^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * SELinux NetLabel Support
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This file provides the necessary glue to tie NetLabel into the SELinux
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * subsystem.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Author: Paul Moore <paul@paul-moore.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/spinlock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/rcupdate.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/gfp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <net/sock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <net/netlabel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <net/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <net/ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include "objsec.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include "security.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include "netlabel.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * selinux_netlbl_sidlookup_cached - Cache a SID lookup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) * @secattr: the NetLabel security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) * @sid: the SID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) * Query the SELinux security server to lookup the correct SID for the given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) * security attributes. If the query is successful, cache the result to speed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) * up future lookups. Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) u32 *sid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) if (rc == 0 &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) (secattr->flags & NETLBL_SECATTR_CACHE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) netlbl_cache_add(skb, family, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * @sk: the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * Generate the NetLabel security attributes for a socket, making full use of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) * the socket's attribute cache. Returns a pointer to the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) * on success, NULL on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) struct netlbl_lsm_secattr *secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) if (sksec->nlbl_secattr != NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) return sksec->nlbl_secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) secattr = netlbl_secattr_alloc(GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) if (secattr == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) if (rc != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) netlbl_secattr_free(secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) sksec->nlbl_secattr = secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) return secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) * selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) * @sk: the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) * @sid: the SID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) * Query the socket's cached secattr and if the SID matches the cached value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) * return the cache, otherwise return NULL.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) const struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) u32 sid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) if (secattr == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) if ((secattr->flags & NETLBL_SECATTR_SECID) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) (secattr->attr.secid == sid))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) * Invalidate the NetLabel security attribute mapping cache.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) void selinux_netlbl_cache_invalidate(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) netlbl_cache_invalidate();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) * selinux_netlbl_err - Handle a NetLabel packet error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) * @error: the error code
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) * @gateway: true if host is acting as a gateway, false otherwise
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) * When a packet is dropped due to a call to avc_has_perm() pass the error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) * code to the NetLabel subsystem so any protocol specific processing can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) * done. This is safe to call even if you are unsure if NetLabel labeling is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) * present on the packet, NetLabel is smart enough to only act when it should.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) netlbl_skbuff_err(skb, family, error, gateway);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) * selinux_netlbl_sk_security_free - Free the NetLabel fields
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) * @sksec: the sk_security_struct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) * Free all of the memory in the NetLabel fields of a sk_security_struct.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) if (sksec->nlbl_secattr != NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) netlbl_secattr_free(sksec->nlbl_secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) * @sksec: the sk_security_struct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * @family: the socket family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) * Called when the NetLabel state of a sk_security_struct needs to be reset.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) * The caller is responsible for all the NetLabel sk_security_struct locking.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) sksec->nlbl_state = NLBL_UNSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) * @family: protocol family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) * @type: NetLabel labeling protocol type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) * @sid: the SID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) * Call the NetLabel mechanism to get the security attributes of the given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) * packet and use those attributes to determine the correct context/SID to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) * assign to the packet. Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) u32 *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) u32 *sid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) struct netlbl_lsm_secattr secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) if (!netlbl_enabled()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) *sid = SECSID_NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) netlbl_secattr_init(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) rc = netlbl_skbuff_getattr(skb, family, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) rc = selinux_netlbl_sidlookup_cached(skb, family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) &secattr, sid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) *sid = SECSID_NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) *type = secattr.type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) netlbl_secattr_destroy(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) * @family: protocol family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) * @sid: the SID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) * Description
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) * Call the NetLabel mechanism to set the label of a packet using @sid.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) * Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) u32 sid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) struct netlbl_lsm_secattr secattr_storage;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) struct netlbl_lsm_secattr *secattr = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) struct sock *sk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) /* if this is a locally generated packet check to see if it is already
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) * being labeled by it's parent socket, if it is just exit */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) sk = skb_to_full_sk(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) if (sk != NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) if (sksec->nlbl_state != NLBL_REQSKB)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) secattr = selinux_netlbl_sock_getattr(sk, sid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) if (secattr == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) secattr = &secattr_storage;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) netlbl_secattr_init(secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) rc = security_netlbl_sid_to_secattr(&selinux_state, sid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) goto skbuff_setsid_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) rc = netlbl_skbuff_setattr(skb, family, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) skbuff_setsid_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) if (secattr == &secattr_storage)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) netlbl_secattr_destroy(secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) * selinux_netlbl_sctp_assoc_request - Label an incoming sctp association.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) * @ep: incoming association endpoint.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) * @skb: the packet.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) * A new incoming connection is represented by @ep, ......
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) * Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) struct netlbl_lsm_secattr secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) struct sk_security_struct *sksec = ep->base.sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) struct sockaddr_in addr4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) struct sockaddr_in6 addr6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) if (ep->base.sk->sk_family != PF_INET &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) ep->base.sk->sk_family != PF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) netlbl_secattr_init(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) rc = security_netlbl_sid_to_secattr(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) ep->secid, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) goto assoc_request_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) /* Move skb hdr address info to a struct sockaddr and then call
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) * netlbl_conn_setattr().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) if (ip_hdr(skb)->version == 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) addr4.sin_family = AF_INET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr4, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) } else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) addr6.sin6_family = AF_INET6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) addr6.sin6_addr = ipv6_hdr(skb)->saddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr6, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) rc = -EAFNOSUPPORT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) if (rc == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) sksec->nlbl_state = NLBL_LABELED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) assoc_request_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) netlbl_secattr_destroy(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) * selinux_netlbl_inet_conn_request - Label an incoming stream connection
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) * @req: incoming connection request socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) * A new incoming connection request is represented by @req, we need to label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) * the new request_sock here and the stack will ensure the on-the-wire label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) * will get preserved when a full sock is created once the connection handshake
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) * is complete. Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) struct netlbl_lsm_secattr secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) if (family != PF_INET && family != PF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) netlbl_secattr_init(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) goto inet_conn_request_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) rc = netlbl_req_setattr(req, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) inet_conn_request_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) netlbl_secattr_destroy(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) * @sk: the new sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) * A new connection has been established using @sk, we've already labeled the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) * we need to set the NetLabel state here since we now have a sock structure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) if (family == PF_INET)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) sksec->nlbl_state = NLBL_LABELED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) sksec->nlbl_state = NLBL_UNSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) * selinux_netlbl_sctp_sk_clone - Copy state to the newly created sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) * @sk: current sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) * @newsk: the new sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) * Called whenever a new socket is created by accept(2) or sctp_peeloff(3).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) struct sk_security_struct *newsksec = newsk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) newsksec->nlbl_state = sksec->nlbl_state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) * selinux_netlbl_socket_post_create - Label a socket using NetLabel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) * @sock: the socket to label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) * @family: protocol family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) * Attempt to label a socket using the NetLabel mechanism using the given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) * SID. Returns zero values on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) struct netlbl_lsm_secattr *secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) if (family != PF_INET && family != PF_INET6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) secattr = selinux_netlbl_sock_genattr(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) if (secattr == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) rc = netlbl_sock_setattr(sk, family, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) switch (rc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) case 0:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) sksec->nlbl_state = NLBL_LABELED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) case -EDESTADDRREQ:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) sksec->nlbl_state = NLBL_REQSKB;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) * @sksec: the sock's sk_security_struct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) * @family: protocol family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) * @ad: the audit data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) * Fetch the NetLabel security attributes from @skb and perform an access check
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) * against the receiving socket. Returns zero on success, negative values on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) * error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) u16 family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) struct common_audit_data *ad)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) u32 nlbl_sid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) u32 perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) struct netlbl_lsm_secattr secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) if (!netlbl_enabled())
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) netlbl_secattr_init(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) rc = netlbl_skbuff_getattr(skb, family, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) rc = selinux_netlbl_sidlookup_cached(skb, family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) &secattr, &nlbl_sid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) nlbl_sid = SECINITSID_UNLABELED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) netlbl_secattr_destroy(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) switch (sksec->sclass) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) case SECCLASS_UDP_SOCKET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) perm = UDP_SOCKET__RECVFROM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) case SECCLASS_TCP_SOCKET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) perm = TCP_SOCKET__RECVFROM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) perm = RAWIP_SOCKET__RECVFROM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) rc = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) if (rc == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) if (nlbl_sid != SECINITSID_UNLABELED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) netlbl_skbuff_err(skb, family, rc, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) * selinux_netlbl_option - Is this a NetLabel option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) * @level: the socket level or protocol
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) * @optname: the socket option name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) * Returns true if @level and @optname refer to a NetLabel option.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) * Helper for selinux_netlbl_socket_setsockopt().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) static inline int selinux_netlbl_option(int level, int optname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) return (level == IPPROTO_IP && optname == IP_OPTIONS) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) (level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) * @sock: the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) * @level: the socket level or protocol
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) * @optname: the socket option name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) * Check the setsockopt() call and if the user is trying to replace the IP
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) * options on a socket and a NetLabel is in place for the socket deny the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) * access; otherwise allow the access. Returns zero when the access is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) * allowed, -EACCES when denied, and other negative values on error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) int selinux_netlbl_socket_setsockopt(struct socket *sock,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) int level,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) int optname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) int rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) struct sock *sk = sock->sk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) struct netlbl_lsm_secattr secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) if (selinux_netlbl_option(level, optname) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) (sksec->nlbl_state == NLBL_LABELED ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) sksec->nlbl_state == NLBL_CONNLABELED)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) netlbl_secattr_init(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) lock_sock(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) /* call the netlabel function directly as we want to see the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) * on-the-wire label that is assigned via the socket's options
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) * and not the cached netlabel/lsm attributes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) rc = netlbl_sock_getattr(sk, &secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) release_sock(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) if (rc == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) rc = -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) else if (rc == -ENOMSG)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) netlbl_secattr_destroy(&secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) * selinux_netlbl_socket_connect_helper - Help label a client-side socket on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) * connect
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) * @sk: the socket to label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) * @addr: the destination address
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) * Attempt to label a connected socket with NetLabel using the given address.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) * Returns zero values on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) static int selinux_netlbl_socket_connect_helper(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) struct sockaddr *addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) struct netlbl_lsm_secattr *secattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) /* connected sockets are allowed to disconnect when the address family
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) * is set to AF_UNSPEC, if that is what is happening we want to reset
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) * the socket */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) if (addr->sa_family == AF_UNSPEC) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) netlbl_sock_delattr(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) sksec->nlbl_state = NLBL_REQSKB;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) secattr = selinux_netlbl_sock_genattr(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) if (secattr == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) rc = netlbl_conn_setattr(sk, addr, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) if (rc == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) sksec->nlbl_state = NLBL_CONNLABELED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) * selinux_netlbl_socket_connect_locked - Label a client-side socket on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) * connect
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) * @sk: the socket to label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) * @addr: the destination address
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) * Attempt to label a connected socket that already has the socket locked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) * with NetLabel using the given address.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) * Returns zero values on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) int selinux_netlbl_socket_connect_locked(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) struct sockaddr *addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) struct sk_security_struct *sksec = sk->sk_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) if (sksec->nlbl_state != NLBL_REQSKB &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) sksec->nlbl_state != NLBL_CONNLABELED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) return selinux_netlbl_socket_connect_helper(sk, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) * selinux_netlbl_socket_connect - Label a client-side socket on connect
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) * @sk: the socket to label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) * @addr: the destination address
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) * Attempt to label a connected socket with NetLabel using the given address.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) * Returns zero values on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) lock_sock(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) rc = selinux_netlbl_socket_connect_locked(sk, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) release_sock(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags