From patchwork Thu Jun 23 19:52:49 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9195961 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 34B956075A for ; Thu, 23 Jun 2016 20:05:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2479B1FEC1 for ; Thu, 23 Jun 2016 20:05:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 162F22846B; Thu, 23 Jun 2016 20:05:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5F1E91FEC1 for ; Thu, 23 Jun 2016 20:05:04 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="14966436" IronPort-PHdr: =?us-ascii?q?9a23=3AbxyNsRcfX5BvY7CWir8G9bHJlGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxc+9bB7h7PlgxGXEQZ/co6odzbGH6+a4BidYvN6oizMrSNR0TRgLiM?= =?us-ascii?q?EbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpQAbFhi3Dwdp?= =?us-ascii?q?POO9QteU1JXvkbjtsMWOKyxzxxOFKYtoKxu3qQiD/uI3uqBFbpgL9x3Sv3FTcP?= =?us-ascii?q?5Xz247bXianhL7+9vitMU7q3cYhuglv/Jkfe26Ov1gDO8QMDNzOGAv5db0nQLE?= =?us-ascii?q?UBDK/XwYFGIMnV4AGwHY6DniV4r19y79sfBwniKdOIm+VrwvcSiz5KdsDhnzgW?= =?us-ascii?q?EIMCB9uGzPg9Zxl4pDqQigvAR7yoXZJoaPO742cqfQcd0dX2ZpRMtdVyVdRIi7?= =?us-ascii?q?as9HFOcIO6BYoofhtnMPqwezAU+nA+argj9Bgjns2rY31f89FgrF9AMlFtMK9n?= =?us-ascii?q?/TqYbbLqAXBMy8yuHq0C/MYvVNkWPx4Y7JfxQjifSBWbZ5d83Bj0IoElWW3R2r?= =?us-ascii?q?tYX5MmbNhaw2uG+B4r8lDLqi?= X-IPAS-Result: =?us-ascii?q?A2HOBADUP2xX/wHyM5BdHAEBgyCBU7wsH4cyTAEBAQEBAQI?= =?us-ascii?q?CYieCMoIbAgQBAjcUIAsDAwkBARcIIQgIAwEtFREHBwsFGASIDwTHKwELASSPB?= =?us-ascii?q?hEBhXcFjXlwihaOM4lchUaPflSCCByBT2uIS4E1AQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 23 Jun 2016 20:05:01 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NK4lIt004953; Thu, 23 Jun 2016 16:04:54 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u5NJv8kW212544 for ; Thu, 23 Jun 2016 15:57:08 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NJv5dF003270 for ; Thu, 23 Jun 2016 15:57:07 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AnBQDyPWxX/4GlL8FdHQGDIIFTuCuECYYYAoEvTAEBAQEBAWYnhE0CBHkQGAgxVwcSiDTHKwEBCCeVDwWNeXCKFo4ziVyFRo9+VIIIHIFPOTKKAAEBAQ X-IPAS-Result: A1AnBQDyPWxX/4GlL8FdHQGDIIFTuCuECYYYAoEvTAEBAQEBAWYnhE0CBHkQGAgxVwcSiDTHKwEBCCeVDwWNeXCKFo4ziVyFRo9+VIIIHIFPOTKKAAEBAQ X-IronPort-AV: E=Sophos;i="5.26,518,1459828800"; d="scan'208";a="5538172" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 23 Jun 2016 15:56:27 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3ACX7CcxJg37P+ipEV4NmcpTZWNBhigK39O0sv0rFi?= =?us-ascii?q?tYgVIvvxwZ3uMQTl6Ol3ixeRBMOAuqoC07Sd6vi/EUU7or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6anHS+4HYoFwnlMkIt?= =?us-ascii?q?f6KuS9aU15r8jrjts7ToICxwzAKnZr1zKBjk5S7wjeIxxbVYF6Aq1xHSqWFJce?= =?us-ascii?q?kFjUlhJFaUggqurpzopM0r221qtvkg789NV7nhN+R9FOQATWduD2dg783xtALc?= =?us-ascii?q?ZRCI+2BZSWIS1B1SDEyN9BjnWr/puzb+8+963zOXe8bxSPR8Qji5x7t6Qx/vzi?= =?us-ascii?q?EcPng293+TwsFohbhauzq5rgZ+2JbQaYqYcv1kceeVcdcXSWRGRMp5TSFNAoqg?= =?us-ascii?q?KYAICq5JJutRqc/9qlUSvDO/AxWhAKXkzToMzn//2esg1P8sFxra2wcjN90LuX?= =?us-ascii?q?XQ6t7yMfQ8S+ewmYXBy33hculZ1DHmoNzEexYgrPWOdbd9dc7Yz04/UQjCiwPD?= =?us-ascii?q?+sTeIzqJ27FV4CCg5O16WLfq0jZ/pg=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0EOBQCo7GpX/4GlL8FeHQGDIIFTuCaEC?= =?us-ascii?q?YYXAoEwTAEBAQEBAQICYieCMoIbAgR5EBgIMVcHEog0xREBAQgnlQ8FjXhwihW?= =?us-ascii?q?OL4lbhUaPfFSCCByBTzkyinEBAQE?= X-IPAS-Result: =?us-ascii?q?A0EOBQCo7GpX/4GlL8FeHQGDIIFTuCaECYYXAoEwTAEBAQE?= =?us-ascii?q?BAQICYieCMoIbAgR5EBgIMVcHEog0xREBAQgnlQ8FjXhwihWOL4lbhUaPfFSCC?= =?us-ascii?q?ByBTzkyinEBAQE?= X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="17160095" Received: from unknown (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea11.nsa.gov with ESMTP; 23 Jun 2016 19:56:26 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 23 Jun 2016 22:53:21 +0300 Received: from x-vnc01.mtx.labs.mlnx (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id u5NJr2DC029223; Thu, 23 Jun 2016 22:53:18 +0300 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Subject: [PATCH 03/12] selinux: Implement Infiniband flush callback Date: Thu, 23 Jun 2016 22:52:49 +0300 Message-Id: <1466711578-64398-4-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1466711578-64398-1-git-send-email-danielj@mellanox.com> References: <1466711578-64398-1-git-send-email-danielj@mellanox.com> X-Mailman-Approved-At: Thu, 23 Jun 2016 16:01:54 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: linux-rdma@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Because access for infiniband is enforced in the setup phase of a connection there must be a way to notify ib_core if the policy or enforcement setting have changed. Added register and unregister_ib_flush_callback hooks so infiniband can setup notification of policy and enforment changes. In the AVC reset callback function call the ib_flush callback if it's registered. Also renamed the callback function, the previous name was 'net' specific. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen --- security/selinux/hooks.c | 36 ++++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index a86d537..6a8841d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -94,6 +94,9 @@ #include "audit.h" #include "avc_ss.h" +static void (*ib_flush_callback)(void); +static DEFINE_MUTEX(ib_flush_mutex); + /* SECMARK reference count */ static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); @@ -159,13 +162,17 @@ static int selinux_peerlbl_enabled(void) return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled()); } -static int selinux_netcache_avc_callback(u32 event) +static int selinux_cache_avc_callback(u32 event) { if (event == AVC_CALLBACK_RESET) { sel_netif_flush(); sel_netnode_flush(); sel_netport_flush(); synchronize_net(); + mutex_lock(&ib_flush_mutex); + if (ib_flush_callback) + ib_flush_callback(); + mutex_unlock(&ib_flush_mutex); } return 0; } @@ -5993,6 +6000,23 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) #endif +#ifdef CONFIG_SECURITY_INFINIBAND +static void selinux_register_ib_flush_callback(void (*callback)(void)) +{ + mutex_lock(&ib_flush_mutex); + ib_flush_callback = callback; + mutex_unlock(&ib_flush_mutex); +} + +static void selinux_unregister_ib_flush_callback(void) +{ + mutex_lock(&ib_flush_mutex); + ib_flush_callback = NULL; + mutex_unlock(&ib_flush_mutex); +} + +#endif + static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), @@ -6174,6 +6198,12 @@ static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), +#ifdef CONFIG_SECURITY_INFINIBAND + LSM_HOOK_INIT(register_ib_flush_callback, + selinux_register_ib_flush_callback), + LSM_HOOK_INIT(unregister_ib_flush_callback, + selinux_unregister_ib_flush_callback), +#endif #ifdef CONFIG_SECURITY_NETWORK_XFRM LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc), @@ -6233,9 +6263,11 @@ static __init int selinux_init(void) 0, SLAB_PANIC, NULL); avc_init(); + ib_flush_callback = NULL; + security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); - if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) + if (avc_add_callback(selinux_cache_avc_callback, AVC_CALLBACK_RESET)) panic("SELinux: Unable to register AVC netcache callback\n"); if (selinux_enforcing)