1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30#include <linux/spinlock.h>
31#include <linux/rcupdate.h>
32#include <net/sock.h>
33#include <net/netlabel.h>
34
35#include "objsec.h"
36#include "security.h"
37
38
39
40
41
42
43
44
45
46
47
48
49
50static int selinux_netlbl_sock_setsid(struct sock *sk, u32 sid)
51{
52 int rc;
53 struct sk_security_struct *sksec = sk->sk_security;
54 struct netlbl_lsm_secattr secattr;
55
56 netlbl_secattr_init(&secattr);
57
58 rc = security_netlbl_sid_to_secattr(sid, &secattr);
59 if (rc != 0)
60 goto sock_setsid_return;
61 rc = netlbl_sock_setattr(sk, &secattr);
62 if (rc == 0) {
63 spin_lock_bh(&sksec->nlbl_lock);
64 sksec->nlbl_state = NLBL_LABELED;
65 spin_unlock_bh(&sksec->nlbl_lock);
66 }
67
68sock_setsid_return:
69 netlbl_secattr_destroy(&secattr);
70 return rc;
71}
72
73
74
75
76
77
78
79
80void selinux_netlbl_cache_invalidate(void)
81{
82 netlbl_cache_invalidate();
83}
84
85
86
87
88
89
90
91
92
93
94
95void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
96 int family)
97{
98 if (family == PF_INET)
99 ssec->nlbl_state = NLBL_REQUIRE;
100 else
101 ssec->nlbl_state = NLBL_UNSET;
102}
103
104
105
106
107
108
109
110
111
112
113
114void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
115 int family)
116{
117
118 selinux_netlbl_sk_security_reset(ssec, family);
119 spin_lock_init(&ssec->nlbl_lock);
120}
121
122
123
124
125
126
127
128
129
130
131
132void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
133 struct sk_security_struct *newssec)
134{
135
136
137
138 rcu_read_lock();
139 selinux_netlbl_sk_security_reset(newssec, ssec->sk->sk_family);
140 newssec->sclass = ssec->sclass;
141 rcu_read_unlock();
142}
143
144
145
146
147
148
149
150
151
152
153
154
155
156int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
157{
158 int rc;
159 struct netlbl_lsm_secattr secattr;
160
161 if (!netlbl_enabled()) {
162 *sid = SECSID_NULL;
163 return 0;
164 }
165
166 netlbl_secattr_init(&secattr);
167 rc = netlbl_skbuff_getattr(skb, &secattr);
168 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
169 rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
170 if (rc == 0 &&
171 (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
172 (secattr.flags & NETLBL_SECATTR_CACHE))
173 netlbl_cache_add(skb, &secattr);
174 } else
175 *sid = SECSID_NULL;
176 netlbl_secattr_destroy(&secattr);
177
178 return rc;
179}
180
181
182
183
184
185
186
187
188
189
190
191void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
192{
193 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
194 struct sk_security_struct *sksec = sk->sk_security;
195 struct netlbl_lsm_secattr secattr;
196 u32 nlbl_peer_sid;
197
198 sksec->sclass = isec->sclass;
199
200 rcu_read_lock();
201
202 if (sksec->nlbl_state != NLBL_REQUIRE) {
203 rcu_read_unlock();
204 return;
205 }
206
207 netlbl_secattr_init(&secattr);
208 if (netlbl_sock_getattr(sk, &secattr) == 0 &&
209 secattr.flags != NETLBL_SECATTR_NONE &&
210 security_netlbl_secattr_to_sid(&secattr,
211 SECINITSID_NETMSG,
212 &nlbl_peer_sid) == 0)
213 sksec->peer_sid = nlbl_peer_sid;
214 netlbl_secattr_destroy(&secattr);
215
216
217
218
219 selinux_netlbl_sock_setsid(sk, sksec->sid);
220
221 rcu_read_unlock();
222}
223
224
225
226
227
228
229
230
231
232
233int selinux_netlbl_socket_post_create(struct socket *sock)
234{
235 int rc = 0;
236 struct sock *sk = sock->sk;
237 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
238 struct sk_security_struct *sksec = sk->sk_security;
239
240 sksec->sclass = isec->sclass;
241
242 rcu_read_lock();
243 if (sksec->nlbl_state == NLBL_REQUIRE)
244 rc = selinux_netlbl_sock_setsid(sk, sksec->sid);
245 rcu_read_unlock();
246
247 return rc;
248}
249
250
251
252
253
254
255
256
257
258
259
260
261
262int selinux_netlbl_inode_permission(struct inode *inode, int mask)
263{
264 int rc;
265 struct sock *sk;
266 struct socket *sock;
267 struct sk_security_struct *sksec;
268
269 if (!S_ISSOCK(inode->i_mode) ||
270 ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
271 return 0;
272 sock = SOCKET_I(inode);
273 sk = sock->sk;
274 sksec = sk->sk_security;
275
276 rcu_read_lock();
277 if (sksec->nlbl_state != NLBL_REQUIRE) {
278 rcu_read_unlock();
279 return 0;
280 }
281 local_bh_disable();
282 bh_lock_sock_nested(sk);
283 rc = selinux_netlbl_sock_setsid(sk, sksec->sid);
284 bh_unlock_sock(sk);
285 local_bh_enable();
286 rcu_read_unlock();
287
288 return rc;
289}
290
291
292
293
294
295
296
297
298
299
300
301
302
303int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
304 struct sk_buff *skb,
305 struct avc_audit_data *ad)
306{
307 int rc;
308 u32 nlbl_sid;
309 u32 perm;
310 struct netlbl_lsm_secattr secattr;
311
312 if (!netlbl_enabled())
313 return 0;
314
315 netlbl_secattr_init(&secattr);
316 rc = netlbl_skbuff_getattr(skb, &secattr);
317 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
318 rc = security_netlbl_secattr_to_sid(&secattr,
319 SECINITSID_NETMSG,
320 &nlbl_sid);
321 if (rc == 0 &&
322 (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
323 (secattr.flags & NETLBL_SECATTR_CACHE))
324 netlbl_cache_add(skb, &secattr);
325 } else
326 nlbl_sid = SECINITSID_UNLABELED;
327 netlbl_secattr_destroy(&secattr);
328 if (rc != 0)
329 return rc;
330
331 switch (sksec->sclass) {
332 case SECCLASS_UDP_SOCKET:
333 perm = UDP_SOCKET__RECVFROM;
334 break;
335 case SECCLASS_TCP_SOCKET:
336 perm = TCP_SOCKET__RECVFROM;
337 break;
338 default:
339 perm = RAWIP_SOCKET__RECVFROM;
340 }
341
342 rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
343 if (rc == 0)
344 return 0;
345
346 if (nlbl_sid != SECINITSID_UNLABELED)
347 netlbl_skbuff_err(skb, rc);
348 return rc;
349}
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364int selinux_netlbl_socket_setsockopt(struct socket *sock,
365 int level,
366 int optname)
367{
368 int rc = 0;
369 struct sock *sk = sock->sk;
370 struct sk_security_struct *sksec = sk->sk_security;
371 struct netlbl_lsm_secattr secattr;
372
373 rcu_read_lock();
374 if (level == IPPROTO_IP && optname == IP_OPTIONS &&
375 sksec->nlbl_state == NLBL_LABELED) {
376 netlbl_secattr_init(&secattr);
377 lock_sock(sk);
378 rc = netlbl_sock_getattr(sk, &secattr);
379 release_sock(sk);
380 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
381 rc = -EACCES;
382 netlbl_secattr_destroy(&secattr);
383 }
384 rcu_read_unlock();
385
386 return rc;
387}
388