aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorJames Morris <jmorris@redhat.com>2005-05-01 11:58:40 -0400
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-05-01 11:58:40 -0400
commitb207a290ea7dc83dba02e40b81cc8a29415a9c60 (patch)
treefe76d1c494977ba95ab576e9207dc13c4a66a04a /security
parent6af963f1d6789ef20abca5696cd52a758b396e52 (diff)
[PATCH] SELinux: add finer grained permissions to Netlink audit processing
This patch provides finer grained permissions for the audit family of Netlink sockets under SELinux. 1. We need a way to differentiate between privileged and unprivileged reads of kernel data maintained by the audit subsystem. The AUDIT_GET operation is unprivileged: it returns the current status of the audit subsystem (e.g. whether it's enabled etc.). The AUDIT_LIST operation however returns a list of the current audit ruleset, which is considered privileged by the audit folk. To deal with this, a new SELinux permission has been implemented and applied to the operation: nlmsg_readpriv, which can be allocated to appropriately privileged domains. Unprivileged domains would only be allocated nlmsg_read. 2. There is a requirement for certain domains to generate audit events from userspace. These events need to be collected by the kernel, collated and transmitted sequentially back to the audit daemon. An example is user level login, an auditable event under CAPP, where login-related domains generate AUDIT_USER messages via PAM which are relayed back to auditd via the kernel. To prevent handing out nlmsg_write permissions to such domains, a new permission has been added, nlmsg_relay, which is intended for this type of purpose: data is passed via the kernel back to userspace but no privileged information is written to the kernel. Also, AUDIT_LOGIN messages are now valid only for kernel->user messaging, so this value has been removed from the SELinux nlmsgtab (which is only used to check user->kernel messages). Signed-off-by: James Morris <jmorris@redhat.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security')
-rw-r--r--security/selinux/include/av_perm_to_string.h2
-rw-r--r--security/selinux/include/av_permissions.h2
-rw-r--r--security/selinux/nlmsgtab.c13
3 files changed, 10 insertions, 7 deletions
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index eb340b45bc6f..8928bb4d3c53 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -220,6 +220,8 @@
220 S_(SECCLASS_NETLINK_XFRM_SOCKET, NETLINK_XFRM_SOCKET__NLMSG_WRITE, "nlmsg_write") 220 S_(SECCLASS_NETLINK_XFRM_SOCKET, NETLINK_XFRM_SOCKET__NLMSG_WRITE, "nlmsg_write")
221 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READ, "nlmsg_read") 221 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READ, "nlmsg_read")
222 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE, "nlmsg_write") 222 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE, "nlmsg_write")
223 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_RELAY, "nlmsg_relay")
224 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV, "nlmsg_readpriv")
223 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read") 225 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read")
224 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write") 226 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write")
225 S_(SECCLASS_DBUS, DBUS__ACQUIRE_SVC, "acquire_svc") 227 S_(SECCLASS_DBUS, DBUS__ACQUIRE_SVC, "acquire_svc")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index f9de0f966559..bdfce4ca8f8e 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -840,6 +840,8 @@
840 840
841#define NETLINK_AUDIT_SOCKET__NLMSG_READ 0x00400000UL 841#define NETLINK_AUDIT_SOCKET__NLMSG_READ 0x00400000UL
842#define NETLINK_AUDIT_SOCKET__NLMSG_WRITE 0x00800000UL 842#define NETLINK_AUDIT_SOCKET__NLMSG_WRITE 0x00800000UL
843#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY 0x01000000UL
844#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV 0x02000000UL
843 845
844#define NETLINK_IP6FW_SOCKET__IOCTL 0x00000001UL 846#define NETLINK_IP6FW_SOCKET__IOCTL 0x00000001UL
845#define NETLINK_IP6FW_SOCKET__READ 0x00000002UL 847#define NETLINK_IP6FW_SOCKET__READ 0x00000002UL
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index f79408252730..b3adb481bc25 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -91,13 +91,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
91 91
92static struct nlmsg_perm nlmsg_audit_perms[] = 92static struct nlmsg_perm nlmsg_audit_perms[] =
93{ 93{
94 { AUDIT_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ }, 94 { AUDIT_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
95 { AUDIT_SET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, 95 { AUDIT_SET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
96 { AUDIT_LIST, NETLINK_AUDIT_SOCKET__NLMSG_READ }, 96 { AUDIT_LIST, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
97 { AUDIT_ADD, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, 97 { AUDIT_ADD, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
98 { AUDIT_DEL, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, 98 { AUDIT_DEL, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
99 { AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, 99 { AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_RELAY },
100 { AUDIT_LOGIN, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
101}; 100};
102 101
103 102