aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2006-10-30 18:22:15 -0500
committerDavid S. Miller <davem@sunset.davemloft.net>2006-10-30 18:24:49 -0500
commitf8687afefcc821fc47c75775eec87731fe3de360 (patch)
tree9835a3c95fb94597ede42cfdf732b97cc495c9bf /net/ipv4
parent920b868ae1dfdac77c5e8c97e7067b23680f043e (diff)
[NetLabel]: protect the CIPSOv4 socket option from setsockopt()
This patch makes two changes to protect applications from either removing or tampering with the CIPSOv4 IP option on a socket. The first is the requirement that applications have the CAP_NET_RAW capability to set an IPOPT_CIPSO option on a socket; this prevents untrusted applications from setting their own CIPSOv4 security attributes on the packets they send. The second change is to SELinux and it prevents applications from setting any IPv4 options when there is an IPOPT_CIPSO option already present on the socket; this prevents applications from removing CIPSOv4 security attributes from the packets they send. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/cipso_ipv4.c7
-rw-r--r--net/ipv4/ip_options.c2
2 files changed, 4 insertions, 5 deletions
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index e2077a3aa8c0..6460233407c7 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1307,7 +1307,8 @@ int cipso_v4_socket_setattr(const struct socket *sock,
1307 1307
1308 /* We can't use ip_options_get() directly because it makes a call to 1308 /* We can't use ip_options_get() directly because it makes a call to
1309 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and 1309 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1310 * we can't block here. */ 1310 * we won't always have CAP_NET_RAW even though we _always_ want to
1311 * set the IPOPT_CIPSO option. */
1311 opt_len = (buf_len + 3) & ~3; 1312 opt_len = (buf_len + 3) & ~3;
1312 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC); 1313 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1313 if (opt == NULL) { 1314 if (opt == NULL) {
@@ -1317,11 +1318,9 @@ int cipso_v4_socket_setattr(const struct socket *sock,
1317 memcpy(opt->__data, buf, buf_len); 1318 memcpy(opt->__data, buf, buf_len);
1318 opt->optlen = opt_len; 1319 opt->optlen = opt_len;
1319 opt->is_data = 1; 1320 opt->is_data = 1;
1321 opt->cipso = sizeof(struct iphdr);
1320 kfree(buf); 1322 kfree(buf);
1321 buf = NULL; 1323 buf = NULL;
1322 ret_val = ip_options_compile(opt, NULL);
1323 if (ret_val != 0)
1324 goto socket_setattr_failure;
1325 1324
1326 sk_inet = inet_sk(sk); 1325 sk_inet = inet_sk(sk);
1327 if (sk_inet->is_icsk) { 1326 if (sk_inet->is_icsk) {
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 8dabbfc31267..9f02917d6f45 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -443,7 +443,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
443 opt->router_alert = optptr - iph; 443 opt->router_alert = optptr - iph;
444 break; 444 break;
445 case IPOPT_CIPSO: 445 case IPOPT_CIPSO:
446 if (opt->cipso) { 446 if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) {
447 pp_ptr = optptr; 447 pp_ptr = optptr;
448 goto error; 448 goto error;
449 } 449 }