diff options
author | Darrel Goeddel <dgoeddel@trustedcs.com> | 2006-06-27 16:26:11 -0400 |
---|---|---|
committer | David S. Miller <davem@sunset.davemloft.net> | 2006-06-29 19:57:55 -0400 |
commit | c7bdb545d23026b18be53289fd866d1ac07f5f8c (patch) | |
tree | 6d9a218871d88f7579dd53f14692df2529b6e712 /net | |
parent | 576a30eb6453439b3c37ba24455ac7090c247b5a (diff) |
[NETLINK]: Encapsulate eff_cap usage within security framework.
This patch encapsulates the usage of eff_cap (in netlink_skb_params) within
the security framework by extending security_netlink_recv to include a required
capability parameter and converting all direct usage of eff_caps outside
of the lsm modules to use the interface. It also updates the SELinux
implementation of the security_netlink_send and security_netlink_recv
hooks to take advantage of the sid in the netlink_skb_params struct.
This also enables SELinux to perform auditing of netlink capability checks.
Please apply, for 2.6.18 if possible.
Signed-off-by: Darrel Goeddel <dgoeddel@trustedcs.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/core/rtnetlink.c | 2 | ||||
-rw-r--r-- | net/decnet/netfilter/dn_rtmsg.c | 2 | ||||
-rw-r--r-- | net/ipv4/netfilter/ip_queue.c | 2 | ||||
-rw-r--r-- | net/ipv6/netfilter/ip6_queue.c | 2 | ||||
-rw-r--r-- | net/netfilter/nfnetlink.c | 2 | ||||
-rw-r--r-- | net/netlink/genetlink.c | 2 | ||||
-rw-r--r-- | net/xfrm/xfrm_user.c | 2 |
7 files changed, 7 insertions, 7 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 3fcfa9c59e1f..f25aac17497a 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c | |||
@@ -663,7 +663,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp) | |||
663 | sz_idx = type>>2; | 663 | sz_idx = type>>2; |
664 | kind = type&3; | 664 | kind = type&3; |
665 | 665 | ||
666 | if (kind != 2 && security_netlink_recv(skb)) { | 666 | if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN)) { |
667 | *errp = -EPERM; | 667 | *errp = -EPERM; |
668 | return -1; | 668 | return -1; |
669 | } | 669 | } |
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c index 74133ecd7700..8b99bd33540d 100644 --- a/net/decnet/netfilter/dn_rtmsg.c +++ b/net/decnet/netfilter/dn_rtmsg.c | |||
@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) | |||
107 | if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) | 107 | if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) |
108 | return; | 108 | return; |
109 | 109 | ||
110 | if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) | 110 | if (security_netlink_recv(skb, CAP_NET_ADMIN)) |
111 | RCV_SKB_FAIL(-EPERM); | 111 | RCV_SKB_FAIL(-EPERM); |
112 | 112 | ||
113 | /* Eventually we might send routing messages too */ | 113 | /* Eventually we might send routing messages too */ |
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c index 213d116e5bb9..198ac36db861 100644 --- a/net/ipv4/netfilter/ip_queue.c +++ b/net/ipv4/netfilter/ip_queue.c | |||
@@ -515,7 +515,7 @@ ipq_rcv_skb(struct sk_buff *skb) | |||
515 | if (type <= IPQM_BASE) | 515 | if (type <= IPQM_BASE) |
516 | return; | 516 | return; |
517 | 517 | ||
518 | if (security_netlink_recv(skb)) | 518 | if (security_netlink_recv(skb, CAP_NET_ADMIN)) |
519 | RCV_SKB_FAIL(-EPERM); | 519 | RCV_SKB_FAIL(-EPERM); |
520 | 520 | ||
521 | write_lock_bh(&queue_lock); | 521 | write_lock_bh(&queue_lock); |
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c index b4b7d441af25..968a14be0d05 100644 --- a/net/ipv6/netfilter/ip6_queue.c +++ b/net/ipv6/netfilter/ip6_queue.c | |||
@@ -505,7 +505,7 @@ ipq_rcv_skb(struct sk_buff *skb) | |||
505 | if (type <= IPQM_BASE) | 505 | if (type <= IPQM_BASE) |
506 | return; | 506 | return; |
507 | 507 | ||
508 | if (security_netlink_recv(skb)) | 508 | if (security_netlink_recv(skb, CAP_NET_ADMIN)) |
509 | RCV_SKB_FAIL(-EPERM); | 509 | RCV_SKB_FAIL(-EPERM); |
510 | 510 | ||
511 | write_lock_bh(&queue_lock); | 511 | write_lock_bh(&queue_lock); |
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c index b88e82a1a987..ec9f0efea6bb 100644 --- a/net/netfilter/nfnetlink.c +++ b/net/netfilter/nfnetlink.c | |||
@@ -229,7 +229,7 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, | |||
229 | NFNL_SUBSYS_ID(nlh->nlmsg_type), | 229 | NFNL_SUBSYS_ID(nlh->nlmsg_type), |
230 | NFNL_MSG_TYPE(nlh->nlmsg_type)); | 230 | NFNL_MSG_TYPE(nlh->nlmsg_type)); |
231 | 231 | ||
232 | if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) { | 232 | if (security_netlink_recv(skb, CAP_NET_ADMIN)) { |
233 | DEBUGP("missing CAP_NET_ADMIN\n"); | 233 | DEBUGP("missing CAP_NET_ADMIN\n"); |
234 | *errp = -EPERM; | 234 | *errp = -EPERM; |
235 | return -1; | 235 | return -1; |
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c index f329b72578f5..edf084becd5e 100644 --- a/net/netlink/genetlink.c +++ b/net/netlink/genetlink.c | |||
@@ -320,7 +320,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
320 | goto errout; | 320 | goto errout; |
321 | } | 321 | } |
322 | 322 | ||
323 | if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb)) { | 323 | if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb, CAP_NET_ADMIN)) { |
324 | err = -EPERM; | 324 | err = -EPERM; |
325 | goto errout; | 325 | goto errout; |
326 | } | 326 | } |
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index c21dc26141ea..3e6a722d072e 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c | |||
@@ -1435,7 +1435,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err | |||
1435 | link = &xfrm_dispatch[type]; | 1435 | link = &xfrm_dispatch[type]; |
1436 | 1436 | ||
1437 | /* All operations require privileges, even GET */ | 1437 | /* All operations require privileges, even GET */ |
1438 | if (security_netlink_recv(skb)) { | 1438 | if (security_netlink_recv(skb, CAP_NET_ADMIN)) { |
1439 | *errp = -EPERM; | 1439 | *errp = -EPERM; |
1440 | return -1; | 1440 | return -1; |
1441 | } | 1441 | } |