aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDarrel Goeddel <dgoeddel@trustedcs.com>2006-06-27 16:26:11 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-06-29 19:57:55 -0400
commitc7bdb545d23026b18be53289fd866d1ac07f5f8c (patch)
tree6d9a218871d88f7579dd53f14692df2529b6e712 /net
parent576a30eb6453439b3c37ba24455ac7090c247b5a (diff)
[NETLINK]: Encapsulate eff_cap usage within security framework.
This patch encapsulates the usage of eff_cap (in netlink_skb_params) within the security framework by extending security_netlink_recv to include a required capability parameter and converting all direct usage of eff_caps outside of the lsm modules to use the interface. It also updates the SELinux implementation of the security_netlink_send and security_netlink_recv hooks to take advantage of the sid in the netlink_skb_params struct. This also enables SELinux to perform auditing of netlink capability checks. Please apply, for 2.6.18 if possible. Signed-off-by: Darrel Goeddel <dgoeddel@trustedcs.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/rtnetlink.c2
-rw-r--r--net/decnet/netfilter/dn_rtmsg.c2
-rw-r--r--net/ipv4/netfilter/ip_queue.c2
-rw-r--r--net/ipv6/netfilter/ip6_queue.c2
-rw-r--r--net/netfilter/nfnetlink.c2
-rw-r--r--net/netlink/genetlink.c2
-rw-r--r--net/xfrm/xfrm_user.c2
7 files changed, 7 insertions, 7 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 3fcfa9c59e1f..f25aac17497a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -663,7 +663,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp)
663 sz_idx = type>>2; 663 sz_idx = type>>2;
664 kind = type&3; 664 kind = type&3;
665 665
666 if (kind != 2 && security_netlink_recv(skb)) { 666 if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN)) {
667 *errp = -EPERM; 667 *errp = -EPERM;
668 return -1; 668 return -1;
669 } 669 }
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 74133ecd7700..8b99bd33540d 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
107 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 107 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
108 return; 108 return;
109 109
110 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) 110 if (security_netlink_recv(skb, CAP_NET_ADMIN))
111 RCV_SKB_FAIL(-EPERM); 111 RCV_SKB_FAIL(-EPERM);
112 112
113 /* Eventually we might send routing messages too */ 113 /* Eventually we might send routing messages too */
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 213d116e5bb9..198ac36db861 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -515,7 +515,7 @@ ipq_rcv_skb(struct sk_buff *skb)
515 if (type <= IPQM_BASE) 515 if (type <= IPQM_BASE)
516 return; 516 return;
517 517
518 if (security_netlink_recv(skb)) 518 if (security_netlink_recv(skb, CAP_NET_ADMIN))
519 RCV_SKB_FAIL(-EPERM); 519 RCV_SKB_FAIL(-EPERM);
520 520
521 write_lock_bh(&queue_lock); 521 write_lock_bh(&queue_lock);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index b4b7d441af25..968a14be0d05 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -505,7 +505,7 @@ ipq_rcv_skb(struct sk_buff *skb)
505 if (type <= IPQM_BASE) 505 if (type <= IPQM_BASE)
506 return; 506 return;
507 507
508 if (security_netlink_recv(skb)) 508 if (security_netlink_recv(skb, CAP_NET_ADMIN))
509 RCV_SKB_FAIL(-EPERM); 509 RCV_SKB_FAIL(-EPERM);
510 510
511 write_lock_bh(&queue_lock); 511 write_lock_bh(&queue_lock);
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index b88e82a1a987..ec9f0efea6bb 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -229,7 +229,7 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb,
229 NFNL_SUBSYS_ID(nlh->nlmsg_type), 229 NFNL_SUBSYS_ID(nlh->nlmsg_type),
230 NFNL_MSG_TYPE(nlh->nlmsg_type)); 230 NFNL_MSG_TYPE(nlh->nlmsg_type));
231 231
232 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) { 232 if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
233 DEBUGP("missing CAP_NET_ADMIN\n"); 233 DEBUGP("missing CAP_NET_ADMIN\n");
234 *errp = -EPERM; 234 *errp = -EPERM;
235 return -1; 235 return -1;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f329b72578f5..edf084becd5e 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -320,7 +320,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
320 goto errout; 320 goto errout;
321 } 321 }
322 322
323 if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb)) { 323 if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb, CAP_NET_ADMIN)) {
324 err = -EPERM; 324 err = -EPERM;
325 goto errout; 325 goto errout;
326 } 326 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c21dc26141ea..3e6a722d072e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1435,7 +1435,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
1435 link = &xfrm_dispatch[type]; 1435 link = &xfrm_dispatch[type];
1436 1436
1437 /* All operations require privileges, even GET */ 1437 /* All operations require privileges, even GET */
1438 if (security_netlink_recv(skb)) { 1438 if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
1439 *errp = -EPERM; 1439 *errp = -EPERM;
1440 return -1; 1440 return -1;
1441 } 1441 }