From patchwork Thu Jun 23 19:52:50 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9195975 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BB43F6075A for ; Thu, 23 Jun 2016 20:06:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AB0E72846B for ; Thu, 23 Jun 2016 20:06:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9DCDD28473; Thu, 23 Jun 2016 20:06:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D5D472846B for ; Thu, 23 Jun 2016 20:06:42 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="14966603" IronPort-PHdr: =?us-ascii?q?9a23=3A/EdB6RDFnySr/1i35FhIUyQJP3N1i/DPJgcQr6Af?= =?us-ascii?q?oPdwSP/8r8bcNUDSrc9gkEXOFd2CrakV06yO7Ou4BCQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6kO74TNaIBjjLw09?= =?us-ascii?q?fr2zQd+KyZzonLjvs7ToICxwzAKnZr1zKBjk5S7wjeIxxbVYF6Aq1xHSqWFJce?= =?us-ascii?q?kFjUlhJFaUggqurpzopM0rzj5U884F24YAFPyiPvdwcbsNBzQ8MnsqzNbsqAKG?= =?us-ascii?q?VgyLoHwGXSFeihNVByDd5Qz+G5L2tTH38OF63W3SJsHtZawlUjSlqaFwQVnnjz?= =?us-ascii?q?lDfzMh+XvWkeRohbhauwqlrhdyhYnOb8XdOP5zcq3aZ98yX2dNXs9NESdGB8f0?= =?us-ascii?q?dIYGCawBMOhEvqH8oUcDqV21AgzoTOPmznlSgWT727Ym1O8iOQ7D1Q0kWdkJtS?= =?us-ascii?q?f6ttLwYYsbV6iX0bPHwDPYJ6da0DH85YzKWhUspfWFW7VgN8HWzB98REv+klyM?= =?us-ascii?q?pNm9bHuu3eMXvj3etrJt?= X-IPAS-Result: =?us-ascii?q?A2H/BAAAQWxX/wHyM5BdHQGDIIFTvCwfgkmEaUwBAQEBAQE?= =?us-ascii?q?CAmIngjKCGwIEAQIkExQgCwMDCQEBFwghCAgDAS0VEQcHCwUYBIgPBMcwAQsBJ?= =?us-ascii?q?I8GEQGFdwWOaYoWjjOJXIVGj35UgggcgU9riEuBNQEBAQ?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 23 Jun 2016 20:06:22 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NK6L26005391; Thu, 23 Jun 2016 16:06:21 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u5NK5fuA212724 for ; Thu, 23 Jun 2016 16:05:41 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NK5eKd005321 for ; Thu, 23 Jun 2016 16:05:40 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AnBQBCQGxX/4GlL8FdHQGDIIFTuCuECYJggzgCgS9MAQEBAQEBZieETQIEJ1IQGAgxVwcSiDTHLAEBCCeVDwWOaYoWjjOJXIVGj35UgggcgU85MooAAQEB X-IPAS-Result: A1AnBQBCQGxX/4GlL8FdHQGDIIFTuCuECYJggzgCgS9MAQEBAQEBZieETQIEJ1IQGAgxVwcSiDTHLAEBCCeVDwWOaYoWjjOJXIVGj35UgggcgU85MooAAQEB X-IronPort-AV: E=Sophos;i="5.26,518,1459828800"; d="scan'208";a="5538214" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 23 Jun 2016 16:05:09 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3A/Ev6ORGw9jlcH94MGJXkX51GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ74r8mwAkXT6L1XgUPTWs2DsrQf2rKQ6/+rATFIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TWM5DIfUi/yKRBy?= =?us-ascii?q?brysXNWD14LviKvqptX6WEZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuwwZgf8q9tZBXKPmZOx4COUAVHV1e1wyscbrrxjY?= =?us-ascii?q?UiOU4WYHF34RllxPGQeBpAnzQ5PZqiLnsq943y6AMIv9SrVwES+u9I93WRToj2?= =?us-ascii?q?EBLDd//2bJzoR9lKtBoQmJvxVlwpXMZIieObx5ZKyZNd8eSGZPWdxdfzZMDoO1?= =?us-ascii?q?c80ECO9Fdf1Vpo+7p1YAsQqWBA+wCeepwThNwjf21Kl8yeM6HAfdwAsrHPoBtX?= =?us-ascii?q?3VqJP+M6JBf/qyyfzkxDOLTe5M1jr788CcfhknoPyIX5p1fM7VwE8oB0XOiVDG?= =?us-ascii?q?+t+tBC+cyulY6zvT1OFnT+/6zjd/8ww=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0EPBQCo7GpX/4GlL8FeHQGDIIFTuCaEC?= =?us-ascii?q?YJggzcCgTBMAQEBAQEBAgJiJ4IyghsCBCdSEBgIMVcHEog0xREBAQgnlQ8Fjmi?= =?us-ascii?q?KFY4viVuFRo98VIIIHIFPOTKKcQEBAQ?= X-IPAS-Result: =?us-ascii?q?A0EPBQCo7GpX/4GlL8FeHQGDIIFTuCaECYJggzcCgTBMAQE?= =?us-ascii?q?BAQEBAgJiJ4IyghsCBCdSEBgIMVcHEog0xREBAQgnlQ8FjmiKFY4viVuFRo98V?= =?us-ascii?q?IIIHIFPOTKKcQEBAQ?= X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="17160482" Received: from unknown (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea11.nsa.gov with ESMTP; 23 Jun 2016 20:05:08 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 23 Jun 2016 22:53:25 +0300 Received: from x-vnc01.mtx.labs.mlnx (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id u5NJr2DD029223; Thu, 23 Jun 2016 22:53:23 +0300 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Subject: [PATCH 04/12] selinux: Allocate and free infiniband security hooks Date: Thu, 23 Jun 2016 22:52:50 +0300 Message-Id: <1466711578-64398-5-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1466711578-64398-1-git-send-email-danielj@mellanox.com> References: <1466711578-64398-1-git-send-email-danielj@mellanox.com> X-Mailman-Approved-At: Thu, 23 Jun 2016 16:06:20 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: linux-rdma@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Implement and attach hooks to allocate and free Infiniband QP and MAD agent security structures. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen --- include/rdma/ib_mad.h | 1 + include/rdma/ib_verbs.h | 1 + security/selinux/hooks.c | 53 +++++++++++++++++++++++++++++++++++++++ security/selinux/include/objsec.h | 5 ++++ 4 files changed, 60 insertions(+) diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h index c8a773f..a1ed025 100644 --- a/include/rdma/ib_mad.h +++ b/include/rdma/ib_mad.h @@ -537,6 +537,7 @@ struct ib_mad_agent { u32 flags; u8 port_num; u8 rmpp_version; + void *m_security; }; /** diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 3f6780b..e522acb 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1454,6 +1454,7 @@ struct ib_qp { void *qp_context; u32 qp_num; enum ib_qp_type qp_type; + struct ib_qp_security *qp_sec; }; struct ib_mr { diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6a8841d..4f13ea4 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -17,6 +17,7 @@ * Paul Moore * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd. * Yuichi Nakamura + * Copyright (C) 2016 Mellanox Technologies * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2, @@ -83,6 +84,8 @@ #include #include #include +#include +#include #include "avc.h" #include "objsec.h" @@ -6015,6 +6018,47 @@ static void selinux_unregister_ib_flush_callback(void) mutex_unlock(&ib_flush_mutex); } +static int selinux_ib_qp_alloc_security(struct ib_qp_security *qp_sec) +{ + struct ib_security_struct *sec; + + sec = kzalloc(sizeof(*sec), GFP_ATOMIC); + if (!sec) + return -ENOMEM; + sec->sid = current_sid(); + + qp_sec->q_security = sec; + return 0; +} + +static void selinux_ib_qp_free_security(struct ib_qp_security *qp_sec) +{ + struct ib_security_struct *sec = qp_sec->q_security; + + qp_sec->q_security = NULL; + kfree(sec); +} + +static int selinux_ib_mad_agent_alloc_security(struct ib_mad_agent *mad_agent) +{ + struct ib_security_struct *sec; + + sec = kzalloc(sizeof(*sec), GFP_ATOMIC); + if (!sec) + return -ENOMEM; + sec->sid = current_sid(); + + mad_agent->m_security = sec; + return 0; +} + +static void selinux_ib_mad_agent_free_security(struct ib_mad_agent *mad_agent) +{ + struct ib_security_struct *sec = mad_agent->m_security; + + mad_agent->m_security = NULL; + kfree(sec); +} #endif static struct security_hook_list selinux_hooks[] = { @@ -6198,11 +6242,20 @@ static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), + #ifdef CONFIG_SECURITY_INFINIBAND LSM_HOOK_INIT(register_ib_flush_callback, selinux_register_ib_flush_callback), LSM_HOOK_INIT(unregister_ib_flush_callback, selinux_unregister_ib_flush_callback), + LSM_HOOK_INIT(ib_qp_alloc_security, + selinux_ib_qp_alloc_security), + LSM_HOOK_INIT(ib_qp_free_security, + selinux_ib_qp_free_security), + LSM_HOOK_INIT(ib_mad_agent_alloc_security, + selinux_ib_mad_agent_alloc_security), + LSM_HOOK_INIT(ib_mad_agent_free_security, + selinux_ib_mad_agent_free_security), #endif #ifdef CONFIG_SECURITY_NETWORK_XFRM diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index c21e135..8e7db43 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -10,6 +10,7 @@ * * Copyright (C) 2001,2002 Networks Associates Technology, Inc. * Copyright (C) 2003 Red Hat, Inc., James Morris + * Copyright (C) 2016 Mellanox Technologies * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2, @@ -128,6 +129,10 @@ struct key_security_struct { u32 sid; /* SID of key */ }; +struct ib_security_struct { + u32 sid; /* SID of the queue pair or MAD agent */ +}; + extern unsigned int selinux_checkreqprot; #endif /* _SELINUX_OBJSEC_H_ */