aboutsummaryrefslogtreecommitdiffstats
path: root/include/net/xfrm.h
diff options
context:
space:
mode:
authorJoy Latten <latten@austin.ibm.com>2007-06-04 19:05:57 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-06-07 16:42:46 -0400
commit4aa2e62c45b5ca08be2d0d3c0744d7585b56e860 (patch)
tree16649593d55f3df4dac54227fcda28bb4fb49f17 /include/net/xfrm.h
parentb00b4bf94edb42852d55619af453588b2de2dc5e (diff)
xfrm: Add security check before flushing SAD/SPD
Currently we check for permission before deleting entries from SAD and SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete()) However we are not checking for authorization when flushing the SPD and the SAD completely. It was perhaps missed in the original security hooks patch. This patch adds a security check when flushing entries from the SAD and SPD. It runs the entire database and checks each entry for a denial. If the process attempting the flush is unable to remove all of the entries a denial is logged the the flush function returns an error without removing anything. This is particularly useful when a process may need to create or delete its own xfrm entries used for things like labeled networking but that same process should not be able to delete other entries or flush the entire database. Signed-off-by: Joy Latten<latten@austin.ibm.com> Signed-off-by: Eric Paris <eparis@parisplace.org> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'include/net/xfrm.h')
-rw-r--r--include/net/xfrm.h6
1 files changed, 3 insertions, 3 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 90185e8b335e..311f25af5e1a 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -964,7 +964,7 @@ struct xfrmk_spdinfo {
964 964
965extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq); 965extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
966extern int xfrm_state_delete(struct xfrm_state *x); 966extern int xfrm_state_delete(struct xfrm_state *x);
967extern void xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info); 967extern int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info);
968extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si); 968extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si);
969extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si); 969extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
970extern int xfrm_replay_check(struct xfrm_state *x, __be32 seq); 970extern int xfrm_replay_check(struct xfrm_state *x, __be32 seq);
@@ -1020,13 +1020,13 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
1020 struct xfrm_sec_ctx *ctx, int delete, 1020 struct xfrm_sec_ctx *ctx, int delete,
1021 int *err); 1021 int *err);
1022struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err); 1022struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err);
1023void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info); 1023int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
1024u32 xfrm_get_acqseq(void); 1024u32 xfrm_get_acqseq(void);
1025void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi); 1025void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi);
1026struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 1026struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
1027 xfrm_address_t *daddr, xfrm_address_t *saddr, 1027 xfrm_address_t *daddr, xfrm_address_t *saddr,
1028 int create, unsigned short family); 1028 int create, unsigned short family);
1029extern void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info); 1029extern int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
1030extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1030extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1031extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst, 1031extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
1032 struct flowi *fl, int family, int strict); 1032 struct flowi *fl, int family, int strict);