xfrm: Add security check before flushing SAD/SPD

Currently we check for permission before deleting entries from SAD and
SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete())
However we are not checking for authorization when flushing the SPD and
the SAD completely. It was perhaps missed in the original security hooks
patch.

This patch adds a security check when flushing entries from the SAD and
SPD.  It runs the entire database and checks each entry for a denial.
If the process attempting the flush is unable to remove all of the
entries a denial is logged the the flush function returns an error
without removing anything.

This is particularly useful when a process may need to create or delete
its own xfrm entries used for things like labeled networking but that
same process should not be able to delete other entries or flush the
entire database.

Signed-off-by: Joy Latten<latten@austin.ibm.com>
Signed-off-by: Eric Paris <eparis@parisplace.org>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 7 insertions, 2 deletions

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b14c7e590c31..c06883bf620e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1418,10 +1418,13 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
         struct xfrm_audit audit_info;
+        int err;
 
         audit_info.loginuid = NETLINK_CB(skb).loginuid;
         audit_info.secid = NETLINK_CB(skb).sid;
-        xfrm_state_flush(p->proto, &audit_info);
+        err = xfrm_state_flush(p->proto, &audit_info);
+        if (err)
+                return err;
         c.data.proto = p->proto;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1582,7 +1585,9 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         audit_info.loginuid = NETLINK_CB(skb).loginuid;
         audit_info.secid = NETLINK_CB(skb).sid;
-        xfrm_policy_flush(type, &audit_info);
+        err = xfrm_policy_flush(type, &audit_info);
+        if (err)
+                return err;
         c.data.type = type;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;