aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
Diffstat (limited to 'security')
-rw-r--r--security/Kconfig13
-rw-r--r--security/capability.c6
-rw-r--r--security/dummy.c45
-rw-r--r--security/keys/internal.h1
-rw-r--r--security/keys/key.c58
-rw-r--r--security/keys/keyring.c66
-rw-r--r--security/keys/user_defined.c33
-rw-r--r--security/selinux/Makefile2
-rw-r--r--security/selinux/hooks.c39
-rw-r--r--security/selinux/include/av_perm_to_string.h1
-rw-r--r--security/selinux/include/av_permissions.h1
-rw-r--r--security/selinux/include/xfrm.h54
-rw-r--r--security/selinux/selinuxfs.c4
-rw-r--r--security/selinux/ss/avtab.c2
-rw-r--r--security/selinux/ss/policydb.c2
-rw-r--r--security/selinux/xfrm.c305
16 files changed, 470 insertions, 162 deletions
diff --git a/security/Kconfig b/security/Kconfig
index 64d3f1e9ca..34f593410d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -54,6 +54,19 @@ config SECURITY_NETWORK
54 implement socket and networking access controls. 54 implement socket and networking access controls.
55 If you are unsure how to answer this question, answer N. 55 If you are unsure how to answer this question, answer N.
56 56
57config SECURITY_NETWORK_XFRM
58 bool "XFRM (IPSec) Networking Security Hooks"
59 depends on XFRM && SECURITY_NETWORK
60 help
61 This enables the XFRM (IPSec) networking security hooks.
62 If enabled, a security module can use these hooks to
63 implement per-packet access controls based on labels
64 derived from IPSec policy. Non-IPSec communications are
65 designated as unlabelled, and only sockets authorized
66 to communicate unlabelled data can send without using
67 IPSec.
68 If you are unsure how to answer this question, answer N.
69
57config SECURITY_CAPABILITIES 70config SECURITY_CAPABILITIES
58 tristate "Default Linux Capabilities" 71 tristate "Default Linux Capabilities"
59 depends on SECURITY 72 depends on SECURITY
diff --git a/security/capability.c b/security/capability.c
index ec18d60756..f9b35cc0b2 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -49,8 +49,6 @@ static struct security_operations capability_ops = {
49 .vm_enough_memory = cap_vm_enough_memory, 49 .vm_enough_memory = cap_vm_enough_memory,
50}; 50};
51 51
52#define MY_NAME __stringify(KBUILD_MODNAME)
53
54/* flag to keep track of how we were registered */ 52/* flag to keep track of how we were registered */
55static int secondary; 53static int secondary;
56 54
@@ -67,7 +65,7 @@ static int __init capability_init (void)
67 /* register ourselves with the security framework */ 65 /* register ourselves with the security framework */
68 if (register_security (&capability_ops)) { 66 if (register_security (&capability_ops)) {
69 /* try registering with primary module */ 67 /* try registering with primary module */
70 if (mod_reg_security (MY_NAME, &capability_ops)) { 68 if (mod_reg_security (KBUILD_MODNAME, &capability_ops)) {
71 printk (KERN_INFO "Failure registering capabilities " 69 printk (KERN_INFO "Failure registering capabilities "
72 "with primary security module.\n"); 70 "with primary security module.\n");
73 return -EINVAL; 71 return -EINVAL;
@@ -85,7 +83,7 @@ static void __exit capability_exit (void)
85 return; 83 return;
86 /* remove ourselves from the security framework */ 84 /* remove ourselves from the security framework */
87 if (secondary) { 85 if (secondary) {
88 if (mod_unreg_security (MY_NAME, &capability_ops)) 86 if (mod_unreg_security (KBUILD_MODNAME, &capability_ops))
89 printk (KERN_INFO "Failure unregistering capabilities " 87 printk (KERN_INFO "Failure unregistering capabilities "
90 "with primary module.\n"); 88 "with primary module.\n");
91 return; 89 return;
diff --git a/security/dummy.c b/security/dummy.c
index 3ca5f2b828..a15c54709f 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -776,8 +776,42 @@ static inline int dummy_sk_alloc_security (struct sock *sk, int family, gfp_t pr
776static inline void dummy_sk_free_security (struct sock *sk) 776static inline void dummy_sk_free_security (struct sock *sk)
777{ 777{
778} 778}
779
780static unsigned int dummy_sk_getsid(struct sock *sk, struct flowi *fl, u8 dir)
781{
782 return 0;
783}
779#endif /* CONFIG_SECURITY_NETWORK */ 784#endif /* CONFIG_SECURITY_NETWORK */
780 785
786#ifdef CONFIG_SECURITY_NETWORK_XFRM
787static int dummy_xfrm_policy_alloc_security(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
788{
789 return 0;
790}
791
792static inline int dummy_xfrm_policy_clone_security(struct xfrm_policy *old, struct xfrm_policy *new)
793{
794 return 0;
795}
796
797static void dummy_xfrm_policy_free_security(struct xfrm_policy *xp)
798{
799}
800
801static int dummy_xfrm_state_alloc_security(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
802{
803 return 0;
804}
805
806static void dummy_xfrm_state_free_security(struct xfrm_state *x)
807{
808}
809
810static int dummy_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
811{
812 return 0;
813}
814#endif /* CONFIG_SECURITY_NETWORK_XFRM */
781static int dummy_register_security (const char *name, struct security_operations *ops) 815static int dummy_register_security (const char *name, struct security_operations *ops)
782{ 816{
783 return -EINVAL; 817 return -EINVAL;
@@ -970,7 +1004,16 @@ void security_fixup_ops (struct security_operations *ops)
970 set_to_dummy_if_null(ops, socket_getpeersec); 1004 set_to_dummy_if_null(ops, socket_getpeersec);
971 set_to_dummy_if_null(ops, sk_alloc_security); 1005 set_to_dummy_if_null(ops, sk_alloc_security);
972 set_to_dummy_if_null(ops, sk_free_security); 1006 set_to_dummy_if_null(ops, sk_free_security);
973#endif /* CONFIG_SECURITY_NETWORK */ 1007 set_to_dummy_if_null(ops, sk_getsid);
1008 #endif /* CONFIG_SECURITY_NETWORK */
1009#ifdef CONFIG_SECURITY_NETWORK_XFRM
1010 set_to_dummy_if_null(ops, xfrm_policy_alloc_security);
1011 set_to_dummy_if_null(ops, xfrm_policy_clone_security);
1012 set_to_dummy_if_null(ops, xfrm_policy_free_security);
1013 set_to_dummy_if_null(ops, xfrm_state_alloc_security);
1014 set_to_dummy_if_null(ops, xfrm_state_free_security);
1015 set_to_dummy_if_null(ops, xfrm_policy_lookup);
1016#endif /* CONFIG_SECURITY_NETWORK_XFRM */
974#ifdef CONFIG_KEYS 1017#ifdef CONFIG_KEYS
975 set_to_dummy_if_null(ops, key_alloc); 1018 set_to_dummy_if_null(ops, key_alloc);
976 set_to_dummy_if_null(ops, key_free); 1019 set_to_dummy_if_null(ops, key_free);
diff --git a/security/keys/internal.h b/security/keys/internal.h
index db99ed434f..39cba97c5e 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -25,7 +25,6 @@
25#define kdebug(FMT, a...) do {} while(0) 25#define kdebug(FMT, a...) do {} while(0)
26#endif 26#endif
27 27
28extern struct key_type key_type_dead;
29extern struct key_type key_type_user; 28extern struct key_type key_type_user;
30 29
31/*****************************************************************************/ 30/*****************************************************************************/
diff --git a/security/keys/key.c b/security/keys/key.c
index 01bcfecb7e..99781b7983 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -36,7 +36,7 @@ static DECLARE_WORK(key_cleanup_task, key_cleanup, NULL);
36DECLARE_RWSEM(key_construction_sem); 36DECLARE_RWSEM(key_construction_sem);
37 37
38/* any key who's type gets unegistered will be re-typed to this */ 38/* any key who's type gets unegistered will be re-typed to this */
39struct key_type key_type_dead = { 39static struct key_type key_type_dead = {
40 .name = "dead", 40 .name = "dead",
41}; 41};
42 42
@@ -240,9 +240,9 @@ static inline void key_alloc_serial(struct key *key)
240/* 240/*
241 * allocate a key of the specified type 241 * allocate a key of the specified type
242 * - update the user's quota to reflect the existence of the key 242 * - update the user's quota to reflect the existence of the key
243 * - called from a key-type operation with key_types_sem read-locked by either 243 * - called from a key-type operation with key_types_sem read-locked by
244 * key_create_or_update() or by key_duplicate(); this prevents unregistration 244 * key_create_or_update()
245 * of the key type 245 * - this prevents unregistration of the key type
246 * - upon return the key is as yet uninstantiated; the caller needs to either 246 * - upon return the key is as yet uninstantiated; the caller needs to either
247 * instantiate the key or discard it before returning 247 * instantiate the key or discard it before returning
248 */ 248 */
@@ -889,56 +889,6 @@ EXPORT_SYMBOL(key_update);
889 889
890/*****************************************************************************/ 890/*****************************************************************************/
891/* 891/*
892 * duplicate a key, potentially with a revised description
893 * - must be supported by the keytype (keyrings for instance can be duplicated)
894 */
895struct key *key_duplicate(struct key *source, const char *desc)
896{
897 struct key *key;
898 int ret;
899
900 key_check(source);
901
902 if (!desc)
903 desc = source->description;
904
905 down_read(&key_types_sem);
906
907 ret = -EINVAL;
908 if (!source->type->duplicate)
909 goto error;
910
911 /* allocate and instantiate a key */
912 key = key_alloc(source->type, desc, current->fsuid, current->fsgid,
913 source->perm, 0);
914 if (IS_ERR(key))
915 goto error_k;
916
917 down_read(&source->sem);
918 ret = key->type->duplicate(key, source);
919 up_read(&source->sem);
920 if (ret < 0)
921 goto error2;
922
923 atomic_inc(&key->user->nikeys);
924 set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
925
926 error_k:
927 up_read(&key_types_sem);
928 out:
929 return key;
930
931 error2:
932 key_put(key);
933 error:
934 up_read(&key_types_sem);
935 key = ERR_PTR(ret);
936 goto out;
937
938} /* end key_duplicate() */
939
940/*****************************************************************************/
941/*
942 * revoke a key 892 * revoke a key
943 */ 893 */
944void key_revoke(struct key *key) 894void key_revoke(struct key *key)
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 4e9fa8be44..5d22c0388b 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -48,7 +48,6 @@ static inline unsigned keyring_hash(const char *desc)
48 */ 48 */
49static int keyring_instantiate(struct key *keyring, 49static int keyring_instantiate(struct key *keyring,
50 const void *data, size_t datalen); 50 const void *data, size_t datalen);
51static int keyring_duplicate(struct key *keyring, const struct key *source);
52static int keyring_match(const struct key *keyring, const void *criterion); 51static int keyring_match(const struct key *keyring, const void *criterion);
53static void keyring_destroy(struct key *keyring); 52static void keyring_destroy(struct key *keyring);
54static void keyring_describe(const struct key *keyring, struct seq_file *m); 53static void keyring_describe(const struct key *keyring, struct seq_file *m);
@@ -59,7 +58,6 @@ struct key_type key_type_keyring = {
59 .name = "keyring", 58 .name = "keyring",
60 .def_datalen = sizeof(struct keyring_list), 59 .def_datalen = sizeof(struct keyring_list),
61 .instantiate = keyring_instantiate, 60 .instantiate = keyring_instantiate,
62 .duplicate = keyring_duplicate,
63 .match = keyring_match, 61 .match = keyring_match,
64 .destroy = keyring_destroy, 62 .destroy = keyring_destroy,
65 .describe = keyring_describe, 63 .describe = keyring_describe,
@@ -70,7 +68,7 @@ struct key_type key_type_keyring = {
70 * semaphore to serialise link/link calls to prevent two link calls in parallel 68 * semaphore to serialise link/link calls to prevent two link calls in parallel
71 * introducing a cycle 69 * introducing a cycle
72 */ 70 */
73DECLARE_RWSEM(keyring_serialise_link_sem); 71static DECLARE_RWSEM(keyring_serialise_link_sem);
74 72
75/*****************************************************************************/ 73/*****************************************************************************/
76/* 74/*
@@ -120,68 +118,6 @@ static int keyring_instantiate(struct key *keyring,
120 118
121/*****************************************************************************/ 119/*****************************************************************************/
122/* 120/*
123 * duplicate the list of subscribed keys from a source keyring into this one
124 */
125static int keyring_duplicate(struct key *keyring, const struct key *source)
126{
127 struct keyring_list *sklist, *klist;
128 unsigned max;
129 size_t size;
130 int loop, ret;
131
132 const unsigned limit =
133 (PAGE_SIZE - sizeof(*klist)) / sizeof(struct key *);
134
135 ret = 0;
136
137 /* find out how many keys are currently linked */
138 rcu_read_lock();
139 sklist = rcu_dereference(source->payload.subscriptions);
140 max = 0;
141 if (sklist)
142 max = sklist->nkeys;
143 rcu_read_unlock();
144
145 /* allocate a new payload and stuff load with key links */
146 if (max > 0) {
147 BUG_ON(max > limit);
148
149 max = (max + 3) & ~3;
150 if (max > limit)
151 max = limit;
152
153 ret = -ENOMEM;
154 size = sizeof(*klist) + sizeof(struct key *) * max;
155 klist = kmalloc(size, GFP_KERNEL);
156 if (!klist)
157 goto error;
158
159 /* set links */
160 rcu_read_lock();
161 sklist = rcu_dereference(source->payload.subscriptions);
162
163 klist->maxkeys = max;
164 klist->nkeys = sklist->nkeys;
165 memcpy(klist->keys,
166 sklist->keys,
167 sklist->nkeys * sizeof(struct key *));
168
169 for (loop = klist->nkeys - 1; loop >= 0; loop--)
170 atomic_inc(&klist->keys[loop]->usage);
171
172 rcu_read_unlock();
173
174 rcu_assign_pointer(keyring->payload.subscriptions, klist);
175 ret = 0;
176 }
177
178 error:
179 return ret;
180
181} /* end keyring_duplicate() */
182
183/*****************************************************************************/
184/*
185 * match keyrings on their name 121 * match keyrings on their name
186 */ 122 */
187static int keyring_match(const struct key *keyring, const void *description) 123static int keyring_match(const struct key *keyring, const void *description)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index cbda3b2780..8e71895b97 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -26,7 +26,6 @@
26struct key_type key_type_user = { 26struct key_type key_type_user = {
27 .name = "user", 27 .name = "user",
28 .instantiate = user_instantiate, 28 .instantiate = user_instantiate,
29 .duplicate = user_duplicate,
30 .update = user_update, 29 .update = user_update,
31 .match = user_match, 30 .match = user_match,
32 .destroy = user_destroy, 31 .destroy = user_destroy,
@@ -68,42 +67,10 @@ error:
68 return ret; 67 return ret;
69 68
70} /* end user_instantiate() */ 69} /* end user_instantiate() */
71
72EXPORT_SYMBOL_GPL(user_instantiate); 70EXPORT_SYMBOL_GPL(user_instantiate);
73 71
74/*****************************************************************************/ 72/*****************************************************************************/
75/* 73/*
76 * duplicate a user defined key
77 * - both keys' semaphores are locked against further modification
78 * - the new key cannot yet be accessed
79 */
80int user_duplicate(struct key *key, const struct key *source)
81{
82 struct user_key_payload *upayload, *spayload;
83 int ret;
84
85 /* just copy the payload */
86 ret = -ENOMEM;
87 upayload = kmalloc(sizeof(*upayload) + source->datalen, GFP_KERNEL);
88 if (upayload) {
89 spayload = rcu_dereference(source->payload.data);
90 BUG_ON(source->datalen != spayload->datalen);
91
92 upayload->datalen = key->datalen = spayload->datalen;
93 memcpy(upayload->data, spayload->data, key->datalen);
94
95 key->payload.data = upayload;
96 ret = 0;
97 }
98
99 return ret;
100
101} /* end user_duplicate() */
102
103EXPORT_SYMBOL_GPL(user_duplicate);
104
105/*****************************************************************************/
106/*
107 * dispose of the old data from an updated user defined key 74 * dispose of the old data from an updated user defined key
108 */ 75 */
109static void user_update_rcu_disposal(struct rcu_head *rcu) 76static void user_update_rcu_disposal(struct rcu_head *rcu)
diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index b038cd0fae..06d54d9d20 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -8,5 +8,7 @@ selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o
8 8
9selinux-$(CONFIG_SECURITY_NETWORK) += netif.o 9selinux-$(CONFIG_SECURITY_NETWORK) += netif.o
10 10
11selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o
12
11EXTRA_CFLAGS += -Isecurity/selinux/include 13EXTRA_CFLAGS += -Isecurity/selinux/include
12 14
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index fc774436a2..3d496eae1b 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -73,6 +73,7 @@
73#include "avc.h" 73#include "avc.h"
74#include "objsec.h" 74#include "objsec.h"
75#include "netif.h" 75#include "netif.h"
76#include "xfrm.h"
76 77
77#define XATTR_SELINUX_SUFFIX "selinux" 78#define XATTR_SELINUX_SUFFIX "selinux"
78#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX 79#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
@@ -3349,6 +3350,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3349 err = avc_has_perm(sock_sid, port_sid, 3350 err = avc_has_perm(sock_sid, port_sid,
3350 sock_class, recv_perm, &ad); 3351 sock_class, recv_perm, &ad);
3351 } 3352 }
3353
3354 if (!err)
3355 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3356
3352out: 3357out:
3353 return err; 3358 return err;
3354} 3359}
@@ -3401,6 +3406,24 @@ static void selinux_sk_free_security(struct sock *sk)
3401 sk_free_security(sk); 3406 sk_free_security(sk);
3402} 3407}
3403 3408
3409static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3410{
3411 struct inode_security_struct *isec;
3412 u32 sock_sid = SECINITSID_ANY_SOCKET;
3413
3414 if (!sk)
3415 return selinux_no_sk_sid(fl);
3416
3417 read_lock_bh(&sk->sk_callback_lock);
3418 isec = get_sock_isec(sk);
3419
3420 if (isec)
3421 sock_sid = isec->sid;
3422
3423 read_unlock_bh(&sk->sk_callback_lock);
3424 return sock_sid;
3425}
3426
3404static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) 3427static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3405{ 3428{
3406 int err = 0; 3429 int err = 0;
@@ -3536,6 +3559,11 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3536 send_perm, &ad) ? NF_DROP : NF_ACCEPT; 3559 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3537 } 3560 }
3538 3561
3562 if (err != NF_ACCEPT)
3563 goto out;
3564
3565 err = selinux_xfrm_postroute_last(isec->sid, skb);
3566
3539out: 3567out:
3540 return err; 3568 return err;
3541} 3569}
@@ -4380,6 +4408,16 @@ static struct security_operations selinux_ops = {
4380 .socket_getpeersec = selinux_socket_getpeersec, 4408 .socket_getpeersec = selinux_socket_getpeersec,
4381 .sk_alloc_security = selinux_sk_alloc_security, 4409 .sk_alloc_security = selinux_sk_alloc_security,
4382 .sk_free_security = selinux_sk_free_security, 4410 .sk_free_security = selinux_sk_free_security,
4411 .sk_getsid = selinux_sk_getsid_security,
4412#endif
4413
4414#ifdef CONFIG_SECURITY_NETWORK_XFRM
4415 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4416 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4417 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4418 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4419 .xfrm_state_free_security = selinux_xfrm_state_free,
4420 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4383#endif 4421#endif
4384}; 4422};
4385 4423
@@ -4491,6 +4529,7 @@ static int __init selinux_nf_ip_init(void)
4491 panic("SELinux: nf_register_hook for IPv6: error %d\n", err); 4529 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4492 4530
4493#endif /* IPV6 */ 4531#endif /* IPV6 */
4532
4494out: 4533out:
4495 return err; 4534 return err;
4496} 4535}
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index 1deb59e1b7..591e98d931 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -238,3 +238,4 @@
238 S_(SECCLASS_NSCD, NSCD__SHMEMHOST, "shmemhost") 238 S_(SECCLASS_NSCD, NSCD__SHMEMHOST, "shmemhost")
239 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, "sendto") 239 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, "sendto")
240 S_(SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, "recvfrom") 240 S_(SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, "recvfrom")
241 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, "setcontext")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index a78b5d59c9..d7f02edf39 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -908,6 +908,7 @@
908 908
909#define ASSOCIATION__SENDTO 0x00000001UL 909#define ASSOCIATION__SENDTO 0x00000001UL
910#define ASSOCIATION__RECVFROM 0x00000002UL 910#define ASSOCIATION__RECVFROM 0x00000002UL
911#define ASSOCIATION__SETCONTEXT 0x00000004UL
911 912
912#define NETLINK_KOBJECT_UEVENT_SOCKET__IOCTL 0x00000001UL 913#define NETLINK_KOBJECT_UEVENT_SOCKET__IOCTL 0x00000001UL
913#define NETLINK_KOBJECT_UEVENT_SOCKET__READ 0x00000002UL 914#define NETLINK_KOBJECT_UEVENT_SOCKET__READ 0x00000002UL
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
new file mode 100644
index 0000000000..8e87996c6d
--- /dev/null
+++ b/security/selinux/include/xfrm.h
@@ -0,0 +1,54 @@
1/*
2 * SELinux support for the XFRM LSM hooks
3 *
4 * Author : Trent Jaeger, <jaegert@us.ibm.com>
5 */
6#ifndef _SELINUX_XFRM_H_
7#define _SELINUX_XFRM_H_
8
9int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx);
10int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new);
11void selinux_xfrm_policy_free(struct xfrm_policy *xp);
12int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
13void selinux_xfrm_state_free(struct xfrm_state *x);
14int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir);
15
16/*
17 * Extract the security blob from the sock (it's actually on the socket)
18 */
19static inline struct inode_security_struct *get_sock_isec(struct sock *sk)
20{
21 if (!sk->sk_socket)
22 return NULL;
23
24 return SOCK_INODE(sk->sk_socket)->i_security;
25}
26
27
28static inline u32 selinux_no_sk_sid(struct flowi *fl)
29{
30 /* NOTE: no sock occurs on ICMP reply, forwards, ... */
31 /* icmp_reply: authorize as kernel packet */
32 if (fl && fl->proto == IPPROTO_ICMP) {
33 return SECINITSID_KERNEL;
34 }
35
36 return SECINITSID_ANY_SOCKET;
37}
38
39#ifdef CONFIG_SECURITY_NETWORK_XFRM
40int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb);
41int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb);
42#else
43static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb)
44{
45 return 0;
46}
47
48static inline int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb)
49{
50 return NF_ACCEPT;
51}
52#endif
53
54#endif /* _SELINUX_XFRM_H_ */
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 0e1352a555..e59da6398d 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -376,7 +376,7 @@ static ssize_t selinux_transaction_write(struct file *file, const char __user *b
376 char *data; 376 char *data;
377 ssize_t rv; 377 ssize_t rv;
378 378
379 if (ino >= sizeof(write_op)/sizeof(write_op[0]) || !write_op[ino]) 379 if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
380 return -EINVAL; 380 return -EINVAL;
381 381
382 data = simple_transaction_get(file, buf, size); 382 data = simple_transaction_get(file, buf, size);
@@ -1161,7 +1161,7 @@ static int sel_make_avc_files(struct dentry *dir)
1161#endif 1161#endif
1162 }; 1162 };
1163 1163
1164 for (i = 0; i < sizeof (files) / sizeof (files[0]); i++) { 1164 for (i = 0; i < ARRAY_SIZE(files); i++) {
1165 struct inode *inode; 1165 struct inode *inode;
1166 struct dentry *dentry; 1166 struct dentry *dentry;
1167 1167
diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index dde094feb2..d049c7acbc 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -359,7 +359,7 @@ int avtab_read_item(void *fp, u32 vers, struct avtab *a,
359 return -1; 359 return -1;
360 } 360 }
361 361
362 for (i = 0; i < sizeof(spec_order)/sizeof(u16); i++) { 362 for (i = 0; i < ARRAY_SIZE(spec_order); i++) {
363 if (val & spec_order[i]) { 363 if (val & spec_order[i]) {
364 key.specified = spec_order[i] | enabled; 364 key.specified = spec_order[i] | enabled;
365 datum.data = le32_to_cpu(buf32[items++]); 365 datum.data = le32_to_cpu(buf32[items++]);
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 0ac311dc83..0111990ba8 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -103,7 +103,7 @@ static struct policydb_compat_info *policydb_lookup_compat(int version)
103 int i; 103 int i;
104 struct policydb_compat_info *info = NULL; 104 struct policydb_compat_info *info = NULL;
105 105
106 for (i = 0; i < sizeof(policydb_compat)/sizeof(*info); i++) { 106 for (i = 0; i < ARRAY_SIZE(policydb_compat); i++) {
107 if (policydb_compat[i].version == version) { 107 if (policydb_compat[i].version == version) {
108 info = &policydb_compat[i]; 108 info = &policydb_compat[i];
109 break; 109 break;
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
new file mode 100644
index 0000000000..5b7776504e
--- /dev/null
+++ b/security/selinux/xfrm.c
@@ -0,0 +1,305 @@
1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux XFRM hook function implementations.
5 *
6 * Authors: Serge Hallyn <sergeh@us.ibm.com>
7 * Trent Jaeger <jaegert@us.ibm.com>
8 *
9 * Copyright (C) 2005 International Business Machines Corporation
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2,
13 * as published by the Free Software Foundation.
14 */
15
16/*
17 * USAGE:
18 * NOTES:
19 * 1. Make sure to enable the following options in your kernel config:
20 * CONFIG_SECURITY=y
21 * CONFIG_SECURITY_NETWORK=y
22 * CONFIG_SECURITY_NETWORK_XFRM=y
23 * CONFIG_SECURITY_SELINUX=m/y
24 * ISSUES:
25 * 1. Caching packets, so they are not dropped during negotiation
26 * 2. Emulating a reasonable SO_PEERSEC across machines
27 * 3. Testing addition of sk_policy's with security context via setsockopt
28 */
29#include <linux/config.h>
30#include <linux/module.h>
31#include <linux/kernel.h>
32#include <linux/init.h>
33#include <linux/security.h>
34#include <linux/types.h>
35#include <linux/netfilter.h>
36#include <linux/netfilter_ipv4.h>
37#include <linux/netfilter_ipv6.h>
38#include <linux/ip.h>
39#include <linux/tcp.h>
40#include <linux/skbuff.h>
41#include <linux/xfrm.h>
42#include <net/xfrm.h>
43#include <net/checksum.h>
44#include <net/udp.h>
45#include <asm/semaphore.h>
46
47#include "avc.h"
48#include "objsec.h"
49#include "xfrm.h"
50
51
52/*
53 * Returns true if an LSM/SELinux context
54 */
55static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
56{
57 return (ctx &&
58 (ctx->ctx_doi == XFRM_SC_DOI_LSM) &&
59 (ctx->ctx_alg == XFRM_SC_ALG_SELINUX));
60}
61
62/*
63 * Returns true if the xfrm contains a security blob for SELinux
64 */
65static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
66{
67 return selinux_authorizable_ctx(x->security);
68}
69
70/*
71 * LSM hook implementation that authorizes that a socket can be used
72 * with the corresponding xfrm_sec_ctx and direction.
73 */
74int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
75{
76 int rc = 0;
77 u32 sel_sid = SECINITSID_UNLABELED;
78 struct xfrm_sec_ctx *ctx;
79
80 /* Context sid is either set to label or ANY_ASSOC */
81 if ((ctx = xp->security)) {
82 if (!selinux_authorizable_ctx(ctx))
83 return -EINVAL;
84
85 sel_sid = ctx->ctx_sid;
86 }
87
88 rc = avc_has_perm(sk_sid, sel_sid, SECCLASS_ASSOCIATION,
89 ((dir == FLOW_DIR_IN) ? ASSOCIATION__RECVFROM :
90 ((dir == FLOW_DIR_OUT) ? ASSOCIATION__SENDTO :
91 (ASSOCIATION__SENDTO | ASSOCIATION__RECVFROM))),
92 NULL);
93
94 return rc;
95}
96
97/*
98 * Security blob allocation for xfrm_policy and xfrm_state
99 * CTX does not have a meaningful value on input
100 */
101static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *uctx)
102{
103 int rc = 0;
104 struct task_security_struct *tsec = current->security;
105 struct xfrm_sec_ctx *ctx;
106
107 BUG_ON(!uctx);
108 BUG_ON(uctx->ctx_doi != XFRM_SC_ALG_SELINUX);
109
110 if (uctx->ctx_len >= PAGE_SIZE)
111 return -ENOMEM;
112
113 *ctxp = ctx = kmalloc(sizeof(*ctx) +
114 uctx->ctx_len,
115 GFP_KERNEL);
116
117 if (!ctx)
118 return -ENOMEM;
119
120 ctx->ctx_doi = uctx->ctx_doi;
121 ctx->ctx_len = uctx->ctx_len;
122 ctx->ctx_alg = uctx->ctx_alg;
123
124 memcpy(ctx->ctx_str,
125 uctx+1,
126 ctx->ctx_len);
127 rc = security_context_to_sid(ctx->ctx_str,
128 ctx->ctx_len,
129 &ctx->ctx_sid);
130
131 if (rc)
132 goto out;
133
134 /*
135 * Does the subject have permission to set security or permission to
136 * do the relabel?
137 * Must be permitted to relabel from default socket type (process type)
138 * to specified context
139 */
140 rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
141 SECCLASS_ASSOCIATION,
142 ASSOCIATION__SETCONTEXT, NULL);
143 if (rc)
144 goto out;
145
146 return rc;
147
148out:
149 *ctxp = 0;
150 kfree(ctx);
151 return rc;
152}
153
154/*
155 * LSM hook implementation that allocs and transfers uctx spec to
156 * xfrm_policy.
157 */
158int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *uctx)
159{
160 int err;
161
162 BUG_ON(!xp);
163
164 err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx);
165 return err;
166}
167
168
169/*
170 * LSM hook implementation that copies security data structure from old to
171 * new for policy cloning.
172 */
173int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
174{
175 struct xfrm_sec_ctx *old_ctx, *new_ctx;
176
177 old_ctx = old->security;
178
179 if (old_ctx) {
180 new_ctx = new->security = kmalloc(sizeof(*new_ctx) +
181 old_ctx->ctx_len,
182 GFP_KERNEL);
183
184 if (!new_ctx)
185 return -ENOMEM;
186
187 memcpy(new_ctx, old_ctx, sizeof(*new_ctx));
188 memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len);
189 }
190 return 0;
191}
192
193/*
194 * LSM hook implementation that frees xfrm_policy security information.
195 */
196void selinux_xfrm_policy_free(struct xfrm_policy *xp)
197{
198 struct xfrm_sec_ctx *ctx = xp->security;
199 if (ctx)
200 kfree(ctx);
201}
202
203/*
204 * LSM hook implementation that allocs and transfers sec_ctx spec to
205 * xfrm_state.
206 */
207int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx)
208{
209 int err;
210
211 BUG_ON(!x);
212
213 err = selinux_xfrm_sec_ctx_alloc(&x->security, uctx);
214 return err;
215}
216
217/*
218 * LSM hook implementation that frees xfrm_state security information.
219 */
220void selinux_xfrm_state_free(struct xfrm_state *x)
221{
222 struct xfrm_sec_ctx *ctx = x->security;
223 if (ctx)
224 kfree(ctx);
225}
226
227/*
228 * LSM hook that controls access to unlabelled packets. If
229 * a xfrm_state is authorizable (defined by macro) then it was
230 * already authorized by the IPSec process. If not, then
231 * we need to check for unlabelled access since this may not have
232 * gone thru the IPSec process.
233 */
234int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb)
235{
236 int i, rc = 0;
237 struct sec_path *sp;
238
239 sp = skb->sp;
240
241 if (sp) {
242 /*
243 * __xfrm_policy_check does not approve unless xfrm_policy_ok
244 * says that spi's match for policy and the socket.
245 *
246 * Only need to verify the existence of an authorizable sp.
247 */
248 for (i = 0; i < sp->len; i++) {
249 struct xfrm_state *x = sp->x[i].xvec;
250
251 if (x && selinux_authorizable_xfrm(x))
252 goto accept;
253 }
254 }
255
256 /* check SELinux sock for unlabelled access */
257 rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION,
258 ASSOCIATION__RECVFROM, NULL);
259 if (rc)
260 goto drop;
261
262accept:
263 return 0;
264
265drop:
266 return rc;
267}
268
269/*
270 * POSTROUTE_LAST hook's XFRM processing:
271 * If we have no security association, then we need to determine
272 * whether the socket is allowed to send to an unlabelled destination.
273 * If we do have a authorizable security association, then it has already been
274 * checked in xfrm_policy_lookup hook.
275 */
276int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb)
277{
278 struct dst_entry *dst;
279 int rc = 0;
280
281 dst = skb->dst;
282
283 if (dst) {
284 struct dst_entry *dst_test;
285
286 for (dst_test = dst; dst_test != 0;
287 dst_test = dst_test->child) {
288 struct xfrm_state *x = dst_test->xfrm;
289
290 if (x && selinux_authorizable_xfrm(x))
291 goto accept;
292 }
293 }
294
295 rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION,
296 ASSOCIATION__SENDTO, NULL);
297 if (rc)
298 goto drop;
299
300accept:
301 return NF_ACCEPT;
302
303drop:
304 return NF_DROP;
305}
generated by cgit v1.2.2 (git 2.25.0) at 2025-03-29 17:29:41 -0400