selinux: look for IPsec labels on both inbound and outbound packets

Previously selinux_skb_peerlbl_sid() would only check for labeled
IPsec security labels on inbound packets, this patch enables it to
check both inbound and outbound traffic for labeled IPsec security
labels.

Reported-by: Janak Desai <Janak.Desai@gtri.gatech.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>

1 files changed, 41 insertions, 10 deletions

diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index cf79a4564e38..0462cb3ff0a7 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -209,19 +209,26 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
                             NULL) ? 0 : 1);
 }
 
-/*
- * LSM hook implementation that checks and/or returns the xfrm sid for the
- * incoming packet.
- */
-int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
+static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb)
 {
-        u32 sid_session = SECSID_NULL;
-        struct sec_path *sp;
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_state *x;
 
-        if (skb == NULL)
-                goto out;
+        if (dst == NULL)
+                return SECSID_NULL;
+        x = dst->xfrm;
+        if (x == NULL || !selinux_authorizable_xfrm(x))
+                return SECSID_NULL;
+
+        return x->security->ctx_sid;
+}
+
+static int selinux_xfrm_skb_sid_ingress(struct sk_buff *skb,
+                                        u32 *sid, int ckall)
+{
+        u32 sid_session = SECSID_NULL;
+        struct sec_path *sp = skb->sp;
 
-        sp = skb->sp;
         if (sp) {
                 int i;
 
@@ -248,6 +255,30 @@ out:
 }
 
 /*
+ * LSM hook implementation that checks and/or returns the xfrm sid for the
+ * incoming packet.
+ */
+int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
+{
+        if (skb == NULL) {
+                *sid = SECSID_NULL;
+                return 0;
+        }
+        return selinux_xfrm_skb_sid_ingress(skb, sid, ckall);
+}
+
+int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
+{
+        int rc;
+
+        rc = selinux_xfrm_skb_sid_ingress(skb, sid, 0);
+        if (rc == 0 && *sid == SECSID_NULL)
+                *sid = selinux_xfrm_skb_sid_egress(skb);
+
+        return rc;
+}
+
+/*
  * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
  */
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,