!ss_initialized);
|
|
|
|
|
|
|
|
/* how can we clone if the old one wasn't set up?? */
|
|
|
|
BUG_ON(!oldsbsec->initialized);
|
|
|
|
|
2008-04-09 20:08:35 +02:00
|
|
|
/* if fs is reusing a sb, just let its options stand... */
|
|
|
|
if (newsbsec->initialized)
|
|
|
|
return;
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
mutex_lock(&newsbsec->lock);
|
|
|
|
|
|
|
|
newsbsec->flags = oldsbsec->flags;
|
|
|
|
|
|
|
|
newsbsec->sid = oldsbsec->sid;
|
|
|
|
newsbsec->def_sid = oldsbsec->def_sid;
|
|
|
|
newsbsec->behavior = oldsbsec->behavior;
|
|
|
|
|
|
|
|
if (set_context) {
|
|
|
|
u32 sid = oldsbsec->mntpoint_sid;
|
|
|
|
|
|
|
|
if (!set_fscontext)
|
|
|
|
newsbsec->sid = sid;
|
|
|
|
if (!set_rootcontext) {
|
|
|
|
struct inode *newinode = newsb->s_root->d_inode;
|
|
|
|
struct inode_security_struct *newisec = newinode->i_security;
|
|
|
|
newisec->sid = sid;
|
|
|
|
}
|
|
|
|
newsbsec->mntpoint_sid = sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
2007-11-30 19:00:35 +01:00
|
|
|
if (set_rootcontext) {
|
|
|
|
const struct inode *oldinode = oldsb->s_root->d_inode;
|
|
|
|
const struct inode_security_struct *oldisec = oldinode->i_security;
|
|
|
|
struct inode *newinode = newsb->s_root->d_inode;
|
|
|
|
struct inode_security_struct *newisec = newinode->i_security;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
newisec->sid = oldisec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
sb_finish_set_opts(newsb);
|
|
|
|
mutex_unlock(&newsbsec->lock);
|
|
|
|
}
|
|
|
|
|
2008-03-17 21:29:23 +01:00
|
|
|
static int selinux_parse_opts_str(char *options,
|
|
|
|
struct security_mnt_opts *opts)
|
2007-11-30 19:00:35 +01:00
|
|
|
{
|
2008-03-05 16:31:54 +01:00
|
|
|
char *p;
|
2007-11-30 19:00:35 +01:00
|
|
|
char *context = NULL, *defcontext = NULL;
|
|
|
|
char *fscontext = NULL, *rootcontext = NULL;
|
2008-03-05 16:31:54 +01:00
|
|
|
int rc, num_mnt_opts = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->num_mnt_opts = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
/* Standard string-based options. */
|
|
|
|
while ((p = strsep(&options, "|")) != NULL) {
|
|
|
|
int token;
|
|
|
|
substring_t args[MAX_OPT_ARGS];
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (!*p)
|
|
|
|
continue;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
token = match_token(p, tokens, args);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
switch (token) {
|
|
|
|
case Opt_context:
|
|
|
|
if (context || defcontext) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
context = match_strdup(&args[0]);
|
|
|
|
if (!context) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case Opt_fscontext:
|
|
|
|
if (fscontext) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
fscontext = match_strdup(&args[0]);
|
|
|
|
if (!fscontext) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case Opt_rootcontext:
|
|
|
|
if (rootcontext) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
rootcontext = match_strdup(&args[0]);
|
|
|
|
if (!rootcontext) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case Opt_defcontext:
|
|
|
|
if (context || defcontext) {
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
defcontext = match_strdup(&args[0]);
|
|
|
|
if (!defcontext) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
rc = -EINVAL;
|
|
|
|
printk(KERN_WARNING "SELinux: unknown mount option\n");
|
|
|
|
goto out_err;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
}
|
|
|
|
}
|
2007-11-30 19:00:35 +01:00
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
rc = -ENOMEM;
|
|
|
|
opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
|
|
|
|
if (!opts->mnt_opts)
|
|
|
|
goto out_err;
|
|
|
|
|
|
|
|
opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
|
|
|
|
if (!opts->mnt_opts_flags) {
|
|
|
|
kfree(opts->mnt_opts);
|
|
|
|
goto out_err;
|
|
|
|
}
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
if (fscontext) {
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[num_mnt_opts] = fscontext;
|
|
|
|
opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (context) {
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[num_mnt_opts] = context;
|
|
|
|
opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (rootcontext) {
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[num_mnt_opts] = rootcontext;
|
|
|
|
opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
if (defcontext) {
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->mnt_opts[num_mnt_opts] = defcontext;
|
|
|
|
opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
|
2007-11-30 19:00:35 +01:00
|
|
|
}
|
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
opts->num_mnt_opts = num_mnt_opts;
|
|
|
|
return 0;
|
|
|
|
|
2007-11-30 19:00:35 +01:00
|
|
|
out_err:
|
|
|
|
kfree(context);
|
|
|
|
kfree(defcontext);
|
|
|
|
kfree(fscontext);
|
|
|
|
kfree(rootcontext);
|
2005-04-17 00:20:36 +02:00
|
|
|
return rc;
|
|
|
|
}
|
2008-03-05 16:31:54 +01:00
|
|
|
/*
|
|
|
|
* string mount options parsing and call set the sbsec
|
|
|
|
*/
|
|
|
|
static int superblock_doinit(struct super_block *sb, void *data)
|
|
|
|
{
|
|
|
|
int rc = 0;
|
|
|
|
char *options = data;
|
|
|
|
struct security_mnt_opts opts;
|
|
|
|
|
|
|
|
security_init_mnt_opts(&opts);
|
|
|
|
|
|
|
|
if (!data)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
|
|
|
|
|
|
|
|
rc = selinux_parse_opts_str(options, &opts);
|
|
|
|
if (rc)
|
|
|
|
goto out_err;
|
|
|
|
|
|
|
|
out:
|
|
|
|
rc = selinux_set_mnt_opts(sb, &opts);
|
|
|
|
|
|
|
|
out_err:
|
|
|
|
security_free_mnt_opts(&opts);
|
|
|
|
return rc;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
static inline u16 inode_mode_to_security_class(umode_t mode)
|
|
|
|
{
|
|
|
|
switch (mode & S_IFMT) {
|
|
|
|
case S_IFSOCK:
|
|
|
|
return SECCLASS_SOCK_FILE;
|
|
|
|
case S_IFLNK:
|
|
|
|
return SECCLASS_LNK_FILE;
|
|
|
|
case S_IFREG:
|
|
|
|
return SECCLASS_FILE;
|
|
|
|
case S_IFBLK:
|
|
|
|
return SECCLASS_BLK_FILE;
|
|
|
|
case S_IFDIR:
|
|
|
|
return SECCLASS_DIR;
|
|
|
|
case S_IFCHR:
|
|
|
|
return SECCLASS_CHR_FILE;
|
|
|
|
case S_IFIFO:
|
|
|
|
return SECCLASS_FIFO_FILE;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
return SECCLASS_FILE;
|
|
|
|
}
|
|
|
|
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
static inline int default_protocol_stream(int protocol)
|
|
|
|
{
|
|
|
|
return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int default_protocol_dgram(int protocol)
|
|
|
|
{
|
|
|
|
return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static inline u16 socket_type_to_security_class(int family, int type, int protocol)
|
|
|
|
{
|
|
|
|
switch (family) {
|
|
|
|
case PF_UNIX:
|
|
|
|
switch (type) {
|
|
|
|
case SOCK_STREAM:
|
|
|
|
case SOCK_SEQPACKET:
|
|
|
|
return SECCLASS_UNIX_STREAM_SOCKET;
|
|
|
|
case SOCK_DGRAM:
|
|
|
|
return SECCLASS_UNIX_DGRAM_SOCKET;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case PF_INET:
|
|
|
|
case PF_INET6:
|
|
|
|
switch (type) {
|
|
|
|
case SOCK_STREAM:
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
if (default_protocol_stream(protocol))
|
|
|
|
return SECCLASS_TCP_SOCKET;
|
|
|
|
else
|
|
|
|
return SECCLASS_RAWIP_SOCKET;
|
2005-04-17 00:20:36 +02:00
|
|
|
case SOCK_DGRAM:
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
if (default_protocol_dgram(protocol))
|
|
|
|
return SECCLASS_UDP_SOCKET;
|
|
|
|
else
|
|
|
|
return SECCLASS_RAWIP_SOCKET;
|
2006-11-14 01:09:01 +01:00
|
|
|
case SOCK_DCCP:
|
|
|
|
return SECCLASS_DCCP_SOCKET;
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
default:
|
2005-04-17 00:20:36 +02:00
|
|
|
return SECCLASS_RAWIP_SOCKET;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case PF_NETLINK:
|
|
|
|
switch (protocol) {
|
|
|
|
case NETLINK_ROUTE:
|
|
|
|
return SECCLASS_NETLINK_ROUTE_SOCKET;
|
|
|
|
case NETLINK_FIREWALL:
|
|
|
|
return SECCLASS_NETLINK_FIREWALL_SOCKET;
|
2005-08-16 05:34:48 +02:00
|
|
|
case NETLINK_INET_DIAG:
|
2005-04-17 00:20:36 +02:00
|
|
|
return SECCLASS_NETLINK_TCPDIAG_SOCKET;
|
|
|
|
case NETLINK_NFLOG:
|
|
|
|
return SECCLASS_NETLINK_NFLOG_SOCKET;
|
|
|
|
case NETLINK_XFRM:
|
|
|
|
return SECCLASS_NETLINK_XFRM_SOCKET;
|
|
|
|
case NETLINK_SELINUX:
|
|
|
|
return SECCLASS_NETLINK_SELINUX_SOCKET;
|
|
|
|
case NETLINK_AUDIT:
|
|
|
|
return SECCLASS_NETLINK_AUDIT_SOCKET;
|
|
|
|
case NETLINK_IP6_FW:
|
|
|
|
return SECCLASS_NETLINK_IP6FW_SOCKET;
|
|
|
|
case NETLINK_DNRTMSG:
|
|
|
|
return SECCLASS_NETLINK_DNRT_SOCKET;
|
2005-04-17 00:24:13 +02:00
|
|
|
case NETLINK_KOBJECT_UEVENT:
|
|
|
|
return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
return SECCLASS_NETLINK_SOCKET;
|
|
|
|
}
|
|
|
|
case PF_PACKET:
|
|
|
|
return SECCLASS_PACKET_SOCKET;
|
|
|
|
case PF_KEY:
|
|
|
|
return SECCLASS_KEY_SOCKET;
|
2006-06-09 09:25:03 +02:00
|
|
|
case PF_APPLETALK:
|
|
|
|
return SECCLASS_APPLETALK_SOCKET;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return SECCLASS_SOCKET;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
|
|
static int selinux_proc_get_sid(struct proc_dir_entry *de,
|
|
|
|
u16 tclass,
|
|
|
|
u32 *sid)
|
|
|
|
{
|
|
|
|
int buflen, rc;
|
|
|
|
char *buffer, *path, *end;
|
|
|
|
|
|
|
|
buffer = (char*)__get_free_page(GFP_KERNEL);
|
|
|
|
if (!buffer)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
buflen = PAGE_SIZE;
|
|
|
|
end = buffer+buflen;
|
|
|
|
*--end = '\0';
|
|
|
|
buflen--;
|
|
|
|
path = end-1;
|
|
|
|
*path = '/';
|
|
|
|
while (de && de != de->parent) {
|
|
|
|
buflen -= de->namelen + 1;
|
|
|
|
if (buflen < 0)
|
|
|
|
break;
|
|
|
|
end -= de->namelen;
|
|
|
|
memcpy(end, de->name, de->namelen);
|
|
|
|
*--end = '/';
|
|
|
|
path = end;
|
|
|
|
de = de->parent;
|
|
|
|
}
|
|
|
|
rc = security_genfs_sid("proc", path, tclass, sid);
|
|
|
|
free_page((unsigned long)buffer);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static int selinux_proc_get_sid(struct proc_dir_entry *de,
|
|
|
|
u16 tclass,
|
|
|
|
u32 *sid)
|
|
|
|
{
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* The inode's security attributes must be initialized before first use. */
|
|
|
|
static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
|
|
|
|
{
|
|
|
|
struct superblock_security_struct *sbsec = NULL;
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
u32 sid;
|
|
|
|
struct dentry *dentry;
|
|
|
|
#define INITCONTEXTLEN 255
|
|
|
|
char *context = NULL;
|
|
|
|
unsigned len = 0;
|
|
|
|
int rc = 0;
|
|
|
|
|
|
|
|
if (isec->initialized)
|
|
|
|
goto out;
|
|
|
|
|
2006-09-26 08:32:01 +02:00
|
|
|
mutex_lock(&isec->lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (isec->initialized)
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
sbsec = inode->i_sb->s_security;
|
|
|
|
if (!sbsec->initialized) {
|
|
|
|
/* Defer initialization until selinux_complete_init,
|
|
|
|
after the initial policy is loaded and the security
|
|
|
|
server is ready to handle calls. */
|
|
|
|
spin_lock(&sbsec->isec_lock);
|
|
|
|
if (list_empty(&isec->list))
|
|
|
|
list_add(&isec->list, &sbsec->isec_head);
|
|
|
|
spin_unlock(&sbsec->isec_lock);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
switch (sbsec->behavior) {
|
|
|
|
case SECURITY_FS_USE_XATTR:
|
|
|
|
if (!inode->i_op->getxattr) {
|
|
|
|
isec->sid = sbsec->def_sid;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Need a dentry, since the xattr API requires one.
|
|
|
|
Life would be simpler if we could just pass the inode. */
|
|
|
|
if (opt_dentry) {
|
|
|
|
/* Called from d_instantiate or d_splice_alias. */
|
|
|
|
dentry = dget(opt_dentry);
|
|
|
|
} else {
|
|
|
|
/* Called from selinux_complete_init, try to find a dentry. */
|
|
|
|
dentry = d_find_alias(inode);
|
|
|
|
}
|
|
|
|
if (!dentry) {
|
|
|
|
printk(KERN_WARNING "%s: no dentry for dev=%s "
|
|
|
|
"ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
|
|
|
|
inode->i_ino);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
len = INITCONTEXTLEN;
|
2008-04-04 14:46:05 +02:00
|
|
|
context = kmalloc(len, GFP_NOFS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!context) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
dput(dentry);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
|
|
|
|
context, len);
|
|
|
|
if (rc == -ERANGE) {
|
|
|
|
/* Need a larger buffer. Query for the right size. */
|
|
|
|
rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
|
|
|
|
NULL, 0);
|
|
|
|
if (rc < 0) {
|
|
|
|
dput(dentry);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
kfree(context);
|
|
|
|
len = rc;
|
2008-04-04 14:46:05 +02:00
|
|
|
context = kmalloc(len, GFP_NOFS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!context) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
dput(dentry);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
rc = inode->i_op->getxattr(dentry,
|
|
|
|
XATTR_NAME_SELINUX,
|
|
|
|
context, len);
|
|
|
|
}
|
|
|
|
dput(dentry);
|
|
|
|
if (rc < 0) {
|
|
|
|
if (rc != -ENODATA) {
|
|
|
|
printk(KERN_WARNING "%s: getxattr returned "
|
|
|
|
"%d for dev=%s ino=%ld\n", __FUNCTION__,
|
|
|
|
-rc, inode->i_sb->s_id, inode->i_ino);
|
|
|
|
kfree(context);
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
/* Map ENODATA to the default file SID */
|
|
|
|
sid = sbsec->def_sid;
|
|
|
|
rc = 0;
|
|
|
|
} else {
|
2005-07-28 10:07:37 +02:00
|
|
|
rc = security_context_to_sid_default(context, rc, &sid,
|
2008-04-04 14:46:05 +02:00
|
|
|
sbsec->def_sid,
|
|
|
|
GFP_NOFS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (rc) {
|
|
|
|
printk(KERN_WARNING "%s: context_to_sid(%s) "
|
|
|
|
"returned %d for dev=%s ino=%ld\n",
|
|
|
|
__FUNCTION__, context, -rc,
|
|
|
|
inode->i_sb->s_id, inode->i_ino);
|
|
|
|
kfree(context);
|
|
|
|
/* Leave with the unlabeled SID */
|
|
|
|
rc = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
kfree(context);
|
|
|
|
isec->sid = sid;
|
|
|
|
break;
|
|
|
|
case SECURITY_FS_USE_TASK:
|
|
|
|
isec->sid = isec->task_sid;
|
|
|
|
break;
|
|
|
|
case SECURITY_FS_USE_TRANS:
|
|
|
|
/* Default to the fs SID. */
|
|
|
|
isec->sid = sbsec->sid;
|
|
|
|
|
|
|
|
/* Try to obtain a transition SID. */
|
|
|
|
isec->sclass = inode_mode_to_security_class(inode->i_mode);
|
|
|
|
rc = security_transition_sid(isec->task_sid,
|
|
|
|
sbsec->sid,
|
|
|
|
isec->sclass,
|
|
|
|
&sid);
|
|
|
|
if (rc)
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
isec->sid = sid;
|
|
|
|
break;
|
2006-07-10 13:43:53 +02:00
|
|
|
case SECURITY_FS_USE_MNTPOINT:
|
|
|
|
isec->sid = sbsec->mntpoint_sid;
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
2006-07-10 13:43:53 +02:00
|
|
|
/* Default to the fs superblock SID. */
|
2005-04-17 00:20:36 +02:00
|
|
|
isec->sid = sbsec->sid;
|
|
|
|
|
|
|
|
if (sbsec->proc) {
|
|
|
|
struct proc_inode *proci = PROC_I(inode);
|
|
|
|
if (proci->pde) {
|
|
|
|
isec->sclass = inode_mode_to_security_class(inode->i_mode);
|
|
|
|
rc = selinux_proc_get_sid(proci->pde,
|
|
|
|
isec->sclass,
|
|
|
|
&sid);
|
|
|
|
if (rc)
|
2006-09-26 08:32:01 +02:00
|
|
|
goto out_unlock;
|
2005-04-17 00:20:36 +02:00
|
|
|
isec->sid = sid;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
isec->initialized = 1;
|
|
|
|
|
2006-09-26 08:32:01 +02:00
|
|
|
out_unlock:
|
|
|
|
mutex_unlock(&isec->lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
if (isec->sclass == SECCLASS_FILE)
|
|
|
|
isec->sclass = inode_mode_to_security_class(inode->i_mode);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Convert a Linux signal to an access vector. */
|
|
|
|
static inline u32 signal_to_av(int sig)
|
|
|
|
{
|
|
|
|
u32 perm = 0;
|
|
|
|
|
|
|
|
switch (sig) {
|
|
|
|
case SIGCHLD:
|
|
|
|
/* Commonly granted from child to parent. */
|
|
|
|
perm = PROCESS__SIGCHLD;
|
|
|
|
break;
|
|
|
|
case SIGKILL:
|
|
|
|
/* Cannot be caught or ignored */
|
|
|
|
perm = PROCESS__SIGKILL;
|
|
|
|
break;
|
|
|
|
case SIGSTOP:
|
|
|
|
/* Cannot be caught or ignored */
|
|
|
|
perm = PROCESS__SIGSTOP;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* All other signals. */
|
|
|
|
perm = PROCESS__SIGNAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return perm;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check permission betweeen a pair of tasks, e.g. signal checks,
|
|
|
|
fork check, ptrace check, etc. */
|
|
|
|
static int task_has_perm(struct task_struct *tsk1,
|
|
|
|
struct task_struct *tsk2,
|
|
|
|
u32 perms)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec1, *tsec2;
|
|
|
|
|
|
|
|
tsec1 = tsk1->security;
|
|
|
|
tsec2 = tsk2->security;
|
|
|
|
return avc_has_perm(tsec1->sid, tsec2->sid,
|
|
|
|
SECCLASS_PROCESS, perms, NULL);
|
|
|
|
}
|
|
|
|
|
2008-02-07 17:21:04 +01:00
|
|
|
#if CAP_LAST_CAP > 63
|
|
|
|
#error Fix SELinux to handle capabilities > 63.
|
|
|
|
#endif
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Check whether a task is allowed to use a capability. */
|
|
|
|
static int task_has_capability(struct task_struct *tsk,
|
|
|
|
int cap)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct avc_audit_data ad;
|
2008-02-07 17:21:04 +01:00
|
|
|
u16 sclass;
|
|
|
|
u32 av = CAP_TO_MASK(cap);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
tsec = tsk->security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,CAP);
|
|
|
|
ad.tsk = tsk;
|
|
|
|
ad.u.cap = cap;
|
|
|
|
|
2008-02-07 17:21:04 +01:00
|
|
|
switch (CAP_TO_INDEX(cap)) {
|
|
|
|
case 0:
|
|
|
|
sclass = SECCLASS_CAPABILITY;
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
sclass = SECCLASS_CAPABILITY2;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
printk(KERN_ERR
|
|
|
|
"SELinux: out of range capability %d\n", cap);
|
|
|
|
BUG();
|
|
|
|
}
|
|
|
|
return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Check whether a task is allowed to use a system operation. */
|
|
|
|
static int task_has_system(struct task_struct *tsk,
|
|
|
|
u32 perms)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
|
|
|
|
tsec = tsk->security;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
|
|
|
|
SECCLASS_SYSTEM, perms, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check whether a task has a particular permission to an inode.
|
|
|
|
The 'adp' parameter is optional and allows other audit
|
|
|
|
data to be passed (e.g. the dentry). */
|
|
|
|
static int inode_has_perm(struct task_struct *tsk,
|
|
|
|
struct inode *inode,
|
|
|
|
u32 perms,
|
|
|
|
struct avc_audit_data *adp)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
2007-02-14 09:34:16 +01:00
|
|
|
if (unlikely (IS_PRIVATE (inode)))
|
|
|
|
return 0;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
tsec = tsk->security;
|
|
|
|
isec = inode->i_security;
|
|
|
|
|
|
|
|
if (!adp) {
|
|
|
|
adp = &ad;
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
|
|
|
ad.u.fs.inode = inode;
|
|
|
|
}
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Same as inode_has_perm, but pass explicit audit data containing
|
|
|
|
the dentry to help the auditing code to more easily generate the
|
|
|
|
pathname if needed. */
|
|
|
|
static inline int dentry_has_perm(struct task_struct *tsk,
|
|
|
|
struct vfsmount *mnt,
|
|
|
|
struct dentry *dentry,
|
|
|
|
u32 av)
|
|
|
|
{
|
|
|
|
struct inode *inode = dentry->d_inode;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.mnt = mnt;
|
|
|
|
ad.u.fs.path.dentry = dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
return inode_has_perm(tsk, inode, av, &ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check whether a task can use an open file descriptor to
|
|
|
|
access an inode in a given way. Check access to the
|
|
|
|
descriptor itself, and then use dentry_has_perm to
|
|
|
|
check a particular permission to the file.
|
|
|
|
Access to the descriptor is implicitly granted if it
|
|
|
|
has the same SID as the process. If av is zero, then
|
|
|
|
access to the file is not checked, e.g. for cases
|
|
|
|
where only the descriptor is affected like seek. */
|
2006-01-14 22:20:43 +01:00
|
|
|
static int file_has_perm(struct task_struct *tsk,
|
2005-04-17 00:20:36 +02:00
|
|
|
struct file *file,
|
|
|
|
u32 av)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = tsk->security;
|
|
|
|
struct file_security_struct *fsec = file->f_security;
|
2008-02-15 04:38:33 +01:00
|
|
|
struct inode *inode = file->f_path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path = file->f_path;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (tsec->sid != fsec->sid) {
|
|
|
|
rc = avc_has_perm(tsec->sid, fsec->sid,
|
|
|
|
SECCLASS_FD,
|
|
|
|
FD__USE,
|
|
|
|
&ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* av is zero if only checking access to the descriptor. */
|
|
|
|
if (av)
|
|
|
|
return inode_has_perm(tsk, inode, av, &ad);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check whether a task can create a file. */
|
|
|
|
static int may_create(struct inode *dir,
|
|
|
|
struct dentry *dentry,
|
|
|
|
u16 tclass)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct inode_security_struct *dsec;
|
|
|
|
struct superblock_security_struct *sbsec;
|
|
|
|
u32 newsid;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
dsec = dir->i_security;
|
|
|
|
sbsec = dir->i_sb->s_security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
|
|
|
|
DIR__ADD_NAME | DIR__SEARCH,
|
|
|
|
&ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
|
|
|
|
newsid = tsec->create_sid;
|
|
|
|
} else {
|
|
|
|
rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
|
|
|
|
&newsid);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return avc_has_perm(newsid, sbsec->sid,
|
|
|
|
SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__ASSOCIATE, &ad);
|
|
|
|
}
|
|
|
|
|
2006-06-26 09:24:57 +02:00
|
|
|
/* Check whether a task can create a key. */
|
|
|
|
static int may_create_key(u32 ksid,
|
|
|
|
struct task_struct *ctx)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
|
|
|
|
tsec = ctx->security;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
#define MAY_LINK 0
|
|
|
|
#define MAY_UNLINK 1
|
|
|
|
#define MAY_RMDIR 2
|
|
|
|
|
|
|
|
/* Check whether a task can link, unlink, or rmdir a file/directory. */
|
|
|
|
static int may_link(struct inode *dir,
|
|
|
|
struct dentry *dentry,
|
|
|
|
int kind)
|
|
|
|
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct inode_security_struct *dsec, *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
u32 av;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
dsec = dir->i_security;
|
|
|
|
isec = dentry->d_inode->i_security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
av = DIR__SEARCH;
|
|
|
|
av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
|
|
|
|
rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
switch (kind) {
|
|
|
|
case MAY_LINK:
|
|
|
|
av = FILE__LINK;
|
|
|
|
break;
|
|
|
|
case MAY_UNLINK:
|
|
|
|
av = FILE__UNLINK;
|
|
|
|
break;
|
|
|
|
case MAY_RMDIR:
|
|
|
|
av = DIR__RMDIR;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int may_rename(struct inode *old_dir,
|
|
|
|
struct dentry *old_dentry,
|
|
|
|
struct inode *new_dir,
|
|
|
|
struct dentry *new_dentry)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
u32 av;
|
|
|
|
int old_is_dir, new_is_dir;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
old_dsec = old_dir->i_security;
|
|
|
|
old_isec = old_dentry->d_inode->i_security;
|
|
|
|
old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
|
|
|
|
new_dsec = new_dir->i_security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
|
|
|
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = old_dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
|
|
|
|
DIR__REMOVE_NAME | DIR__SEARCH, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
rc = avc_has_perm(tsec->sid, old_isec->sid,
|
|
|
|
old_isec->sclass, FILE__RENAME, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
if (old_is_dir && new_dir != old_dir) {
|
|
|
|
rc = avc_has_perm(tsec->sid, old_isec->sid,
|
|
|
|
old_isec->sclass, DIR__REPARENT, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = new_dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
av = DIR__ADD_NAME | DIR__SEARCH;
|
|
|
|
if (new_dentry->d_inode)
|
|
|
|
av |= DIR__REMOVE_NAME;
|
|
|
|
rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
if (new_dentry->d_inode) {
|
|
|
|
new_isec = new_dentry->d_inode->i_security;
|
|
|
|
new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
|
|
|
|
rc = avc_has_perm(tsec->sid, new_isec->sid,
|
|
|
|
new_isec->sclass,
|
|
|
|
(new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check whether a task can perform a filesystem operation. */
|
|
|
|
static int superblock_has_perm(struct task_struct *tsk,
|
|
|
|
struct super_block *sb,
|
|
|
|
u32 perms,
|
|
|
|
struct avc_audit_data *ad)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct superblock_security_struct *sbsec;
|
|
|
|
|
|
|
|
tsec = tsk->security;
|
|
|
|
sbsec = sb->s_security;
|
|
|
|
return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
|
|
|
|
perms, ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Convert a Linux mode and permission mask to an access vector. */
|
|
|
|
static inline u32 file_mask_to_av(int mode, int mask)
|
|
|
|
{
|
|
|
|
u32 av = 0;
|
|
|
|
|
|
|
|
if ((mode & S_IFMT) != S_IFDIR) {
|
|
|
|
if (mask & MAY_EXEC)
|
|
|
|
av |= FILE__EXECUTE;
|
|
|
|
if (mask & MAY_READ)
|
|
|
|
av |= FILE__READ;
|
|
|
|
|
|
|
|
if (mask & MAY_APPEND)
|
|
|
|
av |= FILE__APPEND;
|
|
|
|
else if (mask & MAY_WRITE)
|
|
|
|
av |= FILE__WRITE;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
if (mask & MAY_EXEC)
|
|
|
|
av |= DIR__SEARCH;
|
|
|
|
if (mask & MAY_WRITE)
|
|
|
|
av |= DIR__WRITE;
|
|
|
|
if (mask & MAY_READ)
|
|
|
|
av |= DIR__READ;
|
|
|
|
}
|
|
|
|
|
|
|
|
return av;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Convert a Linux file to an access vector. */
|
|
|
|
static inline u32 file_to_av(struct file *file)
|
|
|
|
{
|
|
|
|
u32 av = 0;
|
|
|
|
|
|
|
|
if (file->f_mode & FMODE_READ)
|
|
|
|
av |= FILE__READ;
|
|
|
|
if (file->f_mode & FMODE_WRITE) {
|
|
|
|
if (file->f_flags & O_APPEND)
|
|
|
|
av |= FILE__APPEND;
|
|
|
|
else
|
|
|
|
av |= FILE__WRITE;
|
|
|
|
}
|
2008-03-17 13:55:18 +01:00
|
|
|
if (!av) {
|
|
|
|
/*
|
|
|
|
* Special file opened with flags 3 for ioctl-only use.
|
|
|
|
*/
|
|
|
|
av = FILE__IOCTL;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
return av;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Hook functions begin here. */
|
|
|
|
|
|
|
|
static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
|
|
|
|
{
|
|
|
|
struct task_security_struct *psec = parent->security;
|
|
|
|
struct task_security_struct *csec = child->security;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->ptrace(parent,child);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = task_has_perm(parent, child, PROCESS__PTRACE);
|
|
|
|
/* Save the SID of the tracing process for later use in apply_creds. */
|
2006-03-11 12:27:16 +01:00
|
|
|
if (!(child->ptrace & PT_PTRACED) && !rc)
|
2005-04-17 00:20:36 +02:00
|
|
|
csec->ptrace_sid = psec->sid;
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable, kernel_cap_t *permitted)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = task_has_perm(current, target, PROCESS__GETCAP);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
|
|
|
return secondary_ops->capget(target, effective, inheritable, permitted);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable, kernel_cap_t *permitted)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = secondary_ops->capset_check(target, effective, inheritable, permitted);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
|
|
|
return task_has_perm(current, target, PROCESS__SETCAP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable, kernel_cap_t *permitted)
|
|
|
|
{
|
|
|
|
secondary_ops->capset_set(target, effective, inheritable, permitted);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_capable(struct task_struct *tsk, int cap)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->capable(tsk, cap);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return task_has_capability(tsk,cap);
|
|
|
|
}
|
|
|
|
|
2007-02-14 09:34:14 +01:00
|
|
|
static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
|
|
|
|
{
|
|
|
|
int buflen, rc;
|
|
|
|
char *buffer, *path, *end;
|
|
|
|
|
|
|
|
rc = -ENOMEM;
|
|
|
|
buffer = (char*)__get_free_page(GFP_KERNEL);
|
|
|
|
if (!buffer)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
buflen = PAGE_SIZE;
|
|
|
|
end = buffer+buflen;
|
|
|
|
*--end = '\0';
|
|
|
|
buflen--;
|
|
|
|
path = end-1;
|
|
|
|
*path = '/';
|
|
|
|
while (table) {
|
|
|
|
const char *name = table->procname;
|
|
|
|
size_t namelen = strlen(name);
|
|
|
|
buflen -= namelen + 1;
|
|
|
|
if (buflen < 0)
|
|
|
|
goto out_free;
|
|
|
|
end -= namelen;
|
|
|
|
memcpy(end, name, namelen);
|
|
|
|
*--end = '/';
|
|
|
|
path = end;
|
|
|
|
table = table->parent;
|
|
|
|
}
|
2007-02-14 09:34:15 +01:00
|
|
|
buflen -= 4;
|
|
|
|
if (buflen < 0)
|
|
|
|
goto out_free;
|
|
|
|
end -= 4;
|
|
|
|
memcpy(end, "/sys", 4);
|
|
|
|
path = end;
|
2007-02-14 09:34:14 +01:00
|
|
|
rc = security_genfs_sid("proc", path, tclass, sid);
|
|
|
|
out_free:
|
|
|
|
free_page((unsigned long)buffer);
|
|
|
|
out:
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_sysctl(ctl_table *table, int op)
|
|
|
|
{
|
|
|
|
int error = 0;
|
|
|
|
u32 av;
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
u32 tsid;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->sysctl(table, op);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
|
2007-02-14 09:34:14 +01:00
|
|
|
rc = selinux_sysctl_get_sid(table, (op == 0001) ?
|
|
|
|
SECCLASS_DIR : SECCLASS_FILE, &tsid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (rc) {
|
|
|
|
/* Default to the well-defined sysctl SID. */
|
|
|
|
tsid = SECINITSID_SYSCTL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* The op values are "defined" in sysctl.c, thereby creating
|
|
|
|
* a bad coupling between this module and sysctl.c */
|
|
|
|
if(op == 001) {
|
|
|
|
error = avc_has_perm(tsec->sid, tsid,
|
|
|
|
SECCLASS_DIR, DIR__SEARCH, NULL);
|
|
|
|
} else {
|
|
|
|
av = 0;
|
|
|
|
if (op & 004)
|
|
|
|
av |= FILE__READ;
|
|
|
|
if (op & 002)
|
|
|
|
av |= FILE__WRITE;
|
|
|
|
if (av)
|
|
|
|
error = avc_has_perm(tsec->sid, tsid,
|
|
|
|
SECCLASS_FILE, av, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
|
|
|
|
{
|
|
|
|
int rc = 0;
|
|
|
|
|
|
|
|
if (!sb)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
switch (cmds) {
|
|
|
|
case Q_SYNC:
|
|
|
|
case Q_QUOTAON:
|
|
|
|
case Q_QUOTAOFF:
|
|
|
|
case Q_SETINFO:
|
|
|
|
case Q_SETQUOTA:
|
|
|
|
rc = superblock_has_perm(current,
|
|
|
|
sb,
|
|
|
|
FILESYSTEM__QUOTAMOD, NULL);
|
|
|
|
break;
|
|
|
|
case Q_GETFMT:
|
|
|
|
case Q_GETINFO:
|
|
|
|
case Q_GETQUOTA:
|
|
|
|
rc = superblock_has_perm(current,
|
|
|
|
sb,
|
|
|
|
FILESYSTEM__QUOTAGET, NULL);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
rc = 0; /* let the kernel handle invalid cmds */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_quota_on(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_syslog(int type)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->syslog(type);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case 3: /* Read last kernel messages */
|
|
|
|
case 10: /* Return size of the log buffer */
|
|
|
|
rc = task_has_system(current, SYSTEM__SYSLOG_READ);
|
|
|
|
break;
|
|
|
|
case 6: /* Disable logging to console */
|
|
|
|
case 7: /* Enable logging to console */
|
|
|
|
case 8: /* Set level of messages printed to console */
|
|
|
|
rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
|
|
|
|
break;
|
|
|
|
case 0: /* Close log */
|
|
|
|
case 1: /* Open log */
|
|
|
|
case 2: /* Read from log */
|
|
|
|
case 4: /* Read/clear last kernel messages */
|
|
|
|
case 5: /* Clear ring buffer */
|
|
|
|
default:
|
|
|
|
rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check that a process has enough memory to allocate a new virtual
|
|
|
|
* mapping. 0 means there is enough memory for the allocation to
|
|
|
|
* succeed and -ENOMEM implies there is not.
|
|
|
|
*
|
|
|
|
* Note that secondary_ops->capable and task_has_perm_noaudit return 0
|
|
|
|
* if the capability is granted, but __vm_enough_memory requires 1 if
|
|
|
|
* the capability is granted.
|
|
|
|
*
|
|
|
|
* Do not audit the selinux permission check, as this is applied to all
|
|
|
|
* processes that allocate mappings.
|
|
|
|
*/
|
2007-08-22 23:01:28 +02:00
|
|
|
static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int rc, cap_sys_admin = 0;
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
|
|
|
|
rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
|
|
|
|
if (rc == 0)
|
|
|
|
rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
|
2007-06-07 21:34:10 +02:00
|
|
|
SECCLASS_CAPABILITY,
|
|
|
|
CAP_TO_MASK(CAP_SYS_ADMIN),
|
|
|
|
0,
|
|
|
|
NULL);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (rc == 0)
|
|
|
|
cap_sys_admin = 1;
|
|
|
|
|
2007-08-22 23:01:28 +02:00
|
|
|
return __vm_enough_memory(mm, pages, cap_sys_admin);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* binprm security operations */
|
|
|
|
|
|
|
|
static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
struct bprm_security_struct *bsec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!bsec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
bsec->bprm = bprm;
|
|
|
|
bsec->sid = SECINITSID_UNLABELED;
|
|
|
|
bsec->set = 0;
|
|
|
|
|
|
|
|
bprm->security = bsec;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_bprm_set_security(struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
2006-12-08 11:37:38 +01:00
|
|
|
struct inode *inode = bprm->file->f_path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct bprm_security_struct *bsec;
|
|
|
|
u32 newsid;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->bprm_set_security(bprm);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
bsec = bprm->security;
|
|
|
|
|
|
|
|
if (bsec->set)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = inode->i_security;
|
|
|
|
|
|
|
|
/* Default to the current task SID. */
|
|
|
|
bsec->sid = tsec->sid;
|
|
|
|
|
2006-06-27 11:53:42 +02:00
|
|
|
/* Reset fs, key, and sock SIDs on execve. */
|
2005-04-17 00:20:36 +02:00
|
|
|
tsec->create_sid = 0;
|
2006-06-27 11:53:42 +02:00
|
|
|
tsec->keycreate_sid = 0;
|
2006-06-26 09:26:03 +02:00
|
|
|
tsec->sockcreate_sid = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (tsec->exec_sid) {
|
|
|
|
newsid = tsec->exec_sid;
|
|
|
|
/* Reset exec SID on execve. */
|
|
|
|
tsec->exec_sid = 0;
|
|
|
|
} else {
|
|
|
|
/* Check for a default transition on this program. */
|
|
|
|
rc = security_transition_sid(tsec->sid, isec->sid,
|
|
|
|
SECCLASS_PROCESS, &newsid);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path = bprm->file->f_path;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-12-08 11:37:38 +01:00
|
|
|
if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
|
2005-04-17 00:20:36 +02:00
|
|
|
newsid = tsec->sid;
|
|
|
|
|
|
|
|
if (tsec->sid == newsid) {
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid,
|
|
|
|
SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
} else {
|
|
|
|
/* Check permissions for the transition. */
|
|
|
|
rc = avc_has_perm(tsec->sid, newsid,
|
|
|
|
SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = avc_has_perm(newsid, isec->sid,
|
|
|
|
SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* Clear any possibly unsafe personality bits on exec: */
|
|
|
|
current->personality &= ~PER_CLEAR_ON_SETID;
|
|
|
|
|
|
|
|
/* Set the security field to the new SID. */
|
|
|
|
bsec->sid = newsid;
|
|
|
|
}
|
|
|
|
|
|
|
|
bsec->set = 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_bprm_check_security (struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
return secondary_ops->bprm_check_security(bprm);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int selinux_bprm_secureexec (struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
int atsecure = 0;
|
|
|
|
|
|
|
|
if (tsec->osid != tsec->sid) {
|
|
|
|
/* Enable secure mode for SIDs transitions unless
|
|
|
|
the noatsecure permission is granted between
|
|
|
|
the two SIDs, i.e. ahp returns 0. */
|
|
|
|
atsecure = avc_has_perm(tsec->osid, tsec->sid,
|
|
|
|
SECCLASS_PROCESS,
|
|
|
|
PROCESS__NOATSECURE, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (atsecure || secondary_ops->bprm_secureexec(bprm));
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_bprm_free_security(struct linux_binprm *bprm)
|
|
|
|
{
|
2005-06-25 23:58:51 +02:00
|
|
|
kfree(bprm->security);
|
2005-04-17 00:20:36 +02:00
|
|
|
bprm->security = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
extern struct vfsmount *selinuxfs_mount;
|
|
|
|
extern struct dentry *selinux_null;
|
|
|
|
|
|
|
|
/* Derived from fs/exec.c:flush_old_files. */
|
|
|
|
static inline void flush_unauthorized_files(struct files_struct * files)
|
|
|
|
{
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
struct file *file, *devnull = NULL;
|
2006-09-26 08:32:03 +02:00
|
|
|
struct tty_struct *tty;
|
2005-09-09 22:04:10 +02:00
|
|
|
struct fdtable *fdt;
|
2005-04-17 00:20:36 +02:00
|
|
|
long j = -1;
|
2006-12-08 11:36:04 +01:00
|
|
|
int drop_tty = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-09-26 08:32:03 +02:00
|
|
|
mutex_lock(&tty_mutex);
|
2006-12-08 11:36:04 +01:00
|
|
|
tty = get_current_tty();
|
2005-04-17 00:20:36 +02:00
|
|
|
if (tty) {
|
|
|
|
file_list_lock();
|
2005-10-31 00:02:16 +01:00
|
|
|
file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (file) {
|
|
|
|
/* Revalidate access to controlling tty.
|
|
|
|
Use inode_has_perm on the tty inode directly rather
|
|
|
|
than using file_has_perm, as this particular open
|
|
|
|
file may belong to another process and we are only
|
|
|
|
interested in the inode-based check here. */
|
2006-12-08 11:37:38 +01:00
|
|
|
struct inode *inode = file->f_path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
if (inode_has_perm(current, inode,
|
|
|
|
FILE__READ | FILE__WRITE, NULL)) {
|
2006-12-08 11:36:04 +01:00
|
|
|
drop_tty = 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
file_list_unlock();
|
|
|
|
}
|
2006-09-26 08:32:03 +02:00
|
|
|
mutex_unlock(&tty_mutex);
|
2007-05-08 09:26:56 +02:00
|
|
|
/* Reset controlling tty. */
|
|
|
|
if (drop_tty)
|
|
|
|
no_tty();
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Revalidate access to inherited open files. */
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,FS);
|
|
|
|
|
|
|
|
spin_lock(&files->file_lock);
|
|
|
|
for (;;) {
|
|
|
|
unsigned long set, i;
|
|
|
|
int fd;
|
|
|
|
|
|
|
|
j++;
|
|
|
|
i = j * __NFDBITS;
|
2005-09-09 22:04:10 +02:00
|
|
|
fdt = files_fdtable(files);
|
2006-12-10 11:21:12 +01:00
|
|
|
if (i >= fdt->max_fds)
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
2005-09-09 22:04:10 +02:00
|
|
|
set = fdt->open_fds->fds_bits[j];
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!set)
|
|
|
|
continue;
|
|
|
|
spin_unlock(&files->file_lock);
|
|
|
|
for ( ; set ; i++,set >>= 1) {
|
|
|
|
if (set & 1) {
|
|
|
|
file = fget(i);
|
|
|
|
if (!file)
|
|
|
|
continue;
|
|
|
|
if (file_has_perm(current,
|
|
|
|
file,
|
|
|
|
file_to_av(file))) {
|
|
|
|
sys_close(i);
|
|
|
|
fd = get_unused_fd();
|
|
|
|
if (fd != i) {
|
|
|
|
if (fd >= 0)
|
|
|
|
put_unused_fd(fd);
|
|
|
|
fput(file);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (devnull) {
|
2006-01-08 10:02:19 +01:00
|
|
|
get_file(devnull);
|
2005-04-17 00:20:36 +02:00
|
|
|
} else {
|
|
|
|
devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
|
2006-11-27 07:16:48 +01:00
|
|
|
if (IS_ERR(devnull)) {
|
|
|
|
devnull = NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
put_unused_fd(fd);
|
|
|
|
fput(file);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
fd_install(fd, devnull);
|
|
|
|
}
|
|
|
|
fput(file);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
spin_lock(&files->file_lock);
|
|
|
|
|
|
|
|
}
|
|
|
|
spin_unlock(&files->file_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct bprm_security_struct *bsec;
|
|
|
|
u32 sid;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
secondary_ops->bprm_apply_creds(bprm, unsafe);
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
|
|
|
|
bsec = bprm->security;
|
|
|
|
sid = bsec->sid;
|
|
|
|
|
|
|
|
tsec->osid = tsec->sid;
|
|
|
|
bsec->unsafe = 0;
|
|
|
|
if (tsec->sid != sid) {
|
|
|
|
/* Check for shared state. If not ok, leave SID
|
|
|
|
unchanged and kill. */
|
|
|
|
if (unsafe & LSM_UNSAFE_SHARE) {
|
|
|
|
rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
|
|
|
|
PROCESS__SHARE, NULL);
|
|
|
|
if (rc) {
|
|
|
|
bsec->unsafe = 1;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check for ptracing, and update the task SID if ok.
|
|
|
|
Otherwise, leave SID unchanged and kill. */
|
|
|
|
if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
|
|
|
|
rc = avc_has_perm(tsec->ptrace_sid, sid,
|
|
|
|
SECCLASS_PROCESS, PROCESS__PTRACE,
|
|
|
|
NULL);
|
|
|
|
if (rc) {
|
|
|
|
bsec->unsafe = 1;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
tsec->sid = sid;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* called after apply_creds without the task lock held
|
|
|
|
*/
|
|
|
|
static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct rlimit *rlim, *initrlim;
|
|
|
|
struct itimerval itimer;
|
|
|
|
struct bprm_security_struct *bsec;
|
|
|
|
int rc, i;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
bsec = bprm->security;
|
|
|
|
|
|
|
|
if (bsec->unsafe) {
|
|
|
|
force_sig_specific(SIGKILL, current);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (tsec->osid == tsec->sid)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* Close files for which the new task SID is not authorized. */
|
|
|
|
flush_unauthorized_files(current->files);
|
|
|
|
|
|
|
|
/* Check whether the new SID can inherit signal state
|
|
|
|
from the old SID. If not, clear itimers to avoid
|
|
|
|
subsequent signal generation and flush and unblock
|
|
|
|
signals. This must occur _after_ the task SID has
|
|
|
|
been updated so that any kill done after the flush
|
|
|
|
will be checked against the new SID. */
|
|
|
|
rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
|
|
|
|
PROCESS__SIGINH, NULL);
|
|
|
|
if (rc) {
|
|
|
|
memset(&itimer, 0, sizeof itimer);
|
|
|
|
for (i = 0; i < 3; i++)
|
|
|
|
do_setitimer(i, &itimer, NULL);
|
|
|
|
flush_signals(current);
|
|
|
|
spin_lock_irq(¤t->sighand->siglock);
|
|
|
|
flush_signal_handlers(current, 1);
|
|
|
|
sigemptyset(¤t->blocked);
|
|
|
|
recalc_sigpending();
|
|
|
|
spin_unlock_irq(¤t->sighand->siglock);
|
|
|
|
}
|
|
|
|
|
2007-08-29 14:51:50 +02:00
|
|
|
/* Always clear parent death signal on SID transitions. */
|
|
|
|
current->pdeath_signal = 0;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Check whether the new SID can inherit resource limits
|
|
|
|
from the old SID. If not, reset all soft limits to
|
|
|
|
the lower of the current task's hard limit and the init
|
|
|
|
task's soft limit. Note that the setting of hard limits
|
|
|
|
(even to lower them) can be controlled by the setrlimit
|
|
|
|
check. The inclusion of the init task's soft limit into
|
|
|
|
the computation is to avoid resetting soft limits higher
|
|
|
|
than the default soft limit for cases where the default
|
|
|
|
is lower than the hard limit, e.g. RLIMIT_CORE or
|
|
|
|
RLIMIT_STACK.*/
|
|
|
|
rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
|
|
|
|
PROCESS__RLIMITINH, NULL);
|
|
|
|
if (rc) {
|
|
|
|
for (i = 0; i < RLIM_NLIMITS; i++) {
|
|
|
|
rlim = current->signal->rlim + i;
|
|
|
|
initrlim = init_task.signal->rlim+i;
|
|
|
|
rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
|
|
|
|
}
|
|
|
|
if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
|
|
|
|
/*
|
|
|
|
* This will cause RLIMIT_CPU calculations
|
|
|
|
* to be refigured.
|
|
|
|
*/
|
|
|
|
current->it_prof_expires = jiffies_to_cputime(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Wake up the parent if it is waiting so that it can
|
|
|
|
recheck wait permission to the new task SID. */
|
|
|
|
wake_up_interruptible(¤t->parent->signal->wait_chldexit);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* superblock security operations */
|
|
|
|
|
|
|
|
static int selinux_sb_alloc_security(struct super_block *sb)
|
|
|
|
{
|
|
|
|
return superblock_alloc_security(sb);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_sb_free_security(struct super_block *sb)
|
|
|
|
{
|
|
|
|
superblock_free_security(sb);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int match_prefix(char *prefix, int plen, char *option, int olen)
|
|
|
|
{
|
|
|
|
if (plen > olen)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return !memcmp(prefix, option, plen);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int selinux_option(char *option, int len)
|
|
|
|
{
|
|
|
|
return (match_prefix("context=", sizeof("context=")-1, option, len) ||
|
|
|
|
match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
|
2006-07-10 13:43:55 +02:00
|
|
|
match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
|
|
|
|
match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void take_option(char **to, char *from, int *first, int len)
|
|
|
|
{
|
|
|
|
if (!*first) {
|
|
|
|
**to = ',';
|
|
|
|
*to += 1;
|
[PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e. "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.
For example, with the current code:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1
instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4
The options that will be passed on to the file system will be
ro,c3,c4,exec.
The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.
This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched. It also introduces a new function that
will strip the quotes from the context option prior to translation. The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.
Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 10:58:44 +02:00
|
|
|
} else
|
2005-04-17 00:20:36 +02:00
|
|
|
*first = 0;
|
|
|
|
memcpy(*to, from, len);
|
|
|
|
*to += len;
|
|
|
|
}
|
|
|
|
|
[PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e. "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.
For example, with the current code:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1
instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4
The options that will be passed on to the file system will be
ro,c3,c4,exec.
The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.
This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched. It also introduces a new function that
will strip the quotes from the context option prior to translation. The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.
Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 10:58:44 +02:00
|
|
|
static inline void take_selinux_option(char **to, char *from, int *first,
|
|
|
|
int len)
|
|
|
|
{
|
|
|
|
int current_size = 0;
|
|
|
|
|
|
|
|
if (!*first) {
|
|
|
|
**to = '|';
|
|
|
|
*to += 1;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
*first = 0;
|
|
|
|
|
|
|
|
while (current_size < len) {
|
|
|
|
if (*from != '"') {
|
|
|
|
**to = *from;
|
|
|
|
*to += 1;
|
|
|
|
}
|
|
|
|
from += 1;
|
|
|
|
current_size += 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-03-05 16:31:54 +01:00
|
|
|
static int selinux_sb_copy_data(char *orig, char *copy)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int fnosec, fsec, rc = 0;
|
|
|
|
char *in_save, *in_curr, *in_end;
|
|
|
|
char *sec_curr, *nosec_save, *nosec;
|
[PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e. "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.
For example, with the current code:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1
instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4
The options that will be passed on to the file system will be
ro,c3,c4,exec.
The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.
This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched. It also introduces a new function that
will strip the quotes from the context option prior to translation. The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.
Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 10:58:44 +02:00
|
|
|
int open_quote = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
in_curr = orig;
|
|
|
|
sec_curr = copy;
|
|
|
|
|
|
|
|
nosec = (char *)get_zeroed_page(GFP_KERNEL);
|
|
|
|
if (!nosec) {
|
|
|
|
rc = -ENOMEM;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
nosec_save = nosec;
|
|
|
|
fnosec = fsec = 1;
|
|
|
|
in_save = in_end = orig;
|
|
|
|
|
|
|
|
do {
|
[PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e. "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.
For example, with the current code:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1
instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4
The options that will be passed on to the file system will be
ro,c3,c4,exec.
The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.
This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched. It also introduces a new function that
will strip the quotes from the context option prior to translation. The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.
Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 10:58:44 +02:00
|
|
|
if (*in_end == '"')
|
|
|
|
open_quote = !open_quote;
|
|
|
|
if ((*in_end == ',' && open_quote == 0) ||
|
|
|
|
*in_end == '\0') {
|
2005-04-17 00:20:36 +02:00
|
|
|
int len = in_end - in_curr;
|
|
|
|
|
|
|
|
if (selinux_option(in_curr, len))
|
[PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e. "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.
For example, with the current code:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1
instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4
The options that will be passed on to the file system will be
ro,c3,c4,exec.
The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.
This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched. It also introduces a new function that
will strip the quotes from the context option prior to translation. The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.
Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 10:58:44 +02:00
|
|
|
take_selinux_option(&sec_curr, in_curr, &fsec, len);
|
2005-04-17 00:20:36 +02:00
|
|
|
else
|
|
|
|
take_option(&nosec, in_curr, &fnosec, len);
|
|
|
|
|
|
|
|
in_curr = in_end + 1;
|
|
|
|
}
|
|
|
|
} while (*in_end++);
|
|
|
|
|
2005-06-30 11:58:51 +02:00
|
|
|
strcpy(in_save, nosec_save);
|
2005-06-22 02:15:18 +02:00
|
|
|
free_page((unsigned long)nosec_save);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_sb_kern_mount(struct super_block *sb, void *data)
|
|
|
|
{
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = superblock_doinit(sb, data);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = sb->s_root;
|
2005-04-17 00:20:36 +02:00
|
|
|
return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
|
|
|
|
}
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
static int selinux_sb_statfs(struct dentry *dentry)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = dentry->d_sb->s_root;
|
2006-06-23 11:02:58 +02:00
|
|
|
return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_mount(char * dev_name,
|
|
|
|
struct nameidata *nd,
|
|
|
|
char * type,
|
|
|
|
unsigned long flags,
|
|
|
|
void * data)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (flags & MS_REMOUNT)
|
2008-02-15 04:34:32 +01:00
|
|
|
return superblock_has_perm(current, nd->path.mnt->mnt_sb,
|
2005-04-17 00:20:36 +02:00
|
|
|
FILESYSTEM__REMOUNT, NULL);
|
|
|
|
else
|
2008-02-15 04:34:32 +01:00
|
|
|
return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
|
2005-04-17 00:20:36 +02:00
|
|
|
FILE__MOUNTON);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_umount(struct vfsmount *mnt, int flags)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->sb_umount(mnt, flags);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return superblock_has_perm(current,mnt->mnt_sb,
|
|
|
|
FILESYSTEM__UNMOUNT,NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* inode security operations */
|
|
|
|
|
|
|
|
static int selinux_inode_alloc_security(struct inode *inode)
|
|
|
|
{
|
|
|
|
return inode_alloc_security(inode);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_inode_free_security(struct inode *inode)
|
|
|
|
{
|
|
|
|
inode_free_security(inode);
|
|
|
|
}
|
|
|
|
|
2005-09-09 22:01:35 +02:00
|
|
|
static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
|
|
|
|
char **name, void **value,
|
|
|
|
size_t *len)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct inode_security_struct *dsec;
|
|
|
|
struct superblock_security_struct *sbsec;
|
2005-09-09 22:01:43 +02:00
|
|
|
u32 newsid, clen;
|
2005-09-09 22:01:35 +02:00
|
|
|
int rc;
|
2005-09-09 22:01:43 +02:00
|
|
|
char *namep = NULL, *context;
|
2005-09-09 22:01:35 +02:00
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
dsec = dir->i_security;
|
|
|
|
sbsec = dir->i_sb->s_security;
|
|
|
|
|
|
|
|
if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
|
|
|
|
newsid = tsec->create_sid;
|
|
|
|
} else {
|
|
|
|
rc = security_transition_sid(tsec->sid, dsec->sid,
|
|
|
|
inode_mode_to_security_class(inode->i_mode),
|
|
|
|
&newsid);
|
|
|
|
if (rc) {
|
|
|
|
printk(KERN_WARNING "%s: "
|
|
|
|
"security_transition_sid failed, rc=%d (dev=%s "
|
|
|
|
"ino=%ld)\n",
|
|
|
|
__FUNCTION__,
|
|
|
|
-rc, inode->i_sb->s_id, inode->i_ino);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2006-09-26 08:32:00 +02:00
|
|
|
/* Possibly defer initialization to selinux_complete_init. */
|
|
|
|
if (sbsec->initialized) {
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
isec->sclass = inode_mode_to_security_class(inode->i_mode);
|
|
|
|
isec->sid = newsid;
|
|
|
|
isec->initialized = 1;
|
|
|
|
}
|
2005-09-09 22:01:35 +02:00
|
|
|
|
2006-03-22 09:09:13 +01:00
|
|
|
if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
|
2005-11-09 06:34:33 +01:00
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
2005-09-09 22:01:43 +02:00
|
|
|
if (name) {
|
2008-04-04 00:35:05 +02:00
|
|
|
namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
|
2005-09-09 22:01:43 +02:00
|
|
|
if (!namep)
|
|
|
|
return -ENOMEM;
|
|
|
|
*name = namep;
|
|
|
|
}
|
2005-09-09 22:01:35 +02:00
|
|
|
|
2005-09-09 22:01:43 +02:00
|
|
|
if (value && len) {
|
|
|
|
rc = security_sid_to_context(newsid, &context, &clen);
|
|
|
|
if (rc) {
|
|
|
|
kfree(namep);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
*value = context;
|
|
|
|
*len = clen;
|
2005-09-09 22:01:35 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
|
|
|
|
{
|
|
|
|
return may_create(dir, dentry, SECCLASS_FILE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
return may_link(dir, old_dentry, MAY_LINK);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_unlink(dir, dentry);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
return may_link(dir, dentry, MAY_UNLINK);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
|
|
|
|
{
|
|
|
|
return may_create(dir, dentry, SECCLASS_LNK_FILE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
|
|
|
|
{
|
|
|
|
return may_create(dir, dentry, SECCLASS_DIR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return may_link(dir, dentry, MAY_RMDIR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return may_create(dir, dentry, inode_mode_to_security_class(mode));
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
|
|
|
|
struct inode *new_inode, struct dentry *new_dentry)
|
|
|
|
{
|
|
|
|
return may_rename(old_inode, old_dentry, new_inode, new_dentry);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_readlink(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__READ);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_follow_link(dentry,nameidata);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__READ);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_permission(struct inode *inode, int mask,
|
|
|
|
struct nameidata *nd)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_permission(inode, mask, nd);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (!mask) {
|
|
|
|
/* No permission to check. Existence test. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return inode_has_perm(current, inode,
|
|
|
|
file_mask_to_av(inode->i_mode, mask), NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->inode_setattr(dentry, iattr);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (iattr->ia_valid & ATTR_FORCE)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
|
|
|
|
ATTR_ATIME_SET | ATTR_MTIME_SET))
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
|
|
|
|
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
|
|
|
|
}
|
|
|
|
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
|
|
|
|
{
|
|
|
|
if (!strncmp(name, XATTR_SECURITY_PREFIX,
|
|
|
|
sizeof XATTR_SECURITY_PREFIX - 1)) {
|
|
|
|
if (!strcmp(name, XATTR_NAME_CAPS)) {
|
|
|
|
if (!capable(CAP_SETFCAP))
|
|
|
|
return -EPERM;
|
|
|
|
} else if (!capable(CAP_SYS_ADMIN)) {
|
|
|
|
/* A different attribute in the security namespace.
|
|
|
|
Restrict to administrator. */
|
|
|
|
return -EPERM;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Not an attribute we recognize, so just check the
|
|
|
|
ordinary setattr permission. */
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
struct inode *inode = dentry->d_inode;
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
struct superblock_security_struct *sbsec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
u32 newsid;
|
|
|
|
int rc = 0;
|
|
|
|
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
if (strcmp(name, XATTR_NAME_SELINUX))
|
|
|
|
return selinux_inode_setotherxattr(dentry, name);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
sbsec = inode->i_sb->s_security;
|
|
|
|
if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
2007-07-17 11:30:08 +02:00
|
|
|
if (!is_owner_or_cap(inode))
|
2005-04-17 00:20:36 +02:00
|
|
|
return -EPERM;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,FS);
|
2008-02-15 04:38:33 +01:00
|
|
|
ad.u.fs.path.dentry = dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
|
|
|
|
FILE__RELABELFROM, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = security_context_to_sid(value, size, &newsid);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
|
|
|
|
FILE__RELABELTO, &ad);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
rc = security_validate_transition(isec->sid, newsid, tsec->sid,
|
|
|
|
isec->sclass);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return avc_has_perm(newsid,
|
|
|
|
sbsec->sid,
|
|
|
|
SECCLASS_FILESYSTEM,
|
|
|
|
FILESYSTEM__ASSOCIATE,
|
|
|
|
&ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
|
|
|
|
void *value, size_t size, int flags)
|
|
|
|
{
|
|
|
|
struct inode *inode = dentry->d_inode;
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
u32 newsid;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
if (strcmp(name, XATTR_NAME_SELINUX)) {
|
|
|
|
/* Not an attribute we recognize, so nothing to do. */
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
rc = security_context_to_sid(value, size, &newsid);
|
|
|
|
if (rc) {
|
|
|
|
printk(KERN_WARNING "%s: unable to obtain SID for context "
|
|
|
|
"%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
isec->sid = newsid;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_getxattr (struct dentry *dentry, char *name)
|
|
|
|
{
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_listxattr (struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_removexattr (struct dentry *dentry, char *name)
|
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
if (strcmp(name, XATTR_NAME_SELINUX))
|
|
|
|
return selinux_inode_setotherxattr(dentry, name);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* No one is allowed to remove a SELinux security label.
|
|
|
|
You can change the label, but all data must be labeled. */
|
|
|
|
return -EACCES;
|
|
|
|
}
|
|
|
|
|
2005-10-30 23:59:22 +01:00
|
|
|
/*
|
|
|
|
* Copy the in-core inode security context value to the user. If the
|
|
|
|
* getxattr() prior to this succeeded, check to see if we need to
|
|
|
|
* canonicalize the value to be finally returned to the user.
|
|
|
|
*
|
|
|
|
* Permission check is handled by selinux_inode_getxattr hook.
|
|
|
|
*/
|
2008-02-05 07:29:39 +01:00
|
|
|
static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-02-05 07:29:39 +01:00
|
|
|
u32 size;
|
|
|
|
int error;
|
|
|
|
char *context = NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
2005-10-30 23:59:22 +01:00
|
|
|
|
2005-11-03 18:15:16 +01:00
|
|
|
if (strcmp(name, XATTR_SELINUX_SUFFIX))
|
|
|
|
return -EOPNOTSUPP;
|
2005-10-30 23:59:22 +01:00
|
|
|
|
2008-02-05 07:29:39 +01:00
|
|
|
error = security_sid_to_context(isec->sid, &context, &size);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
error = size;
|
|
|
|
if (alloc) {
|
|
|
|
*buffer = context;
|
|
|
|
goto out_nofree;
|
|
|
|
}
|
|
|
|
kfree(context);
|
|
|
|
out_nofree:
|
|
|
|
return error;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_setsecurity(struct inode *inode, const char *name,
|
|
|
|
const void *value, size_t size, int flags)
|
|
|
|
{
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
u32 newsid;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
if (strcmp(name, XATTR_SELINUX_SUFFIX))
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
|
|
|
if (!value || !size)
|
|
|
|
return -EACCES;
|
|
|
|
|
|
|
|
rc = security_context_to_sid((void*)value, size, &newsid);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
isec->sid = newsid;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
|
|
|
|
{
|
|
|
|
const int len = sizeof(XATTR_NAME_SELINUX);
|
|
|
|
if (buffer && len <= buffer_size)
|
|
|
|
memcpy(buffer, XATTR_NAME_SELINUX, len);
|
|
|
|
return len;
|
|
|
|
}
|
|
|
|
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
static int selinux_inode_need_killpriv(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return secondary_ops->inode_need_killpriv(dentry);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_inode_killpriv(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return secondary_ops->inode_killpriv(dentry);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* file security operations */
|
|
|
|
|
2007-09-14 02:27:07 +02:00
|
|
|
static int selinux_revalidate_file_permission(struct file *file, int mask)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2006-08-05 08:17:57 +02:00
|
|
|
int rc;
|
2006-12-08 11:37:38 +01:00
|
|
|
struct inode *inode = file->f_path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!mask) {
|
|
|
|
/* No permission to check. Existence test. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
|
|
|
|
if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
|
|
|
|
mask |= MAY_APPEND;
|
|
|
|
|
2006-08-05 08:17:57 +02:00
|
|
|
rc = file_has_perm(current, file,
|
|
|
|
file_mask_to_av(inode->i_mode, mask));
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return selinux_netlbl_inode_permission(inode, mask);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-09-14 02:27:07 +02:00
|
|
|
static int selinux_file_permission(struct file *file, int mask)
|
|
|
|
{
|
|
|
|
struct inode *inode = file->f_path.dentry->d_inode;
|
|
|
|
struct task_security_struct *tsec = current->security;
|
|
|
|
struct file_security_struct *fsec = file->f_security;
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
|
|
|
|
if (!mask) {
|
|
|
|
/* No permission to check. Existence test. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (tsec->sid == fsec->sid && fsec->isid == isec->sid
|
|
|
|
&& fsec->pseqno == avc_policy_seqno())
|
|
|
|
return selinux_netlbl_inode_permission(inode, mask);
|
|
|
|
|
|
|
|
return selinux_revalidate_file_permission(file, mask);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_file_alloc_security(struct file *file)
|
|
|
|
{
|
|
|
|
return file_alloc_security(file);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_file_free_security(struct file *file)
|
|
|
|
{
|
|
|
|
file_free_security(file);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_ioctl(struct file *file, unsigned int cmd,
|
|
|
|
unsigned long arg)
|
|
|
|
{
|
|
|
|
int error = 0;
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case FIONREAD:
|
|
|
|
/* fall through */
|
|
|
|
case FIBMAP:
|
|
|
|
/* fall through */
|
|
|
|
case FIGETBSZ:
|
|
|
|
/* fall through */
|
|
|
|
case EXT2_IOC_GETFLAGS:
|
|
|
|
/* fall through */
|
|
|
|
case EXT2_IOC_GETVERSION:
|
|
|
|
error = file_has_perm(current, file, FILE__GETATTR);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case EXT2_IOC_SETFLAGS:
|
|
|
|
/* fall through */
|
|
|
|
case EXT2_IOC_SETVERSION:
|
|
|
|
error = file_has_perm(current, file, FILE__SETATTR);
|
|
|
|
break;
|
|
|
|
|
|
|
|
/* sys_ioctl() checks */
|
|
|
|
case FIONBIO:
|
|
|
|
/* fall through */
|
|
|
|
case FIOASYNC:
|
|
|
|
error = file_has_perm(current, file, 0);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case KDSKBENT:
|
|
|
|
case KDSKBSENT:
|
|
|
|
error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
|
|
|
|
break;
|
|
|
|
|
|
|
|
/* default case assumes that the command will go
|
|
|
|
* to the file's ioctl() function.
|
|
|
|
*/
|
|
|
|
default:
|
|
|
|
error = file_has_perm(current, file, FILE__IOCTL);
|
|
|
|
|
|
|
|
}
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
|
|
|
|
{
|
|
|
|
#ifndef CONFIG_PPC32
|
|
|
|
if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
|
|
|
|
/*
|
|
|
|
* We are making executable an anonymous mapping or a
|
|
|
|
* private file mapping that will also be writable.
|
|
|
|
* This has an additional check.
|
|
|
|
*/
|
|
|
|
int rc = task_has_perm(current, current, PROCESS__EXECMEM);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
if (file) {
|
|
|
|
/* read access is always possible with a mapping */
|
|
|
|
u32 av = FILE__READ;
|
|
|
|
|
|
|
|
/* write access only matters if the mapping is shared */
|
|
|
|
if (shared && (prot & PROT_WRITE))
|
|
|
|
av |= FILE__WRITE;
|
|
|
|
|
|
|
|
if (prot & PROT_EXEC)
|
|
|
|
av |= FILE__EXECUTE;
|
|
|
|
|
|
|
|
return file_has_perm(current, file, av);
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_mmap(struct file *file, unsigned long reqprot,
|
2007-06-28 21:55:21 +02:00
|
|
|
unsigned long prot, unsigned long flags,
|
|
|
|
unsigned long addr, unsigned long addr_only)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2007-06-28 21:55:21 +02:00
|
|
|
int rc = 0;
|
|
|
|
u32 sid = ((struct task_security_struct*)(current->security))->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-06-28 21:55:21 +02:00
|
|
|
if (addr < mmap_min_addr)
|
|
|
|
rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
|
|
|
|
MEMPROTECT__MMAP_ZERO, NULL);
|
|
|
|
if (rc || addr_only)
|
2005-04-17 00:20:36 +02:00
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (selinux_checkreqprot)
|
|
|
|
prot = reqprot;
|
|
|
|
|
|
|
|
return file_map_prot_check(file, prot,
|
|
|
|
(flags & MAP_TYPE) == MAP_SHARED);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_mprotect(struct vm_area_struct *vma,
|
|
|
|
unsigned long reqprot,
|
|
|
|
unsigned long prot)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->file_mprotect(vma, reqprot, prot);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (selinux_checkreqprot)
|
|
|
|
prot = reqprot;
|
|
|
|
|
|
|
|
#ifndef CONFIG_PPC32
|
2006-02-01 12:05:54 +01:00
|
|
|
if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
|
|
|
|
rc = 0;
|
|
|
|
if (vma->vm_start >= vma->vm_mm->start_brk &&
|
|
|
|
vma->vm_end <= vma->vm_mm->brk) {
|
|
|
|
rc = task_has_perm(current, current,
|
|
|
|
PROCESS__EXECHEAP);
|
|
|
|
} else if (!vma->vm_file &&
|
|
|
|
vma->vm_start <= vma->vm_mm->start_stack &&
|
|
|
|
vma->vm_end >= vma->vm_mm->start_stack) {
|
|
|
|
rc = task_has_perm(current, current, PROCESS__EXECSTACK);
|
|
|
|
} else if (vma->vm_file && vma->anon_vma) {
|
|
|
|
/*
|
|
|
|
* We are making executable a file mapping that has
|
|
|
|
* had some COW done. Since pages might have been
|
|
|
|
* written, check ability to execute the possibly
|
|
|
|
* modified content. This typically should only
|
|
|
|
* occur for text relocations.
|
|
|
|
*/
|
|
|
|
rc = file_has_perm(current, vma->vm_file,
|
|
|
|
FILE__EXECMOD);
|
|
|
|
}
|
2005-06-25 23:54:34 +02:00
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
#endif
|
|
|
|
|
|
|
|
return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_lock(struct file *file, unsigned int cmd)
|
|
|
|
{
|
|
|
|
return file_has_perm(current, file, FILE__LOCK);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_fcntl(struct file *file, unsigned int cmd,
|
|
|
|
unsigned long arg)
|
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case F_SETFL:
|
2006-12-08 11:37:38 +01:00
|
|
|
if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
|
2005-04-17 00:20:36 +02:00
|
|
|
err = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
|
|
|
|
err = file_has_perm(current, file,FILE__WRITE);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
/* fall through */
|
|
|
|
case F_SETOWN:
|
|
|
|
case F_SETSIG:
|
|
|
|
case F_GETFL:
|
|
|
|
case F_GETOWN:
|
|
|
|
case F_GETSIG:
|
|
|
|
/* Just check FD__USE permission */
|
|
|
|
err = file_has_perm(current, file, 0);
|
|
|
|
break;
|
|
|
|
case F_GETLK:
|
|
|
|
case F_SETLK:
|
|
|
|
case F_SETLKW:
|
|
|
|
#if BITS_PER_LONG == 32
|
|
|
|
case F_GETLK64:
|
|
|
|
case F_SETLK64:
|
|
|
|
case F_SETLKW64:
|
|
|
|
#endif
|
2006-12-08 11:37:38 +01:00
|
|
|
if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
|
2005-04-17 00:20:36 +02:00
|
|
|
err = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
err = file_has_perm(current, file, FILE__LOCK);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_set_fowner(struct file *file)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct file_security_struct *fsec;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
fsec = file->f_security;
|
|
|
|
fsec->fown_sid = tsec->sid;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_send_sigiotask(struct task_struct *tsk,
|
|
|
|
struct fown_struct *fown, int signum)
|
|
|
|
{
|
|
|
|
struct file *file;
|
|
|
|
u32 perm;
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct file_security_struct *fsec;
|
|
|
|
|
|
|
|
/* struct fown_struct is never outside the context of a struct file */
|
2007-02-10 10:46:25 +01:00
|
|
|
file = container_of(fown, struct file, f_owner);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
tsec = tsk->security;
|
|
|
|
fsec = file->f_security;
|
|
|
|
|
|
|
|
if (!signum)
|
|
|
|
perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
|
|
|
|
else
|
|
|
|
perm = signal_to_av(signum);
|
|
|
|
|
|
|
|
return avc_has_perm(fsec->fown_sid, tsec->sid,
|
|
|
|
SECCLASS_PROCESS, perm, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_file_receive(struct file *file)
|
|
|
|
{
|
|
|
|
return file_has_perm(current, file, file_to_av(file));
|
|
|
|
}
|
|
|
|
|
2007-09-14 02:27:07 +02:00
|
|
|
static int selinux_dentry_open(struct file *file)
|
|
|
|
{
|
|
|
|
struct file_security_struct *fsec;
|
|
|
|
struct inode *inode;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
inode = file->f_path.dentry->d_inode;
|
|
|
|
fsec = file->f_security;
|
|
|
|
isec = inode->i_security;
|
|
|
|
/*
|
|
|
|
* Save inode label and policy sequence number
|
|
|
|
* at open-time so that selinux_file_permission
|
|
|
|
* can determine whether revalidation is necessary.
|
|
|
|
* Task label is already saved in the file security
|
|
|
|
* struct as its SID.
|
|
|
|
*/
|
|
|
|
fsec->isid = isec->sid;
|
|
|
|
fsec->pseqno = avc_policy_seqno();
|
|
|
|
/*
|
|
|
|
* Since the inode label or policy seqno may have changed
|
|
|
|
* between the selinux_inode_permission check and the saving
|
|
|
|
* of state above, recheck that access is still permitted.
|
|
|
|
* Otherwise, access might never be revalidated against the
|
|
|
|
* new inode label or new policy.
|
|
|
|
* This check is not redundant - do not remove.
|
|
|
|
*/
|
|
|
|
return inode_has_perm(current, inode, file_to_av(file), NULL);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* task security operations */
|
|
|
|
|
|
|
|
static int selinux_task_create(unsigned long clone_flags)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->task_create(clone_flags);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return task_has_perm(current, current, PROCESS__FORK);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_alloc_security(struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec1, *tsec2;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec1 = current->security;
|
|
|
|
|
|
|
|
rc = task_alloc_security(tsk);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
tsec2 = tsk->security;
|
|
|
|
|
|
|
|
tsec2->osid = tsec1->osid;
|
|
|
|
tsec2->sid = tsec1->sid;
|
|
|
|
|
2006-06-27 11:53:42 +02:00
|
|
|
/* Retain the exec, fs, key, and sock SIDs across fork */
|
2005-04-17 00:20:36 +02:00
|
|
|
tsec2->exec_sid = tsec1->exec_sid;
|
|
|
|
tsec2->create_sid = tsec1->create_sid;
|
2006-06-27 11:53:42 +02:00
|
|
|
tsec2->keycreate_sid = tsec1->keycreate_sid;
|
2006-06-26 09:26:03 +02:00
|
|
|
tsec2->sockcreate_sid = tsec1->sockcreate_sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Retain ptracer SID across fork, if any.
|
|
|
|
This will be reset by the ptrace hook upon any
|
|
|
|
subsequent ptrace_attach operations. */
|
|
|
|
tsec2->ptrace_sid = tsec1->ptrace_sid;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_task_free_security(struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
task_free_security(tsk);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
|
|
|
|
{
|
|
|
|
/* Since setuid only affects the current process, and
|
|
|
|
since the SELinux controls are not based on the Linux
|
|
|
|
identity attributes, SELinux does not need to control
|
|
|
|
this operation. However, SELinux does control the use
|
|
|
|
of the CAP_SETUID and CAP_SETGID capabilities using the
|
|
|
|
capable hook. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
|
|
|
|
{
|
|
|
|
return secondary_ops->task_post_setuid(id0,id1,id2,flags);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
|
|
|
|
{
|
|
|
|
/* See the comment for setuid above. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__SETPGID);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_getpgid(struct task_struct *p)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__GETPGID);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_getsid(struct task_struct *p)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__GETSESSION);
|
|
|
|
}
|
|
|
|
|
2006-06-30 10:55:46 +02:00
|
|
|
static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
|
|
|
|
{
|
|
|
|
selinux_get_task_sid(p, secid);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_task_setgroups(struct group_info *group_info)
|
|
|
|
{
|
|
|
|
/* See the comment for setuid above. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_setnice(struct task_struct *p, int nice)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->task_setnice(p, nice);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return task_has_perm(current,p, PROCESS__SETSCHED);
|
|
|
|
}
|
|
|
|
|
2006-06-23 11:03:58 +02:00
|
|
|
static int selinux_task_setioprio(struct task_struct *p, int ioprio)
|
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->task_setioprio(p, ioprio);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
2006-06-23 11:03:58 +02:00
|
|
|
return task_has_perm(current, p, PROCESS__SETSCHED);
|
|
|
|
}
|
|
|
|
|
2006-06-30 10:55:49 +02:00
|
|
|
static int selinux_task_getioprio(struct task_struct *p)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__GETSCHED);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
|
|
|
|
{
|
|
|
|
struct rlimit *old_rlim = current->signal->rlim + resource;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->task_setrlimit(resource, new_rlim);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* Control the ability to change the hard limit (whether
|
|
|
|
lowering or raising it), so that the hard limit can
|
|
|
|
later be used as a safe reset point for the soft limit
|
|
|
|
upon context transitions. See selinux_bprm_apply_creds. */
|
|
|
|
if (old_rlim->rlim_max != new_rlim->rlim_max)
|
|
|
|
return task_has_perm(current, current, PROCESS__SETRLIMIT);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
|
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->task_setscheduler(p, policy, lp);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
return task_has_perm(current, p, PROCESS__SETSCHED);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_getscheduler(struct task_struct *p)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__GETSCHED);
|
|
|
|
}
|
|
|
|
|
2006-06-23 11:04:01 +02:00
|
|
|
static int selinux_task_movememory(struct task_struct *p)
|
|
|
|
{
|
|
|
|
return task_has_perm(current, p, PROCESS__SETSCHED);
|
|
|
|
}
|
|
|
|
|
2006-06-30 10:55:46 +02:00
|
|
|
static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
|
|
|
|
int sig, u32 secid)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
u32 perm;
|
|
|
|
int rc;
|
2006-06-30 10:55:46 +02:00
|
|
|
struct task_security_struct *tsec;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-06-30 10:55:46 +02:00
|
|
|
rc = secondary_ops->task_kill(p, info, sig, secid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
2005-10-31 00:03:45 +01:00
|
|
|
if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (!sig)
|
|
|
|
perm = PROCESS__SIGNULL; /* null signal; existence test */
|
|
|
|
else
|
|
|
|
perm = signal_to_av(sig);
|
2006-06-30 10:55:46 +02:00
|
|
|
tsec = p->security;
|
|
|
|
if (secid)
|
|
|
|
rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
|
|
|
|
else
|
|
|
|
rc = task_has_perm(current, p, perm);
|
|
|
|
return rc;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_prctl(int option,
|
|
|
|
unsigned long arg2,
|
|
|
|
unsigned long arg3,
|
|
|
|
unsigned long arg4,
|
|
|
|
unsigned long arg5)
|
|
|
|
{
|
|
|
|
/* The current prctl operations do not appear to require
|
|
|
|
any SELinux controls since they merely observe or modify
|
|
|
|
the state of the current process. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_task_wait(struct task_struct *p)
|
|
|
|
{
|
2007-10-22 22:10:31 +02:00
|
|
|
return task_has_perm(p, current, PROCESS__SIGCHLD);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_task_reparent_to_init(struct task_struct *p)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
|
|
|
|
secondary_ops->task_reparent_to_init(p);
|
|
|
|
|
|
|
|
tsec = p->security;
|
|
|
|
tsec->osid = tsec->sid;
|
|
|
|
tsec->sid = SECINITSID_KERNEL;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_task_to_inode(struct task_struct *p,
|
|
|
|
struct inode *inode)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = p->security;
|
|
|
|
struct inode_security_struct *isec = inode->i_security;
|
|
|
|
|
|
|
|
isec->sid = tsec->sid;
|
|
|
|
isec->initialized = 1;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns error only if unable to parse addresses */
|
2006-11-09 00:04:26 +01:00
|
|
|
static int selinux_parse_skb_ipv4(struct sk_buff *skb,
|
|
|
|
struct avc_audit_data *ad, u8 *proto)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int offset, ihlen, ret = -EINVAL;
|
|
|
|
struct iphdr _iph, *ih;
|
|
|
|
|
2007-03-11 02:16:10 +01:00
|
|
|
offset = skb_network_offset(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
|
|
|
|
if (ih == NULL)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
ihlen = ih->ihl * 4;
|
|
|
|
if (ihlen < sizeof(_iph))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
ad->u.net.v4info.saddr = ih->saddr;
|
|
|
|
ad->u.net.v4info.daddr = ih->daddr;
|
|
|
|
ret = 0;
|
|
|
|
|
2006-11-09 00:04:26 +01:00
|
|
|
if (proto)
|
|
|
|
*proto = ih->protocol;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
switch (ih->protocol) {
|
|
|
|
case IPPROTO_TCP: {
|
|
|
|
struct tcphdr _tcph, *th;
|
|
|
|
|
|
|
|
if (ntohs(ih->frag_off) & IP_OFFSET)
|
|
|
|
break;
|
|
|
|
|
|
|
|
offset += ihlen;
|
|
|
|
th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
|
|
|
|
if (th == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = th->source;
|
|
|
|
ad->u.net.dport = th->dest;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case IPPROTO_UDP: {
|
|
|
|
struct udphdr _udph, *uh;
|
|
|
|
|
|
|
|
if (ntohs(ih->frag_off) & IP_OFFSET)
|
|
|
|
break;
|
|
|
|
|
|
|
|
offset += ihlen;
|
|
|
|
uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
|
|
|
|
if (uh == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = uh->source;
|
|
|
|
ad->u.net.dport = uh->dest;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2006-11-14 01:09:01 +01:00
|
|
|
case IPPROTO_DCCP: {
|
|
|
|
struct dccp_hdr _dccph, *dh;
|
|
|
|
|
|
|
|
if (ntohs(ih->frag_off) & IP_OFFSET)
|
|
|
|
break;
|
|
|
|
|
|
|
|
offset += ihlen;
|
|
|
|
dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
|
|
|
|
if (dh == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = dh->dccph_sport;
|
|
|
|
ad->u.net.dport = dh->dccph_dport;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
out:
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
|
|
|
|
/* Returns error only if unable to parse addresses */
|
2006-11-09 00:04:26 +01:00
|
|
|
static int selinux_parse_skb_ipv6(struct sk_buff *skb,
|
|
|
|
struct avc_audit_data *ad, u8 *proto)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
u8 nexthdr;
|
|
|
|
int ret = -EINVAL, offset;
|
|
|
|
struct ipv6hdr _ipv6h, *ip6;
|
|
|
|
|
2007-03-11 02:16:10 +01:00
|
|
|
offset = skb_network_offset(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
|
|
|
|
if (ip6 == NULL)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
|
|
|
|
ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
|
|
|
|
ret = 0;
|
|
|
|
|
|
|
|
nexthdr = ip6->nexthdr;
|
|
|
|
offset += sizeof(_ipv6h);
|
2005-04-25 05:16:19 +02:00
|
|
|
offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (offset < 0)
|
|
|
|
goto out;
|
|
|
|
|
2006-11-09 00:04:26 +01:00
|
|
|
if (proto)
|
|
|
|
*proto = nexthdr;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
switch (nexthdr) {
|
|
|
|
case IPPROTO_TCP: {
|
|
|
|
struct tcphdr _tcph, *th;
|
|
|
|
|
|
|
|
th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
|
|
|
|
if (th == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = th->source;
|
|
|
|
ad->u.net.dport = th->dest;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case IPPROTO_UDP: {
|
|
|
|
struct udphdr _udph, *uh;
|
|
|
|
|
|
|
|
uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
|
|
|
|
if (uh == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = uh->source;
|
|
|
|
ad->u.net.dport = uh->dest;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2006-11-14 01:09:01 +01:00
|
|
|
case IPPROTO_DCCP: {
|
|
|
|
struct dccp_hdr _dccph, *dh;
|
|
|
|
|
|
|
|
dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
|
|
|
|
if (dh == NULL)
|
|
|
|
break;
|
|
|
|
|
|
|
|
ad->u.net.sport = dh->dccph_sport;
|
|
|
|
ad->u.net.dport = dh->dccph_dport;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* includes fragments */
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
out:
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* IPV6 */
|
|
|
|
|
|
|
|
static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
|
2008-01-29 14:38:13 +01:00
|
|
|
char **addrp, int src, u8 *proto)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
switch (ad->u.net.family) {
|
|
|
|
case PF_INET:
|
2006-11-09 00:04:26 +01:00
|
|
|
ret = selinux_parse_skb_ipv4(skb, ad, proto);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (ret || !addrp)
|
|
|
|
break;
|
|
|
|
*addrp = (char *)(src ? &ad->u.net.v4info.saddr :
|
|
|
|
&ad->u.net.v4info.daddr);
|
|
|
|
break;
|
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
case PF_INET6:
|
2006-11-09 00:04:26 +01:00
|
|
|
ret = selinux_parse_skb_ipv6(skb, ad, proto);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (ret || !addrp)
|
|
|
|
break;
|
|
|
|
*addrp = (char *)(src ? &ad->u.net.v6info.saddr :
|
|
|
|
&ad->u.net.v6info.daddr);
|
|
|
|
break;
|
|
|
|
#endif /* IPV6 */
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:51:16 +01:00
|
|
|
if (unlikely(ret))
|
|
|
|
printk(KERN_WARNING
|
|
|
|
"SELinux: failure in selinux_parse_skb(),"
|
|
|
|
" unable to parse packet\n");
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2007-03-01 20:35:22 +01:00
|
|
|
/**
|
2008-01-29 14:38:23 +01:00
|
|
|
* selinux_skb_peerlbl_sid - Determine the peer label of a packet
|
2007-03-01 20:35:22 +01:00
|
|
|
* @skb: the packet
|
2008-01-29 14:38:04 +01:00
|
|
|
* @family: protocol family
|
2008-01-29 14:38:23 +01:00
|
|
|
* @sid: the packet's peer label SID
|
2007-03-01 20:35:22 +01:00
|
|
|
*
|
|
|
|
* Description:
|
2008-01-29 14:38:23 +01:00
|
|
|
* Check the various different forms of network peer labeling and determine
|
|
|
|
* the peer label/SID for the packet; most of the magic actually occurs in
|
|
|
|
* the security server function security_net_peersid_cmp(). The function
|
|
|
|
* returns zero if the value in @sid is valid (although it may be SECSID_NULL)
|
|
|
|
* or -EACCES if @sid is invalid due to inconsistencies with the different
|
|
|
|
* peer labels.
|
2007-03-01 20:35:22 +01:00
|
|
|
*
|
|
|
|
*/
|
2008-01-29 14:38:23 +01:00
|
|
|
static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
|
2007-03-01 20:35:22 +01:00
|
|
|
{
|
2008-01-29 14:51:16 +01:00
|
|
|
int err;
|
2007-03-01 20:35:22 +01:00
|
|
|
u32 xfrm_sid;
|
|
|
|
u32 nlbl_sid;
|
2008-01-29 14:38:23 +01:00
|
|
|
u32 nlbl_type;
|
2007-03-01 20:35:22 +01:00
|
|
|
|
|
|
|
selinux_skb_xfrm_sid(skb, &xfrm_sid);
|
2008-01-29 14:44:18 +01:00
|
|
|
selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
|
2008-01-29 14:38:23 +01:00
|
|
|
|
2008-01-29 14:51:16 +01:00
|
|
|
err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
|
|
|
|
if (unlikely(err)) {
|
|
|
|
printk(KERN_WARNING
|
|
|
|
"SELinux: failure in selinux_skb_peerlbl_sid(),"
|
|
|
|
" unable to determine packet's peer label\n");
|
2008-01-29 14:38:23 +01:00
|
|
|
return -EACCES;
|
2008-01-29 14:51:16 +01:00
|
|
|
}
|
2008-01-29 14:38:23 +01:00
|
|
|
|
|
|
|
return 0;
|
2007-03-01 20:35:22 +01:00
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* socket security operations */
|
|
|
|
static int socket_has_perm(struct task_struct *task, struct socket *sock,
|
|
|
|
u32 perms)
|
|
|
|
{
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
tsec = task->security;
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
|
|
|
|
if (isec->sid == SECINITSID_KERNEL)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.sk = sock->sk;
|
|
|
|
err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
|
|
|
|
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_create(int family, int type,
|
|
|
|
int protocol, int kern)
|
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
struct task_security_struct *tsec;
|
2006-06-26 09:26:03 +02:00
|
|
|
u32 newsid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (kern)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
tsec = current->security;
|
2006-06-26 09:26:03 +02:00
|
|
|
newsid = tsec->sockcreate_sid ? : tsec->sid;
|
|
|
|
err = avc_has_perm(tsec->sid, newsid,
|
2005-04-17 00:20:36 +02:00
|
|
|
socket_type_to_security_class(family, type,
|
|
|
|
protocol), SOCKET__CREATE, NULL);
|
|
|
|
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2006-08-05 08:17:57 +02:00
|
|
|
static int selinux_socket_post_create(struct socket *sock, int family,
|
|
|
|
int type, int protocol, int kern)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2006-08-05 08:17:57 +02:00
|
|
|
int err = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct task_security_struct *tsec;
|
2006-08-05 08:08:56 +02:00
|
|
|
struct sk_security_struct *sksec;
|
2006-06-26 09:26:03 +02:00
|
|
|
u32 newsid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
|
|
|
|
tsec = current->security;
|
2006-06-26 09:26:03 +02:00
|
|
|
newsid = tsec->sockcreate_sid ? : tsec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
isec->sclass = socket_type_to_security_class(family, type, protocol);
|
2006-06-26 09:26:03 +02:00
|
|
|
isec->sid = kern ? SECINITSID_KERNEL : newsid;
|
2005-04-17 00:20:36 +02:00
|
|
|
isec->initialized = 1;
|
|
|
|
|
2006-08-05 08:08:56 +02:00
|
|
|
if (sock->sk) {
|
|
|
|
sksec = sock->sk->sk_security;
|
|
|
|
sksec->sid = isec->sid;
|
2008-01-29 14:38:23 +01:00
|
|
|
sksec->sclass = isec->sclass;
|
2006-11-17 23:38:53 +01:00
|
|
|
err = selinux_netlbl_socket_post_create(sock);
|
2006-08-05 08:08:56 +02:00
|
|
|
}
|
|
|
|
|
2006-08-05 08:17:57 +02:00
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Range of port numbers used to automatically bind.
|
|
|
|
Need to determine whether we should perform a name_bind
|
|
|
|
permission check between the socket and the port number. */
|
|
|
|
|
|
|
|
static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
|
|
|
|
{
|
|
|
|
u16 family;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = socket_has_perm(current, sock, SOCKET__BIND);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If PF_INET or PF_INET6, check name_bind permission for the port.
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
* Multiple address binding for SCTP is not supported yet: we just
|
|
|
|
* check the first address now.
|
2005-04-17 00:20:36 +02:00
|
|
|
*/
|
|
|
|
family = sock->sk->sk_family;
|
|
|
|
if (family == PF_INET || family == PF_INET6) {
|
|
|
|
char *addrp;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
struct sockaddr_in *addr4 = NULL;
|
|
|
|
struct sockaddr_in6 *addr6 = NULL;
|
|
|
|
unsigned short snum;
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
u32 sid, node_perm, addrlen;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
|
|
|
|
if (family == PF_INET) {
|
|
|
|
addr4 = (struct sockaddr_in *)address;
|
|
|
|
snum = ntohs(addr4->sin_port);
|
|
|
|
addrlen = sizeof(addr4->sin_addr.s_addr);
|
|
|
|
addrp = (char *)&addr4->sin_addr.s_addr;
|
|
|
|
} else {
|
|
|
|
addr6 = (struct sockaddr_in6 *)address;
|
|
|
|
snum = ntohs(addr6->sin6_port);
|
|
|
|
addrlen = sizeof(addr6->sin6_addr.s6_addr);
|
|
|
|
addrp = (char *)&addr6->sin6_addr.s6_addr;
|
|
|
|
}
|
|
|
|
|
2007-10-11 02:30:46 +02:00
|
|
|
if (snum) {
|
|
|
|
int low, high;
|
|
|
|
|
|
|
|
inet_get_local_port_range(&low, &high);
|
|
|
|
|
|
|
|
if (snum < max(PROT_SOCK, low) || snum > high) {
|
|
|
|
err = security_port_sid(sk->sk_family,
|
|
|
|
sk->sk_type,
|
|
|
|
sk->sk_protocol, snum,
|
|
|
|
&sid);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.sport = htons(snum);
|
|
|
|
ad.u.net.family = family;
|
|
|
|
err = avc_has_perm(isec->sid, sid,
|
|
|
|
isec->sclass,
|
|
|
|
SOCKET__NAME_BIND, &ad);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
switch(isec->sclass) {
|
|
|
|
case SECCLASS_TCP_SOCKET:
|
2005-04-17 00:20:36 +02:00
|
|
|
node_perm = TCP_SOCKET__NODE_BIND;
|
|
|
|
break;
|
|
|
|
|
[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling
The following patch updates the way SELinux classifies and handles IP
based protocols.
Currently, IP sockets are classified by SELinux as being either TCP, UDP
or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
The classification code is out of date and uses only the socket type
parameter to socket(2) to determine the class of IP socket. So, any
socket created with SOCK_STREAM will be classified by SELinux as TCP, and
SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and
SOCK_DCCP are currently ignored by SELinux, which classifies them as
generic sockets, which means they don't even get basic IP level checking.
This patch changes the SELinux IP socket classification logic, so that
only an IPPROTO_IP protocol value passed to socket(2) classify the socket
as TCP or UDP. The patch also drops the check for SOCK_RAW and converts
it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
Note that protocol-specific support for SCTP, DCCP etc. is not addressed
here, we're just getting these protocols checked at the IP layer.
This fixes a reported problem where SCTP sockets were being recognized as
generic SELinux sockets yet still being passed in one case to an IP level
check, which then fails for generic sockets.
It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
any SOCK_DGRAM socket is classified as UDP.
This patch also unifies the way IP sockets classes are determined in
selinux_socket_bind(), so we use the already calculated value instead of
trying to recalculate it.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-30 20:24:34 +02:00
|
|
|
case SECCLASS_UDP_SOCKET:
|
2005-04-17 00:20:36 +02:00
|
|
|
node_perm = UDP_SOCKET__NODE_BIND;
|
|
|
|
break;
|
2006-11-14 01:09:01 +01:00
|
|
|
|
|
|
|
case SECCLASS_DCCP_SOCKET:
|
|
|
|
node_perm = DCCP_SOCKET__NODE_BIND;
|
|
|
|
break;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
node_perm = RAWIP_SOCKET__NODE_BIND;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:38:13 +01:00
|
|
|
err = sel_netnode_sid(addrp, family, &sid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.sport = htons(snum);
|
|
|
|
ad.u.net.family = family;
|
|
|
|
|
|
|
|
if (family == PF_INET)
|
|
|
|
ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
|
|
|
|
else
|
|
|
|
ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
|
|
|
|
|
|
|
|
err = avc_has_perm(isec->sid, sid,
|
|
|
|
isec->sclass, node_perm, &ad);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
|
|
|
|
{
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = socket_has_perm(current, sock, SOCKET__CONNECT);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
/*
|
2006-11-14 01:09:01 +01:00
|
|
|
* If a TCP or DCCP socket, check name_connect permission for the port.
|
2005-04-17 00:20:36 +02:00
|
|
|
*/
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
2006-11-14 01:09:01 +01:00
|
|
|
if (isec->sclass == SECCLASS_TCP_SOCKET ||
|
|
|
|
isec->sclass == SECCLASS_DCCP_SOCKET) {
|
2005-04-17 00:20:36 +02:00
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
struct sockaddr_in *addr4 = NULL;
|
|
|
|
struct sockaddr_in6 *addr6 = NULL;
|
|
|
|
unsigned short snum;
|
2006-11-14 01:09:01 +01:00
|
|
|
u32 sid, perm;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (sk->sk_family == PF_INET) {
|
|
|
|
addr4 = (struct sockaddr_in *)address;
|
2005-07-29 06:16:21 +02:00
|
|
|
if (addrlen < sizeof(struct sockaddr_in))
|
2005-04-17 00:20:36 +02:00
|
|
|
return -EINVAL;
|
|
|
|
snum = ntohs(addr4->sin_port);
|
|
|
|
} else {
|
|
|
|
addr6 = (struct sockaddr_in6 *)address;
|
2005-07-29 06:16:21 +02:00
|
|
|
if (addrlen < SIN6_LEN_RFC2133)
|
2005-04-17 00:20:36 +02:00
|
|
|
return -EINVAL;
|
|
|
|
snum = ntohs(addr6->sin6_port);
|
|
|
|
}
|
|
|
|
|
|
|
|
err = security_port_sid(sk->sk_family, sk->sk_type,
|
|
|
|
sk->sk_protocol, snum, &sid);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
2006-11-14 01:09:01 +01:00
|
|
|
perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
|
|
|
|
TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.dport = htons(snum);
|
|
|
|
ad.u.net.family = sk->sk_family;
|
2006-11-14 01:09:01 +01:00
|
|
|
err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_listen(struct socket *sock, int backlog)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__LISTEN);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct inode_security_struct *newisec;
|
|
|
|
|
|
|
|
err = socket_has_perm(current, sock, SOCKET__ACCEPT);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
newisec = SOCK_INODE(newsock)->i_security;
|
|
|
|
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
newisec->sclass = isec->sclass;
|
|
|
|
newisec->sid = isec->sid;
|
|
|
|
newisec->initialized = 1;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
|
|
|
|
int size)
|
|
|
|
{
|
2006-08-05 08:17:57 +02:00
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = socket_has_perm(current, sock, SOCKET__WRITE);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
|
|
|
|
int size, int flags)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__READ);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_getsockname(struct socket *sock)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__GETATTR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_getpeername(struct socket *sock)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__GETATTR);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
|
|
|
|
{
|
2006-10-31 00:22:15 +01:00
|
|
|
int err;
|
|
|
|
|
|
|
|
err = socket_has_perm(current, sock, SOCKET__SETOPT);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
return selinux_netlbl_socket_setsockopt(sock, level, optname);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_getsockopt(struct socket *sock, int level,
|
|
|
|
int optname)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__GETOPT);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_shutdown(struct socket *sock, int how)
|
|
|
|
{
|
|
|
|
return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_unix_stream_connect(struct socket *sock,
|
|
|
|
struct socket *other,
|
|
|
|
struct sock *newsk)
|
|
|
|
{
|
|
|
|
struct sk_security_struct *ssec;
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct inode_security_struct *other_isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = secondary_ops->unix_stream_connect(sock, other, newsk);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
other_isec = SOCK_INODE(other)->i_security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.sk = other->sk;
|
|
|
|
|
|
|
|
err = avc_has_perm(isec->sid, other_isec->sid,
|
|
|
|
isec->sclass,
|
|
|
|
UNIX_STREAM_SOCKET__CONNECTTO, &ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
/* connecting socket */
|
|
|
|
ssec = sock->sk->sk_security;
|
|
|
|
ssec->peer_sid = other_isec->sid;
|
|
|
|
|
|
|
|
/* server child socket */
|
|
|
|
ssec = newsk->sk_security;
|
|
|
|
ssec->peer_sid = isec->sid;
|
2006-07-25 08:32:50 +02:00
|
|
|
err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
|
|
|
|
|
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_unix_may_send(struct socket *sock,
|
|
|
|
struct socket *other)
|
|
|
|
{
|
|
|
|
struct inode_security_struct *isec;
|
|
|
|
struct inode_security_struct *other_isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
|
|
|
other_isec = SOCK_INODE(other)->i_security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad,NET);
|
|
|
|
ad.u.net.sk = other->sk;
|
|
|
|
|
|
|
|
err = avc_has_perm(isec->sid, other_isec->sid,
|
|
|
|
isec->sclass, SOCKET__SENDTO, &ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
|
|
|
|
u32 peer_sid,
|
|
|
|
struct avc_audit_data *ad)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
u32 if_sid;
|
|
|
|
u32 node_sid;
|
|
|
|
|
|
|
|
err = sel_netif_sid(ifindex, &if_sid);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = avc_has_perm(peer_sid, if_sid,
|
|
|
|
SECCLASS_NETIF, NETIF__INGRESS, ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
err = sel_netnode_sid(addrp, family, &node_sid);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
return avc_has_perm(peer_sid, node_sid,
|
|
|
|
SECCLASS_NODE, NODE__RECVFROM, ad);
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
|
|
|
|
struct sk_buff *skb,
|
|
|
|
struct avc_audit_data *ad,
|
|
|
|
u16 family,
|
|
|
|
char *addrp)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-01-29 14:38:23 +01:00
|
|
|
int err;
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
u16 sk_class;
|
|
|
|
u32 netif_perm, node_perm, recv_perm;
|
|
|
|
u32 port_sid, node_sid, if_sid, sk_sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
sk_sid = sksec->sid;
|
|
|
|
sk_class = sksec->sclass;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
switch (sk_class) {
|
2005-04-17 00:20:36 +02:00
|
|
|
case SECCLASS_UDP_SOCKET:
|
|
|
|
netif_perm = NETIF__UDP_RECV;
|
|
|
|
node_perm = NODE__UDP_RECV;
|
|
|
|
recv_perm = UDP_SOCKET__RECV_MSG;
|
|
|
|
break;
|
|
|
|
case SECCLASS_TCP_SOCKET:
|
|
|
|
netif_perm = NETIF__TCP_RECV;
|
|
|
|
node_perm = NODE__TCP_RECV;
|
|
|
|
recv_perm = TCP_SOCKET__RECV_MSG;
|
|
|
|
break;
|
2006-11-14 01:09:01 +01:00
|
|
|
case SECCLASS_DCCP_SOCKET:
|
|
|
|
netif_perm = NETIF__DCCP_RECV;
|
|
|
|
node_perm = NODE__DCCP_RECV;
|
|
|
|
recv_perm = DCCP_SOCKET__RECV_MSG;
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
netif_perm = NETIF__RAWIP_RECV;
|
|
|
|
node_perm = NODE__RAWIP_RECV;
|
2008-01-29 14:38:23 +01:00
|
|
|
recv_perm = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
err = sel_netif_sid(skb->iif, &if_sid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
2008-01-29 14:38:23 +01:00
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:13 +01:00
|
|
|
err = sel_netnode_sid(addrp, family, &node_sid);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
2008-01-29 14:38:23 +01:00
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
2008-01-29 14:38:23 +01:00
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
if (!recv_perm)
|
|
|
|
return 0;
|
|
|
|
err = security_port_sid(sk->sk_family, sk->sk_type,
|
|
|
|
sk->sk_protocol, ntohs(ad->u.net.sport),
|
|
|
|
&port_sid);
|
2008-01-29 14:51:16 +01:00
|
|
|
if (unlikely(err)) {
|
|
|
|
printk(KERN_WARNING
|
|
|
|
"SELinux: failure in"
|
|
|
|
" selinux_sock_rcv_skb_iptables_compat(),"
|
|
|
|
" network port label not found\n");
|
2008-01-29 14:38:23 +01:00
|
|
|
return err;
|
2008-01-29 14:51:16 +01:00
|
|
|
}
|
2008-01-29 14:38:23 +01:00
|
|
|
return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
|
|
|
|
struct avc_audit_data *ad,
|
|
|
|
u16 family, char *addrp)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
u32 peer_sid;
|
|
|
|
u32 sk_sid = sksec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
if (selinux_compat_net)
|
|
|
|
err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
|
|
|
|
family, addrp);
|
|
|
|
else
|
|
|
|
err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
|
|
|
|
PACKET__RECV, ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
if (selinux_policycap_netpeer) {
|
|
|
|
err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, peer_sid,
|
|
|
|
SECCLASS_PEER, PEER__RECV, ad);
|
|
|
|
} else {
|
|
|
|
err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
|
|
|
|
{
|
2008-01-29 14:38:23 +01:00
|
|
|
int err;
|
2006-07-25 08:32:50 +02:00
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
2008-01-29 14:38:23 +01:00
|
|
|
u16 family = sk->sk_family;
|
|
|
|
u32 sk_sid = sksec->sid;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
char *addrp;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
|
|
|
if (family != PF_INET && family != PF_INET6)
|
2008-01-29 14:38:23 +01:00
|
|
|
return 0;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
|
|
|
/* Handle mapped IPv4 packets arriving via IPv6 sockets */
|
2006-12-04 23:00:55 +01:00
|
|
|
if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
family = PF_INET;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, NET);
|
2008-01-29 14:38:10 +01:00
|
|
|
ad.u.net.netif = skb->iif;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
ad.u.net.family = family;
|
2008-01-29 14:38:13 +01:00
|
|
|
err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
if (err)
|
2008-01-29 14:38:23 +01:00
|
|
|
return err;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
/* If any sort of compatibility mode is enabled then handoff processing
|
|
|
|
* to the selinux_sock_rcv_skb_compat() function to deal with the
|
|
|
|
* special handling. We do this in an attempt to keep this function
|
|
|
|
* as fast and as clean as possible. */
|
|
|
|
if (selinux_compat_net || !selinux_policycap_netpeer)
|
|
|
|
return selinux_sock_rcv_skb_compat(sk, skb, &ad,
|
|
|
|
family, addrp);
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
2008-01-29 14:43:36 +01:00
|
|
|
if (netlbl_enabled() || selinux_xfrm_enabled()) {
|
|
|
|
u32 peer_sid;
|
|
|
|
|
|
|
|
err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
|
2008-01-29 14:49:27 +01:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
|
|
|
|
peer_sid, &ad);
|
2008-01-29 14:43:36 +01:00
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
|
|
|
|
PEER__RECV, &ad);
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
if (selinux_secmark_enabled()) {
|
|
|
|
err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
|
|
|
|
PACKET__RECV, &ad);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:43:36 +01:00
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
|
|
|
|
int __user *optlen, unsigned len)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
char *scontext;
|
|
|
|
u32 scontext_len;
|
|
|
|
struct sk_security_struct *ssec;
|
|
|
|
struct inode_security_struct *isec;
|
2006-11-17 23:38:54 +01:00
|
|
|
u32 peer_sid = SECSID_NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
isec = SOCK_INODE(sock)->i_security;
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
|
2006-11-17 23:38:54 +01:00
|
|
|
if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
|
|
|
|
isec->sclass == SECCLASS_TCP_SOCKET) {
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
ssec = sock->sk->sk_security;
|
|
|
|
peer_sid = ssec->peer_sid;
|
|
|
|
}
|
2006-11-17 23:38:54 +01:00
|
|
|
if (peer_sid == SECSID_NULL) {
|
2005-04-17 00:20:36 +02:00
|
|
|
err = -ENOPROTOOPT;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (scontext_len > len) {
|
|
|
|
err = -ERANGE;
|
|
|
|
goto out_len;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (copy_to_user(optval, scontext, scontext_len))
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
out_len:
|
|
|
|
if (put_user(scontext_len, optlen))
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
kfree(scontext);
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2006-08-02 23:12:06 +02:00
|
|
|
static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
{
|
2006-08-02 23:12:06 +02:00
|
|
|
u32 peer_secid = SECSID_NULL;
|
2008-01-29 14:38:04 +01:00
|
|
|
u16 family;
|
[AF_UNIX]: Datagram getpeersec
This patch implements an API whereby an application can determine the
label of its peer's Unix datagram sockets via the auxiliary data mechanism of
recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of the peer of a Unix datagram socket. The application
can then use this security context to determine the security context for
processing on behalf of the peer who sent the packet.
Patch design and implementation:
The design and implementation is very similar to the UDP case for INET
sockets. Basically we build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message). To retrieve the security
context, the application first indicates to the kernel such desire by
setting the SO_PASSSEC option via getsockopt. Then the application
retrieves the security context using the auxiliary data mechanism.
An example server application for Unix datagram socket should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_SOCKET, SO_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_SOCKET &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
sock_setsockopt is enhanced with a new socket option SOCK_PASSSEC to allow
a server socket to receive security context of the peer.
Testing:
We have tested the patch by setting up Unix datagram client and server
applications. We verified that the server can retrieve the security context
using the auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-29 21:27:47 +02:00
|
|
|
|
2008-01-29 14:38:04 +01:00
|
|
|
if (sock)
|
|
|
|
family = sock->sk->sk_family;
|
|
|
|
else if (skb && skb->sk)
|
|
|
|
family = skb->sk->sk_family;
|
|
|
|
else
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (sock && family == PF_UNIX)
|
2006-08-02 23:12:06 +02:00
|
|
|
selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
|
2006-11-17 23:38:54 +01:00
|
|
|
else if (skb)
|
2008-01-29 14:38:23 +01:00
|
|
|
selinux_skb_peerlbl_sid(skb, family, &peer_secid);
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
|
2008-01-29 14:38:04 +01:00
|
|
|
out:
|
2006-08-02 23:12:06 +02:00
|
|
|
*secid = peer_secid;
|
2008-01-29 14:38:04 +01:00
|
|
|
if (peer_secid == SECSID_NULL)
|
|
|
|
return -EINVAL;
|
|
|
|
return 0;
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
}
|
|
|
|
|
2005-10-21 09:20:43 +02:00
|
|
|
static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
return sk_alloc_security(sk, family, priority);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_sk_free_security(struct sock *sk)
|
|
|
|
{
|
|
|
|
sk_free_security(sk);
|
|
|
|
}
|
|
|
|
|
2006-08-05 08:08:56 +02:00
|
|
|
static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
{
|
2006-08-05 08:08:56 +02:00
|
|
|
struct sk_security_struct *ssec = sk->sk_security;
|
|
|
|
struct sk_security_struct *newssec = newsk->sk_security;
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
2006-08-05 08:08:56 +02:00
|
|
|
newssec->sid = ssec->sid;
|
|
|
|
newssec->peer_sid = ssec->peer_sid;
|
2008-01-29 14:38:23 +01:00
|
|
|
newssec->sclass = ssec->sclass;
|
2006-08-30 02:53:48 +02:00
|
|
|
|
2006-11-17 23:38:53 +01:00
|
|
|
selinux_netlbl_sk_security_clone(ssec, newssec);
|
2006-08-05 08:08:56 +02:00
|
|
|
}
|
|
|
|
|
2006-08-05 08:12:42 +02:00
|
|
|
static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
|
2006-08-05 08:08:56 +02:00
|
|
|
{
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
if (!sk)
|
2006-08-05 08:12:42 +02:00
|
|
|
*secid = SECINITSID_ANY_SOCKET;
|
2006-08-05 08:08:56 +02:00
|
|
|
else {
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
2006-08-05 08:12:42 +02:00
|
|
|
*secid = sksec->sid;
|
2006-08-05 08:08:56 +02:00
|
|
|
}
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
}
|
|
|
|
|
2006-08-15 09:03:53 +02:00
|
|
|
static void selinux_sock_graft(struct sock* sk, struct socket *parent)
|
2006-07-25 08:32:50 +02:00
|
|
|
{
|
|
|
|
struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
|
2006-09-30 00:50:25 +02:00
|
|
|
if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
|
|
|
|
sk->sk_family == PF_UNIX)
|
|
|
|
isec->sid = sksec->sid;
|
2008-01-29 14:38:23 +01:00
|
|
|
sksec->sclass = isec->sclass;
|
2006-08-05 08:17:57 +02:00
|
|
|
|
|
|
|
selinux_netlbl_sock_graft(sk, parent);
|
2006-07-25 08:32:50 +02:00
|
|
|
}
|
|
|
|
|
2006-08-15 09:03:53 +02:00
|
|
|
static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
|
|
|
|
struct request_sock *req)
|
2006-07-25 08:32:50 +02:00
|
|
|
{
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
int err;
|
2006-08-05 08:17:57 +02:00
|
|
|
u32 newsid;
|
2006-07-25 08:32:50 +02:00
|
|
|
u32 peersid;
|
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
|
|
|
|
if (err)
|
|
|
|
return err;
|
2006-07-28 07:01:34 +02:00
|
|
|
if (peersid == SECSID_NULL) {
|
|
|
|
req->secid = sksec->sid;
|
2006-11-17 23:38:54 +01:00
|
|
|
req->peer_secid = SECSID_NULL;
|
2006-07-28 07:01:34 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-07-25 08:32:50 +02:00
|
|
|
err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
req->secid = newsid;
|
2006-11-09 00:04:09 +01:00
|
|
|
req->peer_secid = peersid;
|
2006-07-25 08:32:50 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-08-15 09:03:53 +02:00
|
|
|
static void selinux_inet_csk_clone(struct sock *newsk,
|
|
|
|
const struct request_sock *req)
|
2006-07-25 08:32:50 +02:00
|
|
|
{
|
|
|
|
struct sk_security_struct *newsksec = newsk->sk_security;
|
|
|
|
|
|
|
|
newsksec->sid = req->secid;
|
2006-11-09 00:04:09 +01:00
|
|
|
newsksec->peer_sid = req->peer_secid;
|
2006-07-25 08:32:50 +02:00
|
|
|
/* NOTE: Ideally, we should also get the isec->sid for the
|
|
|
|
new socket in sync, but we don't have the isec available yet.
|
|
|
|
So we will wait until sock_graft to do it, by which
|
|
|
|
time it will have been created and available. */
|
2006-08-30 02:53:48 +02:00
|
|
|
|
2006-11-17 23:38:53 +01:00
|
|
|
/* We don't need to take any sort of lock here as we are the only
|
|
|
|
* thread with access to newsksec */
|
|
|
|
selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
|
2006-07-25 08:32:50 +02:00
|
|
|
}
|
|
|
|
|
2006-11-09 00:04:09 +01:00
|
|
|
static void selinux_inet_conn_established(struct sock *sk,
|
|
|
|
struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
|
2008-01-29 14:38:23 +01:00
|
|
|
selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
|
2006-11-09 00:04:09 +01:00
|
|
|
}
|
|
|
|
|
2006-08-15 09:03:53 +02:00
|
|
|
static void selinux_req_classify_flow(const struct request_sock *req,
|
|
|
|
struct flowi *fl)
|
2006-07-25 08:32:50 +02:00
|
|
|
{
|
|
|
|
fl->secid = req->secid;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
u32 perm;
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
struct socket *sock = sk->sk_socket;
|
|
|
|
struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
|
|
|
|
|
|
|
|
if (skb->len < NLMSG_SPACE(0)) {
|
|
|
|
err = -EINVAL;
|
|
|
|
goto out;
|
|
|
|
}
|
2007-04-26 04:08:35 +02:00
|
|
|
nlh = nlmsg_hdr(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
|
|
|
|
if (err) {
|
|
|
|
if (err == -EINVAL) {
|
2005-06-22 16:04:33 +02:00
|
|
|
audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
|
2005-04-17 00:20:36 +02:00
|
|
|
"SELinux: unrecognized netlink message"
|
|
|
|
" type=%hu for sclass=%hu\n",
|
|
|
|
nlh->nlmsg_type, isec->sclass);
|
|
|
|
if (!selinux_enforcing)
|
|
|
|
err = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Ignore */
|
|
|
|
if (err == -ENOENT)
|
|
|
|
err = 0;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = socket_has_perm(current, sock, perm);
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef CONFIG_NETFILTER
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
|
|
|
|
u16 family)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-01-29 14:49:27 +01:00
|
|
|
char *addrp;
|
|
|
|
u32 peer_sid;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
u8 secmark_active;
|
|
|
|
u8 peerlbl_active;
|
2006-07-25 08:32:50 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
if (!selinux_policycap_netpeer)
|
|
|
|
return NF_ACCEPT;
|
2006-07-25 08:32:50 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
secmark_active = selinux_secmark_enabled();
|
|
|
|
peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
|
|
|
|
if (!secmark_active && !peerlbl_active)
|
|
|
|
return NF_ACCEPT;
|
2006-07-25 08:32:50 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
AVC_AUDIT_DATA_INIT(&ad, NET);
|
|
|
|
ad.u.net.netif = ifindex;
|
|
|
|
ad.u.net.family = family;
|
|
|
|
if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
if (peerlbl_active)
|
|
|
|
if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
|
|
|
|
peer_sid, &ad) != 0)
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
if (secmark_active)
|
|
|
|
if (avc_has_perm(peer_sid, skb->secmark,
|
|
|
|
SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
return NF_ACCEPT;
|
|
|
|
}
|
|
|
|
|
|
|
|
static unsigned int selinux_ipv4_forward(unsigned int hooknum,
|
|
|
|
struct sk_buff *skb,
|
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
{
|
|
|
|
return selinux_ip_forward(skb, in->ifindex, PF_INET);
|
|
|
|
}
|
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
static unsigned int selinux_ipv6_forward(unsigned int hooknum,
|
|
|
|
struct sk_buff *skb,
|
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
{
|
|
|
|
return selinux_ip_forward(skb, in->ifindex, PF_INET6);
|
|
|
|
}
|
|
|
|
#endif /* IPV6 */
|
|
|
|
|
|
|
|
static int selinux_ip_postroute_iptables_compat(struct sock *sk,
|
|
|
|
int ifindex,
|
|
|
|
struct avc_audit_data *ad,
|
|
|
|
u16 family, char *addrp)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
u16 sk_class;
|
|
|
|
u32 netif_perm, node_perm, send_perm;
|
|
|
|
u32 port_sid, node_sid, if_sid, sk_sid;
|
|
|
|
|
|
|
|
sk_sid = sksec->sid;
|
|
|
|
sk_class = sksec->sclass;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
switch (sk_class) {
|
2005-04-17 00:20:36 +02:00
|
|
|
case SECCLASS_UDP_SOCKET:
|
|
|
|
netif_perm = NETIF__UDP_SEND;
|
|
|
|
node_perm = NODE__UDP_SEND;
|
|
|
|
send_perm = UDP_SOCKET__SEND_MSG;
|
|
|
|
break;
|
|
|
|
case SECCLASS_TCP_SOCKET:
|
|
|
|
netif_perm = NETIF__TCP_SEND;
|
|
|
|
node_perm = NODE__TCP_SEND;
|
|
|
|
send_perm = TCP_SOCKET__SEND_MSG;
|
|
|
|
break;
|
2006-11-14 01:09:01 +01:00
|
|
|
case SECCLASS_DCCP_SOCKET:
|
|
|
|
netif_perm = NETIF__DCCP_SEND;
|
|
|
|
node_perm = NODE__DCCP_SEND;
|
|
|
|
send_perm = DCCP_SOCKET__SEND_MSG;
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
netif_perm = NETIF__RAWIP_SEND;
|
|
|
|
node_perm = NODE__RAWIP_SEND;
|
2008-01-29 14:49:27 +01:00
|
|
|
send_perm = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
err = sel_netif_sid(ifindex, &if_sid);
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
if (err)
|
2008-01-29 14:49:27 +01:00
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
|
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:38:13 +01:00
|
|
|
err = sel_netnode_sid(addrp, family, &node_sid);
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
if (err)
|
2008-01-29 14:49:27 +01:00
|
|
|
return err;
|
|
|
|
err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
if (err)
|
2008-01-29 14:49:27 +01:00
|
|
|
return err;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
if (send_perm != 0)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
err = security_port_sid(sk->sk_family, sk->sk_type,
|
|
|
|
sk->sk_protocol, ntohs(ad->u.net.dport),
|
|
|
|
&port_sid);
|
2008-01-29 14:51:16 +01:00
|
|
|
if (unlikely(err)) {
|
|
|
|
printk(KERN_WARNING
|
|
|
|
"SELinux: failure in"
|
|
|
|
" selinux_ip_postroute_iptables_compat(),"
|
|
|
|
" network port label not found\n");
|
2008-01-29 14:49:27 +01:00
|
|
|
return err;
|
2008-01-29 14:51:16 +01:00
|
|
|
}
|
2008-01-29 14:49:27 +01:00
|
|
|
return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
|
|
|
|
int ifindex,
|
|
|
|
struct avc_audit_data *ad,
|
|
|
|
u16 family,
|
|
|
|
char *addrp,
|
|
|
|
u8 proto)
|
|
|
|
{
|
|
|
|
struct sock *sk = skb->sk;
|
|
|
|
struct sk_security_struct *sksec;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
if (sk == NULL)
|
|
|
|
return NF_ACCEPT;
|
|
|
|
sksec = sk->sk_security;
|
|
|
|
|
|
|
|
if (selinux_compat_net) {
|
|
|
|
if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
|
|
|
|
ad, family, addrp))
|
|
|
|
return NF_DROP;
|
|
|
|
} else {
|
|
|
|
if (avc_has_perm(sksec->sid, skb->secmark,
|
|
|
|
SECCLASS_PACKET, PACKET__SEND, ad))
|
|
|
|
return NF_DROP;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
2008-01-29 14:49:27 +01:00
|
|
|
|
|
|
|
if (selinux_policycap_netpeer)
|
|
|
|
if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
return NF_ACCEPT;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
}
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
|
|
|
|
u16 family)
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
{
|
2008-01-29 14:49:27 +01:00
|
|
|
u32 secmark_perm;
|
|
|
|
u32 peer_sid;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
struct sock *sk;
|
|
|
|
struct avc_audit_data ad;
|
2008-01-29 14:49:27 +01:00
|
|
|
char *addrp;
|
2006-11-09 00:04:26 +01:00
|
|
|
u8 proto;
|
2008-01-29 14:49:27 +01:00
|
|
|
u8 secmark_active;
|
|
|
|
u8 peerlbl_active;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, NET);
|
2008-01-29 14:49:27 +01:00
|
|
|
ad.u.net.netif = ifindex;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
ad.u.net.family = family;
|
2008-01-29 14:49:27 +01:00
|
|
|
if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
|
|
|
|
return NF_DROP;
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
/* If any sort of compatibility mode is enabled then handoff processing
|
|
|
|
* to the selinux_ip_postroute_compat() function to deal with the
|
|
|
|
* special handling. We do this in an attempt to keep this function
|
|
|
|
* as fast and as clean as possible. */
|
|
|
|
if (selinux_compat_net || !selinux_policycap_netpeer)
|
|
|
|
return selinux_ip_postroute_compat(skb, ifindex, &ad,
|
|
|
|
family, addrp, proto);
|
|
|
|
|
|
|
|
/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
|
|
|
|
* packet transformation so allow the packet to pass without any checks
|
|
|
|
* since we'll have another chance to perform access control checks
|
|
|
|
* when the packet is on it's final way out.
|
|
|
|
* NOTE: there appear to be some IPv6 multicast cases where skb->dst
|
|
|
|
* is NULL, in this case go ahead and apply access control. */
|
|
|
|
if (skb->dst != NULL && skb->dst->xfrm != NULL)
|
|
|
|
return NF_ACCEPT;
|
|
|
|
|
|
|
|
secmark_active = selinux_secmark_enabled();
|
|
|
|
peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
|
|
|
|
if (!secmark_active && !peerlbl_active)
|
|
|
|
return NF_ACCEPT;
|
|
|
|
|
|
|
|
/* if the packet is locally generated (skb->sk != NULL) then use the
|
|
|
|
* socket's label as the peer label, otherwise the packet is being
|
|
|
|
* forwarded through this system and we need to fetch the peer label
|
|
|
|
* directly from the packet */
|
|
|
|
sk = skb->sk;
|
|
|
|
if (sk) {
|
|
|
|
struct sk_security_struct *sksec = sk->sk_security;
|
|
|
|
peer_sid = sksec->sid;
|
|
|
|
secmark_perm = PACKET__SEND;
|
|
|
|
} else {
|
|
|
|
if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
|
|
|
|
return NF_DROP;
|
|
|
|
secmark_perm = PACKET__FORWARD_OUT;
|
|
|
|
}
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
if (secmark_active)
|
|
|
|
if (avc_has_perm(peer_sid, skb->secmark,
|
|
|
|
SECCLASS_PACKET, secmark_perm, &ad))
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
if (peerlbl_active) {
|
|
|
|
u32 if_sid;
|
|
|
|
u32 node_sid;
|
|
|
|
|
|
|
|
if (sel_netif_sid(ifindex, &if_sid))
|
|
|
|
return NF_DROP;
|
|
|
|
if (avc_has_perm(peer_sid, if_sid,
|
|
|
|
SECCLASS_NETIF, NETIF__EGRESS, &ad))
|
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
if (sel_netnode_sid(addrp, family, &node_sid))
|
|
|
|
return NF_DROP;
|
|
|
|
if (avc_has_perm(peer_sid, node_sid,
|
|
|
|
SECCLASS_NODE, NODE__SENDTO, &ad))
|
|
|
|
return NF_DROP;
|
|
|
|
}
|
[SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.
Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.
To allow for a smooth transition to the new controls, the old code is
still present, but not active by default. To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net. Switching between the network control models
requires the security load_policy permission. The old controls will
probably eventually be removed and any continued use is discouraged.
With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.
It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime). It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-09 09:33:33 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
return NF_ACCEPT;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
|
|
|
|
struct sk_buff *skb,
|
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
|
|
|
int (*okfn)(struct sk_buff *))
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-01-29 14:49:27 +01:00
|
|
|
return selinux_ip_postroute(skb, out->ifindex, PF_INET);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
2008-01-29 14:49:27 +01:00
|
|
|
static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
|
|
|
|
struct sk_buff *skb,
|
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
|
|
|
int (*okfn)(struct sk_buff *))
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-01-29 14:49:27 +01:00
|
|
|
return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
#endif /* IPV6 */
|
|
|
|
|
|
|
|
#endif /* CONFIG_NETFILTER */
|
|
|
|
|
|
|
|
static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = secondary_ops->netlink_send(sk, skb);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
|
|
|
|
err = selinux_nlmsg_perm(sk, skb);
|
|
|
|
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2006-06-27 22:26:11 +02:00
|
|
|
static int selinux_netlink_recv(struct sk_buff *skb, int capability)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2006-06-27 22:26:11 +02:00
|
|
|
int err;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
err = secondary_ops->netlink_recv(skb, capability);
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, CAP);
|
|
|
|
ad.u.cap = capability;
|
|
|
|
|
|
|
|
return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
|
|
|
|
SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int ipc_alloc_security(struct task_struct *task,
|
|
|
|
struct kern_ipc_perm *perm,
|
|
|
|
u16 sclass)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = task->security;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!isec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
isec->sclass = sclass;
|
|
|
|
isec->ipc_perm = perm;
|
2006-02-01 12:05:56 +01:00
|
|
|
isec->sid = tsec->sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
perm->security = isec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void ipc_free_security(struct kern_ipc_perm *perm)
|
|
|
|
{
|
|
|
|
struct ipc_security_struct *isec = perm->security;
|
|
|
|
perm->security = NULL;
|
|
|
|
kfree(isec);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int msg_msg_alloc_security(struct msg_msg *msg)
|
|
|
|
{
|
|
|
|
struct msg_security_struct *msec;
|
|
|
|
|
2005-10-30 23:59:21 +01:00
|
|
|
msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!msec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
msec->msg = msg;
|
|
|
|
msec->sid = SECINITSID_UNLABELED;
|
|
|
|
msg->security = msec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void msg_msg_free_security(struct msg_msg *msg)
|
|
|
|
{
|
|
|
|
struct msg_security_struct *msec = msg->security;
|
|
|
|
|
|
|
|
msg->security = NULL;
|
|
|
|
kfree(msec);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
|
2005-05-01 17:58:39 +02:00
|
|
|
u32 perms)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = ipc_perms->security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = ipc_perms->key;
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
|
|
|
|
{
|
|
|
|
return msg_msg_alloc_security(msg);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_msg_msg_free_security(struct msg_msg *msg)
|
|
|
|
{
|
|
|
|
msg_msg_free_security(msg);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* message queue security operations */
|
|
|
|
static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = msq->q_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = msq->q_perm.key;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
|
|
|
|
MSGQ__CREATE, &ad);
|
|
|
|
if (rc) {
|
|
|
|
ipc_free_security(&msq->q_perm);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_msg_queue_free_security(struct msg_queue *msq)
|
|
|
|
{
|
|
|
|
ipc_free_security(&msq->q_perm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = msq->q_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = msq->q_perm.key;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
|
|
|
|
MSGQ__ASSOCIATE, &ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
int perms;
|
|
|
|
|
|
|
|
switch(cmd) {
|
|
|
|
case IPC_INFO:
|
|
|
|
case MSG_INFO:
|
|
|
|
/* No specific object, just general system-wide information. */
|
|
|
|
return task_has_system(current, SYSTEM__IPC_INFO);
|
|
|
|
case IPC_STAT:
|
|
|
|
case MSG_STAT:
|
|
|
|
perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
|
|
|
|
break;
|
|
|
|
case IPC_SET:
|
|
|
|
perms = MSGQ__SETATTR;
|
|
|
|
break;
|
|
|
|
case IPC_RMID:
|
|
|
|
perms = MSGQ__DESTROY;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
err = ipc_has_perm(&msq->q_perm, perms);
|
2005-04-17 00:20:36 +02:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct msg_security_struct *msec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = msq->q_perm.security;
|
|
|
|
msec = msg->security;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* First time through, need to assign label to the message
|
|
|
|
*/
|
|
|
|
if (msec->sid == SECINITSID_UNLABELED) {
|
|
|
|
/*
|
|
|
|
* Compute new sid based on current process and
|
|
|
|
* message queue this message will be stored in
|
|
|
|
*/
|
|
|
|
rc = security_transition_sid(tsec->sid,
|
|
|
|
isec->sid,
|
|
|
|
SECCLASS_MSG,
|
|
|
|
&msec->sid);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = msq->q_perm.key;
|
|
|
|
|
|
|
|
/* Can this process write to the queue? */
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
|
|
|
|
MSGQ__WRITE, &ad);
|
|
|
|
if (!rc)
|
|
|
|
/* Can this process send the message */
|
|
|
|
rc = avc_has_perm(tsec->sid, msec->sid,
|
|
|
|
SECCLASS_MSG, MSG__SEND, &ad);
|
|
|
|
if (!rc)
|
|
|
|
/* Can the message be put in the queue? */
|
|
|
|
rc = avc_has_perm(msec->sid, isec->sid,
|
|
|
|
SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
|
|
|
|
struct task_struct *target,
|
|
|
|
long type, int mode)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct msg_security_struct *msec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
tsec = target->security;
|
|
|
|
isec = msq->q_perm.security;
|
|
|
|
msec = msg->security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = msq->q_perm.key;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid,
|
|
|
|
SECCLASS_MSGQ, MSGQ__READ, &ad);
|
|
|
|
if (!rc)
|
|
|
|
rc = avc_has_perm(tsec->sid, msec->sid,
|
|
|
|
SECCLASS_MSG, MSG__RECEIVE, &ad);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Shared Memory security operations */
|
|
|
|
static int selinux_shm_alloc_security(struct shmid_kernel *shp)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = shp->shm_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = shp->shm_perm.key;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
|
|
|
|
SHM__CREATE, &ad);
|
|
|
|
if (rc) {
|
|
|
|
ipc_free_security(&shp->shm_perm);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_shm_free_security(struct shmid_kernel *shp)
|
|
|
|
{
|
|
|
|
ipc_free_security(&shp->shm_perm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = shp->shm_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = shp->shm_perm.key;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
|
|
|
|
SHM__ASSOCIATE, &ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Note, at this point, shp is locked down */
|
|
|
|
static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
|
|
|
|
{
|
|
|
|
int perms;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
switch(cmd) {
|
|
|
|
case IPC_INFO:
|
|
|
|
case SHM_INFO:
|
|
|
|
/* No specific object, just general system-wide information. */
|
|
|
|
return task_has_system(current, SYSTEM__IPC_INFO);
|
|
|
|
case IPC_STAT:
|
|
|
|
case SHM_STAT:
|
|
|
|
perms = SHM__GETATTR | SHM__ASSOCIATE;
|
|
|
|
break;
|
|
|
|
case IPC_SET:
|
|
|
|
perms = SHM__SETATTR;
|
|
|
|
break;
|
|
|
|
case SHM_LOCK:
|
|
|
|
case SHM_UNLOCK:
|
|
|
|
perms = SHM__LOCK;
|
|
|
|
break;
|
|
|
|
case IPC_RMID:
|
|
|
|
perms = SHM__DESTROY;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
err = ipc_has_perm(&shp->shm_perm, perms);
|
2005-04-17 00:20:36 +02:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_shm_shmat(struct shmid_kernel *shp,
|
|
|
|
char __user *shmaddr, int shmflg)
|
|
|
|
{
|
|
|
|
u32 perms;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
if (shmflg & SHM_RDONLY)
|
|
|
|
perms = SHM__READ;
|
|
|
|
else
|
|
|
|
perms = SHM__READ | SHM__WRITE;
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
return ipc_has_perm(&shp->shm_perm, perms);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Semaphore security operations */
|
|
|
|
static int selinux_sem_alloc_security(struct sem_array *sma)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
|
|
|
|
if (rc)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = sma->sem_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = sma->sem_perm.key;
|
|
|
|
|
|
|
|
rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
|
|
|
|
SEM__CREATE, &ad);
|
|
|
|
if (rc) {
|
|
|
|
ipc_free_security(&sma->sem_perm);
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_sem_free_security(struct sem_array *sma)
|
|
|
|
{
|
|
|
|
ipc_free_security(&sma->sem_perm);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_sem_associate(struct sem_array *sma, int semflg)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct ipc_security_struct *isec;
|
|
|
|
struct avc_audit_data ad;
|
|
|
|
|
|
|
|
tsec = current->security;
|
|
|
|
isec = sma->sem_perm.security;
|
|
|
|
|
|
|
|
AVC_AUDIT_DATA_INIT(&ad, IPC);
|
|
|
|
ad.u.ipc_id = sma->sem_perm.key;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
|
|
|
|
SEM__ASSOCIATE, &ad);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Note, at this point, sma is locked down */
|
|
|
|
static int selinux_sem_semctl(struct sem_array *sma, int cmd)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
u32 perms;
|
|
|
|
|
|
|
|
switch(cmd) {
|
|
|
|
case IPC_INFO:
|
|
|
|
case SEM_INFO:
|
|
|
|
/* No specific object, just general system-wide information. */
|
|
|
|
return task_has_system(current, SYSTEM__IPC_INFO);
|
|
|
|
case GETPID:
|
|
|
|
case GETNCNT:
|
|
|
|
case GETZCNT:
|
|
|
|
perms = SEM__GETATTR;
|
|
|
|
break;
|
|
|
|
case GETVAL:
|
|
|
|
case GETALL:
|
|
|
|
perms = SEM__READ;
|
|
|
|
break;
|
|
|
|
case SETVAL:
|
|
|
|
case SETALL:
|
|
|
|
perms = SEM__WRITE;
|
|
|
|
break;
|
|
|
|
case IPC_RMID:
|
|
|
|
perms = SEM__DESTROY;
|
|
|
|
break;
|
|
|
|
case IPC_SET:
|
|
|
|
perms = SEM__SETATTR;
|
|
|
|
break;
|
|
|
|
case IPC_STAT:
|
|
|
|
case SEM_STAT:
|
|
|
|
perms = SEM__GETATTR | SEM__ASSOCIATE;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
err = ipc_has_perm(&sma->sem_perm, perms);
|
2005-04-17 00:20:36 +02:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_sem_semop(struct sem_array *sma,
|
|
|
|
struct sembuf *sops, unsigned nsops, int alter)
|
|
|
|
{
|
|
|
|
u32 perms;
|
|
|
|
|
|
|
|
if (alter)
|
|
|
|
perms = SEM__READ | SEM__WRITE;
|
|
|
|
else
|
|
|
|
perms = SEM__READ;
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
return ipc_has_perm(&sma->sem_perm, perms);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
|
|
|
|
{
|
|
|
|
u32 av = 0;
|
|
|
|
|
|
|
|
av = 0;
|
|
|
|
if (flag & S_IRUGO)
|
|
|
|
av |= IPC__UNIX_READ;
|
|
|
|
if (flag & S_IWUGO)
|
|
|
|
av |= IPC__UNIX_WRITE;
|
|
|
|
|
|
|
|
if (av == 0)
|
|
|
|
return 0;
|
|
|
|
|
2005-05-01 17:58:39 +02:00
|
|
|
return ipc_has_perm(ipcp, av);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* module stacking operations */
|
|
|
|
static int selinux_register_security (const char *name, struct security_operations *ops)
|
|
|
|
{
|
|
|
|
if (secondary_ops != original_ops) {
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_ERR "%s: There is already a secondary security "
|
2005-04-17 00:20:36 +02:00
|
|
|
"module registered.\n", __FUNCTION__);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
secondary_ops = ops;
|
|
|
|
|
|
|
|
printk(KERN_INFO "%s: Registering secondary module %s\n",
|
|
|
|
__FUNCTION__,
|
|
|
|
name);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
|
|
|
|
{
|
|
|
|
if (inode)
|
|
|
|
inode_doinit_with_dentry(inode, dentry);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_getprocattr(struct task_struct *p,
|
2007-03-12 17:17:58 +01:00
|
|
|
char *name, char **value)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
2005-11-03 18:15:16 +01:00
|
|
|
u32 sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
2007-03-12 17:17:58 +01:00
|
|
|
unsigned len;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (current != p) {
|
|
|
|
error = task_has_perm(current, p, PROCESS__GETATTR);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
tsec = p->security;
|
|
|
|
|
|
|
|
if (!strcmp(name, "current"))
|
|
|
|
sid = tsec->sid;
|
|
|
|
else if (!strcmp(name, "prev"))
|
|
|
|
sid = tsec->osid;
|
|
|
|
else if (!strcmp(name, "exec"))
|
|
|
|
sid = tsec->exec_sid;
|
|
|
|
else if (!strcmp(name, "fscreate"))
|
|
|
|
sid = tsec->create_sid;
|
2006-06-26 09:24:57 +02:00
|
|
|
else if (!strcmp(name, "keycreate"))
|
|
|
|
sid = tsec->keycreate_sid;
|
2006-06-26 09:26:03 +02:00
|
|
|
else if (!strcmp(name, "sockcreate"))
|
|
|
|
sid = tsec->sockcreate_sid;
|
2005-04-17 00:20:36 +02:00
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!sid)
|
|
|
|
return 0;
|
|
|
|
|
2007-03-12 17:17:58 +01:00
|
|
|
error = security_sid_to_context(sid, value, &len);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
return len;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_setprocattr(struct task_struct *p,
|
|
|
|
char *name, void *value, size_t size)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
u32 sid = 0;
|
|
|
|
int error;
|
|
|
|
char *str = value;
|
|
|
|
|
|
|
|
if (current != p) {
|
|
|
|
/* SELinux only allows a process to change its own
|
|
|
|
security attributes. */
|
|
|
|
return -EACCES;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Basic control over ability to set these attributes at all.
|
|
|
|
* current == p, but we'll pass them separately in case the
|
|
|
|
* above restriction is ever removed.
|
|
|
|
*/
|
|
|
|
if (!strcmp(name, "exec"))
|
|
|
|
error = task_has_perm(current, p, PROCESS__SETEXEC);
|
|
|
|
else if (!strcmp(name, "fscreate"))
|
|
|
|
error = task_has_perm(current, p, PROCESS__SETFSCREATE);
|
2006-06-26 09:24:57 +02:00
|
|
|
else if (!strcmp(name, "keycreate"))
|
|
|
|
error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
|
2006-06-26 09:26:03 +02:00
|
|
|
else if (!strcmp(name, "sockcreate"))
|
|
|
|
error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
|
2005-04-17 00:20:36 +02:00
|
|
|
else if (!strcmp(name, "current"))
|
|
|
|
error = task_has_perm(current, p, PROCESS__SETCURRENT);
|
|
|
|
else
|
|
|
|
error = -EINVAL;
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
|
|
|
/* Obtain a SID for the context, if one was specified. */
|
|
|
|
if (size && str[1] && str[1] != '\n') {
|
|
|
|
if (str[size-1] == '\n') {
|
|
|
|
str[size-1] = 0;
|
|
|
|
size--;
|
|
|
|
}
|
|
|
|
error = security_context_to_sid(value, size, &sid);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Permission checking based on the specified context is
|
|
|
|
performed during the actual operation (execve,
|
|
|
|
open/mkdir/...), when we know the full context of the
|
|
|
|
operation. See selinux_bprm_set_security for the execve
|
|
|
|
checks and may_create for the file creation checks. The
|
|
|
|
operation will then fail if the context is not permitted. */
|
|
|
|
tsec = p->security;
|
|
|
|
if (!strcmp(name, "exec"))
|
|
|
|
tsec->exec_sid = sid;
|
|
|
|
else if (!strcmp(name, "fscreate"))
|
|
|
|
tsec->create_sid = sid;
|
2006-06-26 09:24:57 +02:00
|
|
|
else if (!strcmp(name, "keycreate")) {
|
|
|
|
error = may_create_key(sid, p);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
tsec->keycreate_sid = sid;
|
2006-06-26 09:26:03 +02:00
|
|
|
} else if (!strcmp(name, "sockcreate"))
|
|
|
|
tsec->sockcreate_sid = sid;
|
|
|
|
else if (!strcmp(name, "current")) {
|
2005-04-17 00:20:36 +02:00
|
|
|
struct av_decision avd;
|
|
|
|
|
|
|
|
if (sid == 0)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/* Only allow single threaded processes to change context */
|
|
|
|
if (atomic_read(&p->mm->mm_users) != 1) {
|
|
|
|
struct task_struct *g, *t;
|
|
|
|
struct mm_struct *mm = p->mm;
|
|
|
|
read_lock(&tasklist_lock);
|
|
|
|
do_each_thread(g, t)
|
|
|
|
if (t->mm == mm && t != p) {
|
|
|
|
read_unlock(&tasklist_lock);
|
|
|
|
return -EPERM;
|
|
|
|
}
|
|
|
|
while_each_thread(g, t);
|
|
|
|
read_unlock(&tasklist_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check permissions for the transition. */
|
|
|
|
error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
|
|
|
|
PROCESS__DYNTRANSITION, NULL);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
|
|
|
/* Check for ptracing, and update the task SID if ok.
|
|
|
|
Otherwise, leave SID unchanged and fail. */
|
|
|
|
task_lock(p);
|
|
|
|
if (p->ptrace & PT_PTRACED) {
|
|
|
|
error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
|
|
|
|
SECCLASS_PROCESS,
|
2007-06-07 21:34:10 +02:00
|
|
|
PROCESS__PTRACE, 0, &avd);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error)
|
|
|
|
tsec->sid = sid;
|
|
|
|
task_unlock(p);
|
|
|
|
avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
|
|
|
|
PROCESS__PTRACE, &avd, error, NULL);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
} else {
|
|
|
|
tsec->sid = sid;
|
|
|
|
task_unlock(p);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return size;
|
|
|
|
}
|
|
|
|
|
2006-08-02 23:12:06 +02:00
|
|
|
static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
|
|
|
|
{
|
|
|
|
return security_sid_to_context(secid, secdata, seclen);
|
|
|
|
}
|
|
|
|
|
2008-01-16 00:47:35 +01:00
|
|
|
static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
|
|
|
|
{
|
|
|
|
return security_context_to_sid(secdata, seclen, secid);
|
|
|
|
}
|
|
|
|
|
2006-08-02 23:12:06 +02:00
|
|
|
static void selinux_release_secctx(char *secdata, u32 seclen)
|
|
|
|
{
|
2007-08-01 17:12:58 +02:00
|
|
|
kfree(secdata);
|
2006-08-02 23:12:06 +02:00
|
|
|
}
|
|
|
|
|
2006-06-22 23:47:17 +02:00
|
|
|
#ifdef CONFIG_KEYS
|
|
|
|
|
2006-06-26 09:24:50 +02:00
|
|
|
static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
|
|
|
|
unsigned long flags)
|
2006-06-22 23:47:17 +02:00
|
|
|
{
|
|
|
|
struct task_security_struct *tsec = tsk->security;
|
|
|
|
struct key_security_struct *ksec;
|
|
|
|
|
|
|
|
ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
|
|
|
|
if (!ksec)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ksec->obj = k;
|
2006-06-26 09:24:57 +02:00
|
|
|
if (tsec->keycreate_sid)
|
|
|
|
ksec->sid = tsec->keycreate_sid;
|
|
|
|
else
|
|
|
|
ksec->sid = tsec->sid;
|
2006-06-22 23:47:17 +02:00
|
|
|
k->security = ksec;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void selinux_key_free(struct key *k)
|
|
|
|
{
|
|
|
|
struct key_security_struct *ksec = k->security;
|
|
|
|
|
|
|
|
k->security = NULL;
|
|
|
|
kfree(ksec);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int selinux_key_permission(key_ref_t key_ref,
|
|
|
|
struct task_struct *ctx,
|
|
|
|
key_perm_t perm)
|
|
|
|
{
|
|
|
|
struct key *key;
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
struct key_security_struct *ksec;
|
|
|
|
|
|
|
|
key = key_ref_to_ptr(key_ref);
|
|
|
|
|
|
|
|
tsec = ctx->security;
|
|
|
|
ksec = key->security;
|
|
|
|
|
|
|
|
/* if no specific permissions are requested, we skip the
|
|
|
|
permission check. No serious, additional covert channels
|
|
|
|
appear to be created. */
|
|
|
|
if (perm == 0)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return avc_has_perm(tsec->sid, ksec->sid,
|
|
|
|
SECCLASS_KEY, perm, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static struct security_operations selinux_ops = {
|
|
|
|
.ptrace = selinux_ptrace,
|
|
|
|
.capget = selinux_capget,
|
|
|
|
.capset_check = selinux_capset_check,
|
|
|
|
.capset_set = selinux_capset_set,
|
|
|
|
.sysctl = selinux_sysctl,
|
|
|
|
.capable = selinux_capable,
|
|
|
|
.quotactl = selinux_quotactl,
|
|
|
|
.quota_on = selinux_quota_on,
|
|
|
|
.syslog = selinux_syslog,
|
|
|
|
.vm_enough_memory = selinux_vm_enough_memory,
|
|
|
|
|
|
|
|
.netlink_send = selinux_netlink_send,
|
|
|
|
.netlink_recv = selinux_netlink_recv,
|
|
|
|
|
|
|
|
.bprm_alloc_security = selinux_bprm_alloc_security,
|
|
|
|
.bprm_free_security = selinux_bprm_free_security,
|
|
|
|
.bprm_apply_creds = selinux_bprm_apply_creds,
|
|
|
|
.bprm_post_apply_creds = selinux_bprm_post_apply_creds,
|
|
|
|
.bprm_set_security = selinux_bprm_set_security,
|
|
|
|
.bprm_check_security = selinux_bprm_check_security,
|
|
|
|
.bprm_secureexec = selinux_bprm_secureexec,
|
|
|
|
|
|
|
|
.sb_alloc_security = selinux_sb_alloc_security,
|
|
|
|
.sb_free_security = selinux_sb_free_security,
|
|
|
|
.sb_copy_data = selinux_sb_copy_data,
|
|
|
|
.sb_kern_mount = selinux_sb_kern_mount,
|
|
|
|
.sb_statfs = selinux_sb_statfs,
|
|
|
|
.sb_mount = selinux_mount,
|
|
|
|
.sb_umount = selinux_umount,
|
2007-11-30 19:00:35 +01:00
|
|
|
.sb_get_mnt_opts = selinux_get_mnt_opts,
|
|
|
|
.sb_set_mnt_opts = selinux_set_mnt_opts,
|
|
|
|
.sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
|
2008-03-05 16:31:54 +01:00
|
|
|
.sb_parse_opts_str = selinux_parse_opts_str,
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
.inode_alloc_security = selinux_inode_alloc_security,
|
|
|
|
.inode_free_security = selinux_inode_free_security,
|
2005-09-09 22:01:35 +02:00
|
|
|
.inode_init_security = selinux_inode_init_security,
|
2005-04-17 00:20:36 +02:00
|
|
|
.inode_create = selinux_inode_create,
|
|
|
|
.inode_link = selinux_inode_link,
|
|
|
|
.inode_unlink = selinux_inode_unlink,
|
|
|
|
.inode_symlink = selinux_inode_symlink,
|
|
|
|
.inode_mkdir = selinux_inode_mkdir,
|
|
|
|
.inode_rmdir = selinux_inode_rmdir,
|
|
|
|
.inode_mknod = selinux_inode_mknod,
|
|
|
|
.inode_rename = selinux_inode_rename,
|
|
|
|
.inode_readlink = selinux_inode_readlink,
|
|
|
|
.inode_follow_link = selinux_inode_follow_link,
|
|
|
|
.inode_permission = selinux_inode_permission,
|
|
|
|
.inode_setattr = selinux_inode_setattr,
|
|
|
|
.inode_getattr = selinux_inode_getattr,
|
|
|
|
.inode_setxattr = selinux_inode_setxattr,
|
|
|
|
.inode_post_setxattr = selinux_inode_post_setxattr,
|
|
|
|
.inode_getxattr = selinux_inode_getxattr,
|
|
|
|
.inode_listxattr = selinux_inode_listxattr,
|
|
|
|
.inode_removexattr = selinux_inode_removexattr,
|
|
|
|
.inode_getsecurity = selinux_inode_getsecurity,
|
|
|
|
.inode_setsecurity = selinux_inode_setsecurity,
|
|
|
|
.inode_listsecurity = selinux_inode_listsecurity,
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
.inode_need_killpriv = selinux_inode_need_killpriv,
|
|
|
|
.inode_killpriv = selinux_inode_killpriv,
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
.file_permission = selinux_file_permission,
|
|
|
|
.file_alloc_security = selinux_file_alloc_security,
|
|
|
|
.file_free_security = selinux_file_free_security,
|
|
|
|
.file_ioctl = selinux_file_ioctl,
|
|
|
|
.file_mmap = selinux_file_mmap,
|
|
|
|
.file_mprotect = selinux_file_mprotect,
|
|
|
|
.file_lock = selinux_file_lock,
|
|
|
|
.file_fcntl = selinux_file_fcntl,
|
|
|
|
.file_set_fowner = selinux_file_set_fowner,
|
|
|
|
.file_send_sigiotask = selinux_file_send_sigiotask,
|
|
|
|
.file_receive = selinux_file_receive,
|
|
|
|
|
2007-09-14 02:27:07 +02:00
|
|
|
.dentry_open = selinux_dentry_open,
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
.task_create = selinux_task_create,
|
|
|
|
.task_alloc_security = selinux_task_alloc_security,
|
|
|
|
.task_free_security = selinux_task_free_security,
|
|
|
|
.task_setuid = selinux_task_setuid,
|
|
|
|
.task_post_setuid = selinux_task_post_setuid,
|
|
|
|
.task_setgid = selinux_task_setgid,
|
|
|
|
.task_setpgid = selinux_task_setpgid,
|
|
|
|
.task_getpgid = selinux_task_getpgid,
|
|
|
|
.task_getsid = selinux_task_getsid,
|
2006-06-30 10:55:46 +02:00
|
|
|
.task_getsecid = selinux_task_getsecid,
|
2005-04-17 00:20:36 +02:00
|
|
|
.task_setgroups = selinux_task_setgroups,
|
|
|
|
.task_setnice = selinux_task_setnice,
|
2006-06-23 11:03:58 +02:00
|
|
|
.task_setioprio = selinux_task_setioprio,
|
2006-06-30 10:55:49 +02:00
|
|
|
.task_getioprio = selinux_task_getioprio,
|
2005-04-17 00:20:36 +02:00
|
|
|
.task_setrlimit = selinux_task_setrlimit,
|
|
|
|
.task_setscheduler = selinux_task_setscheduler,
|
|
|
|
.task_getscheduler = selinux_task_getscheduler,
|
2006-06-23 11:04:01 +02:00
|
|
|
.task_movememory = selinux_task_movememory,
|
2005-04-17 00:20:36 +02:00
|
|
|
.task_kill = selinux_task_kill,
|
|
|
|
.task_wait = selinux_task_wait,
|
|
|
|
.task_prctl = selinux_task_prctl,
|
|
|
|
.task_reparent_to_init = selinux_task_reparent_to_init,
|
|
|
|
.task_to_inode = selinux_task_to_inode,
|
|
|
|
|
|
|
|
.ipc_permission = selinux_ipc_permission,
|
|
|
|
|
|
|
|
.msg_msg_alloc_security = selinux_msg_msg_alloc_security,
|
|
|
|
.msg_msg_free_security = selinux_msg_msg_free_security,
|
|
|
|
|
|
|
|
.msg_queue_alloc_security = selinux_msg_queue_alloc_security,
|
|
|
|
.msg_queue_free_security = selinux_msg_queue_free_security,
|
|
|
|
.msg_queue_associate = selinux_msg_queue_associate,
|
|
|
|
.msg_queue_msgctl = selinux_msg_queue_msgctl,
|
|
|
|
.msg_queue_msgsnd = selinux_msg_queue_msgsnd,
|
|
|
|
.msg_queue_msgrcv = selinux_msg_queue_msgrcv,
|
|
|
|
|
|
|
|
.shm_alloc_security = selinux_shm_alloc_security,
|
|
|
|
.shm_free_security = selinux_shm_free_security,
|
|
|
|
.shm_associate = selinux_shm_associate,
|
|
|
|
.shm_shmctl = selinux_shm_shmctl,
|
|
|
|
.shm_shmat = selinux_shm_shmat,
|
|
|
|
|
|
|
|
.sem_alloc_security = selinux_sem_alloc_security,
|
|
|
|
.sem_free_security = selinux_sem_free_security,
|
|
|
|
.sem_associate = selinux_sem_associate,
|
|
|
|
.sem_semctl = selinux_sem_semctl,
|
|
|
|
.sem_semop = selinux_sem_semop,
|
|
|
|
|
|
|
|
.register_security = selinux_register_security,
|
|
|
|
|
|
|
|
.d_instantiate = selinux_d_instantiate,
|
|
|
|
|
|
|
|
.getprocattr = selinux_getprocattr,
|
|
|
|
.setprocattr = selinux_setprocattr,
|
|
|
|
|
2006-08-02 23:12:06 +02:00
|
|
|
.secid_to_secctx = selinux_secid_to_secctx,
|
2008-01-16 00:47:35 +01:00
|
|
|
.secctx_to_secid = selinux_secctx_to_secid,
|
2006-08-02 23:12:06 +02:00
|
|
|
.release_secctx = selinux_release_secctx,
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
.unix_stream_connect = selinux_socket_unix_stream_connect,
|
|
|
|
.unix_may_send = selinux_socket_unix_may_send,
|
|
|
|
|
|
|
|
.socket_create = selinux_socket_create,
|
|
|
|
.socket_post_create = selinux_socket_post_create,
|
|
|
|
.socket_bind = selinux_socket_bind,
|
|
|
|
.socket_connect = selinux_socket_connect,
|
|
|
|
.socket_listen = selinux_socket_listen,
|
|
|
|
.socket_accept = selinux_socket_accept,
|
|
|
|
.socket_sendmsg = selinux_socket_sendmsg,
|
|
|
|
.socket_recvmsg = selinux_socket_recvmsg,
|
|
|
|
.socket_getsockname = selinux_socket_getsockname,
|
|
|
|
.socket_getpeername = selinux_socket_getpeername,
|
|
|
|
.socket_getsockopt = selinux_socket_getsockopt,
|
|
|
|
.socket_setsockopt = selinux_socket_setsockopt,
|
|
|
|
.socket_shutdown = selinux_socket_shutdown,
|
|
|
|
.socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-21 07:41:23 +01:00
|
|
|
.socket_getpeersec_stream = selinux_socket_getpeersec_stream,
|
|
|
|
.socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
|
2005-04-17 00:20:36 +02:00
|
|
|
.sk_alloc_security = selinux_sk_alloc_security,
|
|
|
|
.sk_free_security = selinux_sk_free_security,
|
2006-08-05 08:08:56 +02:00
|
|
|
.sk_clone_security = selinux_sk_clone_security,
|
2006-08-05 08:12:42 +02:00
|
|
|
.sk_getsecid = selinux_sk_getsecid,
|
2006-07-25 08:32:50 +02:00
|
|
|
.sock_graft = selinux_sock_graft,
|
|
|
|
.inet_conn_request = selinux_inet_conn_request,
|
|
|
|
.inet_csk_clone = selinux_inet_csk_clone,
|
2006-11-09 00:04:09 +01:00
|
|
|
.inet_conn_established = selinux_inet_conn_established,
|
2006-07-25 08:32:50 +02:00
|
|
|
.req_classify_flow = selinux_req_classify_flow,
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_NETWORK_XFRM
|
|
|
|
.xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
|
|
|
|
.xfrm_policy_clone_security = selinux_xfrm_policy_clone,
|
|
|
|
.xfrm_policy_free_security = selinux_xfrm_policy_free,
|
2006-06-09 08:39:49 +02:00
|
|
|
.xfrm_policy_delete_security = selinux_xfrm_policy_delete,
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
.xfrm_state_alloc_security = selinux_xfrm_state_alloc,
|
|
|
|
.xfrm_state_free_security = selinux_xfrm_state_free,
|
2006-06-09 08:39:49 +02:00
|
|
|
.xfrm_state_delete_security = selinux_xfrm_state_delete,
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
.xfrm_policy_lookup = selinux_xfrm_policy_lookup,
|
2006-07-25 08:29:07 +02:00
|
|
|
.xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
|
|
|
|
.xfrm_decode_session = selinux_xfrm_decode_session,
|
2005-04-17 00:20:36 +02:00
|
|
|
#endif
|
2006-06-22 23:47:17 +02:00
|
|
|
|
|
|
|
#ifdef CONFIG_KEYS
|
|
|
|
.key_alloc = selinux_key_alloc,
|
|
|
|
.key_free = selinux_key_free,
|
|
|
|
.key_permission = selinux_key_permission,
|
|
|
|
#endif
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
static __init int selinux_init(void)
|
|
|
|
{
|
|
|
|
struct task_security_struct *tsec;
|
|
|
|
|
|
|
|
if (!selinux_enabled) {
|
|
|
|
printk(KERN_INFO "SELinux: Disabled at boot.\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
printk(KERN_INFO "SELinux: Initializing.\n");
|
|
|
|
|
|
|
|
/* Set the security state for the initial task. */
|
|
|
|
if (task_alloc_security(current))
|
|
|
|
panic("SELinux: Failed to initialize initial task.\n");
|
|
|
|
tsec = current->security;
|
|
|
|
tsec->osid = tsec->sid = SECINITSID_KERNEL;
|
|
|
|
|
2006-03-22 09:09:22 +01:00
|
|
|
sel_inode_cache = kmem_cache_create("selinux_inode_security",
|
|
|
|
sizeof(struct inode_security_struct),
|
2007-07-20 03:11:58 +02:00
|
|
|
0, SLAB_PANIC, NULL);
|
2005-04-17 00:20:36 +02:00
|
|
|
avc_init();
|
|
|
|
|
|
|
|
original_ops = secondary_ops = security_ops;
|
|
|
|
if (!secondary_ops)
|
|
|
|
panic ("SELinux: No initial security operations\n");
|
|
|
|
if (register_security (&selinux_ops))
|
|
|
|
panic("SELinux: Unable to register with kernel.\n");
|
|
|
|
|
|
|
|
if (selinux_enforcing) {
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
} else {
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
2006-06-22 23:47:17 +02:00
|
|
|
|
|
|
|
#ifdef CONFIG_KEYS
|
|
|
|
/* Add security information to initial keyrings */
|
2006-06-26 09:24:57 +02:00
|
|
|
selinux_key_alloc(&root_user_keyring, current,
|
|
|
|
KEY_ALLOC_NOT_IN_QUOTA);
|
|
|
|
selinux_key_alloc(&root_session_keyring, current,
|
|
|
|
KEY_ALLOC_NOT_IN_QUOTA);
|
2006-06-22 23:47:17 +02:00
|
|
|
#endif
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
void selinux_complete_init(void)
|
|
|
|
{
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_DEBUG "SELinux: Completing initialization.\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Set up any superblocks initialized prior to the policy load. */
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
|
2006-06-04 11:51:30 +02:00
|
|
|
spin_lock(&sb_lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
spin_lock(&sb_security_lock);
|
|
|
|
next_sb:
|
|
|
|
if (!list_empty(&superblock_security_head)) {
|
|
|
|
struct superblock_security_struct *sbsec =
|
|
|
|
list_entry(superblock_security_head.next,
|
|
|
|
struct superblock_security_struct,
|
|
|
|
list);
|
|
|
|
struct super_block *sb = sbsec->sb;
|
|
|
|
sb->s_count++;
|
|
|
|
spin_unlock(&sb_security_lock);
|
2006-06-04 11:51:30 +02:00
|
|
|
spin_unlock(&sb_lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
down_read(&sb->s_umount);
|
|
|
|
if (sb->s_root)
|
|
|
|
superblock_doinit(sb, NULL);
|
|
|
|
drop_super(sb);
|
2006-06-04 11:51:30 +02:00
|
|
|
spin_lock(&sb_lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
spin_lock(&sb_security_lock);
|
|
|
|
list_del_init(&sbsec->list);
|
|
|
|
goto next_sb;
|
|
|
|
}
|
|
|
|
spin_unlock(&sb_security_lock);
|
2006-06-04 11:51:30 +02:00
|
|
|
spin_unlock(&sb_lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* SELinux requires early initialization in order to label
|
|
|
|
all processes and objects when they are created. */
|
|
|
|
security_initcall(selinux_init);
|
|
|
|
|
2006-02-05 08:27:50 +01:00
|
|
|
#if defined(CONFIG_NETFILTER)
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static struct nf_hook_ops selinux_ipv4_ops[] = {
|
|
|
|
{
|
|
|
|
.hook = selinux_ipv4_postroute,
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.pf = PF_INET,
|
|
|
|
.hooknum = NF_INET_POST_ROUTING,
|
|
|
|
.priority = NF_IP_PRI_SELINUX_LAST,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
.hook = selinux_ipv4_forward,
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.pf = PF_INET,
|
|
|
|
.hooknum = NF_INET_FORWARD,
|
|
|
|
.priority = NF_IP_PRI_SELINUX_FIRST,
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
static struct nf_hook_ops selinux_ipv6_ops[] = {
|
|
|
|
{
|
|
|
|
.hook = selinux_ipv6_postroute,
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.pf = PF_INET6,
|
|
|
|
.hooknum = NF_INET_POST_ROUTING,
|
|
|
|
.priority = NF_IP6_PRI_SELINUX_LAST,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
.hook = selinux_ipv6_forward,
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.pf = PF_INET6,
|
|
|
|
.hooknum = NF_INET_FORWARD,
|
|
|
|
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
#endif /* IPV6 */
|
|
|
|
|
|
|
|
static int __init selinux_nf_ip_init(void)
|
|
|
|
{
|
|
|
|
int err = 0;
|
2008-01-29 14:49:27 +01:00
|
|
|
u32 iter;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!selinux_enabled)
|
|
|
|
goto out;
|
2007-02-23 00:11:31 +01:00
|
|
|
|
|
|
|
printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
|
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
|
|
|
|
err = nf_register_hook(&selinux_ipv4_ops[iter]);
|
|
|
|
if (err)
|
|
|
|
panic("SELinux: nf_register_hook for IPv4: error %d\n",
|
|
|
|
err);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
2008-01-29 14:49:27 +01:00
|
|
|
for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
|
|
|
|
err = nf_register_hook(&selinux_ipv6_ops[iter]);
|
|
|
|
if (err)
|
|
|
|
panic("SELinux: nf_register_hook for IPv6: error %d\n",
|
|
|
|
err);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
#endif /* IPV6 */
|
[LSM-IPSec]: Per-packet access control.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the SELinux LSM to
create, deallocate, and use security contexts for policies
(xfrm_policy) and security associations (xfrm_state) that enable
control of a socket's ability to send and receive packets.
Patch purpose:
The patch is designed to enable the SELinux LSM to implement access
control on individual packets based on the strongly authenticated
IPSec security association. Such access controls augment the existing
ones in SELinux based on network interface and IP address. The former
are very coarse-grained, and the latter can be spoofed. By using
IPSec, the SELinux can control access to remote hosts based on
cryptographic keys generated using the IPSec mechanism. This enables
access control on a per-machine basis or per-application if the remote
machine is running the same mechanism and trusted to enforce the
access control policy.
Patch design approach:
The patch's main function is to authorize a socket's access to a IPSec
policy based on their security contexts. Since the communication is
implemented by a security association, the patch ensures that the
security association's negotiated and used have the same security
context. The patch enables allocation and deallocation of such
security contexts for policies and security associations. It also
enables copying of the security context when policies are cloned.
Lastly, the patch ensures that packets that are sent without using a
IPSec security assocation with a security context are allowed to be
sent in that manner.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
The function which authorizes a socket to perform a requested
operation (send/receive) on a IPSec policy (xfrm_policy) is
selinux_xfrm_policy_lookup. The Netfilter and rcv_skb hooks ensure
that if a IPSec SA with a securit y association has not been used,
then the socket is allowed to send or receive the packet,
respectively.
The patch implements SELinux function for allocating security contexts
when policies (xfrm_policy) are created via the pfkey or xfrm_user
interfaces via selinux_xfrm_policy_alloc. When a security association
is built, SELinux allocates the security context designated by the
XFRM subsystem which is based on that of the authorized policy via
selinux_xfrm_state_alloc.
When a xfrm_policy is cloned, the security context of that policy, if
any, is copied to the clone via selinux_xfrm_policy_clone.
When a xfrm_policy or xfrm_state is freed, its security context, if
any is also freed at selinux_xfrm_policy_free or
selinux_xfrm_state_free.
Testing:
The SELinux authorization function is tested using ipsec-tools. We
created policies and security associations with particular security
contexts and added SELinux access control policy entries to verify the
authorization decision. We also made sure that packets for which no
security context was supplied (which either did or did not use
security associations) were authorized using an unlabelled context.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 08:12:40 +01:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
__initcall(selinux_nf_ip_init);
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
|
|
|
|
static void selinux_nf_ip_exit(void)
|
|
|
|
{
|
2008-01-29 14:49:27 +01:00
|
|
|
u32 iter;
|
|
|
|
|
2007-02-23 00:11:31 +01:00
|
|
|
printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-01-29 14:49:27 +01:00
|
|
|
for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
|
|
|
|
nf_unregister_hook(&selinux_ipv4_ops[iter]);
|
2005-04-17 00:20:36 +02:00
|
|
|
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
2008-01-29 14:49:27 +01:00
|
|
|
for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
|
|
|
|
nf_unregister_hook(&selinux_ipv6_ops[iter]);
|
2005-04-17 00:20:36 +02:00
|
|
|
#endif /* IPV6 */
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2006-02-05 08:27:50 +01:00
|
|
|
#else /* CONFIG_NETFILTER */
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
|
|
|
|
#define selinux_nf_ip_exit()
|
|
|
|
#endif
|
|
|
|
|
2006-02-05 08:27:50 +01:00
|
|
|
#endif /* CONFIG_NETFILTER */
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
|
|
|
|
int selinux_disable(void)
|
|
|
|
{
|
|
|
|
extern void exit_sel_fs(void);
|
|
|
|
static int selinux_disabled = 0;
|
|
|
|
|
|
|
|
if (ss_initialized) {
|
|
|
|
/* Not permitted after initial policy load. */
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (selinux_disabled) {
|
|
|
|
/* Only do this once. */
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
printk(KERN_INFO "SELinux: Disabled at runtime.\n");
|
|
|
|
|
|
|
|
selinux_disabled = 1;
|
2006-05-03 16:52:36 +02:00
|
|
|
selinux_enabled = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Reset security_ops to the secondary module, dummy or capability. */
|
|
|
|
security_ops = secondary_ops;
|
|
|
|
|
|
|
|
/* Unregister netfilter hooks. */
|
|
|
|
selinux_nf_ip_exit();
|
|
|
|
|
|
|
|
/* Unregister selinuxfs. */
|
|
|
|
exit_sel_fs();
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|