diff options
Diffstat (limited to 'security/selinux/hooks.c')
-rw-r--r-- | security/selinux/hooks.c | 66 |
1 files changed, 58 insertions, 8 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 956137baf3e7..0cf98740ddc6 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c | |||
@@ -58,6 +58,7 @@ | |||
58 | #include <linux/netlink.h> | 58 | #include <linux/netlink.h> |
59 | #include <linux/tcp.h> | 59 | #include <linux/tcp.h> |
60 | #include <linux/udp.h> | 60 | #include <linux/udp.h> |
61 | #include <linux/dccp.h> | ||
61 | #include <linux/quota.h> | 62 | #include <linux/quota.h> |
62 | #include <linux/un.h> /* for Unix socket types */ | 63 | #include <linux/un.h> /* for Unix socket types */ |
63 | #include <net/af_unix.h> /* for Unix socket types */ | 64 | #include <net/af_unix.h> /* for Unix socket types */ |
@@ -751,6 +752,8 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc | |||
751 | return SECCLASS_UDP_SOCKET; | 752 | return SECCLASS_UDP_SOCKET; |
752 | else | 753 | else |
753 | return SECCLASS_RAWIP_SOCKET; | 754 | return SECCLASS_RAWIP_SOCKET; |
755 | case SOCK_DCCP: | ||
756 | return SECCLASS_DCCP_SOCKET; | ||
754 | default: | 757 | default: |
755 | return SECCLASS_RAWIP_SOCKET; | 758 | return SECCLASS_RAWIP_SOCKET; |
756 | } | 759 | } |
@@ -2944,6 +2947,22 @@ static int selinux_parse_skb_ipv4(struct sk_buff *skb, | |||
2944 | break; | 2947 | break; |
2945 | } | 2948 | } |
2946 | 2949 | ||
2950 | case IPPROTO_DCCP: { | ||
2951 | struct dccp_hdr _dccph, *dh; | ||
2952 | |||
2953 | if (ntohs(ih->frag_off) & IP_OFFSET) | ||
2954 | break; | ||
2955 | |||
2956 | offset += ihlen; | ||
2957 | dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); | ||
2958 | if (dh == NULL) | ||
2959 | break; | ||
2960 | |||
2961 | ad->u.net.sport = dh->dccph_sport; | ||
2962 | ad->u.net.dport = dh->dccph_dport; | ||
2963 | break; | ||
2964 | } | ||
2965 | |||
2947 | default: | 2966 | default: |
2948 | break; | 2967 | break; |
2949 | } | 2968 | } |
@@ -3004,6 +3023,18 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb, | |||
3004 | break; | 3023 | break; |
3005 | } | 3024 | } |
3006 | 3025 | ||
3026 | case IPPROTO_DCCP: { | ||
3027 | struct dccp_hdr _dccph, *dh; | ||
3028 | |||
3029 | dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); | ||
3030 | if (dh == NULL) | ||
3031 | break; | ||
3032 | |||
3033 | ad->u.net.sport = dh->dccph_sport; | ||
3034 | ad->u.net.dport = dh->dccph_dport; | ||
3035 | break; | ||
3036 | } | ||
3037 | |||
3007 | /* includes fragments */ | 3038 | /* includes fragments */ |
3008 | default: | 3039 | default: |
3009 | break; | 3040 | break; |
@@ -3188,7 +3219,11 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in | |||
3188 | case SECCLASS_UDP_SOCKET: | 3219 | case SECCLASS_UDP_SOCKET: |
3189 | node_perm = UDP_SOCKET__NODE_BIND; | 3220 | node_perm = UDP_SOCKET__NODE_BIND; |
3190 | break; | 3221 | break; |
3191 | 3222 | ||
3223 | case SECCLASS_DCCP_SOCKET: | ||
3224 | node_perm = DCCP_SOCKET__NODE_BIND; | ||
3225 | break; | ||
3226 | |||
3192 | default: | 3227 | default: |
3193 | node_perm = RAWIP_SOCKET__NODE_BIND; | 3228 | node_perm = RAWIP_SOCKET__NODE_BIND; |
3194 | break; | 3229 | break; |
@@ -3226,16 +3261,17 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, | |||
3226 | return err; | 3261 | return err; |
3227 | 3262 | ||
3228 | /* | 3263 | /* |
3229 | * If a TCP socket, check name_connect permission for the port. | 3264 | * If a TCP or DCCP socket, check name_connect permission for the port. |
3230 | */ | 3265 | */ |
3231 | isec = SOCK_INODE(sock)->i_security; | 3266 | isec = SOCK_INODE(sock)->i_security; |
3232 | if (isec->sclass == SECCLASS_TCP_SOCKET) { | 3267 | if (isec->sclass == SECCLASS_TCP_SOCKET || |
3268 | isec->sclass == SECCLASS_DCCP_SOCKET) { | ||
3233 | struct sock *sk = sock->sk; | 3269 | struct sock *sk = sock->sk; |
3234 | struct avc_audit_data ad; | 3270 | struct avc_audit_data ad; |
3235 | struct sockaddr_in *addr4 = NULL; | 3271 | struct sockaddr_in *addr4 = NULL; |
3236 | struct sockaddr_in6 *addr6 = NULL; | 3272 | struct sockaddr_in6 *addr6 = NULL; |
3237 | unsigned short snum; | 3273 | unsigned short snum; |
3238 | u32 sid; | 3274 | u32 sid, perm; |
3239 | 3275 | ||
3240 | if (sk->sk_family == PF_INET) { | 3276 | if (sk->sk_family == PF_INET) { |
3241 | addr4 = (struct sockaddr_in *)address; | 3277 | addr4 = (struct sockaddr_in *)address; |
@@ -3254,11 +3290,13 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, | |||
3254 | if (err) | 3290 | if (err) |
3255 | goto out; | 3291 | goto out; |
3256 | 3292 | ||
3293 | perm = (isec->sclass == SECCLASS_TCP_SOCKET) ? | ||
3294 | TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT; | ||
3295 | |||
3257 | AVC_AUDIT_DATA_INIT(&ad,NET); | 3296 | AVC_AUDIT_DATA_INIT(&ad,NET); |
3258 | ad.u.net.dport = htons(snum); | 3297 | ad.u.net.dport = htons(snum); |
3259 | ad.u.net.family = sk->sk_family; | 3298 | ad.u.net.family = sk->sk_family; |
3260 | err = avc_has_perm(isec->sid, sid, isec->sclass, | 3299 | err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad); |
3261 | TCP_SOCKET__NAME_CONNECT, &ad); | ||
3262 | if (err) | 3300 | if (err) |
3263 | goto out; | 3301 | goto out; |
3264 | } | 3302 | } |
@@ -3446,7 +3484,13 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, | |||
3446 | node_perm = NODE__TCP_RECV; | 3484 | node_perm = NODE__TCP_RECV; |
3447 | recv_perm = TCP_SOCKET__RECV_MSG; | 3485 | recv_perm = TCP_SOCKET__RECV_MSG; |
3448 | break; | 3486 | break; |
3449 | 3487 | ||
3488 | case SECCLASS_DCCP_SOCKET: | ||
3489 | netif_perm = NETIF__DCCP_RECV; | ||
3490 | node_perm = NODE__DCCP_RECV; | ||
3491 | recv_perm = DCCP_SOCKET__RECV_MSG; | ||
3492 | break; | ||
3493 | |||
3450 | default: | 3494 | default: |
3451 | netif_perm = NETIF__RAWIP_RECV; | 3495 | netif_perm = NETIF__RAWIP_RECV; |
3452 | node_perm = NODE__RAWIP_RECV; | 3496 | node_perm = NODE__RAWIP_RECV; |
@@ -3777,7 +3821,13 @@ static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device * | |||
3777 | node_perm = NODE__TCP_SEND; | 3821 | node_perm = NODE__TCP_SEND; |
3778 | send_perm = TCP_SOCKET__SEND_MSG; | 3822 | send_perm = TCP_SOCKET__SEND_MSG; |
3779 | break; | 3823 | break; |
3780 | 3824 | ||
3825 | case SECCLASS_DCCP_SOCKET: | ||
3826 | netif_perm = NETIF__DCCP_SEND; | ||
3827 | node_perm = NODE__DCCP_SEND; | ||
3828 | send_perm = DCCP_SOCKET__SEND_MSG; | ||
3829 | break; | ||
3830 | |||
3781 | default: | 3831 | default: |
3782 | netif_perm = NETIF__RAWIP_SEND; | 3832 | netif_perm = NETIF__RAWIP_SEND; |
3783 | node_perm = NODE__RAWIP_SEND; | 3833 | node_perm = NODE__RAWIP_SEND; |