From patchwork Mon Jun 20 13:36:44 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Huw Davies X-Patchwork-Id: 9187633 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CB73260756 for ; Mon, 20 Jun 2016 14:31:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B6C1F2780C for ; Mon, 20 Jun 2016 14:31:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AA4A62787D; Mon, 20 Jun 2016 14:31:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, T_DKIM_INVALID autolearn=no version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id B9E542780C for ; Mon, 20 Jun 2016 14:31:43 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.26,498,1459814400"; d="scan'208";a="14813488" IronPort-PHdr: =?us-ascii?q?9a23=3AGEuBghOuhLlVzaDsS1ol6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0Kf3+rarrMEGX3/hxlliBBdydsKIVzbuL+P6/EUU7or+/81k6OKRWUBEEjc?= =?us-ascii?q?hE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i760zceF13FOBZv?= =?us-ascii?q?IaytQ8iJ35Xxhr35pcKbSj4LrQT+SIs6FA+xowTVu5teqqpZAYF19CH0pGBVcf?= =?us-ascii?q?9d32JiKAHbtR/94sCt4MwrqHwI6Loc7coIbYHWN+R9FOQZX3waNDUz6dHnuAfr?= =?us-ascii?q?UwSC/D0fX38Qnx4OBBLKqFn+X5Hsom7hu+FgwiiGLIjzSrwpXTmK8ahmUlnrhT?= =?us-ascii?q?0BOjp/93vYzoRrgaZapg+xjwBuyI7TJoeOPbxxeb2OU8kdQD9hQ9kZeyVfA46n?= =?us-ascii?q?J98PEvUpNuFUopbwrkUDtwD4Dg6pUrC8ggRUj2P7iPVpm98qFhvLiUl5R98=3D?= X-IPAS-Result: =?us-ascii?q?A2F0BQAN/WdX/wHyM5BeHQGDIIFTvFgfhgCBM0wBAQEBAQE?= =?us-ascii?q?CAmIngjEPOTwBAQEBAQEjAg1mAiQTBgEBDCAMAgMJAhcpCAgDAS0LChgHCwUYB?= =?us-ascii?q?IgPr0aFKQEBBYt+CI8GEQE1hUKYe44siVqFRo93VIF7DRyBTW2JE4E1AQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 20 Jun 2016 14:31:41 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5KEUFFL022104; Mon, 20 Jun 2016 10:31:37 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u5KDbXtk090425 for ; Mon, 20 Jun 2016 09:37:33 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5KDbXek013787 for ; Mon, 20 Jun 2016 09:37:33 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1DJAgDV8GdXfYO9+9heHAEBhHO4VoQBCBeGAIEzTAEBAQEBARMBARYzhH4qGQEBNwGBHCISiDCvToUpAQEFi1IpCJF9C0CCR5h7jiyPII93gk8NHIFNOzKKSAEBAQ X-IPAS-Result: A1DJAgDV8GdXfYO9+9heHAEBhHO4VoQBCBeGAIEzTAEBAQEBARMBARYzhH4qGQEBNwGBHCISiDCvToUpAQEFi1IpCJF9C0CCR5h7jiyPII93gk8NHIFNOzKKSAEBAQ X-IronPort-AV: E=Sophos;i="5.26,498,1459828800"; d="scan'208";a="5526693" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 20 Jun 2016 09:37:33 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AArbWyx/cDwxQEf9uRHKM819IXTAuvvDOBiVQ1KB8?= =?us-ascii?q?0egcTK2v8tzYMVDF4r011RmSDdSduq8P1baempujcFJDyK7JiGoFfp1IWk1Nou?= =?us-ascii?q?QttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXsq3G/pQQfBg/4fVIs?= =?us-ascii?q?YL+lS8iD0o/pi6ibwN76XUZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuwwZgf8q9tZBXKPmZOx4COUAVHV1e1wyscvmqRXO?= =?us-ascii?q?UyOR6XYGFGYbiBxFB07C9h6+FpPwtDbq8/Fw0zSAPNHnCLUzVSmm4o91RxLyzi?= =?us-ascii?q?QKLTg09CfQkMM0xLlWpBOnugxX35/fYIbTMuF3OKzaY4A0X21EC+ZMSGRtC529?= =?us-ascii?q?YpBHW+ocIs5TqIXwuFYHsxakHk+nA+a5mWwAvWP/waBvi7dpKgrBxgF1WotW6H?= =?us-ascii?q?k=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0EiAwAV8WdXfYO9+9heHAEBhHO4VoQBC?= =?us-ascii?q?BeGAIEzTAEBAQEBAQICDwEBFjMvgjEPOTwBAQEBAQEjAg1iKhkBATcBgRwiEog?= =?us-ascii?q?wr06FKQEBBYtSKQiRfQtAgkeYe44sjyCPd4JPDRyBTTsyikgBAQE?= X-IPAS-Result: =?us-ascii?q?A0EiAwAV8WdXfYO9+9heHAEBhHO4VoQBCBeGAIEzTAEBAQE?= =?us-ascii?q?BAQICDwEBFjMvgjEPOTwBAQEBAQEjAg1iKhkBATcBgRwiEogwr06FKQEBBYtSK?= =?us-ascii?q?QiRfQtAgkeYe44sjyCPd4JPDRyBTTsyikgBAQE?= X-IronPort-AV: E=Sophos;i="5.26,498,1459814400"; d="scan'208";a="17034997" Received: from mail.codeweavers.com ([216.251.189.131]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/DHE-RSA-AES128-SHA; 20 Jun 2016 13:37:31 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=codeweavers.com; s=6377696661; h=Message-Id:Date:Subject:Cc:To:From; bh=OBAb4jmxFen4RnNpl6yLIYT8chUWtuC6qTA4gGdm8jU=; b=AzS7GhILOjgMb/udBFg/Y7OqdkthGLDHgyeyxzJKueFnh5QNYJlcsBtHYtCDA5HrzAQIcQ0JUNQktSp/wYS960RRBAADO5b/STazPL/B3jqLZgQPkdiRU1gusZF1Azcwrxiy+PQg6/ZpkF8RZdLQagf2wwDlsogaIfxpeXPN2HM=; Received: from vpn38.vpn.mn.codeweavers.com ([10.69.139.38] helo=merlot.physics.ox.ac.uk) by mail.codeweavers.com with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1bEzOL-00028s-7w; Mon, 20 Jun 2016 08:37:30 -0500 Received: from daviesh by merlot.physics.ox.ac.uk with local (Exim 4.86_2) (envelope-from ) id 1bEzNs-0003Kx-Cj; Mon, 20 Jun 2016 14:37:00 +0100 From: Huw Davies To: netdev@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Subject: [PATCH v4 04/19] netlabel: Add support for querying a CALIPSO DOI. Date: Mon, 20 Jun 2016 14:36:44 +0100 Message-Id: <1466429819-12707-5-git-send-email-huw@codeweavers.com> X-Mailer: git-send-email 2.7.4 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Query a specified DOI through the NLBL_CALIPSO_C_LIST command. It requires the attribute: NLBL_CALIPSO_A_DOI. The reply will contain: NLBL_CALIPSO_A_MTYPE Signed-off-by: Huw Davies --- include/net/netlabel.h | 4 ++ net/ipv6/calipso.c | 68 +++++++++++++++++++++++++++ net/netlabel/netlabel_calipso.c | 102 ++++++++++++++++++++++++++++++++++++++++ net/netlabel/netlabel_calipso.h | 19 ++++++++ 4 files changed, 193 insertions(+) diff --git a/include/net/netlabel.h b/include/net/netlabel.h index 6af1bb6..0f05b83 100644 --- a/include/net/netlabel.h +++ b/include/net/netlabel.h @@ -223,6 +223,8 @@ struct netlbl_lsm_secattr { * struct netlbl_calipso_ops - NetLabel CALIPSO operations * @doi_add: add a CALIPSO DOI * @doi_free: free a CALIPSO DOI + * @doi_getdef: returns a reference to a DOI + * @doi_putdef: releases a reference of a DOI * * Description: * This structure is filled out by the CALIPSO engine and passed @@ -234,6 +236,8 @@ struct netlbl_calipso_ops { int (*doi_add)(struct calipso_doi *doi_def, struct netlbl_audit *audit_info); void (*doi_free)(struct calipso_doi *doi_def); + struct calipso_doi *(*doi_getdef)(u32 doi); + void (*doi_putdef)(struct calipso_doi *doi_def); }; /* diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index aa44310..128cc69 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -144,9 +144,77 @@ static void calipso_doi_free(struct calipso_doi *doi_def) kfree(doi_def); } +/** + * calipso_doi_free_rcu - Frees a DOI definition via the RCU pointer + * @entry: the entry's RCU field + * + * Description: + * This function is designed to be used as a callback to the call_rcu() + * function so that the memory allocated to the DOI definition can be released + * safely. + * + */ +static void calipso_doi_free_rcu(struct rcu_head *entry) +{ + struct calipso_doi *doi_def; + + doi_def = container_of(entry, struct calipso_doi, rcu); + calipso_doi_free(doi_def); +} + +/** + * calipso_doi_getdef - Returns a reference to a valid DOI definition + * @doi: the DOI value + * + * Description: + * Searches for a valid DOI definition and if one is found it is returned to + * the caller. Otherwise NULL is returned. The caller must ensure that + * calipso_doi_putdef() is called when the caller is done. + * + */ +static struct calipso_doi *calipso_doi_getdef(u32 doi) +{ + struct calipso_doi *doi_def; + + rcu_read_lock(); + doi_def = calipso_doi_search(doi); + if (!doi_def) + goto doi_getdef_return; + if (!atomic_inc_not_zero(&doi_def->refcount)) + doi_def = NULL; + +doi_getdef_return: + rcu_read_unlock(); + return doi_def; +} + +/** + * calipso_doi_putdef - Releases a reference for the given DOI definition + * @doi_def: the DOI definition + * + * Description: + * Releases a DOI definition reference obtained from calipso_doi_getdef(). + * + */ +static void calipso_doi_putdef(struct calipso_doi *doi_def) +{ + if (!doi_def) + return; + + if (!atomic_dec_and_test(&doi_def->refcount)) + return; + spin_lock(&calipso_doi_list_lock); + list_del_rcu(&doi_def->list); + spin_unlock(&calipso_doi_list_lock); + + call_rcu(&doi_def->rcu, calipso_doi_free_rcu); +} + static const struct netlbl_calipso_ops ops = { .doi_add = calipso_doi_add, .doi_free = calipso_doi_free, + .doi_getdef = calipso_doi_getdef, + .doi_putdef = calipso_doi_putdef, }; /** diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c index 8a113f9..6161170 100644 --- a/net/netlabel/netlabel_calipso.c +++ b/net/netlabel/netlabel_calipso.c @@ -124,6 +124,65 @@ static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info) return ret_val; } +/** + * netlbl_calipso_list - Handle a LIST message + * @skb: the NETLINK buffer + * @info: the Generic NETLINK info block + * + * Description: + * Process a user generated LIST message and respond accordingly. + * Returns zero on success and negative values on error. + * + */ +static int netlbl_calipso_list(struct sk_buff *skb, struct genl_info *info) +{ + int ret_val; + struct sk_buff *ans_skb = NULL; + void *data; + u32 doi; + struct calipso_doi *doi_def; + + if (!info->attrs[NLBL_CALIPSO_A_DOI]) { + ret_val = -EINVAL; + goto list_failure; + } + + doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]); + + doi_def = calipso_doi_getdef(doi); + if (!doi_def) { + ret_val = -EINVAL; + goto list_failure; + } + + ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!ans_skb) { + ret_val = -ENOMEM; + goto list_failure_put; + } + data = genlmsg_put_reply(ans_skb, info, &netlbl_calipso_gnl_family, + 0, NLBL_CALIPSO_C_LIST); + if (!data) { + ret_val = -ENOMEM; + goto list_failure_put; + } + + ret_val = nla_put_u32(ans_skb, NLBL_CALIPSO_A_MTYPE, doi_def->type); + if (ret_val != 0) + goto list_failure_put; + + calipso_doi_putdef(doi_def); + + genlmsg_end(ans_skb, data); + return genlmsg_reply(ans_skb, info); + +list_failure_put: + calipso_doi_putdef(doi_def); +list_failure: + kfree_skb(ans_skb); + return ret_val; +} + /* NetLabel Generic NETLINK Command Definitions */ @@ -135,6 +194,13 @@ static const struct genl_ops netlbl_calipso_ops[] = { .doit = netlbl_calipso_add, .dumpit = NULL, }, + { + .cmd = NLBL_CALIPSO_C_LIST, + .flags = 0, + .policy = calipso_genl_policy, + .doit = netlbl_calipso_list, + .dumpit = NULL, + }, }; /* NetLabel Generic NETLINK Protocol Functions @@ -214,3 +280,39 @@ void calipso_doi_free(struct calipso_doi *doi_def) if (ops) ops->doi_free(doi_def); } + +/** + * calipso_doi_getdef - Returns a reference to a valid DOI definition + * @doi: the DOI value + * + * Description: + * Searches for a valid DOI definition and if one is found it is returned to + * the caller. Otherwise NULL is returned. The caller must ensure that + * calipso_doi_putdef() is called when the caller is done. + * + */ +struct calipso_doi *calipso_doi_getdef(u32 doi) +{ + struct calipso_doi *ret_val = NULL; + const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); + + if (ops) + ret_val = ops->doi_getdef(doi); + return ret_val; +} + +/** + * calipso_doi_putdef - Releases a reference for the given DOI definition + * @doi_def: the DOI definition + * + * Description: + * Releases a DOI definition reference obtained from calipso_doi_getdef(). + * + */ +void calipso_doi_putdef(struct calipso_doi *doi_def) +{ + const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); + + if (ops) + ops->doi_putdef(doi_def); +} diff --git a/net/netlabel/netlabel_calipso.h b/net/netlabel/netlabel_calipso.h index f78790a..6da737a 100644 --- a/net/netlabel/netlabel_calipso.h +++ b/net/netlabel/netlabel_calipso.h @@ -46,6 +46,23 @@ * * If using CALIPSO_MAP_PASS no additional attributes are required. * + * o LIST: + * Sent by an application to list the details of a DOI definition. On + * success the kernel should send a response using the following format. + * + * Required attributes: + * + * NLBL_CALIPSO_A_DOI + * + * The valid response message format depends on the type of the DOI mapping, + * the defined formats are shown below. + * + * Required attributes: + * + * NLBL_CALIPSO_A_MTYPE + * + * If using CALIPSO_MAP_PASS no additional attributes are required. + * */ /* NetLabel CALIPSO commands */ @@ -86,5 +103,7 @@ static inline int netlbl_calipso_genl_init(void) int calipso_doi_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info); void calipso_doi_free(struct calipso_doi *doi_def); +struct calipso_doi *calipso_doi_getdef(u32 doi); +void calipso_doi_putdef(struct calipso_doi *doi_def); #endif