[v39,40/42] LSM: Allow reservation of netlabel

Message ID	20231215221636.105680-41-casey@schaufler-ca.com (mailing list archive)
State	Under Review
Delegated to:	Paul Moore
Headers	show Received: from sonic316-27.consmr.mail.ne1.yahoo.com (sonic316-27.consmr.mail.ne1.yahoo.com [66.163.187.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52C6E18EDC for <linux-security-module@vger.kernel.org>; Fri, 15 Dec 2023 22:48:32 +0000 (UTC) From: Casey Schaufler <casey@schaufler-ca.com> To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org Cc: jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org, mic@digikod.net Subject: [PATCH v39 40/42] LSM: Allow reservation of netlabel Date: Fri, 15 Dec 2023 14:16:34 -0800 Message-ID: <20231215221636.105680-41-casey@schaufler-ca.com> In-Reply-To: <20231215221636.105680-1-casey@schaufler-ca.com> References: <20231215221636.105680-1-casey@schaufler-ca.com> Precedence: bulk MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	LSM: General module stacking \| expand [v39,00/42] LSM: General module stacking [v39,01/42] integrity: disassociate ima_filter_rule from security_audit_rule [v39,02/42] SM: Infrastructure management of the sock security [v39,03/42] LSM: Add the lsmblob data structure. [v39,04/42] IMA: avoid label collisions with stacked LSMs [v39,05/42] LSM: Use lsmblob in security_audit_rule_match [v39,06/42] LSM: Add lsmblob_to_secctx hook [v39,07/42] Audit: maintain an lsmblob in audit_context [v39,08/42] LSM: Use lsmblob in security_ipc_getsecid [v39,09/42] Audit: Update shutdown LSM data [v39,10/42] LSM: Use lsmblob in security_current_getsecid [v39,11/42] LSM: Use lsmblob in security_inode_getsecid [v39,12/42] Audit: use an lsmblob in audit_names [v39,13/42] LSM: Create new security_cred_getlsmblob LSM hook [v39,14/42] Audit: Change context data from secid to lsmblob [v39,15/42] Netlabel: Use lsmblob for audit data [v39,16/42] LSM: Ensure the correct LSM context releaser [v39,17/42] LSM: Use lsmcontext in security_secid_to_secctx [v39,18/42] LSM: Use lsmcontext in security_lsmblob_to_secctx [v39,19/42] LSM: Use lsmcontext in security_inode_getsecctx [v39,20/42] LSM: Use lsmcontext in security_dentry_init_security [v39,21/42] LSM: security_lsmblob_to_secctx module selection [v39,22/42] Audit: Create audit_stamp structure [v39,23/42] Audit: Allow multiple records in an audit_buffer [v39,24/42] Audit: Add record for multiple task security contexts [v39,25/42] audit: multiple subject lsm values for netlabel [v39,26/42] Audit: Add record for multiple object contexts [v39,27/42] LSM: Remove unused lsmcontext_init() [v39,28/42] LSM: Improve logic in security_getprocattr [v39,29/42] LSM: secctx provider check on release [v39,30/42] LSM: Single calls in socket_getpeersec hooks [v39,31/42] LSM: Exclusive secmark usage [v39,32/42] LSM: Identify which LSM handles the context string [v39,33/42] AppArmor: Remove the exclusive flag [v39,34/42] LSM: Add mount opts blob size tracking [v39,35/42] LSM: allocate mnt_opts blobs instead of module specific data [v39,36/42] LSM: Infrastructure management of the key security blob [v39,37/42] LSM: Infrastructure management of the mnt_opts security blob [v39,38/42] LSM: Correct handling of ENOSYS in inode_setxattr [v39,39/42] LSM: Remove lsmblob scaffolding [v39,40/42] LSM: Allow reservation of netlabel [v39,41/42] LSM: restrict security_cred_getsecid() to a single LSM [v39,42/42] Smack: Remove LSM_FLAG_EXCLUSIVE

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index fdeffa0c8d13..da60bf163447 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -84,6 +84,7 @@ struct lsm_blob_sizes { int lbs_xattr_count; /* number of xattr slots in new_xattrs array */ int lbs_mnt_opts; bool lbs_secmark; /* expressed desire for secmark use */ + bool lbs_netlabel; /* expressed desire for netlabel use */ }; /** diff --git a/security/security.c b/security/security.c index b1a849e8589c..f1bff6b5b076 100644 --- a/security/security.c +++ b/security/security.c @@ -242,6 +242,12 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) else needed->lbs_secmark = false; } + if (needed->lbs_netlabel) { + if (!blob_sizes.lbs_netlabel) + blob_sizes.lbs_netlabel = true; + else + needed->lbs_netlabel = false; + } } /* Prepare LSM for initialization. */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 113ee3df9b5a..6da2e95ad5b7 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -182,7 +182,7 @@ static int selinux_secmark_enabled(void) static int selinux_peerlbl_enabled(void) { return (selinux_policycap_alwaysnetwork() || - netlbl_enabled() || selinux_xfrm_enabled()); + selinux_netlbl_enabled() || selinux_xfrm_enabled()); } static int selinux_netcache_avc_callback(u32 event) @@ -5673,7 +5673,7 @@ static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb, SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) return NF_DROP; - if (netlbl_enabled()) + if (selinux_netlbl_enabled()) /* we do this in the FORWARD path and not the POST_ROUTING * path because we want to make sure we apply the necessary * labeling before IPsec is applied so we can leverage AH @@ -5690,7 +5690,7 @@ static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb, struct sock *sk; u32 sid; - if (!netlbl_enabled()) + if (!selinux_netlbl_enabled()) return NF_ACCEPT; /* we do this in the LOCAL_OUT path and not the POST_ROUTING path @@ -6965,6 +6965,7 @@ struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = { .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS, .lbs_mnt_opts = sizeof(struct selinux_mnt_opts), .lbs_secmark = true, + .lbs_netlabel = true, }; #ifdef CONFIG_PERF_EVENTS diff --git a/security/selinux/include/netlabel.h b/security/selinux/include/netlabel.h index 4d0456d3d459..189803009d04 100644 --- a/security/selinux/include/netlabel.h +++ b/security/selinux/include/netlabel.h @@ -147,4 +147,9 @@ static inline int selinux_netlbl_socket_connect_locked(struct sock *sk, } #endif /* CONFIG_NETLABEL */ +static inline bool selinux_netlbl_enabled(void) +{ + return selinux_blob_sizes.lbs_netlabel && netlbl_enabled(); +} + #endif diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index e8832726bd86..1242296b5fe1 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -198,7 +198,7 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, int rc; struct netlbl_lsm_secattr secattr; - if (!netlbl_enabled()) { + if (!selinux_netlbl_enabled()) { *type = NETLBL_NLTYPE_NONE; *sid = SECSID_NULL; return 0; @@ -440,7 +440,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, u32 perm; struct netlbl_lsm_secattr secattr; - if (!netlbl_enabled()) + if (!selinux_netlbl_enabled()) return 0; netlbl_secattr_init(&secattr); diff --git a/security/smack/smack.h b/security/smack/smack.h index 85ec8141fe70..2191f8304e4f 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -367,6 +367,11 @@ static inline struct smack_known **smack_key(const struct key *key) } #endif /* CONFIG_KEYS */ +static inline bool smack_netlabel(void) +{ + return smack_blob_sizes.lbs_netlabel; +} + /* * Is the directory transmuting? */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a486ac42caac..9f5a37a5b47e 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2584,6 +2584,9 @@ static int smack_netlbl_add(struct sock *sk) struct smack_known *skp = ssp->smk_out; int rc; + if (!smack_netlabel()) + return 0; + local_bh_disable(); bh_lock_sock_nested(sk); @@ -2614,6 +2617,9 @@ static void smack_netlbl_delete(struct sock *sk) { struct socket_smack *ssp = smack_sock(sk); + if (!smack_netlabel()) + return; + /* * Take the label off the socket if one is set. */ @@ -2664,7 +2670,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap) /* * Clear the socket netlabel if it's set. */ - if (!rc) + if (!rc && smack_netlabel()) smack_netlbl_delete(sk); } rcu_read_unlock(); @@ -3970,6 +3976,8 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap, int acat; int kcat; + if (!smack_netlabel()) + return smack_net_ambient; /* * Netlabel found it in the cache. */ @@ -4126,6 +4134,9 @@ static struct smack_known *smack_from_netlbl(const struct sock *sk, u16 family, struct socket_smack *ssp = NULL; struct smack_known *skp = NULL; + if (!smack_netlabel()) + return NULL; + netlbl_secattr_init(&secattr); if (sk) @@ -4196,7 +4207,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, MAY_WRITE, rc); - if (rc != 0) + if (rc != 0 && smack_netlabel()) netlbl_skbuff_err(skb, family, rc, 0); break; #if IS_ENABLED(CONFIG_IPV6) @@ -4407,7 +4418,7 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, if (skp == NULL) { skp = smack_from_netlbl(sk, family, skb); if (skp == NULL) - skp = &smack_known_huh; + skp = smack_net_ambient; } #ifdef CONFIG_AUDIT @@ -4428,8 +4439,11 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, /* * Save the peer's label in the request_sock so we can later setup * smk_packet in the child socket so that SO_PEERCRED can report it. + * + * Only do this if Smack is using netlabel. */ - req->peer_secid = skp->smk_secid; + if (smack_netlabel()) + req->peer_secid = skp->smk_secid; /* * We need to decide if we want to label the incoming connection here @@ -4442,10 +4456,12 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, hskp = smack_ipv4host_label(&addr); rcu_read_unlock(); - if (hskp == NULL) - rc = netlbl_req_setattr(req, &skp->smk_netlabel); - else - netlbl_req_delattr(req); + if (smack_netlabel()) { + if (hskp == NULL) + rc = netlbl_req_setattr(req, &skp->smk_netlabel); + else + netlbl_req_delattr(req); + } return rc; } @@ -4463,7 +4479,7 @@ static void smack_inet_csk_clone(struct sock *sk, struct socket_smack *ssp = smack_sock(sk); struct smack_known *skp; - if (req->peer_secid != 0) { + if (smack_netlabel() && req->peer_secid != 0) { skp = smack_from_secid(req->peer_secid); ssp->smk_packet = skp; } else @@ -5062,6 +5078,7 @@ struct lsm_blob_sizes smack_blob_sizes __ro_after_init = { .lbs_xattr_count = SMACK_INODE_INIT_XATTRS, .lbs_mnt_opts = sizeof(struct smack_mnt_opts), .lbs_secmark = true, + .lbs_netlabel = true, }; static const struct lsm_id smack_lsmid = { diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 878fe44b662d..f8c0ea18b2fe 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -77,7 +77,7 @@ static DEFINE_MUTEX(smk_net6addr_lock); * If it isn't somehow marked, use this. * It can be reset via smackfs/ambient */ -struct smack_known *smack_net_ambient; +struct smack_known *smack_net_ambient = &smack_known_floor; /* * This is the level in a CIPSO header that indicates a @@ -685,6 +685,9 @@ static void smk_cipso_doi(void) struct cipso_v4_doi *doip; struct netlbl_audit nai; + if (!smack_netlabel()) + return; + smk_netlabel_audit_set(&nai); rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai); @@ -725,6 +728,9 @@ static void smk_unlbl_ambient(char *oldambient) int rc; struct netlbl_audit nai; + if (!smack_netlabel()) + return; + smk_netlabel_audit_set(&nai); if (oldambient != NULL) { @@ -848,6 +854,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, */ if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (*ppos != 0) return -EINVAL; if (format == SMK_FIXED24_FMT && @@ -1178,6 +1186,8 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf, */ if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (*ppos != 0) return -EINVAL; if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1) @@ -1437,6 +1447,8 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf, */ if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (*ppos != 0) return -EINVAL; if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1) @@ -1608,6 +1620,8 @@ static ssize_t smk_write_doi(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (count >= sizeof(temp) || count == 0) return -EINVAL; @@ -1675,6 +1689,8 @@ static ssize_t smk_write_direct(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (count >= sizeof(temp) || count == 0) return -EINVAL; @@ -1753,6 +1769,8 @@ static ssize_t smk_write_mapped(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; + if (!smack_netlabel()) + return -EINVAL; if (count >= sizeof(temp) || count == 0) return -EINVAL;

[v39,40/42] LSM: Allow reservation of netlabel

Commit Message

Patch