selinux: drop remapping of netlink classes
Drop remapping of netlink classes and bypass of permission checking based on netlink message type for policy version < 18. This removes compatibility code introduced when the original single netlink security class used for all netlink sockets was split into finer-grained netlink classes based on netlink protocol and when permission checking was added based on netlink message type in Linux 2.6.8. The only known distribution that shipped with SELinux and policy < 18 was Fedora Core 2, which was EOL'd on 2005-04-11. Given that the remapping code was never updated to address the addition of newer netlink classes, that the corresponding userland support was dropped in 2005, and that the assumptions made by the remapping code about the fixed ordering among netlink classes in the policy may be violated in the future due to the dynamic class/perm discovery support, we should drop this compatibility code now. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
parent
8753f6bec3
commit
941fc5b2bf
|
@ -91,7 +91,6 @@
|
||||||
|
|
||||||
#define NUM_SEL_MNT_OPTS 5
|
#define NUM_SEL_MNT_OPTS 5
|
||||||
|
|
||||||
extern unsigned int policydb_loaded_version;
|
|
||||||
extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
|
extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
|
||||||
extern struct security_operations *security_ops;
|
extern struct security_operations *security_ops;
|
||||||
|
|
||||||
|
@ -4714,10 +4713,7 @@ static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
|
||||||
if (err)
|
if (err)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
|
return selinux_nlmsg_perm(sk, skb);
|
||||||
err = selinux_nlmsg_perm(sk, skb);
|
|
||||||
|
|
||||||
return err;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static int selinux_netlink_recv(struct sk_buff *skb, int capability)
|
static int selinux_netlink_recv(struct sk_buff *skb, int capability)
|
||||||
|
|
|
@ -65,7 +65,6 @@
|
||||||
#include "audit.h"
|
#include "audit.h"
|
||||||
|
|
||||||
extern void selnl_notify_policyload(u32 seqno);
|
extern void selnl_notify_policyload(u32 seqno);
|
||||||
unsigned int policydb_loaded_version;
|
|
||||||
|
|
||||||
int selinux_policycap_netpeer;
|
int selinux_policycap_netpeer;
|
||||||
int selinux_policycap_openperm;
|
int selinux_policycap_openperm;
|
||||||
|
@ -616,17 +615,6 @@ static int context_struct_compute_av(struct context *scontext,
|
||||||
struct ebitmap_node *snode, *tnode;
|
struct ebitmap_node *snode, *tnode;
|
||||||
unsigned int i, j;
|
unsigned int i, j;
|
||||||
|
|
||||||
/*
|
|
||||||
* Remap extended Netlink classes for old policy versions.
|
|
||||||
* Do this here rather than socket_type_to_security_class()
|
|
||||||
* in case a newer policy version is loaded, allowing sockets
|
|
||||||
* to remain in the correct class.
|
|
||||||
*/
|
|
||||||
if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
|
|
||||||
if (tclass >= unmap_class(SECCLASS_NETLINK_ROUTE_SOCKET) &&
|
|
||||||
tclass <= unmap_class(SECCLASS_NETLINK_DNRT_SOCKET))
|
|
||||||
tclass = unmap_class(SECCLASS_NETLINK_SOCKET);
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Initialize the access vectors to the default values.
|
* Initialize the access vectors to the default values.
|
||||||
*/
|
*/
|
||||||
|
@ -761,17 +749,6 @@ int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
|
||||||
|
|
||||||
tclass = unmap_class(orig_tclass);
|
tclass = unmap_class(orig_tclass);
|
||||||
|
|
||||||
/*
|
|
||||||
* Remap extended Netlink classes for old policy versions.
|
|
||||||
* Do this here rather than socket_type_to_security_class()
|
|
||||||
* in case a newer policy version is loaded, allowing sockets
|
|
||||||
* to remain in the correct class.
|
|
||||||
*/
|
|
||||||
if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
|
|
||||||
if (tclass >= unmap_class(SECCLASS_NETLINK_ROUTE_SOCKET) &&
|
|
||||||
tclass <= unmap_class(SECCLASS_NETLINK_DNRT_SOCKET))
|
|
||||||
tclass = unmap_class(SECCLASS_NETLINK_SOCKET);
|
|
||||||
|
|
||||||
if (!tclass || tclass > policydb.p_classes.nprim) {
|
if (!tclass || tclass > policydb.p_classes.nprim) {
|
||||||
printk(KERN_ERR "SELinux: %s: unrecognized class %d\n",
|
printk(KERN_ERR "SELinux: %s: unrecognized class %d\n",
|
||||||
__func__, tclass);
|
__func__, tclass);
|
||||||
|
@ -1766,7 +1743,6 @@ int security_load_policy(void *data, size_t len)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
security_load_policycaps();
|
security_load_policycaps();
|
||||||
policydb_loaded_version = policydb.policyvers;
|
|
||||||
ss_initialized = 1;
|
ss_initialized = 1;
|
||||||
seqno = ++latest_granting;
|
seqno = ++latest_granting;
|
||||||
selinux_complete_init();
|
selinux_complete_init();
|
||||||
|
@ -1829,7 +1805,6 @@ int security_load_policy(void *data, size_t len)
|
||||||
current_mapping = map;
|
current_mapping = map;
|
||||||
current_mapping_size = map_size;
|
current_mapping_size = map_size;
|
||||||
seqno = ++latest_granting;
|
seqno = ++latest_granting;
|
||||||
policydb_loaded_version = policydb.policyvers;
|
|
||||||
write_unlock_irq(&policy_rwlock);
|
write_unlock_irq(&policy_rwlock);
|
||||||
|
|
||||||
/* Free the old policydb and SID table. */
|
/* Free the old policydb and SID table. */
|
||||||
|
|
Loading…
Reference in New Issue