From patchwork Thu Feb 28 22:43:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834101 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8D9801390 for ; Thu, 28 Feb 2019 22:44:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7C32828EAB for ; Thu, 28 Feb 2019 22:44:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6FF0C29307; Thu, 28 Feb 2019 22:44:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E6D3128EAB for ; Thu, 28 Feb 2019 22:44:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728223AbfB1WoK (ORCPT ); Thu, 28 Feb 2019 17:44:10 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:33615 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727917AbfB1WoK (ORCPT ); Thu, 28 Feb 2019 17:44:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393848; bh=jJFDAlCya7gSJRhnJKH9YHfyscZbftGuXLNV9EhATAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=aHncW10SfNr94k78TI7JDa0wfGN5TzOKUB9QuaJNUvVNoSEGmw8LdhFwszQFbHk809KfE/KpWCL3v52LjdxGVn5nXFH1q4r0RmR2Ioz0xqGAkx6PB8px/B3DR8sbZNvLspNVZzuWI4Roy2HAl++6o3Z6lC6zsOir4Hl31jiAnyqOp69LJUjTCEPVN51kyVLtQatMaT0x5EnVXlEqou8mglE7z8IC5POB6XbKKYbswf5TrB8NnFf/dl9HtRVa12FqSPLDRWy9mDZJdHfQFwt/p9VTNQjNs18nA0zeDJW8ykZ/22+9WJOzsgQVp/1EMcr0E7esX4+xY2WXHLtbzaUk4A== X-YMail-OSG: au9nDHoVM1kYBHOFFMzOj6uu1tKcr7Dk76ybJA0sRelx29MH0Ve3o1tqCwUgVu4 PtaxDdv9tbLZn.3qA9Y9WrMrNY47EiGBtwl30f4m.PWOT6d4uq0sV4OcSmq0y7GYgnHUMNot8BV. sWZz0UdpWAMy3lewMvwRRtM60VLS_mG8bbKb1X_4epNoQ3bHF0c9Wlm8NuflW0cSYuyrVLuCjUSZ mDF.tIavxgvL2ur1.B21ZYEnkLe5WRw21V8PkeTSD1cNFHC7crQEWaHR_TbC.jvd6QYyrFNKNkp_ l8fdTAz7kj3kw5mhjix0XXD43HP3yNwI5rtbgYvCdWNbdAdbPhYxl_MaSNfEn5NojFfit6VoEvhc b8XhMRvhJuO_tt.8uboOkuuKDJmB9WgO6cQS3OFknpKC4h5bbGOab47ITR_aTKLoniS0QB6.ICBK FwJ98IwBJq55qgm_tOnThwfFeczISBDAvQt6cZH4c3gpHoG.FqBnc1ibtObf9Y.PNQ6u4eGTyQ3Q F2.KZG48UNd6LBzs1KrW5IEnRRwqNeTEIY0to4ytYHC7qX1kG9QFw6rREEhFslYxEe_j1WZyczJ2 znqkTmTQED9llFfYot_pogi1eVIBXrKuHx98EriI30lk_Gbkg_OfbX_5u2M2DfIQhQHs4DfeooIx rP6KEc9totrVE.NDAkl4G5lEHATHGRmjPTCC3ibT28R6.zHRSknTxwXg2qpcFGSf28TEQb3xPSgG M1aM7viuxkOuflx.fAa0kqRf_RjyytZlEYqDhTyI4NiU_Cj4GBePIa76FZ8h9PjhPR3I0VFm5v_O KzosF31KmmTPua54JqfaMQCK_Xs3dwvW34aClKEd.5p7i_TZ5Dw_8J0Nov1mwTo7PenTWXUNp7H6 3Gy_JTXn14vfULtapT4sYb5tZi9_jE5hfR0P32ijxS6GqWB7vl0RMElf1.Au0XKuzwwPU0lG2LPW aPB6bdcr7LKWosfaYC0xvfzUEOUv2exfSls3dzykONBdswjCk.UI7evO.Ql_wRWacYG0juO1XmRd VZa_yB3N2kheR3Z10wdYIFH.RrL.XDdVvu.VP7Nha5H3OYbOLSIN3D6hZyHv4J7JS.Wx.eXYa5TX buyYJ2MSwFyZJ_GMaRyTlntU.Wj042IbXny4rek683FaelUaw5Gig3rM- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:08 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:05 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 71/97] LSM: Add secmark refcounting to call_one list Date: Thu, 28 Feb 2019 14:43:30 -0800 Message-Id: <20190228224356.2608-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add secmark_refcount_dec and secmark_refcount_inc to the LSM hooks for which only the designated module is called. This is in support of consistant secmark behavior. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 2 ++ security/security.c | 42 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index e76e5cd05180..4020e13f0669 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2029,6 +2029,8 @@ struct lsm_one_hooks { union security_list_options secctx_to_secid; union security_list_options socket_getpeersec_stream; union security_list_options secmark_relabel_packet; + union security_list_options secmark_refcount_inc; + union security_list_options secmark_refcount_dec; }; /* diff --git a/security/security.c b/security/security.c index 024601db215e..af3f6a89ee88 100644 --- a/security/security.c +++ b/security/security.c @@ -472,6 +472,12 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, else if (hooks[i].head == &security_hook_heads.secmark_relabel_packet) lsm_base_one.secmark_relabel_packet = hooks[i].hook; + else if (hooks[i].head == + &security_hook_heads.secmark_refcount_inc) + lsm_base_one.secmark_refcount_inc = hooks[i].hook; + else if (hooks[i].head == + &security_hook_heads.secmark_refcount_dec) + lsm_base_one.secmark_refcount_dec = hooks[i].hook; else continue; if (lsm_base_one.lsm == NULL) @@ -752,6 +758,14 @@ int lsm_superblock_alloc(struct super_block *sb) RC; \ }) +#define call_one_void_hook(FUNC, ...) ({ \ + struct lsm_one_hooks *LOH = current_cred()->security; \ + if (LOH->FUNC.FUNC) \ + LOH->FUNC.FUNC(__VA_ARGS__); \ + else if (LOH->lsm == NULL && lsm_base_one.FUNC.FUNC) \ + lsm_base_one.FUNC.FUNC(__VA_ARGS__); \ +}) + #define call_one_int_hook(FUNC, IRC, ...) ({ \ int RC = IRC; \ struct lsm_one_hooks *LOH = current_cred()->security; \ @@ -2022,6 +2036,8 @@ int security_setprocattr(const char *lsm, const char *name, void *value, union security_list_options secctx_to_secid; union security_list_options socket_getpeersec_stream; union security_list_options secmark_relabel_packet; + union security_list_options secmark_refcount_inc; + union security_list_options secmark_refcount_dec; if (size == 0 || size >= 100) return -EINVAL; @@ -2068,6 +2084,28 @@ int security_setprocattr(const char *lsm, const char *name, void *value, break; } } + secmark_refcount_inc.secmark_refcount_inc = NULL; + hlist_for_each_entry(hp, + &security_hook_heads.secmark_refcount_inc, + list) { + if (size >= strlen(hp->lsm) && + !strncmp(value, hp->lsm, size)) { + secmark_refcount_inc = hp->hook; + found = true; + break; + } + } + secmark_refcount_dec.secmark_refcount_dec = NULL; + hlist_for_each_entry(hp, + &security_hook_heads.secmark_refcount_dec, + list) { + if (size >= strlen(hp->lsm) && + !strncmp(value, hp->lsm, size)) { + secmark_refcount_dec = hp->hook; + found = true; + break; + } + } if (!found) return -EINVAL; @@ -2339,13 +2377,13 @@ EXPORT_SYMBOL(security_secmark_relabel_packet); void security_secmark_refcount_inc(void) { - call_void_hook(secmark_refcount_inc); + call_one_void_hook(secmark_refcount_inc); } EXPORT_SYMBOL(security_secmark_refcount_inc); void security_secmark_refcount_dec(void) { - call_void_hook(secmark_refcount_dec); + call_one_void_hook(secmark_refcount_dec); } EXPORT_SYMBOL(security_secmark_refcount_dec); From patchwork Thu Feb 28 22:43:31 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834099 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CF1721399 for ; Thu, 28 Feb 2019 22:44:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C163528EAB for ; Thu, 28 Feb 2019 22:44:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B5D86290BB; Thu, 28 Feb 2019 22:44:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6FE4129192 for ; Thu, 28 Feb 2019 22:44:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726088AbfB1WoJ (ORCPT ); Thu, 28 Feb 2019 17:44:09 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:34964 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727468AbfB1WoJ (ORCPT ); Thu, 28 Feb 2019 17:44:09 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393848; bh=eJSihQlHJC7zAJUsB7t9oIkvmwu96BhjijJbgq/9xEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=EP6a1oZCwMh3KcKr4GFs98L3q6VtZfDEl2GipoCOl7IOsnOInqPUtDXImsUsC30YhJJ7t+D7PsroAbOVef30JhjhXr/89L1ITiMExbrgPQ79bSwF6zb+WHlUuXPoYgG5er/hpNq8nefRF0RyHVNNM8Lkf+/tDoG3brivFbdvTASPuYwXaaybjPNY3x20PDl9x9HTCNoH6zP7EjKQLYtVtLt18/z18z7gNTOHO2HKLtWs+ttmtPMTEzDGRU68XV327ZrMCZiO6AjihxJ7pL4uig1YiRET17GTFZOS8FzbfutHpPxhzg0J8Je8QjdsTTSAm4oa+DOUpPA+2sybEM7AKQ== X-YMail-OSG: zWkIrMkVM1k2dd5M9yfz5vUV6LDNziSs39xNb5uu8EzF3biSqycvsXGqANDZWwF bjngep9PxcfrFS.z0o4hU0.ZOqk7iuft2siGvOkhgQmHs967KQvd1ZPP2Q4TB4BmoytGOePJ6cet VRZoUgstWxmCObupTLhugnmjZx2Z_lxkmv8cKcq2SJ78X9_44ZAfnqWT4mvCNz9L_B_ME1uhsXUO h7N5ScSQz9KruDLo6OiOmlzQrTQg1ZF0kwCCbTQ5w9RyOADdos2GqoRpvcwp3CMiNQ.uJRGpBl7q Xuv8y657N4UxLPH.4hjbHxt79HxW0J4cv5Ncds2oNU9fS0ME_AenTqIJ5CMcZHiWl223su8weA.t yXFbqfUpGkUO19u6bC6A7lWnwwOz.AvbKvmnPzxNKq7SpOpVe9s80JkTAVCru2Au4NRqnAZPXLe2 vwyjiFN4nxzge1OJPV1raG28Wi3VMuIeAp558.PRze_migEidtchCF2kTocQJ7SzmfOZIW2Zefv7 6_bvxEeF0MdCwizw0_FGLpETTUzk463u29YbZlODPBp0Fu3SJyemtAe5S5e3UV0kOgnYk83WOjbT UMUZsMiZHAy_edTutq5AgxLH7cXhEOBbqTtZr.WVYXbh4egzFP82LRFwXXasF9ung68eiawqWVHL 73iuCeJaHwBPfQD1DMiQLk5ymP4KbxjIZi3UhL37kKuIGiAEC2X2rRRM2ggnLSCgf3totZrRaxXV 5_xNp3.HxPK_MLhYjWRrAP4VS3h6xO4zw0I9pMFrRTA_nMPRY6cFBpUL9hyRA5SPk0DWBbzOG1n5 4s8hbryRxAUA5w1qc1R6K64XW14vZSFebKG7PG6sTkNFVLiJ8lOaFP_kcSE8cDVUF29rwavBgKMo krd7wGS3SE1EGw4AklmdFTIYwQlioY5Yu3VgEbvbV4oUawfM.tyeiR8dlg6dpUYnwQH.2Suq6QOS lCZQncRIkDcRl2H6bcIE.qa.dGqCTFPQXdnSBhma4kYYM.AYJS0ugIrxtFpgdne3Wy2jgrnH.4DQ 2wP3SrgFjz3vT8f82diwPpIglhc3KNj2KkBcUYlf.uJDzTybKtHPcEIyMgqwys6QqiKY3WhCNqGO 7Zl7Gt6whq1StHu.9UfedkVfP6HqjPv.lF57qYUb.bKUhmEM5tj.WXOJU Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:08 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:06 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 72/97] LSM: Add secmark refcounting to call_one list - part 2 Date: Thu, 28 Feb 2019 14:43:31 -0800 Message-Id: <20190228224356.2608-3-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add secmark_refcount_dec and secmark_refcount_inc to the LSM hooks for which only the designated module is called. Signed-off-by: Casey Schaufler --- security/security.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/security.c b/security/security.c index af3f6a89ee88..fc446af4c3bf 100644 --- a/security/security.c +++ b/security/security.c @@ -2125,6 +2125,8 @@ int security_setprocattr(const char *lsm, const char *name, void *value, loh->secctx_to_secid = secctx_to_secid; loh->socket_getpeersec_stream = socket_getpeersec_stream; loh->secmark_relabel_packet = secmark_relabel_packet; + loh->secmark_refcount_inc = secmark_refcount_inc; + loh->secmark_refcount_dec = secmark_refcount_dec; return size; } From patchwork Thu Feb 28 22:43:32 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834107 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 96D881805 for ; Thu, 28 Feb 2019 22:44:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A2EE28EAB for ; Thu, 28 Feb 2019 22:44:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7EB3F29192; Thu, 28 Feb 2019 22:44:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1BF52290BB for ; Thu, 28 Feb 2019 22:44:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727908AbfB1WoL (ORCPT ); Thu, 28 Feb 2019 17:44:11 -0500 Received: from sonic302-10.consmr.mail.bf2.yahoo.com ([74.6.135.49]:37415 "EHLO sonic302-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727468AbfB1WoL (ORCPT ); Thu, 28 Feb 2019 17:44:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393849; bh=4BfO/VPF2tKOCjMpfXoHzygB4AwQ3ldLj2gvJyvC7C4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=eWIHgKqMWKww88vUScNJaLVE8gcGF7fduP8yu4WH7aohJt5tzxRqhkedPmo1R0v7tnjG1ORAiiL2kKWzv1GBo4LHWG0B6ZAACSDjV+o9XqYO+G0+FeoJ0qRErKMrmvMPbK4+KOPHkH6cESZfPQ8NoG8t8/RQwDu98u1fZ6vELRJI5EKgZGLmQ6asQ5PgilGeg2j/JKn9pDa5F4uOw5znvy7+iUgs+oR5LKyIRNDfVEHx8zQ20m0YGO6WU00SCagZEhp3ZIG7QJXM/siRR1Jcs7fqW/WfGsp5uFVVyFrw16deiH7B5wTann3s/3OYJ2L2ynPTYy8HY3xRXmJURsCX+Q== X-YMail-OSG: Vl9nKA4VM1kOCtrmz_.6Lu8MVEoeQlWkkEtqYFyeGhbxiqC791EG4yyu6juDLaw 3CQlfXp.gqoLyA31xT9uoN9vdahmgr06PODoI4k3jZ9z0TNhhlFqzG7bx5SiZpu7nnvFBh96lUB6 eTdkHWOhR7cDWVIJJ3L7yu5MhyoOaR6FhnGRzyMhSXcJScHwxJZHGUNU1Nd3EjnJH7g9A_wTRLJt 2cCyvV6DLahx5TaB07AQtw6yGZ7ru4U5sTFSg_omZxZL6BoacT2BbLi9ivmMX.FDHZjl.GV2.qQh K_Y_aR_mw50jISxbXUhfBkN355enhuPagHm1Cl6B0d8UjtgkjNg3oVqsMFAWc9T0LVSCEtaHquzm NSvrsBxjtLHbD.joGtDFzhyOYveaTfjLKyGkSt37KVH0oODzgMZdjLTb4u7VgtyjTAozKDGiStov DK2g6hwE3eWLIb9LxiRRqCKvFhESkMcmylxRylMKDUvqNlIaJAn4XP4btjb9AeynCidKv_VLAh1D xPNn8_TvgJCayJcwL6KPKXCditcdqS7Eh9YdYOw0me5z5I7QoZTair_RKboL1Qx4.CQ3svoJCNUr HQLDQvT1VrKijeM_62e4A6kdlJh.QYfj.rDIB7kUDL3bnGeK4EOBjl01oPsg.NMhMSBPp1rg913e 3I9stXR_o_5sOaXjTBPbwgZVyKkaSserfOfTTZkbLYas9t74ZfAdZWrTDRtqvTi9ySqzJNyGHKXO WRF.tbtqUuequauiQqBZKWWVQgShydU4uj070pkP55J4wqvDW_oLfXIIr4i3HiFBdhIK.BE_k91k M5IFSt1qjNcrdDTDF.x1ij3ObrKnoS9cAMvKoU7o9dGgV6xEX6jrIxVu8yC.cV6weBnjuf7Yn_z8 ycJYvU_0Bw8E.iyGkXSBGligpiRR4tZ_OquTo25m2dFWm799qS4Xax_HPpAUd1MFMRBsw9qV1_gz R5I2g2k19jrJFEb4JBqnQosm15YqzyWKZM4FxOwnUJ0C4lzZa2I.vEzVkP3jmvcpm3zZb1TdCVnM PKFeoPouHuNkg7mTtO0_dXnK_YXQzabXs.k2awaDQzGQF5ru96OKmmVANaS2U1PE48vOmcJEOuPu VqxJVMU6G3EFjA2uf6PBzxYhdtppmlolTNFp3K0.sUnQQ.w_.x2y92ubM Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:09 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:07 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 73/97] LSM: refactor security_setprocattr Date: Thu, 28 Feb 2019 14:43:32 -0800 Message-Id: <20190228224356.2608-4-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Break the common code for setting the lsm_one hooks into helper function. Signed-off-by: Casey Schaufler --- security/security.c | 120 ++++++++++++++++---------------------------- 1 file changed, 43 insertions(+), 77 deletions(-) diff --git a/security/security.c b/security/security.c index fc446af4c3bf..66bc1a580d48 100644 --- a/security/security.c +++ b/security/security.c @@ -2016,12 +2016,31 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name, return -EINVAL; } +/* + * The use of the secid_to_secctx memeber of the union is + * arbitrary. Any member would work. + */ +static bool lsm_add_one(union security_list_options *hook, + struct hlist_head *head, char *lsm, size_t size, + bool was) +{ + struct security_hook_list *hp; + + hlist_for_each_entry(hp, head, list) { + if (size >= strlen(hp->lsm) && !strncmp(lsm, hp->lsm, size)) { + hook->secid_to_secctx = hp->hook.secid_to_secctx; + return true; + } + } + hook->secid_to_secctx = NULL; + return was; +} + int security_setprocattr(const char *lsm, const char *name, void *value, size_t size) { struct security_hook_list *hp; struct lsm_one_hooks *loh = current_cred()->security; - bool found = false; char *s; /* @@ -2032,80 +2051,31 @@ int security_setprocattr(const char *lsm, const char *name, void *value, *s = '\0'; if (!strcmp(name, "display")) { - union security_list_options secid_to_secctx; - union security_list_options secctx_to_secid; - union security_list_options socket_getpeersec_stream; - union security_list_options secmark_relabel_packet; - union security_list_options secmark_refcount_inc; - union security_list_options secmark_refcount_dec; + struct lsm_one_hooks o; + bool found = false; if (size == 0 || size >= 100) return -EINVAL; - secid_to_secctx.secid_to_secctx = NULL; - hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - secid_to_secctx = hp->hook; - found = true; - break; - } - } - secctx_to_secid.secctx_to_secid = NULL; - hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - secctx_to_secid = hp->hook; - found = true; - break; - } - } - socket_getpeersec_stream.socket_getpeersec_stream = NULL; - hlist_for_each_entry(hp, - &security_hook_heads.socket_getpeersec_stream, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - socket_getpeersec_stream = hp->hook; - found = true; - break; - } - } - secmark_relabel_packet.secmark_relabel_packet = NULL; - hlist_for_each_entry(hp, - &security_hook_heads.secmark_relabel_packet, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - secmark_relabel_packet = hp->hook; - found = true; - break; - } - } - secmark_refcount_inc.secmark_refcount_inc = NULL; - hlist_for_each_entry(hp, - &security_hook_heads.secmark_refcount_inc, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - secmark_refcount_inc = hp->hook; - found = true; - break; - } - } - secmark_refcount_dec.secmark_refcount_dec = NULL; - hlist_for_each_entry(hp, - &security_hook_heads.secmark_refcount_dec, - list) { - if (size >= strlen(hp->lsm) && - !strncmp(value, hp->lsm, size)) { - secmark_refcount_dec = hp->hook; - found = true; - break; - } - } + found = lsm_add_one(&o.secid_to_secctx, + &security_hook_heads.secid_to_secctx, + value, size, found); + found = lsm_add_one(&o.secctx_to_secid, + &security_hook_heads.secctx_to_secid, + value, size, found); + found = lsm_add_one(&o.socket_getpeersec_stream, + &security_hook_heads.socket_getpeersec_stream, + value, size, found); + found = lsm_add_one(&o.secmark_relabel_packet, + &security_hook_heads.secmark_relabel_packet, + value, size, found); + found = lsm_add_one(&o.secmark_refcount_inc, + &security_hook_heads.secmark_refcount_inc, + value, size, found); + found = lsm_add_one(&o.secmark_refcount_dec, + &security_hook_heads.secmark_refcount_dec, + value, size, found); + if (!found) return -EINVAL; @@ -2120,13 +2090,9 @@ int security_setprocattr(const char *lsm, const char *name, void *value, if (loh->lsm) kfree(loh->lsm); + + *loh = o; loh->lsm = s; - loh->secid_to_secctx = secid_to_secctx; - loh->secctx_to_secid = secctx_to_secid; - loh->socket_getpeersec_stream = socket_getpeersec_stream; - loh->secmark_relabel_packet = secmark_relabel_packet; - loh->secmark_refcount_inc = secmark_refcount_inc; - loh->secmark_refcount_dec = secmark_refcount_dec; return size; } From patchwork Thu Feb 28 22:43:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834117 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4A3C81390 for ; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3BDC1290BB for ; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3032329455; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A289428EAB for ; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728622AbfB1WoQ (ORCPT ); Thu, 28 Feb 2019 17:44:16 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:46279 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728480AbfB1WoP (ORCPT ); Thu, 28 Feb 2019 17:44:15 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393853; bh=T99UAwbzwl6vRkj82D5u068WAkhWTn74lvNVXW7yVTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=mDSJUdZ9n2cb7X7U6kzHli4Ym1LUZVYsQiiAjr9UReddt7a4I0GsyeoWiIFtqJM/+bBQLNZOjkJS9s7NYIGSw+lF2p4wrhzZg7iDDOffwhE3KK1lL96XRJrhvMvpmRkcvBquoPAMqtbajRTRiookECS0MWsYGVp1v7CHFnLfUqwrqXyEoUgINYq3uH4xfqQDFHzPEfrUibp8jvsTprfPFnKRcva9W9tPfK91d1w4qINY+m/9k5p7SwFZnYC8xKLrmdtdYDRclbNCgrkby6R3vXR9heD83d6WuK6iwrxE13YBaDRLyT+5W6iRn6AYPv8OA+n+DoBywvgS+nG7MKtWmQ== X-YMail-OSG: 5utznpUVM1kTy8ES9SgFhj.Kqs3r0bJ3pHa1hgCx5pdZ7sq3rxquDjZV7glVvlk 1Kpwx4dKU81ApclMVOTK6.nbKQ3u13Dz9TzE.cGRJpjxtTI63FEz2CFR0hRkBszVcwSDz30C9uc9 aDdam2y4iXT2TfIJjEIathoGDV3B70H3TxQEs4csqVhhBYceYR3slKumzaGv1wTlKGouV_dP3v2u HPff8IinorQQkhLgeKRbC_PILj_CyJ1LbzR0PUKjLdoZuoEyPSG79JVrZjSZZxLIEi8C.wm0oSnY wt1YNnq2n9KKqxlGY0Q4NeF2xTgqFOOhx571pxlZWZwJ24hkWqYExnEOUAhwUJb2kaHTIKLasATm MxQizyJY5mzCG3SDioez4fDkpWjILnict6.MSVSRGmkrkuFgl41jwqKo0B7ZKVjcPJ8NfaA2iHn9 CYoxUZ2gL9t2S6_gEqC0ZFZhhR6eaVDGvN3PTQby9WVzfGgug7qh5AfVsOi8_5oaE11X8FQETvsB 5ZJ9QUjRpiV546fxEryi5wn3IcybcUq4M33Z0btmSsWC4LD9DXsrIRv8ssntOYYVLyxNMDhJg0Aj 9KAbyh2IU0VMFut_hjgZmfuTp1aWntAP2UM0HyxJGDzxN59lWlSJBRJrN2uYyVuSCsxs2HEJtgHW fU2DD5A2nwLnQY8QzdBcX4yIx299iA.Eo9cSpb9_lcvS5X0I6tN7jIzlgyFPftYa33K9kIYgPuWB wIoh03MFM5N.Mmj_5YMlxEQs3RGti0kinqgPGSi4nz3rhP29XglzxhwQu2XFFQyZkPNQnRQFQ8lS C7Qmyf.OlzxpgOQebIAypxntx6m5Cmw577_ga2Vbdz3NqZX72l3pGcunKDmmEp5D4WMwhTv853i3 _X8M7AAv8uXFoliLaK3qD62dy84MPVzI0iI0qOFBWUA1Y.6Y62u.wLVfg8PVMaElp7oQUjZSDYGM MDnax_03X8H0iUclijO7xs.mtzhTqcN0A0SKe504flOib6HmU_Un9TutUEhBvCFUyBXtBSf5EQQt Qf877GwsaAorRxh8UG2L96WAWTM6RNTAoCDB3dvC1pnMTMAs6Bl2bfwD6f6DoAY4QaFffvrEc1Kx yybRnj_.Kn9JzoNolEL.Gpy.Jw6dtVA-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:13 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:08 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 74/97] Smack: Detect if secmarks can be safely used Date: Thu, 28 Feb 2019 14:43:33 -0800 Message-Id: <20190228224356.2608-5-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Utilize the security_secmark_refcount_in() hooks to determine if Smack can safely assume that IP secmarks are not being used by another LSM. Only use secmarks if they can be determined to belong to Smack. [cschaufler@localhost lsm-stacking]$ head -30 ../from-lap-190128/0073* From 796ddbf9da8e0e8180805591badf182d2578ed5a Mon Sep 17 00:00:00 2001 From: Casey Schaufler Date: Thu, 3 Jan 2019 15:56:59 -0800 Subject: [PATCH 73/79] Smack: Detect if secmarks can be safely used Utilize the security_secmark_refcount_in() hooks to determine if Smack can safely assume that IP secmarks are not being used by another LSM. Only use secmarks if they can be determined to belong to Smack. Signed-off-by: Casey Schaufler --- security/smack/smack.h | 15 +++++++++++++++ security/smack/smack_lsm.c | 16 +++++----------- security/smack/smack_netfilter.c | 25 +++++++++++++++++++++++-- 3 files changed, 43 insertions(+), 13 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index f623d059421d..147afb9233b4 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -553,4 +553,19 @@ static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a, } #endif +#ifdef CONFIG_SECURITY_SMACK_NETFILTER +extern bool smack_use_secmark; +void smack_secmark_refcount_inc(void); + +static inline bool smk_use_secmark(void) +{ + return smack_use_secmark; +} +#else +static inline bool smk_use_secmark(void) +{ + return false; +} +#endif + #endif /* _SECURITY_SMACK_H */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 7b8ad16c09e0..c45e2dc3f959 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3742,7 +3742,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) */ static struct smack_known *smack_from_skb(struct sk_buff *skb) { - if (skb == NULL || skb->secmark == 0) + if (skb == NULL || skb->secmark == 0 || !smk_use_secmark()) return NULL; return smack_from_secid(skb->secmark); @@ -3776,7 +3776,6 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) switch (family) { case PF_INET: -#ifdef CONFIG_SECURITY_SMACK_NETFILTER /* * If there is a secmark use it rather than the CIPSO label. * If there is no secmark fall back to CIPSO. @@ -3785,7 +3784,6 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) skp = smack_from_skb(skb); if (skp) goto access_check; -#endif /* CONFIG_SECURITY_SMACK_NETFILTER */ /* * Translate what netlabel gave us. */ @@ -3799,9 +3797,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) netlbl_secattr_destroy(&secattr); -#ifdef CONFIG_SECURITY_SMACK_NETFILTER access_check: -#endif + #ifdef CONFIG_AUDIT smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); ad.a.u.net->family = family; @@ -3928,13 +3925,11 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, s = ssp->smk_out->smk_secid; break; case PF_INET: -#ifdef CONFIG_SECURITY_SMACK_NETFILTER skp = smack_from_skb(skb); if (skp) { s = skp->smk_secid; break; } -#endif /* * Translate what netlabel gave us. */ @@ -4024,7 +4019,6 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, } #endif /* CONFIG_IPV6 */ -#ifdef CONFIG_SECURITY_SMACK_NETFILTER /* * If there is a secmark use it rather than the CIPSO label. * If there is no secmark fall back to CIPSO. @@ -4033,7 +4027,6 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, skp = smack_from_skb(skb); if (skp) goto access_check; -#endif /* CONFIG_SECURITY_SMACK_NETFILTER */ netlbl_secattr_init(&secattr); rc = netlbl_skbuff_getattr(skb, family, &secattr); @@ -4043,9 +4036,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, skp = &smack_known_huh; netlbl_secattr_destroy(&secattr); -#ifdef CONFIG_SECURITY_SMACK_NETFILTER access_check: -#endif #ifdef CONFIG_AUDIT smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); @@ -4620,6 +4611,9 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), #ifdef SMACK_IPV6_PORT_LABELING LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), +#endif +#ifdef CONFIG_SECURITY_SMACK_NETFILTER + LSM_HOOK_INIT(secmark_refcount_inc, smack_secmark_refcount_inc), #endif LSM_HOOK_INIT(sock_graft, smack_sock_graft), LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 701a1cc1bdcc..ea45b173f8ca 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -21,6 +21,15 @@ #include #include "smack.h" +bool smack_use_secmark; +static bool smack_checked_secmark; + +void smack_secmark_refcount_inc(void) +{ + smack_use_secmark = true; + pr_info("Smack: Using network secmarks.\n"); +} + #if IS_ENABLED(CONFIG_IPV6) static unsigned int smack_ipv6_output(void *priv, @@ -31,7 +40,13 @@ static unsigned int smack_ipv6_output(void *priv, struct socket_smack *ssp; struct smack_known *skp; - if (sk && smack_sock(sk)) { + if (!smack_checked_secmark) { + security_secmark_refcount_inc(); + security_secmark_refcount_dec(); + smack_checked_secmark = true; + } + + if (smack_use_secmark && sk && smack_sock(sk)) { ssp = smack_sock(sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; @@ -49,7 +64,13 @@ static unsigned int smack_ipv4_output(void *priv, struct socket_smack *ssp; struct smack_known *skp; - if (sk && smack_sock(sk)) { + if (!smack_checked_secmark) { + security_secmark_refcount_inc(); + security_secmark_refcount_dec(); + smack_checked_secmark = true; + } + + if (smack_use_secmark && sk && smack_sock(sk)) { ssp = smack_sock(sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; From patchwork Thu Feb 28 22:43:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834115 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4DB481805 for ; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3D48229434 for ; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 31ACE28EAB; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CED96290BB for ; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727988AbfB1WoP (ORCPT ); Thu, 28 Feb 2019 17:44:15 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:45001 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728622AbfB1WoP (ORCPT ); Thu, 28 Feb 2019 17:44:15 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393853; bh=dTAYj+IK39gdMMwT3fRNtH6BcvhJsD291Guvs8GW0sU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=EtenEfHE/P/Og+PfebECs6XqThIVdsafi/9nqtsA2b+miU/lymdsMuOyw2LMPlKlBda/INa+zrmYTioZmzFIX+HoTB7qzPmnkrCqwAvU8VrVvz54mrTxUJMzbt8YTM0GOyBfnBY/uY4N7QCKxZ98jrsnFnXAQSsKrR+etkqKRHP8JJjR3uh0kip74Knds6K5MpqRhTODMrzONnhn1oQB+o3J26VJysR7fmmPpMdTdbn384AhbG4zaH0WO7YXiYYYuY9DsAt7u6aUSYu9n+vLn8jJGu2wo0Im2zabLHljJHuBBupTxeLo/YKKFdVqp0YpXcj3gHBEm+TpfBHQsdtgdQ== X-YMail-OSG: s8TE8eQVM1l2WwXyVfNGH.5L047n_523bp_R9U6e.xm6T18opYOlntdh0ezATFa w69uPOKlFUvQaKA1XJEND406xgaM0TklWM8ExzrsDeJ.McrwzdBCOUTN.PIVYfMag2hXZC0T3yF8 4Cr9.Pjab.SmuoxrF8iLea.N5nwuDqUoB2OxyQWze_I3hv2apcRPcGCCUOQz1HJVmxXzSWd00IPG 9SgkJ9dGCLpmqP0WpX94D9JE0GzXYEX0qnocWD_YK7UzZeUpnck.peZTu1uG5Z6GhxFDpussx.XQ zKRmXzPG8om.QxpxCcW1tzgqTlAjQ2ml6mQ9Y84K.AElNTfkOgWpnxl5MTEWqLv3d7PRWLjwpLF3 Pjts4JGrCPRTNcHt5.Jm7.0EOITCcmolM8b27eDNJI3wFm9TK69iSorw6DvLBDuSP4sl4B7UcSZA E68IrpsT3PfQ3gCJuBWIpk9jDL_dE1eFvzcHRfjDq2LdZepOEil9I8RozMOmNOJcKE06OolbKk4x 7ewkZcJFno78ozpHH3zMslXJgwr0rsz6NsdV74.GxSuOwgv0QnvCjNVmtuSKf2.1Vz7x_bb1p1Hn vMzXo8XjEdlix8rVGm66CysJoGWRSVZIeOvRnLjnlTna_CAA12Z421dE22uTeA5_rf4SjG_qq5IL McmCa1hg.LKErmcqerIK_RqBSTyBBpZslSVCwRbE1m5AGFtCW0wm8SmE6hwYXImIO3SbVfEoAoN0 5jG.iZJFO1PYowJc1BPb7gyMxPXzRGiNHzJlHs5rvjGrNCc9ZaVQ1zmwfbgjT_4k_h2L5ioDyWit w8PZUaGJy7HS4D0c3EhRlV0GBSCuNDgOtizhcgwR2SnQQj7zR6tfpZOlhz2p42K1Pzxpgc8uJh41 _PTBBpR7HUb2q2MtNX2TG4EEKxBDPC_nodRsWdOfSJb2qxl327NplF6mYx1DVl704P_7grfnFmrm fADtlGzkH1uJQ0aIg7g_fUdc.AtRDaGh3GmHXmwTjV4Fpt.dBTnHPqYBIJzAO.MQCavOIy5VXV3T kDA65u6dVIF0AbPTYQm45yFqwlfd.SGLriHk0ch_OrhtSrz.2oH._xns6VT1GNMVGCajQ_ggniha AAiV09B6hgmcLictCKuoMruSyQqPZnho6Z.RuN79QLQI2RAaZoU57gLSZ Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:13 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:09 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 75/97] LSM: Support multiple LSMs using inode_init_security Date: Thu, 28 Feb 2019 14:43:34 -0800 Message-Id: <20190228224356.2608-6-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Refactor security_inode_init_security() so that it can do the integrity processing for more than one LSM. Signed-off-by: Casey Schaufler --- security/security.c | 48 +++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 19 deletions(-) diff --git a/security/security.c b/security/security.c index 66bc1a580d48..16ff98c86414 100644 --- a/security/security.c +++ b/security/security.c @@ -1066,9 +1066,10 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const initxattrs initxattrs, void *fs_data) { - struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1]; - struct xattr *lsm_xattr, *evm_xattr, *xattr; - int ret; + struct security_hook_list *p; + struct xattr *repo; + int rc; + int i; if (unlikely(IS_PRIVATE(inode))) return 0; @@ -1076,24 +1077,33 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, if (!initxattrs) return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, NULL, NULL, NULL); - memset(new_xattrs, 0, sizeof(new_xattrs)); - lsm_xattr = new_xattrs; - ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, - &lsm_xattr->name, - &lsm_xattr->value, - &lsm_xattr->value_len); - if (ret) - goto out; - evm_xattr = lsm_xattr + 1; - ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr); - if (ret) - goto out; - ret = initxattrs(inode, new_xattrs, fs_data); + repo = kzalloc((LSM_COUNT * 2) * sizeof(*repo), GFP_NOFS); + if (repo == NULL) + return -ENOMEM; + + i = 0; + rc = -EOPNOTSUPP; + hlist_for_each_entry(p, &security_hook_heads.inode_init_security, + list) { + rc = p->hook.inode_init_security(inode, dir, qstr, + &repo[i].name, &repo[i].value, + &repo[i].value_len); + if (rc) + goto out; + + rc = evm_inode_init_security(inode, &repo[i], &repo[i + 1]); + if (rc) + goto out; + + i += 2; + } + rc = initxattrs(inode, repo, fs_data); out: - for (xattr = new_xattrs; xattr->value != NULL; xattr++) - kfree(xattr->value); - return (ret == -EOPNOTSUPP) ? 0 : ret; + for (i-- ; i >= 0; i--) + kfree(repo[i].value); + kfree(repo); + return (rc == -EOPNOTSUPP) ? 0 : rc; } EXPORT_SYMBOL(security_inode_init_security); From patchwork Thu Feb 28 22:43:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834123 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 60EB91805 for ; Thu, 28 Feb 2019 22:44:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 520E128EAB for ; Thu, 28 Feb 2019 22:44:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4554E29192; Thu, 28 Feb 2019 22:44:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D195428EAB for ; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728438AbfB1WoR (ORCPT ); Thu, 28 Feb 2019 17:44:17 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:46528 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728775AbfB1WoQ (ORCPT ); Thu, 28 Feb 2019 17:44:16 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393853; bh=D46jH1NzMuCKPDROaZjQDTvHqgXO7BOSHaSWxaZtxc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=qz6SU0DCmIGMZkN1UYcY5Oav3kckLekCt6FE1qWTbyG7e+mhRC1LBn35pR30p74wC/4Rtg8U6kswxCtm569gWtc4Ov2WgAMAK9i9iloXjCAUq6SgTf8+4XXVHSP0Qt1wT/e8XNqLtEAHgakGKOmKlEiIbW2ZR0VNnd0r/gM51YSUntkuMogxdkyLXBgW6iU2ftEFfQL0sLKDY/75gaE97dIEzsQKVzo2EKvx+5Up8yFxnwvmxx8GaIyCa8TtyyuZmgSeHBP1MlX9eFRXK+i65/gMOMlVn6PBy9VsCHLS620COzORpPxTxGixFSI08FmwaH4H86cSDkuKCDqm7+kwRQ== X-YMail-OSG: zpq3x9kVM1kZUkVlasbn09i4IDlKWZcSZxNhqXQ_m_ol_I004U4k4ueusbehZDi Z299h.yjHJNAegN5GNN.76k5QAJgwC8oqZQv6OQiBMIsQo5oIbLN0xr5VyQrvEIak6nw7UayhJ57 aUgIjW6VAmdn9luAWQTgO1s6JnG6xysCXaegg91SwvL5mHFRsvU0L4qzcbTLHKJOcsH1R_br3qRL ELQRarjSkLTJM0ID4..EwZfxzUKPfrS7cxPvy2I79ZUd1FpKIm3jrlpFJ.mwkOQIJv90xYtKsFrG 7QcaTTCermb1_uK9PYnSvz5Vp3O6nsOY9R5n8abvSY3NYgXXOH.pIOYSE9oy6c1kDIAEiwvTap.c lTxUrtTZ7Q0jaPW69gvJyJT4mQuZM_nG.6RxNwuMia.FHUzc3ESZ1qGDClp8rKpxRTKAyhM3TadO tsuYLXX5l7aQyURJHNYLdRUqXf5h62fxsDgZhR7JZVTCY68fh5Qi7ETy9XPodAC8zubJdSp3kKbA nwwhI5pHBUAwFYt_Uq6_vJNBStEHC3GS4joqvZUzVxMOp1FG5yZ2183qISj5SLihRyiYj94eIeme rWEhFGfrd6h.yTparI3IE7cLPNG6ctTvIHSnFvwGu3rsnCj98Gz2MgFY.TvMSOGC_0b4Kqk5jRUL noEZwFVl9ZrVaBoitSv2.PtGkechsyoDGm.b1yiLlVTQ._SM79A_3SnfAQhsHnXyUorHpWkPAwNL 5CsRxrXjfgiTvISjGKcAsNNQpld6O1gKx14_eaphDHvQK7gYw6TK4L0h7sJ65S.xv67VbEGMJMw8 2aNpj_uI8xB.z2KOYnfzoRhIbWFVgKo43RWVC5G2ZnK8FjeT32hzaWddl5CZ3cJ_pphcFgixjkiE Gke7sBmF8EV0RM7.yrEKDPJTvW3t8hZTYHMDBCSUt_vHWPeuuRcTaeP6JqeWyIAZG5uDUGTX0LII wXXZJrKK0Qxd1Q0fQ_UJvLHdXvxXVoNMQLgVTw_qQ0gtJW._mkfKz1ktbgYpouSqxk6vNsK.zlL0 IOciJtfFET47WOHpN1gNm4W3PNtTKML_kjzMPBtUMHt_4Pygz6qfxftpNHucQ3kieze8U.k9p5NC huw3ryiZC03xuin_OkqpZZlUQGoUbmdihYdlX1o7ITxqG_Rk3iGbQv0w- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:13 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:11 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 76/97] LSM: Use full security context in security_inode_setsecctx Date: Thu, 28 Feb 2019 14:43:35 -0800 Message-Id: <20190228224356.2608-7-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The security hooks security_inode_setsecctx and security_inode_getsecctx need to maintain the context strings for any and all LSMs that provide contexts. This information is internal to the kernel and volitile. If only one LSM uses this information the raw form is used. Signed-off-by: Casey Schaufler --- security/security.c | 110 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 108 insertions(+), 2 deletions(-) diff --git a/security/security.c b/security/security.c index 16ff98c86414..bb0eea873a7e 100644 --- a/security/security.c +++ b/security/security.c @@ -438,6 +438,9 @@ static int lsm_append(char *new, char **result) /* Base list of once-only hooks */ struct lsm_one_hooks lsm_base_one; +/* Count of inode_[gs]etsecctx hooks */ +static int lsm_inode_secctx_count; + /** * security_add_hooks - Add a modules hooks to the hook lists. * @hooks: the hooks to add @@ -455,6 +458,15 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, hooks[i].lsm = lsm; hlist_add_tail_rcu(&hooks[i].list, hooks[i].head); + /* + * Keep count of the internal security context using hooks. + * Assume that there is a 1:1 mapping from inode_getsecctx + * to inode_setsecctx in the security modules. + */ + if (hooks[i].head == &security_hook_heads.inode_getsecctx) { + lsm_inode_secctx_count++; + continue; + } /* * Check for the special hooks that are restricted to * a single module to create the base set. Use the hooks @@ -2162,15 +2174,109 @@ int security_inode_notifysecctx(struct inode *inode, struct lsm_context *cp) } EXPORT_SYMBOL(security_inode_notifysecctx); +/* + * The inode_[gs]etsecctx functions need to proved a context + * for multiple security modules. If there is more than one + * LSM supplying hooks the format will be + * lsm1='value',lsm2='value'[,lsmN='value']... + */ +static void lsm_release_secctx(struct lsm_context *cp) +{ + kfree(cp->context); +} + int security_inode_setsecctx(struct dentry *dentry, struct lsm_context *cp) { - return call_int_hook(inode_setsecctx, 0, dentry, cp); + struct security_hook_list *hp; + struct lsm_context lc; + char *full; + char *ctx; + char *quote; + int rc = 0; + + if (lsm_inode_secctx_count <= 1) + return call_int_hook(inode_setsecctx, 0, dentry, cp); + + full = kstrndup(cp->context, cp->len, GFP_KERNEL); + if (full == NULL) + return -ENOMEM; + + ctx = full; + hlist_for_each_entry(hp, &security_hook_heads.inode_setsecctx, list) { + if (strncmp(ctx, hp->lsm, strlen(hp->lsm))) { + WARN_ONCE(1, "security_inode_setsecctx form1 error\n"); + rc = -EINVAL; + break; + } + ctx += strlen(hp->lsm); + if (ctx[0] != '=' || ctx[1] != '\'') { + WARN_ONCE(1, "security_inode_setsecctx form2 error\n"); + rc = -EINVAL; + break; + } + ctx += 2; + quote = strnchr(ctx, cp->len, '\''); + if (quote == NULL) { + WARN_ONCE(1, "security_inode_setsecctx form3 error\n"); + rc = -EINVAL; + break; + } + quote[0] = '\0'; + if (quote[1] != ',' && quote[1] != '\0') { + WARN_ONCE(1, "security_inode_setsecctx form4 error\n"); + rc = -EINVAL; + break; + } + lc.context = ctx; + lc.len = strlen(ctx); + + ctx = quote + 2; + + rc = hp->hook.inode_setsecctx(dentry, &lc); + if (rc) + break; + } + + kfree(full); + return rc; } EXPORT_SYMBOL(security_inode_setsecctx); int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp) { - return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, cp); + struct security_hook_list *hp; + struct lsm_context lc; + char *final = NULL; + char *tp; + int rc; + + if (lsm_inode_secctx_count <= 1) + return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, cp); + + hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) { + rc = hp->hook.inode_getsecctx(inode, &lc); + if (rc) { + kfree(final); + return rc; + } + if (final) { + tp = kasprintf(GFP_KERNEL, "%s,%s='%s'", final, + hp->lsm, lc.context); + kfree(final); + } else + tp = kasprintf(GFP_KERNEL, "%s='%s'", hp->lsm, + lc.context); + security_release_secctx(&lc); + if (tp == NULL) { + kfree(final); + return -ENOMEM; + } + final = tp; + } + cp->context = final; + cp->len = strlen(final); + cp->release = lsm_release_secctx; + return 0; } EXPORT_SYMBOL(security_inode_getsecctx); From patchwork Thu Feb 28 22:43:36 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834111 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 796871805 for ; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6D42028EAB for ; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 61E9629192; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 03277290BB for ; Thu, 28 Feb 2019 22:44:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728873AbfB1WoP (ORCPT ); Thu, 28 Feb 2019 17:44:15 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:46311 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727468AbfB1WoP (ORCPT ); Thu, 28 Feb 2019 17:44:15 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393853; bh=zCU06QfSnWUvOOQIGdDJQHUV0K+IFLQD3JU4exaaZTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=tLbxfkwk2AtEcjygfcW+cDEPW6rsafDwz4kcKZlJZcjWo+7Le/5+mP6IytF+uHqPRyH9YuhkwJDfGqr8xHEKOFEgkjdGyL5ByEn5meewq/0EtFiy537rX5GAIWGH5miEN+AdH+ti/53V1Xy/yVSVdlaMoU8qElv8JBVlENrGn6zXzHE3lyqiI509H9wPwF3EdIEIVVi+auMDECH/LxakT6Svk0BZ9kf+xtFTpJWSAzipkRvHdIcHx4nKzVHhYI9oKp/1Q7PnWedy3gKcTjRutwUdSxruKRKOrvJM954SB7mTu3fHcBG9Qf5hUEv+Hu2kwlX1rb1RDppcBnMtXj0kOA== X-YMail-OSG: 159ctkEVM1m4ULjRGYenhBlV1dKq5NLmo6jZqkudgpMZyVhq18J5KCnQTgWtVnL dDQ5dYie0uep73iaRa1uRPPDz7lIMt7qRvmS1FNQbonM6_6FBC4BTh1nY3N.5osPuDaC9udnPZPj n2j0gODITVdRnz2vBPDqr7I_WgFAyix9kvQuxhwvlPfilEp1twpXOeTY_9OPHYalHuCCRRg6R3b9 O5ZPQK7PoeJwdt0H64.7Xq4BTCQmt92ZnVZE5c8nYLm6jRQVPxuELNcodPx3SfFDJBB40zizHOoM y_173FMNZbBgExjNFRgJmFH8DDQEhPGeYIaWcFD4F_FT27m8JpttknzKhUrZdCXbJtcpbW7WN.5L Iodm8DH_GtF4Wt.2dQIj001J1WMn4_DwDkKCdhgQ..Xe8KWVBMsoaKgr3XAutPz3Yhs3df8g.sZc Fyza.yymkwo0vCfLCV.9Dup0n.LAHlFkKhRcfCfVaNFFMBPjU1CoHnJnS8OcCFDet_7dzGr0nkSW irKg.4Yy8e1lFLhC07bHbfV.bnXPQSDH9FIbaTpkNjQiSFbr1wDa9igRSrVnXoAGE_Np4iX8dpiJ I420DcztfgB7XMraHWst.DnZfQ.g4XO9srgU9_fOyWPrpZd7CZKYl55vze4TBBtnF3P3sfE1Syoy nt281jfsNmCnZnN3Q2nsZm2DG43og9BvENHhSHwZC1FOwFwS47DCFlTzn4rswJnG7ngnfvfUHg75 ivDNytZypcSTQfIGcZ8Vr62xutWT0a4pT.ZfWlS7IkyOxzWxzY1AyNJQgwVHCA0wWh0RtYX0ewkt Bp1pQjoSMyWNc9MSS33PS.tgwQLdo5nxxTghSLO.WK32QAIsDG8csK3FQOV_pX7sFTj0KjdLpUib 1VEwmmBIuzn9o27n3WFFBmi8gK.GfgUutHhRxX_Zl8hEzbJvwwLj3LfFtos5IqcZmMeEGxcswB47 qZo5ynI1lMYsxdqzLRMBq4Ks.JOjo.CnDxsAD5ojB1Tg5AR6IBVY0_kY9O5ynfCJgIWY17zN068P vG3JJfxZroUaUpJ9umjXfNsTa0oSSSNWacNTgyAzdN63mJF7mGMhxLr0JyrGGMuJEoiWLzAJ_ymm 9fcJ7lKQH85hkEsf9.EyKjsfO5ViZGCJSR.dYH5RE0f72TXAMZrxGBEk- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:13 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:12 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 77/97] LSM: Correct handling of ENOSYS in inode_setxattr Date: Thu, 28 Feb 2019 14:43:36 -0800 Message-Id: <20190228224356.2608-8-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The usual "bail on fail" behavior of LSM hooks doesn't work for security_inode_setxattr(). Modules are allowed to return -ENOSYS if the attribute specifed isn't one they manage. Fix the code to accomodate this unusal case. This requires changes to the hooks in SELinux and Smack. Signed-off-by: Casey Schaufler --- security/security.c | 28 ++++++++++++++-------------- security/selinux/hooks.c | 7 ++----- security/smack/smack_lsm.c | 10 +++++----- 3 files changed, 21 insertions(+), 24 deletions(-) diff --git a/security/security.c b/security/security.c index bb0eea873a7e..105b5ee22bcf 100644 --- a/security/security.c +++ b/security/security.c @@ -1343,24 +1343,24 @@ int security_inode_getattr(const struct path *path) int security_inode_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) { - int ret; + struct security_hook_list *hp; + int rc = -ENOSYS; if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) return 0; - /* - * SELinux and Smack integrate the cap call, - * so assume that all LSMs supplying this call do so. - */ - ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size, - flags); - if (ret == 1) - ret = cap_inode_setxattr(dentry, name, value, size, flags); - if (ret) - return ret; - ret = ima_inode_setxattr(dentry, name, value, size); - if (ret) - return ret; + hlist_for_each_entry(hp, &security_hook_heads.inode_setxattr, list) { + rc = hp->hook.inode_setxattr(dentry, name, value, size, flags); + if (rc != -ENOSYS) + break; + } + if (rc == -ENOSYS) + rc = cap_inode_setxattr(dentry, name, value, size, flags); + if (rc) + return rc; + rc = ima_inode_setxattr(dentry, name, value, size); + if (rc) + return rc; return evm_inode_setxattr(dentry, name, value, size); } diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index f58c96e2b6c1..501aed18f100 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2998,13 +2998,10 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, int rc = 0; if (strcmp(name, XATTR_NAME_SELINUX)) { - rc = cap_inode_setxattr(dentry, name, value, size, flags); - if (rc) - return rc; - /* Not an attribute we recognize, so just check the ordinary setattr permission. */ - return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); + rc = dentry_has_perm(current_cred(), dentry, FILE__SETATTR); + return rc ? rc : -ENOSYS; } sbsec = selinux_superblock(inode->i_sb); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index c45e2dc3f959..c84c71a31b80 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1194,7 +1194,7 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) rc = -EINVAL; } else - rc = cap_inode_setxattr(dentry, name, value, size, flags); + rc = -ENOSYS; if (check_priv && !smack_privileged(CAP_MAC_ADMIN)) rc = -EPERM; @@ -1208,11 +1208,11 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, rc = -EINVAL; } - smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); - smk_ad_setfield_u_fs_path_dentry(&ad, dentry); - if (rc == 0) { - rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); + smk_ad_setfield_u_fs_path_dentry(&ad, dentry); + rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), + MAY_WRITE, &ad); rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); } From patchwork Thu Feb 28 22:43:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834133 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5BE581805 for ; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4ECF529192 for ; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4320329455; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 955B529192 for ; Thu, 28 Feb 2019 22:44:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728480AbfB1WoV (ORCPT ); Thu, 28 Feb 2019 17:44:21 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:36554 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728775AbfB1WoU (ORCPT ); Thu, 28 Feb 2019 17:44:20 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393858; bh=X8dakGkeNpqur+BQP5PaaGQJmiw+2TNbyOx7dWZIpL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=NYYtVxv79sDcel9zo0Bk2HC78EdMN+YvUWqLZ5JEvShdxy5z1K22lWUV1B2CAX5qJYHTxLfAUmpiTxq+tMXPWuI2UdP1YZ0HtZ79GO8XVqkMxCz9ru1MXzXmB1F/2rGuc8dcIGQzdnIIo4X1jh5ZlnkM1qG379f7qFMPMzTGXdA2DMirEPzmf0Gvt8o6v6WGyuNwBwf8IoID3FwG4eerg4GezH0QM5jJDg/WQEngW/C1cT0pa6aGOBz86CqHmcU82H/isMiYJPwEYr96U8mzz0X7OsZRaDivGyVoSCLMIctmFfHxSdhalBh/5hHH8oaIGTZ0C/rjXzGlYs+BVAQ/LQ== X-YMail-OSG: QZHTLLYVM1nMZwrUtlLmodjlC4s29QGc2F2PaehC2pIHN47I6__nD9Y3TFhLqSy W6u7Ynm1QqtgM652byczGbx1X_UdvaqU4_yoFD4h.Hi_VaWvDPohcrOrvYxHG7l47FFcDYURphfj Vb0aql.jaMqnhCuqFSkgyThv8xcSjvXJxJAcIOFY9.LlEhGyjMiw4LIEc47zvNALoxE6FHAnbWBw kmakiKjnhoqXyeHOWzF.1qTVwzNTKVByXPXLtJoh.emUO4..ccwiHBD7IOnF0TWvkWuDS1BcHPL2 4OfoyHfzqYESRVZjZ6LPIIOdz_4c8F85U9O5pswdMfqOdD5R6pwqjN4uPhfOJmq_YdetmTIWc.r7 OWOVeCw3l2uXHr9bhKclZcDjJhZHQ9PJZ6Uv5.5iof6_E0zFlR5S.STAoHK1.1fB7W.9s7tqdRDN gCgLjor4eAocnOrCiByANk5oVwLOyCPAmDZffP4aslutjysL.COQOzJJYnl.6eX72QSvLx7ZIafR 5xUL6MGW4VHSvEvoUKvMFf3YP0yTLHW9ZURvRrFFq0ulPdp0h8Xdifjxa_s5eI534zGEH7olT_M_ .ZezB0beQihCSR5IJ4EorRcQrjTA6n3lUd8Ms3KKb8dovGdLweqKWjJo3WyaXVyjfbkXsi87SGD1 BmbHErpAOExAax4.xwwg8L7qAN2IOvk3deWjzcIcPmoxLx.oS9YcsMp4NKySVTZx.I25blsaI44D 2IjhO6014amx6Ji7fVTbgaigV2UEqmlsKKyjtdBQHABqnKB0YzTjAI9SdnerX0Z858H.I2Lhx6co l_htjMoxODJyzh8jrwppSXQKpZj6gUTyAKQFfmSlfxNRxi07yW.RTbU2KhO2N4YAJZzAeCbJZN1r oMec8JO0Wdl2h4AcLKZH8qlDxTD3qklA_C90rZhF69rD5vAQjqO_yQHdnmAflhfl.z11q1PtXN2H I0gbcKxoMoSE_E3nVTom3klPhivZkJNB1SNykiqNQNwVEFQcO_RIYhB5vIQb3MkNaiUxyrEVJQ4X ZYas7WBBTdddhEVBw7j9KMb.35YYT_xAAMNIt2LjcFK678NON0gJafVKle_XOSxd_eDAgTTsYVBk _Z7Hzz8nJdB9JZnsAJHYnAJmG5NwqJT1z6ySEzexpMFEkNzzWPAOcFCUn Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:18 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:13 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 78/97] LSM: Infrastructure security blobs for mount options Date: Thu, 28 Feb 2019 14:43:37 -0800 Message-Id: <20190228224356.2608-9-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Manage LSM data for mount options in the infrastructure rather than in the individual modules. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 5 +++++ security/security.c | 18 ++++++++++++++++++ security/selinux/hooks.c | 31 ++++++++++++++++++------------- security/smack/smack_lsm.c | 19 +++++++++++++------ 4 files changed, 54 insertions(+), 19 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 4020e13f0669..58e5465fdd79 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2046,6 +2046,7 @@ struct lsm_blob_sizes { int lbs_key; int lbs_msg_msg; int lbs_task; + int lbs_mnt_opts; }; /* @@ -2119,4 +2120,8 @@ static inline void security_delete_hooks(struct security_hook_list *hooks, extern int lsm_inode_alloc(struct inode *inode); +#ifdef CONFIG_SECURITY +void *lsm_mnt_opts_alloc(void); +#endif + #endif /* ! __LINUX_LSM_HOOKS_H */ diff --git a/security/security.c b/security/security.c index 105b5ee22bcf..780c914df9fb 100644 --- a/security/security.c +++ b/security/security.c @@ -194,6 +194,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) #ifdef CONFIG_KEYS lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key); #endif + lsm_set_blob_size(&needed->lbs_mnt_opts, &blob_sizes.lbs_mnt_opts); lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); @@ -328,6 +329,7 @@ static void __init ordered_lsm_init(void) #ifdef CONFIG_KEYS init_debug("key blob size = %d\n", blob_sizes.lbs_key); #endif /* CONFIG_KEYS */ + init_debug("mnt_opts blob size = %d\n", blob_sizes.lbs_mnt_opts); init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); @@ -738,6 +740,21 @@ int lsm_superblock_alloc(struct super_block *sb) return 0; } +/** + * lsm_mnt_opts_alloc - allocate a composite mnt_opts blob + * + * Allocate the mount options blob + * + * Returns the blob, or NULL if memory can't be allocated. + */ +void *lsm_mnt_opts_alloc(void) +{ + if (blob_sizes.lbs_mnt_opts == 0) + return NULL; + + return kzalloc(blob_sizes.lbs_mnt_opts, GFP_KERNEL); +} + /* * Hook list operation macros. * @@ -941,6 +958,7 @@ void security_free_mnt_opts(void **mnt_opts) if (!*mnt_opts) return; call_void_hook(sb_free_mnt_opts, *mnt_opts); + kfree(*mnt_opts); *mnt_opts = NULL; } EXPORT_SYMBOL(security_free_mnt_opts); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 501aed18f100..e149be6226d6 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -381,14 +381,20 @@ struct selinux_mnt_opts { const char *fscontext, *context, *rootcontext, *defcontext; }; +static void *selinux_mnt_opts(void *mnt_opts) +{ + if (mnt_opts) + return mnt_opts + selinux_blob_sizes.lbs_mnt_opts; + return NULL; +} + static void selinux_free_mnt_opts(void *mnt_opts) { - struct selinux_mnt_opts *opts = mnt_opts; + struct selinux_mnt_opts *opts = selinux_mnt_opts(mnt_opts); kfree(opts->fscontext); kfree(opts->context); kfree(opts->rootcontext); kfree(opts->defcontext); - kfree(opts); } static inline int inode_doinit(struct inode *inode) @@ -614,7 +620,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, const struct cred *cred = current_cred(); struct superblock_security_struct *sbsec = selinux_superblock(sb); struct dentry *root = sbsec->sb->s_root; - struct selinux_mnt_opts *opts = mnt_opts; + struct selinux_mnt_opts *opts = selinux_mnt_opts(mnt_opts); struct inode_security_struct *root_isec; u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0; u32 defcontext_sid = 0; @@ -629,7 +635,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, server is ready to handle calls. */ goto out; } - rc = -EINVAL; + /* Don't set any SELinux options. Allow any other LSM + that's on the stack to do so. */ pr_warn("SELinux: Unable to set superblock options " "before the security server is initialized\n"); goto out; @@ -953,16 +960,17 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, static int selinux_add_opt(int token, const char *s, void **mnt_opts) { - struct selinux_mnt_opts *opts = *mnt_opts; + struct selinux_mnt_opts *opts = selinux_mnt_opts(*mnt_opts); if (token == Opt_seclabel) /* eaten and completely ignored */ return 0; if (!opts) { - opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL); + opts = lsm_mnt_opts_alloc(); if (!opts) return -ENOMEM; *mnt_opts = opts; + opts = selinux_mnt_opts(opts); } if (!s) return -ENOMEM; @@ -1015,10 +1023,8 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len, rc = selinux_add_opt(token, val, mnt_opts); if (unlikely(rc)) { kfree(val); - if (*mnt_opts) { + if (*mnt_opts) selinux_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; - } } return rc; } @@ -2583,10 +2589,8 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) rc = selinux_add_opt(token, arg, mnt_opts); if (unlikely(rc)) { kfree(arg); - if (*mnt_opts) { + if (*mnt_opts) selinux_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; - } return rc; } } else { @@ -2609,7 +2613,7 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) { - struct selinux_mnt_opts *opts = mnt_opts; + struct selinux_mnt_opts *opts = selinux_mnt_opts(mnt_opts); struct superblock_security_struct *sbsec = selinux_superblock(sb); u32 sid; int rc; @@ -6532,6 +6536,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { #ifdef CONFIG_KEYS .lbs_key = sizeof(struct key_security_struct), #endif /* CONFIG_KEYS */ + .lbs_mnt_opts = sizeof(struct selinux_mnt_opts), .lbs_msg_msg = sizeof(struct msg_security_struct), .lbs_sock = sizeof(struct sk_security_struct), .lbs_superblock = sizeof(struct superblock_security_struct), diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index c84c71a31b80..f1e0f1378666 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -573,26 +573,33 @@ struct smack_mnt_opts { const char *fsdefault, *fsfloor, *fshat, *fsroot, *fstransmute; }; +static void *smack_mnt_opts(void *opts) +{ + if (opts) + return opts + smack_blob_sizes.lbs_mnt_opts; + return NULL; +} + static void smack_free_mnt_opts(void *mnt_opts) { - struct smack_mnt_opts *opts = mnt_opts; + struct smack_mnt_opts *opts = smack_mnt_opts(mnt_opts); kfree(opts->fsdefault); kfree(opts->fsfloor); kfree(opts->fshat); kfree(opts->fsroot); kfree(opts->fstransmute); - kfree(opts); } static int smack_add_opt(int token, const char *s, void **mnt_opts) { - struct smack_mnt_opts *opts = *mnt_opts; + struct smack_mnt_opts *opts = smack_mnt_opts(*mnt_opts); if (!opts) { - opts = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL); + opts = lsm_mnt_opts_alloc(); if (!opts) return -ENOMEM; *mnt_opts = opts; + opts = smack_mnt_opts(opts); } if (!s) return -ENOMEM; @@ -654,7 +661,6 @@ static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts) kfree(arg); if (*mnt_opts) smack_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; return rc; } } else { @@ -697,7 +703,7 @@ static int smack_set_mnt_opts(struct super_block *sb, struct superblock_smack *sp = smack_superblock(sb); struct inode_smack *isp; struct smack_known *skp; - struct smack_mnt_opts *opts = mnt_opts; + struct smack_mnt_opts *opts = smack_mnt_opts(mnt_opts); bool transmute = false; if (sp->smk_flags & SMK_SB_INITIALIZED) @@ -4501,6 +4507,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { #ifdef CONFIG_KEYS .lbs_key = sizeof(struct smack_known *), #endif /* CONFIG_KEYS */ + .lbs_mnt_opts = sizeof(struct smack_mnt_opts), .lbs_msg_msg = sizeof(struct smack_known *), .lbs_sock = sizeof(struct socket_smack), .lbs_superblock = sizeof(struct superblock_smack), From patchwork Thu Feb 28 22:43:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834125 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1A88B1390 for ; Thu, 28 Feb 2019 22:44:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B7F128EAB for ; Thu, 28 Feb 2019 22:44:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0025A29192; Thu, 28 Feb 2019 22:44:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E00D28EAB for ; Thu, 28 Feb 2019 22:44:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729133AbfB1WoU (ORCPT ); Thu, 28 Feb 2019 17:44:20 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:32944 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728903AbfB1WoU (ORCPT ); Thu, 28 Feb 2019 17:44:20 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393858; bh=q6uoWrAShVrIzUTRZ/xFtGhPWu+7m7/p+agiDK8IfOs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=cNUW0tGkIopZ2dGhEWsVDhs+wm5ei7NYgaeaBXyVHsn2565YdmKqrTx5oZfsdBSpQciezA2SwJCVsaOj2PlpVirjw5gVjKIr/G48abhUNasKHJeKNtq99F4CtIDleLnwrJhJfieJow2R/WaJguAGBWVSSw/uoLfmwY2OepWvR00k4qoS4W3YqQb6fE/N+2o7slqCKzEqNbHcbXvFkrJiqSYgBNbEF+VTyx1y9PurcteAIbte6NqAEvDKV65DYTUnT59YsuaKkqPFUNpGec95msHpUMNlYgBia2jo4uHC1NddUHR9U+OI769zwOjqoN3/em9vgPrMZ1LIyTQ64Fa+ow== X-YMail-OSG: QCWsTtUVM1nDT5rOHpJtMnRxa1dhZYm9mmtloCJL3DxK5Il7UY.3NQXq5KjXFub RtRFDnceqmnAb0PLQglRDtfJrM70Id3sMkdjvQV5z77SzsC4yjqpSkV72DATKnrvAEgSSHctff9A TBLrhmJc9CdmdJc8AQU3MM81fUskWovBsMgLgkqPjT0OZ.SQg9jUpRX6UQcXzkcKchz6Szd9Bh_f 1fXGH5KpN.80DcpFY6S2JfeEwZ98VajDViLw8YVfwa.yH7wxYeB7CFnZ.s8bBgv7BHSTrOVoMSd4 MEylMyYmwfTVRCN8e.e7Dtzqh09n2ixhCEDWws0VQM4gWgCGi2eHJjXONLhcVGU2P01Pk4yuygTf VyGdMMl8RtR987Xzs_8Wb1gZHHmumULwGyKnhW8.RrpcKmhgpuSpuLmhaSYtQ._RaKH.I04Vgj60 Ej2pzVgXEomNu39aqFrC7XwJO2ascZJLTizwm1zYUxO8HzjfHQQu245yK2doFzBU19VqWcZKSXAy t2TzJSo.AiALd2nYKYKStwo1McFBDmX67BOIPbM2uQbL86C3vf99Dr5miKEy47Lr815fBKPMWAAX 976WjJAyexuRO60ksVVlQSdIVj_.EUWTiogvlLIuZrFzPcqgS7cj8NLYwcD0Pw0Yyoai.w7abtl5 oxyz2zMtMefQv9IiPmIEE2of5r6xb4KonwxS0tP7YsSid0yDGJlPxYldwbiQ_zOWGRsDVirZXo6h pxLmE9PIBxr5hGmnuTk_jq5rygM0OqYoXkTJdncD730ki36iWEXzDPEt9cjvUE1xci8iGEc96o6g dVAgYGsd2gt38831ou_Zf9PhtzhfHdSX_K4xK2cuceQFVeXkBZCcRazP4SMBcfDhO3j31Ydg.Sf2 56gfwry2KNll6HjxOjC.uSVnAp2zEz2yesMF2rKnSP3jEAOC0jLJdbbNwfoNcpEZuZk9h8rG1adn pzwa83438n4AxY70VCgteCD92QpPqTpUikjyM8mzjAnbcpyiRvxOxJbSGbuZ7HsZwiXL_r2Y.c_n f4U4Z.36kzQ3DuqdQzUx00uvbKIjUzrx9UuUoe1uC0HJvJLlF.oHVhphobbdkWka5DFVbxHKaNk2 FlVRMVH9CI26kCBt9joNPa_JAu9xS8kTU2bpSnwFCLmRODFNTnrgpBtTc Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:18 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 731ec5e129ec3fdeedd3a533970a7e62; Thu, 28 Feb 2019 22:44:15 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 79/97] LSM: Fix for security_init_inode_security Date: Thu, 28 Feb 2019 14:43:38 -0800 Message-Id: <20190228224356.2608-10-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The code assumes you can call evm_init_inode_security more than once for an inode, but that won't work because security.evm is a single value attribute. This does not make EVM work properly, but does allow the security modules to initialize their attribures. Signed-off-by: Casey Schaufler --- security/security.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/security/security.c b/security/security.c index 780c914df9fb..c4265ceb6dd0 100644 --- a/security/security.c +++ b/security/security.c @@ -1104,11 +1104,24 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, if (unlikely(IS_PRIVATE(inode))) return 0; - if (!initxattrs) - return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, - dir, qstr, NULL, NULL, NULL); + if (!initxattrs) { + rc = -EOPNOTSUPP; + hlist_for_each_entry(p, + &security_hook_heads.inode_init_security, + list) { + rc = p->hook.inode_init_security(inode, dir, qstr, + NULL, NULL, NULL); + if (rc == -EOPNOTSUPP) { + rc = 0; + continue; + } + if (rc) + break; + } + return rc; + } - repo = kzalloc((LSM_COUNT * 2) * sizeof(*repo), GFP_NOFS); + repo = kzalloc((LSM_COUNT + 1) * sizeof(*repo), GFP_NOFS); if (repo == NULL) return -ENOMEM; @@ -1119,18 +1132,20 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, rc = p->hook.inode_init_security(inode, dir, qstr, &repo[i].name, &repo[i].value, &repo[i].value_len); + if (rc == -EOPNOTSUPP) + continue; if (rc) goto out; - rc = evm_inode_init_security(inode, &repo[i], &repo[i + 1]); - if (rc) - goto out; - - i += 2; + i++; } + rc = evm_inode_init_security(inode, &repo[i], &repo[i + 1]); + if (rc) + goto out; + rc = initxattrs(inode, repo, fs_data); out: - for (i-- ; i >= 0; i--) + for (i++ ; i >= 0; i--) kfree(repo[i].value); kfree(repo); return (rc == -EOPNOTSUPP) ? 0 : rc; From patchwork Thu Feb 28 22:43:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834135 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7071D18EC for ; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6218828EAB for ; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5694D290BB; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 025C1293B8 for ; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729181AbfB1WoV (ORCPT ); Thu, 28 Feb 2019 17:44:21 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:40373 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728893AbfB1WoU (ORCPT ); Thu, 28 Feb 2019 17:44:20 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393858; bh=/hckqGWaPxP0IFAvTcxg8keP+3zAVRCdGN1rW1SVv0Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=UexpzEGVcfYDJEqpBcLfcaVDj3gqUeC61Zdnhg7nLq0KY51wS8wlvqiwvsz2u2bC9c93jKxd0ZXxViSqJ0SvhUe9aw/KqHRHW7i2PpOY52JPGKmEIbJJbX9axwB/27UnkJswhDJa3KFcmFPOmZfl0bD2SBN/Dr7dIWuKlfLBR8ZCmX77gBJu/bMf52tlHdFGJw3sBTIU+m9j3FIryALnRCg/2mQxepDI4JUdFyBgXzf37zyKRFHkVozt7TQkGzPLyn9ansx8NbUrHYlfrFNFG0+biw63+Rv+AjMK/3BwW7MR2sjNUCjDQdg51PUEiCYTNpLzDGHQclTQJMS3O7fhDA== X-YMail-OSG: yrc1LbsVM1k_hBnRZOipsrHLBPot31hGlJj4Y3oHJDTJ_heWLnM3oT0e5mQZHN3 mmrK25HpIGjyHKkJK4T6vIS8U8QooxjIeiL_j_Py19NDSk9gW2eHCeyxiGeWmouRbbmGV.AR0ztU HZ9knRJlCl4hQIvPU9QO4QLMknXLoRZ4_ytHsMB3pUA19xmphI.SywT45PLnbHdbzvxPmh6bWzla pAAR1GkL5lJwIEW213rYjfQGJrJJX6RVsq_SkQG46Fzl.fv.K3ZPxEDNg_iGas3Hn3GNxXg7Uzx5 UbQzoB6M4Qk9FfY20ZFQN1oNeDRc4jnWaBlw0K5REGs8qqohx44S6ZEdf2Kb4dg9uP5vJ8nbljKH jSdV_IJKH0dgmQ8Pid3sUvtRpGCx9lUMvR.PpRhkjUlmNlDm4NEx2P11M2oW_VlX09Ay4wxtsRJK kwNj_RZIkDhrLlyaNZ9p7.I4_s77KL2WDQ_U1pjQaWWPebum8Ybx4nUUMZiPt3gTn6aNrZmY3x0w r2JofOj7ZUd_XGgN3tExVfRmcA9oG6TlTpsA2.3guxjoAB3Lmi2KFFkRg8d0jcjRsB6PLsKv6ynZ hoG2bNKCByiiKN7yCsEiypFBJWkk48i0FhWey21vD6od0VT.3w6XmMxgOaDaP1NwZPlsyKFn6a.9 1Kab11by4Rh3IxTx6VS6eSigDPjoeaMz09YpsqPpy_UbQ84b0VbXuj9JMFTXJRhOnTH8DckAf0Oc cPBkB9FEPVrOHhKUv3ownt2i1bN2IuFoMiDk77WF6B1WhnNn9WmPRLJfb9J5AXbrkaLxQE1VwSXX xoLXW6VA64uPU48f2AyTg2NucyRHhho8G1MxG9oYalxl1byqtiJthr4.olggPdr9zUOPPgdeuXHB CxHyzt.T3aZp6SB9DXZZDQl5jCGY.0TGLVnOIhT96eu1Sw2eCHbYF1.JwdloBF9tp0F.PXTY3S2C kcTkpMhirG1lQNzVx9A5MkcGGl541CmPGCzl9ZgYbwg218x7.iEondeQPeturCvJiSNLODHIBu78 uW_pTcOmgc14fwdJgxy1uSm.Q.csSe2Ju__sGJqHNr_UUnatBeWykh.iSMKjc0qq4sEkBx_ASBRi nmdSEONu4TlVoDdHh1EYy0bYPOwA0b4H9EPa.qDSHwFQM3DLQ_FSTF7s- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:18 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:17 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 80/97] Smack: Advertise the secid to netlabel Date: Thu, 28 Feb 2019 14:43:39 -0800 Message-Id: <20190228224356.2608-11-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add the secid to the attributes shared with netlabel. Signed-off-by: Casey Schaufler --- security/smack/smack_access.c | 8 ++++++-- security/smack/smackfs.c | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index fe2ce3a65822..0764bb85daee 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -549,8 +549,12 @@ struct smack_known *smk_import_entry(const char *string, int len) skp->smk_known = smack; skp->smk_secid = smack_next_secid++; skp->smk_netlabel.domain = skp->smk_known; - skp->smk_netlabel.flags = - NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; + lsm_export_init(&skp->smk_netlabel.attr.le); + skp->smk_netlabel.attr.le.flags = LSM_EXPORT_SMACK; + skp->smk_netlabel.attr.le.smack = skp->smk_secid; + skp->smk_netlabel.flags = NETLBL_SECATTR_DOMAIN | + NETLBL_SECATTR_MLS_LVL | + NETLBL_SECATTR_SECID; /* * If direct labeling works use it. * Otherwise use mapped labeling. diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 28c567465f6c..abaa5325c32f 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -2953,8 +2953,12 @@ static struct vfsmount *smackfs_mount; static int __init smk_preset_netlabel(struct smack_known *skp) { skp->smk_netlabel.domain = skp->smk_known; - skp->smk_netlabel.flags = - NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; + lsm_export_init(&skp->smk_netlabel.attr.le); + skp->smk_netlabel.attr.le.flags = LSM_EXPORT_SMACK; + skp->smk_netlabel.attr.le.smack = skp->smk_secid; + skp->smk_netlabel.flags = NETLBL_SECATTR_DOMAIN | + NETLBL_SECATTR_MLS_LVL | + NETLBL_SECATTR_SECID; return smk_netlbl_mls(smack_cipso_direct, skp->smk_known, &skp->smk_netlabel, strlen(skp->smk_known)); } From patchwork Thu Feb 28 22:43:40 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834143 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7226D1805 for ; Thu, 28 Feb 2019 22:44:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 622942FA84 for ; Thu, 28 Feb 2019 22:44:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 562302FB96; Thu, 28 Feb 2019 22:44:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 90E212FB62 for ; Thu, 28 Feb 2019 22:44:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729874AbfB1Wo1 (ORCPT ); Thu, 28 Feb 2019 17:44:27 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:42279 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729286AbfB1WoZ (ORCPT ); Thu, 28 Feb 2019 17:44:25 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393863; bh=0V5B3ZJvSl2yLA32HH/6eUckEyfPwaN1P5MtJbG6pQs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=kQ9go5BO0EgXbUYlJbRywr6x0AmAXAXZD1nofyPNTDVcxz/IWhGn4im3LSBLTm4BdjZ+/6xzvJQbJHrHao5cWPsj38DFlxzhIo+udvEWZ6s9twLcY7nNxjq2u0izNzsWFuL/kM3PUfOW/K5Z0CA1rJUzdNTGb06wxeU0CR3ebHlAGz82OKvACRwd38EDXyzYq1TrKM82guJAM6uJL/zn8KkYFpgWcRHV5woL62+qOwkg01MKohEtLNItiqStPy3bxY6QqTZO/SJ2YSU3vEt3Samb5sFJKnzmNJu6Q4NDdixgwMjPghyq6WmmUexti8drTJmilsas3+fn5djU5EvZdA== X-YMail-OSG: 0tJUDOoVM1l7zshoOcLVHopcK4lT4sFxB2NxB5PUU6D8g15Tu9Kgtx7CNPAD1GO CvZjtP9IJunZWaMIhdxHQSL3qkq1dnKomJE76rcI6971bAhsSiNsDeB83pltsVg8L20AbMiO0A5j 03cuKI5TeZQ6OmGmmdvD3WrP6v1k9I9ptMoMJOnyjDfKj_kXMty9o8yJrJIK00gAlQH_9t_T6axP gopaCpO.9IX44TonHtUfk1N.NVzO4w9BdpAHV4NfDPc2LD2j3GcCs_GTpjzJB8Fore.Q_NjN99Xf Y4PGGBW2hkASff7y6cgD3gpLhmP5qCmMRsJvWdzqw6W9.GOQI36EpNA_jelnQQFfhJEzU3tb2iB5 IeC.4IHmFR1rN281KMfLM3.W0NshSNTGVXHUw9x7Ev_VNjwMOLmBZefxrN7v6TIr46UXYCUk4rtp rRDdMg411YK.SE4Ki53QMj_tv.77LN7cI6CDyzDf5DeyeqeYujnnb70OOKVkpKbqo6NxGIFrM43i .M7zFktFTMhNFxOFRcFw5nMqB1LHCEryTPcURX1E9l2X_dkQbZOboPXJXeYPrgEr0lBTm0zgW8NE x7uKlEBnct0uoWC_6BWkPV9L9XOW5s1DcV5NglfWBpWhErC4oprzjCagpEdKw8kUC2MIBR4r6MG5 Kp5vQKVgHGVWmTmvzg3DnqF697B7OjsJbhvP3D_duXoWlF8BwE14GMz.TvYsZ8SXdelrJWoOFj1F Qe4ADWVFmTBcK8OuglU2t6jYWcBgy3N_RS8RB6eTQPs2H75LjReZs2oITP5gn6IKLYW6QaWARREf NVQU9qi_8.H1EzR6ghOs8n1YC4HsN30RnUJycXAHtLXTjVmleSeeSvDkTC5T8S819amZodFCann1 bQDBwCxCNn_fwmxNZpsP9JGAWiPmYkhU7llhNE8U2K_e6NKr.ktMQXMZlEJq4NxJ0QFJgMvMAmsl 5vw.yoO1vSddO3skF2fBQqOTl0Hmw_nZoqVz6SO1_ONRufuTijWJXGR_OhWtXkDqzfkoEaktvm7C e1nFdMdfzfewakwjSKxxB75B_2r247CQEKZaFwfhrSEiMx.kUjGsQXufZmddN0soK233lLaPE5Ma gStFEmmjoA4m.D6G0VY0htGdgdVewWiUOlezHgqhZsovxgr.FkzBTofU- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:23 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:18 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 81/97] LSM: Change error detection for UDP peer security Date: Thu, 28 Feb 2019 14:43:40 -0800 Message-Id: <20190228224356.2608-12-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP security_socket_getpeercred_dgram() supplies secids for use by security_secid_to_secctx(). Sometimes a secid will be invalid. Move the check for an invalid secid from the LSM specific socket_getpeercred_dgram hooks into the secid_to_secctx hooks. This allows for the case where one LSM (Smack) will provide a secid and another (SELinux) to have an error for the same call. Regardless of which LSM the caller wants to see the peer security attributes for the correct result will be provided. As there is no longer any reason for security_secid_to_secctx() to return a value make all the secid_to_secctx functions void instead of int. Add checking for a invalid secid to the Smack and SELinux secid_to_secctx hooks. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 3 +-- include/linux/security.h | 11 +++++------ net/ipv4/ip_sockglue.c | 4 +--- security/security.c | 7 +++---- security/selinux/hooks.c | 13 +++++++------ security/smack/smack_lsm.c | 17 ++++++++--------- 6 files changed, 25 insertions(+), 30 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 58e5465fdd79..fec7f86897ea 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -867,7 +867,6 @@ * @sock is the socket * @skb is the skbuff for the packet being queried * @l is a pointer to a buffer in which to copy the security data - * Return 0 on success, error on failure. * @sk_alloc_security: * Allocate and attach a security structure to the sk->sk_security field, * which is used to copy security attributes between local stream sockets. @@ -1681,7 +1680,7 @@ union security_list_options { int (*socket_getpeersec_stream)(struct socket *sock, char __user *optval, int __user *optlen, unsigned len); - int (*socket_getpeersec_dgram)(struct socket *sock, + void (*socket_getpeersec_dgram)(struct socket *sock, struct sk_buff *skb, struct lsm_export *l); int (*sk_alloc_security)(struct sock *sk, int family, gfp_t priority); diff --git a/include/linux/security.h b/include/linux/security.h index cb392c6b620f..7edceb91d77f 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1274,8 +1274,8 @@ int security_socket_shutdown(struct socket *sock, int how); int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb); int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, int __user *optlen, unsigned len); -int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, - struct lsm_export *l); +void security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, + struct lsm_export *l); int security_sk_alloc(struct sock *sk, int family, gfp_t priority); void security_sk_free(struct sock *sk); void security_sk_clone(const struct sock *sk, struct sock *newsk); @@ -1413,11 +1413,10 @@ static inline int security_socket_getpeersec_stream(struct socket *sock, char __ return -ENOPROTOOPT; } -static inline int security_socket_getpeersec_dgram(struct socket *sock, - struct sk_buff *skb, - struct lsm_export *l) +static inline void security_socket_getpeersec_dgram(struct socket *sock, + struct sk_buff *skb, + struct lsm_export *l) { - return -ENOPROTOOPT; } static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 56035b53952d..ae69718d87ae 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -134,9 +134,7 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) struct lsm_context lc; int err; - err = security_socket_getpeersec_dgram(NULL, skb, &le); - if (err) - return; + security_socket_getpeersec_dgram(NULL, skb, &le); err = security_secid_to_secctx(&le, &lc); if (err) diff --git a/security/security.c b/security/security.c index c4265ceb6dd0..ab1050a2dce3 100644 --- a/security/security.c +++ b/security/security.c @@ -2414,12 +2414,11 @@ int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, optval, optlen, len); } -int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, - struct lsm_export *l) +void security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, + struct lsm_export *l) { lsm_export_init(l); - return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock, skb, - l); + call_void_hook(socket_getpeersec_dgram, sock, skb, l); } EXPORT_SYMBOL(security_socket_getpeersec_dgram); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e149be6226d6..22a190f291c0 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4835,9 +4835,9 @@ static int selinux_socket_getpeersec_stream(struct socket *sock, return err; } -static int selinux_socket_getpeersec_dgram(struct socket *sock, - struct sk_buff *skb, - struct lsm_export *l) +static void selinux_socket_getpeersec_dgram(struct socket *sock, + struct sk_buff *skb, + struct lsm_export *l) { u32 peer_secid = SECSID_NULL; u16 family; @@ -4860,9 +4860,7 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, out: selinux_export_secid(l, peer_secid); - if (peer_secid == SECSID_NULL) - return -EINVAL; - return 0; + return; } static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority) @@ -6206,6 +6204,9 @@ static int selinux_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) u32 secid; selinux_import_secid(l, &secid); + if (secid == SECSID_NULL) + return -EINVAL; + cp->release = selinux_release_secctx; if (l->flags & LSM_EXPORT_LENGTH) return security_sid_to_context(&selinux_state, secid, diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index f1e0f1378666..a4c8f93534ec 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3902,9 +3902,9 @@ static int smack_socket_getpeersec_stream(struct socket *sock, * * Sets the netlabel socket state on sk from parent */ -static int smack_socket_getpeersec_dgram(struct socket *sock, - struct sk_buff *skb, - struct lsm_export *l) +static void smack_socket_getpeersec_dgram(struct socket *sock, + struct sk_buff *skb, + struct lsm_export *l) { struct netlbl_lsm_secattr secattr; @@ -3912,7 +3912,6 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, struct smack_known *skp; int family = PF_UNSPEC; u32 s = 0; /* 0 is the invalid secid */ - int rc; if (skb != NULL) { if (skb->protocol == htons(ETH_P_IP)) @@ -3942,8 +3941,7 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, if (sock != NULL && sock->sk != NULL) ssp = smack_sock(sock->sk); netlbl_secattr_init(&secattr); - rc = netlbl_skbuff_getattr(skb, family, &secattr); - if (rc == 0) { + if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) { skp = smack_from_secattr(&secattr, ssp); s = skp->smk_secid; } @@ -3958,9 +3956,7 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, break; } smack_export_secid(l, s); - if (s == 0) - return -EINVAL; - return 0; + return; } /** @@ -4373,6 +4369,9 @@ static int smack_secid_to_secctx(struct lsm_export *l, struct lsm_context *cp) u32 secid; smack_import_secid(l, &secid); + if (secid == 0) + return -EINVAL; + skp = smack_from_secid(secid); cp->context = (l->flags & LSM_EXPORT_LENGTH) ? NULL : skp->smk_known; From patchwork Thu Feb 28 22:43:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834141 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E2D9C1390 for ; Thu, 28 Feb 2019 22:44:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D31B52FA84 for ; Thu, 28 Feb 2019 22:44:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C74802FB96; Thu, 28 Feb 2019 22:44:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5C8102FA84 for ; Thu, 28 Feb 2019 22:44:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729976AbfB1Wo0 (ORCPT ); Thu, 28 Feb 2019 17:44:26 -0500 Received: from sonic302-10.consmr.mail.bf2.yahoo.com ([74.6.135.49]:43999 "EHLO sonic302-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729874AbfB1Wo0 (ORCPT ); Thu, 28 Feb 2019 17:44:26 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393864; bh=HtMHoChzx596drToVKA+SEbhFoEB1xjjcsaTIP+e+fs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=OsepPYFRW8eV4/GP6YRK8ZtOrgX0OUHnBXsVsGlsVBBGE5S9N/5lNcAcyAcPd6EavYNrTEvK3Yeqc32m+WVnheHPyC+xqgNsYboihoUWKVs/sby7EUdJrj/zlv8RQjFBP+f9tFsr2MR1E71jDAg5OKG2PTCxUwjMKf25uflfC4QtkioGRn9RYjhccDtG3v29jU0jvF+Jvxx2AqZcRPT0cnD7tocVFuXkhnrARNNlwT/TjCEmuIV82a4+0NT3b3ONSeMKzIUvselNmTXp1YyL+a1M5jBCazqwdaO7/4gl/GWWvW01qkVa91meoNl+XyxozFLDd3AgKrINWCfEZ3ixBQ== X-YMail-OSG: 6Q7VBNYVM1mz8WdDv..HddDemXEIJOPoTXDSHzdE2DAGqJkvhvxwTurtB3ZWbri 20foMEB2gEViARjPYV5v.JeLO8sCKgRIelWGXPYObAPQhOSGYmUCjkIK6ANLfsrbNypstIM2.l5P bQF7wC_4eg_UYnSvWofsfrajCblewq4gEDpptQZtyLU9To2j3rLmO6lLm9A8dvVxHzQoXKpFoAA9 .RBZA5KTsJ4oCZhIUZfflZydEaBqdIFt0rFw5aiyqZWzBD31AwUxH235_mfgCHTj9QIMkN.u8UIb edHD19m5bIoLm.mEhnl47LTPyo1efYQJbpGt9l8ODJ_i0t3qstbHZViAbpnUZNH5XtKJSNYfwx.Q ra9K7.c1Sm_vlL9GSQ5_.NNglffrmzfFUUoiti.lw0gwvg_7WYYuPvQRTJyDcnxCiNSipvuqXzLV OgVfzwiSh90G3GsnKYOTkOLQMbzYD6LynPOoFpDCq8KRI0gouLbyyNsQ0flko3iO1d2SeTCD19JU zwZlLcQJKohTpICKX33KmnAd2MqmJW_mHyxtAv2nYd6UuwLU1Y_pGemRuZM1iaA4t7q7z3Y_M_H9 8kD.HojZOAsobd_f_wzf5DqYrGn7okqQXxYSK8ciDC9rxXyT_MqzCn8JdTNvU7vdEOAviUBoLQAS MlVhtUPN4Gd.RgKRhwIyYGNNyo4w8Lc.Qw.2dqZnyNi.daOibL9zziNDTa.fDj4o_rzFqM7101kA NpuvFlctp0rTO_Z7mnRZTYZHzOmueHl8N_ES9tokbtGrb4pmFd7miDareHE6MT3cMAf7zsqyKEIw acbSMFCjwBRUab9RTAU2QHx4R4ps5bPTeT7RRXAjroOasclUTG2m31P2nazLVU0yhmJxV3Djp7Er lSu4MpXPqKM9upHJvX5Px3IcLmuMNXmeQ36IiZJa7KQ1cQW8Gq2PwVv33czU5bbRlPNwu0GOFW_0 HIN0GBfAKGHpm7k5idlNT_jQGugsxbog7gsrITa8ERFAKkOEhVCLqlPNLCodCh._KdznqCdEUjQ8 lIQsas2ShDYZAMvMdf2v.5nOI.MrskRBCDokgCbv2hYAdX9Nsx5kA8u5vQMaQM0i_ESY2_CtTOp1 IM.FVgZlxPgAXKxrS_lyeLbiMVLdgIJbQmuQ6b_g43LaOOEsZcqms9gc- Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:24 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:19 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 82/97] Smack: Fix setting of the CIPSO MLS_CAT flags Date: Thu, 28 Feb 2019 14:43:41 -0800 Message-Id: <20190228224356.2608-13-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Don't tell CIPSO that a netlabel created by Smack has categories set whenit doesn't. Signed-off-by: Casey Schaufler --- security/smack/smack_access.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index 0764bb85daee..5fe5c6799b27 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -494,8 +494,8 @@ int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap, int cat; int rc; int byte; + bool has = false; - sap->flags |= NETLBL_SECATTR_MLS_CAT; sap->attr.mls.lvl = level; sap->attr.mls.cat = NULL; @@ -503,6 +503,7 @@ int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap, for (m = 0x80; m != 0; m >>= 1, cat++) { if ((m & *cp) == 0) continue; + has = true; rc = netlbl_catmap_setbit(&sap->attr.mls.cat, cat, GFP_KERNEL); if (rc < 0) { @@ -511,6 +512,9 @@ int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap, } } + if (has) + sap->flags |= NETLBL_SECATTR_MLS_CAT; + return 0; } From patchwork Thu Feb 28 22:43:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834137 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 71C571399 for ; Thu, 28 Feb 2019 22:44:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6309328EAB for ; Thu, 28 Feb 2019 22:44:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 57C9629307; Thu, 28 Feb 2019 22:44:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0FBF728EAB for ; Thu, 28 Feb 2019 22:44:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729783AbfB1WoY (ORCPT ); Thu, 28 Feb 2019 17:44:24 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:36641 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728881AbfB1WoY (ORCPT ); Thu, 28 Feb 2019 17:44:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393863; bh=TzQHmUUpIugfXaNsfKgpGmemY9fdQW/IsocvY7CubrA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=LPQhkxA1ommSYPBRQGsaV2kmbFQ2ro9dPPU2L2hdC5Zz4aQA3orhHvKQbKf0+IScnrJxFya27Ujq+71YCJNiBiCE8bBpSLkScD5K0ZxhtaLauM6Ase+bLUoOpycRY8pjstyXJViBhycAKJJcov64CLazVDS7YhU407HgZDN5GZ83XARCDHTRA3SE09CUFT0U8VoU8qeBqy+7D31hSu6F6R0awfrxLQFru9zgzgx4/U/NdtMSO9IlSgnx6EiTfcs6OfcsxY/F41BpZUV/j9BmEQkxJ/N5/nGlhtknO8o0h/zhx7CKuDn2F0JLUAd963cLMKdvgSwhYWqap6gqDxs6pg== X-YMail-OSG: rHxqlIUVM1ntjIleLcjVf_p35_qx_VosemNMlGzcqJ8g96gsRqeihugXYbPnr8X sHFppleMOfD5_IO0Vy5tsxeQM2VNK_GeNQwS_aCcCgT_UBeS_plSvhMWGcoc5WgHFtn19OBrc1cy fzUZC8WAYUija0PRg5hF1Woa3kpv8HajctnBFua.grLRTVF4jQLQ4ry8D23y.yeUeQOGnWhqDAdo GFLUYXAhUCAdlQ5mqTx76Sm0aurZCc_EQCxd3r3T8J2nGRCR1kvS3GIN3G3mqgT0Sul9t9DVqrVO Te6Vgf4dP65OULanx8Ho4HWVx1_RNaVcy_3yicxDd2TNAXepDYy2GOKK0vV1Q0.uHomZyxhlmQhU lRzRctDiTVNK650yk37w7XNXu1tfoShrz8GYBK_Xwh5tC4.m1uygmbmLwPAP4L6ohcPAIyrBYkyt V8I_MAfwWb5MPPl4KFYtMKyeZNg.4gYCjub0PbT_JuAy7tcgBe29EBuWb8iV3DJgj1ZE4vgdxFv9 uvuaotpHf0ni5szdiMIPwcyWeEpkEf.o72nOTOBkgP_07sYqIEPTPvzM0Mdb_BLqmTe5zPN_nWmj H1tfmFgD97CAGUTK9oFIx.shmJtCSUfKEFxR.aChbrbEGD8h2PYDjXQUzACXkq_o4ObkaQRz4tRT 9WaubTPenMQnTWEw3mLSXxlIMvPTN0Ftnj0UyWW3neN4OFA0hj.oxqx73NoLn2xF2PTVmtxTMkTq yC_TZVo1ZZ9txY0uAtbRy8eUhnQRxEQVtWpar6CJWHLs4cb7tjSHt5mq.leN_bPhmoDLiwKUdFAp VlKMqhX5IMKkl3eY0hEPnBss2uZR75WC3JP7dubgf4Cbc5lUVzGtG8MZSTJRZ.EtmXKMocS7B.QY uG2dw2EbhJgFlsrL8NLoLF5rbkrdaNqD_AuDgr2SK8b3rFZUmyig5kOGGKkpxJDCJK7IEi4bTRfa 6.Po0_5Q5dNoZ7ay6zfLy7n4GB05bIH79N_SWcNXvcHH3cxbeYgCBSgdJ8sU2beEPHNVECqPxDyJ mzyVvdv54lDzPtJqb5zhseN_BwJbzKpjcQgFbceZFtxN1uZYVjHWxmPKsaqM8Nj_aeJTJSJFM8bn 6mOxYCnDOThhAbZQla2DQJhID7jgR4vbDPqfEjgecPbMamQqUKkn2Mw-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:23 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:21 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 83/97] Smack: Set netlabel flags properly on new label import Date: Thu, 28 Feb 2019 14:43:42 -0800 Message-Id: <20190228224356.2608-14-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Ensure that all netlabel flags are correctly set on the netlabel attribute of a newly imported Smack label. Signed-off-by: Casey Schaufler --- security/smack/smackfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index abaa5325c32f..0abfa4315fb1 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -931,6 +931,9 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, smack_catset_bit(cat, mapcatset); } + skp->smk_netlabel.flags = NETLBL_SECATTR_DOMAIN | + NETLBL_SECATTR_MLS_LVL | + NETLBL_SECATTR_SECID; rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); if (rc >= 0) { netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat); From patchwork Thu Feb 28 22:43:43 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834205 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0796D1515 for ; Thu, 28 Feb 2019 22:46:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E89C52FA84 for ; Thu, 28 Feb 2019 22:46:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DA9512FB90; Thu, 28 Feb 2019 22:46:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5B7422FA84 for ; Thu, 28 Feb 2019 22:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728790AbfB1WqZ (ORCPT ); Thu, 28 Feb 2019 17:46:25 -0500 Received: from sonic309-41.consmr.mail.bf2.yahoo.com ([74.6.129.215]:34673 "EHLO sonic309-41.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728763AbfB1WqZ (ORCPT ); Thu, 28 Feb 2019 17:46:25 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393984; bh=v0/bLPt6a0S+kZ7bC0Nm9Gz1IfnCWpsX4z1i6JEy+dk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=VLkHyKzqp/T7ArjzTNQy/CxpFsReYawQxRipzV8TlhT0AOyL81b/nstxtMyvcBKwOPLtRGLdup7p/evMzYrgzZ1mT3BfAw5GokGgsaLbIOJvtvH3DtCTy6xm+F8j15tceOoLrZ3C/FH3U41Dbbqtlw5dklK2Z1wk1XOgd9RNUZRHNPzlCQFT8g5dUU1SBCWbBABiYChYDkFWNr1gWO3Rf31Rnr/hIDmGb24m8tSdclyNOmVHGl3yXwfQlF8W1SIlKDawWfyd4sIP1/e12JEZOmHuvYHew1ye0gs8+nEXdPIreRcjMJ1Dz+Cy+Yw+3IpgO46kl5rfwA9XT0Fv/H0lig== X-YMail-OSG: fZrgIIoVM1lWTAHWwShGfA7FrT9Gt55SakmhDbWBxldYqT8yfCHzNisrY2fDpd1 xkJ7A1jJOQA-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic309.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:46:24 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:22 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 84/97] Netlabel: Add a secattr comparison API function Date: Thu, 28 Feb 2019 14:43:43 -0800 Message-Id: <20190228224356.2608-15-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add a new API function netlbl_secattr_equal() that determines if two secattr structures would result in the same on-wire representation. Signed-off-by: Casey Schaufler --- include/net/netlabel.h | 8 ++++++ net/netlabel/netlabel_kapi.c | 50 ++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) diff --git a/include/net/netlabel.h b/include/net/netlabel.h index 546c75f27d05..00000d53cdcd 100644 --- a/include/net/netlabel.h +++ b/include/net/netlabel.h @@ -472,6 +472,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, u32 offset, unsigned long bitmap, gfp_t flags); +bool netlbl_secattr_equal(const struct netlbl_lsm_secattr *secattr_a, + const struct netlbl_lsm_secattr *secattr_b); /* Bitmap functions */ @@ -623,6 +625,12 @@ static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, { return 0; } +static inline bool netlbl_secattr_equal( + const struct netlbl_lsm_secattr *secattr_a, + const struct netlbl_lsm_secattr *secattr_b) +{ + return true; +} static inline int netlbl_enabled(void) { return 0; diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 01b8006c7c55..db6bb1c037f9 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -1460,6 +1460,56 @@ int netlbl_cache_add(const struct sk_buff *skb, u16 family, return -ENOMSG; } +/** + * netlbl_secattr_equal - Compare two lsm secattrs + * @secattr_a: one security attribute + * @secattr_b: the other security attribute + * + * Description: + * Compare two lsm security attribute structures. + * Don't compare secid fields, as those are distinct. + * Returns true if they are the same, false otherwise. + * + */ +bool netlbl_secattr_equal(const struct netlbl_lsm_secattr *secattr_a, + const struct netlbl_lsm_secattr *secattr_b) +{ + struct netlbl_lsm_catmap *iter_a; + struct netlbl_lsm_catmap *iter_b; + + if (secattr_a == secattr_b) + return true; + if (!secattr_a || !secattr_b) + return false; + + if ((secattr_a->flags & NETLBL_SECATTR_MLS_LVL) != + (secattr_b->flags & NETLBL_SECATTR_MLS_LVL)) + return false; + + if ((secattr_a->flags & NETLBL_SECATTR_MLS_LVL) && + secattr_a->attr.mls.lvl != secattr_b->attr.mls.lvl) + return false; + + if ((secattr_a->flags & NETLBL_SECATTR_MLS_CAT) != + (secattr_b->flags & NETLBL_SECATTR_MLS_CAT)) + return false; + + iter_a = secattr_a->attr.mls.cat; + iter_b = secattr_b->attr.mls.cat; + + while (iter_a && iter_b) { + if (iter_a->startbit != iter_b->startbit) + return false; + if (memcmp(iter_a->bitmap, iter_b->bitmap, + sizeof(iter_a->bitmap))) + return false; + iter_a = iter_a->next; + iter_b = iter_b->next; + } + + return !iter_a && !iter_b; +} + /* * Protocol Engine Functions */ From patchwork Thu Feb 28 22:43:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834159 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 16D901390 for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0AA9D2FA27 for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F34972FB81; Thu, 28 Feb 2019 22:44:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 701D82FA27 for ; Thu, 28 Feb 2019 22:44:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730134AbfB1Woa (ORCPT ); Thu, 28 Feb 2019 17:44:30 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:33240 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730110AbfB1Wo3 (ORCPT ); Thu, 28 Feb 2019 17:44:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393868; bh=5Tzzr7tzx0u4Co/RelBllwIUxaOD5cmia+v4HkbQgps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=OsXOJIEcTGWE4E9VHsQTTs0vrHO3S4hELMBulatsY40iQZiHXQMPfgwp18WtR90M7787TsmiJu5/3VG+m9OXT6Rjb0bJrNTHn0xXXPt9MrOxqrLzaPTk/cr05jmw21im6SC17ZZvtmUx9SboD2t4OJ9QV4M7bco45cUwoKo4P+q3AoBiRycbzZcvAy6BDuZ2d5hFLIn+BwIqLfZ7AEQdtaXxqDL+r9umVfhSR0cbTrKiFGITwOY5R8XjTqjtq9Te3aIZ+cKE1h1obkTfOvbZFWcNe2dWU2C3P+fmsSkziK80sSdfnmTGDUfcu9u5RHU6IplvgRyNtpVABglKNSERtQ== X-YMail-OSG: L1z1N3QVM1nYGyyszql1W09yRNvbgOBtj8N8cu8Jgm3OnKSqpmDYMGmC89VG3Z2 d6lEBeDJZFSrylpFGw3IptqInZuY13A73mbqEFJqunK03dBMMijV0yu8XDBnUv1tmzqEuxMbT8zR xrvHuYvlbsdgSvh6aUxfXTI0N7UH5Ewtd4soZoCqjyZ4dqs2ZIjF8oFEueQ7yZLtYoBmfh3MEhkO K0vWraH3AHAZjilLqjGdI99GFrZFtoT9C1y9wQFehoVgEvivwPQTRP5WEJQOWd5666t6qTgB5mgN wqtamqH5EIC_nJzJmeMDG7VkwUdGZvLO0ZlUsmAwwa7Kxx.809DuFR4aibsRp9lUUH9cyC0q.wPI 3rT.ffecfUt3VmuA2Fbow3KjEjAPP7i5nnRLdOmFg4go_hNX7FilgEHEXp6bd0LWDc8qUoWGaBG1 1gWlyjblyytCrv5CutZPd.xCjNpldATJYBWgCdGlC1sMEmBnh49skwp26FN49wqIf6w3_2c_HnBp Zwkiv6nwDJBZlFW.sr0DhiTcTu9wgoe0VKFYv9rKW2t1Tj1ZoUIdQNWAcjx6BqbQShG1CaV1Oaie 3iwFuSnMlivnSOTsgamDYc0Ls9zNhH7ES08Gs7SVpD4Rc.iHWQgIWxdtXPlxx8_95L_d4Ovag96A VpK3DskU7hALtaa.7LjCqvyDtxzbSpPHm2gt.cEuWbDybuxa7jwH0d3FGVGViwgnZl8GKT95oKUe i.mi.p52VwS5HPMDWS08nrDFDOsB1BTz9JEkzMAgovqFCpmtSi33LIAPr3cW1uOlFJPwxdkNG.Je rjRW43dDIZUhWsF81vENQoTeX1dXa7Qc2h5saVrGH_yAygEnDSxZUVbJCPY8iEy2NjA7UCOFDD19 3QUGJacwgmq.ylkawcHACSso1iYx2a5bMJQTrHCoPHZuWp9NXfllStfmd5svJ2sJhUljb5RSHyvn RqbJ_QAwEEtkCdj8tCemft0bxvLHiuP7t0v2z1MhaZs15HXWx_y5xVYeUv6xDrb6LzkM8GhYRvAa uJqIXh5tWfHLaJZXYvRc6Xuc74e0JSiIS71pJNYGafF6WAj0K5AKrtqMLim2Fi24EtplL5i0L66_ ve0V.WPkLKRbP1_PZNjaYtOscVzfddw-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:28 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:24 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 85/97] Smack: Let netlabel do the work on the ambient domain Date: Thu, 28 Feb 2019 14:43:44 -0800 Message-Id: <20190228224356.2608-16-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Don't delete the netlabel data from sockets on the ambient domain as netlabel will do it correctly without any help. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 31 ++++++++----------------------- 1 file changed, 8 insertions(+), 23 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a4c8f93534ec..d2a73d8a6976 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2316,37 +2316,27 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) /** * smack_netlabel - Set the secattr on a socket * @sk: the socket - * @labeled: socket label scheme * * Convert the outbound smack value (smk_out) to a * secattr and attach it to the socket. * * Returns 0 on success or an error code */ -static int smack_netlabel(struct sock *sk, int labeled) +static int smack_netlabel(struct sock *sk) { struct smack_known *skp; struct socket_smack *ssp = smack_sock(sk); int rc = 0; /* - * Usually the netlabel code will handle changing the + * The netlabel code will handle changing the * packet labeling based on the label. - * The case of a single label host is different, because - * a single label host should never get a labeled packet - * even though the label is usually associated with a packet - * label. */ local_bh_disable(); bh_lock_sock_nested(sk); - if (ssp->smk_out == smack_net_ambient || - labeled == SMACK_UNLABELED_SOCKET) - netlbl_sock_delattr(sk); - else { - skp = ssp->smk_out; - rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); - } + skp = ssp->smk_out; + rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); bh_unlock_sock(sk); local_bh_enable(); @@ -2368,8 +2358,7 @@ static int smack_netlabel(struct sock *sk, int labeled) static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) { struct smack_known *skp; - int rc; - int sk_lbl; + int rc = 0; struct smack_known *hkp; struct socket_smack *ssp = smack_sock(sk); struct smk_audit_info ad; @@ -2385,19 +2374,15 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) ad.a.u.net->dport = sap->sin_port; ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr; #endif - sk_lbl = SMACK_UNLABELED_SOCKET; skp = ssp->smk_out; rc = smk_access(skp, hkp, MAY_WRITE, &ad); rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc); - } else { - sk_lbl = SMACK_CIPSO_SOCKET; - rc = 0; } rcu_read_unlock(); if (rc != 0) return rc; - return smack_netlabel(sk, sk_lbl); + return smack_netlabel(sk); } #if IS_ENABLED(CONFIG_IPV6) @@ -2635,7 +2620,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) { ssp->smk_out = skp; if (sock->sk->sk_family == PF_INET) { - rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); + rc = smack_netlabel(sock->sk); if (rc != 0) printk(KERN_WARNING "Smack: \"%s\" netlbl error %d.\n", @@ -2686,7 +2671,7 @@ static int smack_socket_post_create(struct socket *sock, int family, /* * Set the outbound netlbl. */ - return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); + return smack_netlabel(sock->sk); } /** From patchwork Thu Feb 28 22:43:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834161 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2C9AE1399 for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1EE0A2FA27 for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 12E382FB98; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B9ABE2FB96 for ; Thu, 28 Feb 2019 22:44:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729999AbfB1Wob (ORCPT ); Thu, 28 Feb 2019 17:44:31 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:37841 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730042AbfB1Wo3 (ORCPT ); Thu, 28 Feb 2019 17:44:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393868; bh=qGaKuPvH/w7dCrt+k3wQrAwy4uZDEs/MFzsCuALfi9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=kzUlL1g9y5ZDmRNdIYLwMrlXxwj+S9UZ+bE2rmjogpFkCW4/FjCNTlgSMnIH3Mie6wBJEKd7hY8dP8Ktv/80/VhByZ/8PF192FkjeO3CScOjTvtY9pFZlO7hQoqfLntkUddnuZ6Zf4rr10ZgAdK6gsx6rjD1YNatiNIMRS0JTUX/qKBqm+BMMTkl+Tjv+kNKT8AyRMyTmttXyuRem5OnOrGJ0QBKbF91N7HlWmUj7SMu1CKe3FfkLLuL0/QSN1+nP5hSck6OGPDojqGoWX3g5KEsFtNqEYyOoxGKo4h9PNDQf9Kk9dlyTR7VEx9mF8rzf9hICv7dRPrJjbcDEEEYNw== X-YMail-OSG: QBFW0XcVM1nJSybqPMKADURrdJ0GcqCXA6zVoxaKsBssaKgxOsZwUxqUlGAB6MQ sZbTCLWAnKwAWq7DVw6k5eBeo24OTIALVfbmu0w6i7J2p2Xt2ND8L1_YI0YG_jImI6yVBBrtyg5A ty_EqNdOsF90bDi2Ir..sgUK0Q7_r2jzgtMRDzIOkB8aX0e9gsiol_T0.AVK00MQcEr6A_ZAOKqd I8oajewj3ucIXAZ97.NFX2bJmiT7ilC7o2dm29Nrf8_GuVCWcoS25paiUGtx4P30bkVOen6FefIO uv_JkQ2KD1J3xZ0LajT9ZxNrpcgQWF0Fs0bkgzIifChP9nxMV.4O5xy8z4FhL2gEVuIkDm98sW_v jzVtFDNA0bB_l4nTZ7MG4pjHMW40SWF08oJaOLDDc2EC_Z4LQCWDFJuWSJYCVEjQ41JXf8gW.Ila DlqzWNSfVuD0jZosBRierpjRc0WD.PPoyUVaqIzqyROfqWvX_XBxtbUg2fQxpV1kF0IyfG3HVBZp Hlj9ThZdYqRxkR0pg.gBn6KzhNZcWHDF0RORpXCeLEluCm.ibF8FPyISEyLQ2yVHsV.6FaCRhzrN temfaZ36u94HTKSqnYNIAIO.6iZvBtb1tc2X9X5lS7M8.bNYShw9IY5akZV9MfjmVlwKtuHHsa6_ Mxk_YZPTPWEgiLi07JENWd5KPVwj8ASZ77ZaH94r1krZDwjs_Gblo3Y1FeFdiDNXIw9Smicuj7Da 5s1RNHod5z5rGzmAfNBLWAHsXWOsB5SZq6GVMy8adr_VLtCwybOcSm1YPTQ4e791PL5hQDTGPFVG B7TYq0joN7i562fhhkFcVzLBD.99173l3MeMwFgvjMqi1q.g.F0bEDqKDz7hDGkCFVvmZTthaTbb K4NUy62TRQeKcSX.toEheExUkyIUf2gpR1BQqPlGEatBvBxAgTa5O1A1g7R06fDmiH0obhRMYnOI 55UuUtAT8shi68HgmPnqApenrlyJbAnfVdacGTXMMc82EvEB4arQilwLwCBzgO.0sx7SEqxppq1W JbwTl4HenwISTUeqgGepUoo4CzLBQ0mIHRlEDGs56PM_6bmg.KSZ7yUv8eOVt1Exf_CU0ZvlYF1n 8UGOdgXmy6RoElCFyc1xl4O5RwRx5Ack8pgBQyOSgj0udQ2D8m2VzNHg- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:28 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:25 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 86/97] Smack: Don't set the socket label on each send Date: Thu, 28 Feb 2019 14:43:45 -0800 Message-Id: <20190228224356.2608-17-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The socket does not need to be relabeled on each send. Remove the code that does that. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index d2a73d8a6976..d9055a0df75c 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2379,10 +2379,7 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc); } rcu_read_unlock(); - if (rc != 0) - return rc; - - return smack_netlabel(sk); + return rc; } #if IS_ENABLED(CONFIG_IPV6) From patchwork Thu Feb 28 22:43:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834151 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8EBB41805 for ; Thu, 28 Feb 2019 22:44:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 812542FA84 for ; Thu, 28 Feb 2019 22:44:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 75B892FB90; Thu, 28 Feb 2019 22:44:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38D3E2FA84 for ; Thu, 28 Feb 2019 22:44:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730732AbfB1Wo3 (ORCPT ); Thu, 28 Feb 2019 17:44:29 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:40842 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729286AbfB1Wo3 (ORCPT ); Thu, 28 Feb 2019 17:44:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393868; bh=DZ6t+DXWOolC0BApfZ0rPkxLybTRQPdYfxYwy99dDN4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=MLrBVreqjKaMl6Nqeb6CutaNwlSPpMQ7+DQQBVqB03PT2YYDBrg6cm/csTSAyPEa/hQCrDNSafSvZdFcKgnYpuZvDJc7XexaIcM8vz8t8oG6PmAEg+LhaH64Mg1ccx7zLpC3Vxu6ldYUR1Zv6IrGLx144p95QU3jvH/Rd7O6VOC80/wJeiTOw4sGnjCXMxMtdUYk7mMcKTDTR0eyHx7logcmDA+A/Pxl+d8eic3ksyPHPAEsmKQi/jnopUu54HM8seiveKdBVhr9SIc0a5IOBtujMeQRtPJNE+m6IA7ild+vdsUvj3uPxIZzB9vtxihR8/dCPgNc2adEFWgDR8SeHg== X-YMail-OSG: qK1RDTgVM1kp.L_FiJA3Wiv3v0z04C8gMorrq5FpHf4n8g2JSIHN6AldXeisFof ilWsgPFFVkOXdE4HNtiiOQdxLJlrSl7VIahICo7B2OLREj1o1u.k_o3x7iO6M7INzNKugO5tYaTf BDEMjI0QoKflMs2gHc2vQQ62kTBE0lsjSCs5NzH2M9h3rahFOqI.SyTRrWKEeGe4SnoDRnrSJil9 TrnYrcOUH4422Km58PCbYI4F5zc1M6ONA.cwMs261rcCPaa31wwo65qF4G6Kv47WyRVf4X07XwTy .ricKKi4K_pQGoKgvvIxI8gnQOjZro0ESDBHZbsabcPzTi_Eroelw4pWA9MD2MoUtEWhUH.kD0KG 7JL6f6yR_Qm1IknStzdsHzxuXueDuI6x4tOz5XM8jgDj6ii643LGGgliER.nieFlOC8VBoj9JVwk Ir6ASKqX7.smbSKqZ3W7V1XGKBUb3uDcV5xL4kLUgS2wxS2iOYENLltdue6k85QpulK2mOUxreMB 78kadNOF2jToVHAMT_3axcGMdAWjC7rxKATPb9RUXumE8IP0IYrjo5rlO66cb0F.LNN7UDd_gHRm 9UXvqQm6EA.GiIlY5KQ7leBTFhMhjChGo55.gqlJdsCc4D2Osfh7M8VmKtyjIO2DK_H6wsu2CU3M oyLHaaESIZ_XufR9a5LQVpQK8JTlXawxaTgX5kvUjz2euFWlPi4Ax18XmK2R4OQq5rIYf5FdYHDm 2_XlBAaO_rv8g0Z0d9JxFVhAeB3ov8odG0VOvyJzTIQPfm0FkY1Y1orgi7c73AC6GaREjHqVLsEy Mt.t9ObRsSQa5FoKuMy9k_7_N8bHwW_A.PouLnqH3kv4LIKVIiX9aTdvZdlsuNucO2_Dx99DjbZR 41cqLs9jwkZsW1g2Y7wLbBMQ_yQxQKtm3RRDqifA6uSaN4ITUEQqP6tv7prCq2mG0yTT062Wz.Pp 8Qx2RHtS9Kmw8GqG08wAb914xtCit0J9lzg9cbd1iVAAxv4PFwOrlBEIhWi4TJo77G1_sODBQm91 pHEuNinl7Iwat7spNcw6GqaFa6TP2ECLYKxGaCrxP65F7f22s2KiZUCcqaiYoUckwR9JKWOFVXXU CwOxcZxTDuXW8QaIIEURWmGSR0f1_HOvL3bUl57z2I8UeyE1LbpqN2FDG Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:28 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:26 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 87/97] Smack: Let netlabel do the work on connections Date: Thu, 28 Feb 2019 14:43:46 -0800 Message-Id: <20190228224356.2608-18-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Rather than removing the netlabel socket attribute on connections set the ambient domain. This is more in line with the way netlabel "should" be used. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index d9055a0df75c..f965c9e6287e 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4057,7 +4057,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, if (hskp == NULL) rc = netlbl_req_setattr(req, &skp->smk_netlabel); else - netlbl_req_delattr(req); + rc = netlbl_req_setattr(req, &smack_net_ambient->smk_netlabel); return rc; } From patchwork Thu Feb 28 22:43:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834163 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 37D33188E for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B353290F8 for ; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1F1AE2FB81; Thu, 28 Feb 2019 22:44:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0638D2FA84 for ; Thu, 28 Feb 2019 22:44:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729362AbfB1Woa (ORCPT ); Thu, 28 Feb 2019 17:44:30 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:33000 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730134AbfB1Woa (ORCPT ); Thu, 28 Feb 2019 17:44:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393868; bh=2hYihdVmqU5qALc9NevWfXmFBQM735kkui8Pr/CoqaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=YMBTlj1/ylHbo/3y5sQRfdj88g1jK9w6HZ7+VDdzQjO8mU6NiRlHL7CI7v2vv3zZ2Dh9qAD2KTEN9KENlja8DsUo2Zmc5940wWf7CaF+4xHqFyLCJHPAqcNHBejaQB8sDw6soJD+7odrsecvtL8sTKESpCzmOpLj6wQZYCoLWcrpq9fmg5DXDptguA4zBom68BPdyShZdc9I5jMyf6Iumdopf/OfUpSAK8DERYPQfZrF2gKY0F2itfunu/s/LAXqE1s/1GV2ZinmYHjKiA49Iol+Oxk0kz6AnBHeVdFT2clXq0flZI4y/KBXwq3qbRKMkOqVqv7k3ZzAE1Bz4E3S4A== X-YMail-OSG: FEA2ZaMVM1n1OPndvragrJEmyr9sGjl7Kz2qA0vuCgba2jCkzv43E2P5XqUAH11 CiAEAfaIf3FWOJ5p1feMynW27HcPHWD4TGhcDWv9vgaEIoImNTlpG9A27wvuiyqOEaYFKbi3Rrtc EJH3QxT3O78sbF99TyW2VSwTNCbJWykrJM.uqiFLSBHEx94V9mz52mFsKdxVfhHS40o1w2S2b9xK wRGntirgx8RBIDCOnHuCuoFyxqCv_3_aA64ZLG8TE1u8PLX2nKMx_mA_KgYllM1lPOW4bHIaCpaz Vh4A0QSYsulifp8EMaZiuQo5yXIB9mzffJy0yV3jjQGlIcePmhIyENoXiDsNKJsh7CGXqRbatgrK YlhaOabb1Xw_VKJxgxtd60O7K_s5JwCcL_D6gnino.mniGe2qoOm5psPbsM6pWSSqYOdkoyJfOJ2 URwmKg0VhikTUoKMBc6k6SuyOCsm.6oEnSEj34UGpFQAUdr7Qkr07wqkMs_q6VPu.hrO2G7zpnKo geYvxwJEVrrem.wuYWnf6bVM2aAA6.SC3EF3nI1Itw.eNtO64wREPagCHhvt7KbEm5IN_Iv4X1n_ HeiGk.YQsh7ZEKTKtDrn.dr8eLLgsHJCLqmjGddfyx8h2UrERAPNyXNxMhSM8zqTxnd3NXFwjKDS xD5huaDcWuq5ABpjMc5bhGKsa8EonxlQB653stmI7s6q_tWi2wV5iRjmc2UiJVLxHJlwt.KiOrjN JtKP._T.cQA8QI6FFCoDj_uiRIoiXUw0Ak9uTt9E4NkYIJL9kK2WHR7FGBK0pTDGBUJgMltJfRNi Ltm6TcKiNCEtZ0oNrNd.okdC8op9kscjUD6OQ2Bs3qxtTZszr71PodoLzltluAib5Z9U1J3KVsfA mIBZeKGgsLJgsbL601uVBaxrBJ9uYpHexP643pXp0vT4Z.c.ozdC0n8vzKCd6SCIxKuE1Whqsnw1 .j.LgiAoMVDT5nrXC0WvA5ulwh4cSzvdgZVbnMWliCUdS0FJgUXw2IaLIdlJ__HbMQoKzveY1iIa lKMSSFUWJCj6X61VRHtGZwbWMufCUCht9eod4ry7ixL1b5dshwgEl4xwxUB9dzOqyG0iiljelszX .V2SexBYGrEh2T_dWwSkSmW7VjExECkdDqxnSsSG0G.xkYNuO8X8P5Hji Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:28 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:28 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 88/97] Netlabel: Return the labeling type on socket Date: Thu, 28 Feb 2019 14:43:47 -0800 Message-Id: <20190228224356.2608-19-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Change netlbl_sock_setattr() to return the labeling type of the domain. This allows the labeling types to be compared when two LSMs want to determine how a socket should be used. Signed-off-by: Casey Schaufler --- net/netlabel/netlabel_kapi.c | 25 ++++++++++++------------- security/selinux/netlabel.c | 11 ++++------- security/smack/smack_lsm.c | 2 ++ 3 files changed, 18 insertions(+), 20 deletions(-) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index db6bb1c037f9..61766da2cfac 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -973,15 +973,14 @@ int netlbl_enabled(void) * Attach the correct label to the given socket using the security attributes * specified in @secattr. This function requires exclusive access to @sk, * which means it either needs to be in the process of being created or locked. - * Returns zero on success, -EDESTADDRREQ if the domain is configured to use - * network address selectors (can't blindly label the socket), and negative - * values on all other failures. + * Returns the labeling type of the domain, or negative values on failures. * */ int netlbl_sock_setattr(struct sock *sk, u16 family, const struct netlbl_lsm_secattr *secattr) { + int rc; int ret_val; struct netlbl_dom_map *dom_entry; @@ -993,17 +992,17 @@ int netlbl_sock_setattr(struct sock *sk, } switch (family) { case AF_INET: + ret_val = dom_entry->def.type; switch (dom_entry->def.type) { case NETLBL_NLTYPE_ADDRSELECT: - ret_val = -EDESTADDRREQ; break; case NETLBL_NLTYPE_CIPSOV4: - ret_val = cipso_v4_sock_setattr(sk, - dom_entry->def.cipso, - secattr); + rc = cipso_v4_sock_setattr(sk, dom_entry->def.cipso, + secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: - ret_val = 0; break; default: ret_val = -ENOENT; @@ -1011,17 +1010,17 @@ int netlbl_sock_setattr(struct sock *sk, break; #if IS_ENABLED(CONFIG_IPV6) case AF_INET6: + ret_val = dom_entry->def.type; switch (dom_entry->def.type) { case NETLBL_NLTYPE_ADDRSELECT: - ret_val = -EDESTADDRREQ; break; case NETLBL_NLTYPE_CALIPSO: - ret_val = calipso_sock_setattr(sk, - dom_entry->def.calipso, - secattr); + rc = calipso_sock_setattr(sk, dom_entry->def.calipso, + secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: - ret_val = 0; break; default: ret_val = -ENOENT; diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 4bbd50237a8a..85156a0cdfc3 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -418,15 +418,12 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) if (secattr == NULL) return -ENOMEM; rc = netlbl_sock_setattr(sk, family, secattr); - switch (rc) { - case 0: - sksec->nlbl_state = NLBL_LABELED; - break; - case -EDESTADDRREQ: + if (rc == NETLBL_NLTYPE_ADDRSELECT) sksec->nlbl_state = NLBL_REQSKB; + else if (rc >= 0) + sksec->nlbl_state = NLBL_LABELED; + if (rc > 0) rc = 0; - break; - } return rc; } diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index f965c9e6287e..20eed64e91de 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2337,6 +2337,8 @@ static int smack_netlabel(struct sock *sk) skp = ssp->smk_out; rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); + if (rc > 0) + rc = 0; bh_unlock_sock(sk); local_bh_enable(); From patchwork Thu Feb 28 22:43:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834169 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 460061805 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3250A2FB96 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 246A72FA84; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C8D222FA84 for ; Thu, 28 Feb 2019 22:44:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730845AbfB1Wog (ORCPT ); Thu, 28 Feb 2019 17:44:36 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:46579 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730742AbfB1Wof (ORCPT ); Thu, 28 Feb 2019 17:44:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393874; bh=DnAJ7yFgViYIZXC7EL7fvaMU8/QHiG5SJFZe51H0huA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=k34uvCaWhOIezESOvy0kEYd1YIoyhh0P0h5hICFIArSuY7bv1NlMaVbUflJCRshkY0WNsD2Fl2/KJDcac/rXC4DG9IV911K+axi4N+OrTSCsK2UZUGDtSsH0Yu70PQwlA6SLYQ2sI8AM8PUghe6JVsNS6AkmKvwSQq7F8nXDyiFQMpPhj88eaYBRISX1qFFV8UXoQP/dO6I1L+ySn9HxdHENZFAo2+MQzZ8bFOmgJ+6Ic8XdvVQkGXnsbPOvOpyRAinbOcG2GIXXzH7Wu8pUED6/4kPYGZHkW98tOeudUKiEdkg1ToqBieLbKJZRQndz5Ashzp3GsnSfZJgGa64MwQ== X-YMail-OSG: Z16dURAVM1lLr0yDvRQ0LOHhtf4MEz3AwvfKQyHPaE7xrBjfYlHBguVWevJqVQJ 1QHJoI4nM66keGQ_26TYKveDuA4sdRexYNzPWVP895vaftlGQzzxkldQAGiR.Ojn.wJyzC3T1RDT E3p.pKq44Wmfb.qW.9WpiOypwOHCTy6GEibSntlTZXtgwYhA_CNl1hwXvfWnrJV82FyRwn.pui.L YD6ZVilVomQX7k5HU8Zr16CxiMWbQvVL_OZvbahugphZ410l7XtJhHAG4EvdApEUoSWEBNCnojRR j1oUVv1AmcOYQFXcih8qtMZIeOI1fRnCo3p56rY7Fr_YtPdCk6zqdHLdsz1agS9vyVCaU70yAdkE rsRw6DXkIggXcLv8zB6LQXAXxduVngpBqD.Y3BEh36UM1wE896vJk.1G8tGvWdArXncJNgFFQetD qOVHA0sAzOMdg27BymWBYf2xxbQLR4TrPZ7mqgy.9_OluAodNcvWPRwNDyqBEzHBgzDpDd9D21a. 4nyUAPfCiCA3Pl0YDDwESCS4A3z1iBOyMcMbv_l7Mo_xbM_mRj.wR2GC1nvWgx2vOa.vs8rOvGN8 15neRmMBRhYygXuNpLlVqqlpsLMyVeeEhlxu6hIoZJUiba7Y1ODwLFYz_7mhWMNEO3gV90hdqXpt wFUu9zzn1p2VMlCoN1fR3Fc964M0n37bv3cirxdp3Hg9E0Bw5Bzyu1B_ZNGsRzOXlabPXS259TAZ JiFiVGwvjmGJdA7p_dVRWwmEfhHOc_gQrLYWeQvVG_WRLLTZ58YW8.DqmzsbyiBNJqEftg8yZnk0 1kZHrKWT.Ha4tU89Xv8uZmOSgyZCIiJCSRsxHQhALwbvA0J1hCZawo5RYUOnrgG6nt1So7Rb5AY1 VdY6Nm.ifzB0HZIOp5.JCsRbkah2.hfRD6UP0ndDsLlLqo5l1GpMriCY9CHOC0skGGrhJQynTlcq qOiR75EYNGoxSzxkgI5j7h2XixxjqrVnZiRAVQWqI.gxjacN_eGnV_pdgDiJxUtifsCm5rqt0Q5h fE37T.Q26olHj8ahP24NLb97639HGeLK.KPfSHTWxkkBwxdzSMPAQoWech9UOK7GTXX6G8eGSluJ d966wpE0uBIhQed9mLElZ6XtrQ1oEkRJWK0w- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:34 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp415.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 46c3ca42412e81058eafbaa96f791691; Thu, 28 Feb 2019 22:44:29 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 89/97] Netlabel: Return the labeling type on socket Date: Thu, 28 Feb 2019 14:43:48 -0800 Message-Id: <20190228224356.2608-20-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Change netlbl_conn_setattr() to return the labeling type of the domain. This allows the labeling types to be compared when two LSMs want to determine how a socket should be used. Signed-off-by: Casey Schaufler --- net/netlabel/netlabel_kapi.c | 20 ++++++++++++-------- security/selinux/netlabel.c | 8 ++++++-- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 61766da2cfac..2bd765290550 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -1101,14 +1101,16 @@ int netlbl_sock_getattr(struct sock *sk, * Description: * Attach the correct label to the given connected socket using the security * attributes specified in @secattr. The caller is responsible for ensuring - * that @sk is locked. Returns zero on success, negative values on failure. + * that @sk is locked. Returns the NLTYPE on success, negative values on + * failure. * */ int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr) { - int ret_val; + int rc; + int ret_val = 0; struct sockaddr_in *addr4; #if IS_ENABLED(CONFIG_IPV6) struct sockaddr_in6 *addr6; @@ -1125,16 +1127,17 @@ int netlbl_conn_setattr(struct sock *sk, ret_val = -ENOENT; goto conn_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CIPSOV4: - ret_val = cipso_v4_sock_setattr(sk, - entry->cipso, secattr); + rc = cipso_v4_sock_setattr(sk, entry->cipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: /* just delete the protocols we support for right now * but we could remove other protocols if needed */ netlbl_sock_delattr(sk); - ret_val = 0; break; default: ret_val = -ENOENT; @@ -1149,16 +1152,17 @@ int netlbl_conn_setattr(struct sock *sk, ret_val = -ENOENT; goto conn_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CALIPSO: - ret_val = calipso_sock_setattr(sk, - entry->calipso, secattr); + rc = calipso_sock_setattr(sk, entry->calipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: /* just delete the protocols we support for right now * but we could remove other protocols if needed */ netlbl_sock_delattr(sk); - ret_val = 0; break; default: ret_val = -ENOENT; diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 85156a0cdfc3..ca47c99f964a 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -321,8 +321,10 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep, } rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr); - if (rc == 0) + if (rc >= 0) { sksec->nlbl_state = NLBL_LABELED; + rc = 0; + } assoc_request_return: netlbl_secattr_destroy(&secattr); @@ -576,8 +578,10 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, return rc; } rc = netlbl_conn_setattr(sk, addr, secattr); - if (rc == 0) + if (rc >= 0) { sksec->nlbl_state = NLBL_CONNLABELED; + rc = 0; + } return rc; } From patchwork Thu Feb 28 22:43:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834187 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6C5F91908 for ; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5DA25290F8 for ; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4B9F02FB9B; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3AC412FB81 for ; Thu, 28 Feb 2019 22:44:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730742AbfB1Wog (ORCPT ); Thu, 28 Feb 2019 17:44:36 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:36327 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730867AbfB1Wof (ORCPT ); Thu, 28 Feb 2019 17:44:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393874; bh=Aom2uBgZ2TgbnkpBYLBmQEguXBd2kkH61KqQlvE1qx8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=QoOvw978cxNT+hXmheB1R8kCa/AtxIvjyEhc23rrd8M6s4ODMi/Hs8kBHBCzHH/jnwn6kdIaPmiwhZxNpEngO4rCOIkxWoB0AKdLQV+kGayY4vfeU3GTWKEphcC7qrMcu7vuFs/z6FGIuTtim/AaSVVjCMlGu6d9x2gDZqcLdgaAhA35QlhDwxTR31myp2cALbYpBwYmA+lw0ZPN3lZQNtsMlXnmsAwD/VmGOnuTC2fmNswIIE+CwGCtuLeFwhPo97f1ZQLx6Z1F+qR/Gx6p0DDggI9OUgCesfZ0RYYll1Y3pbjQq23PaRcfFs+cF60MW4nP93yFwKNDJ9U43zH07w== X-YMail-OSG: .tbyCMkVM1l5zH_GU0QAOAob4._wCWjQUriDnvQf.gKOPY_SxNrMHS.ZroHACRf _oi7v3TCOKjOXqXzU_z6YMalk5AY6hNbnVfCWr82wIZW0.dkbIYzJ0Vt7lvwoCfyjP4_yhQap0w0 EXbZ3mCPXKLk6_.dd5KqSHXbh0._ExkePje8X5BM7FlQtJoWpVVhXEU4CeGCco9R2B4vilsN5Ml. 2944s0IFD.nz1.Shr.LMacF.LCXYXYQRwzHxTpkE3f6WYrloICavZs7bT76LR1THhdrZvw9gVHLR Uv.wYIy4jlb6VXrq_bPIvQzDIQLbLs9d26spLciVMwj5q6_720QaBbLhjB6oTHrVd8Brw.FCqoaR eN0TEzBSy3k2nhU6C.VadpK9Y8g2mRufxz__swgvZFdBO0dKAGulbW8CSdg67Z9Y2nADTSjA2xQ1 .arREMekw4yaNXpK7okK3ZLAT3QnzJdALLilwjJQ.kHwMZLFsXN3eHOBwpgpaDS2rgLoJXyiAoCQ wlYGCgvt.ykD2Us7IdcBDr6K8L0VJeSMzyUs9NrIQN3kNXyy8a8RpwPdZZzSqgnmGUfoHgUA8wL9 HnfJ3J82Vs47BrW9Cy7W6GRPXp1KQP5IKjNw7XNbtCVqmwYBx6ZBBGMsizBXA677Hkd9RTg0arvB cUtwJvy7KxBbedfppLv7MjS21cRolUC1xYkKZMiuUW3msIIcv65A31MnsS0WxpjpJelgMwbL9inK GPwKZ5lgUac_RS5_PGy2qEuZ8vsn6zSnYFdsfchJIbwGPTYs4mGJlqCLF.WdtjBqgA5iHP66Rwo9 .EqYzU4rGK8vKljHZnOLQQNag.dyB2z7n8v.p2DanwZgUf9s3YwYqPYgMHleTg.jHPhTtc6_PhDJ aDDJ2EwZhMz1SDEu3ZgjNVMF6._lufdPUjYKSy8AXRHkoTNwP9bnjXYbP0wAgLCnjzok7vF3ijsA 6GKQiJuWQZ6RSDCHODBVZR7MxFTj63lmFNhUSV0P_wYwVQkn4xiHJfexK0ppoIo1acaxAptcwoXP s86R1PW.5vGom0sEvLm1i8LAda7BGAbUxazfJicDItm7hCw63jacO8i0QFEL2fft8u_Md47q.v96 .5td.XlDraikotXy7SImAbH4TixWT6x7H48kRQbDXtiNPGSmXICZ.tcBC Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:34 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:31 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 90/97] Netlabel: Return the labeling type on socket Date: Thu, 28 Feb 2019 14:43:49 -0800 Message-Id: <20190228224356.2608-21-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Change netlbl_skbuff_setattr() to return the labeling type of the domain. This allows the labeling types to be compared when two LSMs want to determine how a socket should be used. Signed-off-by: Casey Schaufler --- net/netlabel/netlabel_kapi.c | 7 ++++++- security/selinux/netlabel.c | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 2bd765290550..1d362a38dd05 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -1278,7 +1278,8 @@ void netlbl_req_delattr(struct request_sock *req) * * Description: * Attach the correct label to the given packet using the security attributes - * specified in @secattr. Returns zero on success, negative values on failure. + * specified in @secattr. Returns the NLTYPE on success, negative values on + * failure. * */ int netlbl_skbuff_setattr(struct sk_buff *skb, @@ -1315,6 +1316,8 @@ int netlbl_skbuff_setattr(struct sk_buff *skb, default: ret_val = -ENOENT; } + if (ret_val == 0) + ret_val = entry->type; break; #if IS_ENABLED(CONFIG_IPV6) case AF_INET6: @@ -1338,6 +1341,8 @@ int netlbl_skbuff_setattr(struct sk_buff *skb, default: ret_val = -ENOENT; } + if (ret_val == 0) + ret_val = entry->type; break; #endif /* IPv6 */ default: diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index ca47c99f964a..b6eede4406bd 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -266,6 +266,8 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, } rc = netlbl_skbuff_setattr(skb, family, secattr); + if (rc > 0) + rc = 0; skbuff_setsid_return: if (secattr == &secattr_storage) From patchwork Thu Feb 28 22:43:50 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834197 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1267F1805 for ; Thu, 28 Feb 2019 22:44:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 06B62290F8 for ; Thu, 28 Feb 2019 22:44:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EF9FF2FA84; Thu, 28 Feb 2019 22:44:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 91D352FA27 for ; Thu, 28 Feb 2019 22:44:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730110AbfB1Wog (ORCPT ); Thu, 28 Feb 2019 17:44:36 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:37242 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730042AbfB1Wof (ORCPT ); Thu, 28 Feb 2019 17:44:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393874; bh=mBl/BTOGpw7zkbjPkI0ZSNky0iR3x9y1FbWRTLx/zrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=MnGyKpMb671zrYH5kS7t0dX89JqlqbqUKBsfP3okqW4DIH1YzpkcxkW75lbcZH4gIJPEqaRV1iE88QaQIJ1E7/7wgBaP9edcOZdHic0b72e5K+pkHNnT42YLZYbkZfcwvyFqdDFcS1cF4REdivW0Jj3vOp4osht0QAELtUxaY9oTqkrclB2i52eijLLn0UO7Gu7WSLj7xtqm6OSCB4FXC0NAZIPBXzmcvWQBYMqpBw8lc26aU3humTvxQditXZxDGSUuZYxLE8Sarq5w7CNN4vjuaJo4DibBZGjWyNaudJ22SMkUMLjSzF+ZIyMt6gin7+5iTckCKszdma0L+Ev93w== X-YMail-OSG: leitoa0VM1k3Y0qz8zWWkxRBpN5E5rT8UMH9zeBnkVXWyQWdF.VHi2n3TTCFa.h 4_tdUwxN.uUgCuGNb6uhygbPvhdrArk4dXUQxeBUMnj8nch92TRa6F2SRpJ54xfDGQdkoPrbnVE1 8t4mtyqsPr7ZTfXriVqLJzTsNPb98NTlPH6llQ9xyUpUC_8c_MFrVR65zLcJzs7_LRNqRFWU.p0B WSV3CjX3Io2CXbuDSEx_LOYj4c0Nohm_K9TrqPvPDnsUIzr2SYNM19VzvhRQxP64Yy1bXx9KybkK 9m3zlUsGZAhmM935cxFret3vbBCXOSx6WG9AWYEgrnCucXxVjF5sHzjFhI3zTzrxbb3zS2R83fZD ERkVXtoeF3J6jTCUQGlv5ySRTRppHEpJbmlFXOeatCyeILsjZVrCrEfDws_28HZjDjojdmZMdFTT vcOQU1u3XppLp9j80ZoRlTSnUEzUpdFzg0SrrO6Xpn2LYIqPvFUyT_grXrPDcJtGsHBOMa5_Ym00 D7HftiA9w5SVgrxoRuEaB17kIe4qgzBaVZEN7y6Otx8s4wALccSlAK6QhnnMVnZWhye2_eoTxM2u d3RQ8upzUFnp21ZEmL43j.Ov6J4XfpCg5urYhkG_OulfbwMSGi4th9NuDzIUySdXof8bnwbr3Lh3 iy0fcEmX98a9snD2FjT7GidUmvwBSEVvTlFdFjwAvbKJmpWgIdWOTN5CovDN7621czXTSd7iXPoe uuHnRszkY9XHyM0POUAWIfgeLxyt7uR_bxSOCkiHJNKKa2N8HiZLwKtK3.ck17cXInyFuir9ofeJ lv3Z2WDgecn1BYbTjWvZ0r4LVRPzztGn4wvIvSdPy3EBQrnBl0_h9vb_o2RXJFYLyzKITJZpmK20 Vy5LJ2Sz0Nhs91qwcopelmxXfWCx8D77C8zsbHTec1pmQc8OeIkkOLGIOGMr8q7q5jJ5ESdFHnIG fYPzzj.ZpjdoJtd7kAUDhuTIkfSFd5KWUNeTZ99hMmFWuAp94PuB9rlRUTbbSRQoC1tDjJ0OnKlr mHmW9uu6qLE_jDPk.edV0a8_zJVdn4Cx5CiK322GrSnZ2JCPJJsWdqfskmecGgRBWQLcdfS3URk6 wwXVt3tQPRJL.2WyFDoOiULtDNqQPjSL7Yl28vuzH7nLHIdBW06Wz.erR Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:34 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:33 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 91/97] Netlabel: Return the labeling type on socket Date: Thu, 28 Feb 2019 14:43:50 -0800 Message-Id: <20190228224356.2608-22-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Change netlbl_req_setattr() to return the labeling type of the domain. This allows the labeling types to be compared when two LSMs want to determine how a socket should be used. Signed-off-by: Casey Schaufler --- net/netlabel/netlabel_kapi.c | 18 +++++++++++------- security/selinux/netlabel.c | 2 ++ security/smack/smack_lsm.c | 2 ++ 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 1d362a38dd05..5c5825171281 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -1185,12 +1185,14 @@ int netlbl_conn_setattr(struct sock *sk, * * Description: * Attach the correct label to the given socket using the security attributes - * specified in @secattr. Returns zero on success, negative values on failure. + * specified in @secattr. Returns the NLTYPE on success, negative values on + * failure. * */ int netlbl_req_setattr(struct request_sock *req, const struct netlbl_lsm_secattr *secattr) { + int rc; int ret_val; struct netlbl_dommap_def *entry; struct inet_request_sock *ireq = inet_rsk(req); @@ -1204,14 +1206,15 @@ int netlbl_req_setattr(struct request_sock *req, ret_val = -ENOENT; goto req_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CIPSOV4: - ret_val = cipso_v4_req_setattr(req, - entry->cipso, secattr); + rc = cipso_v4_req_setattr(req, entry->cipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: netlbl_req_delattr(req); - ret_val = 0; break; default: ret_val = -ENOENT; @@ -1225,14 +1228,15 @@ int netlbl_req_setattr(struct request_sock *req, ret_val = -ENOENT; goto req_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CALIPSO: - ret_val = calipso_req_setattr(req, - entry->calipso, secattr); + rc = calipso_req_setattr(req, entry->calipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: netlbl_req_delattr(req); - ret_val = 0; break; default: ret_val = -ENOENT; diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index b6eede4406bd..9fbf22a3ca57 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -358,6 +358,8 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family) if (rc != 0) goto inet_conn_request_return; rc = netlbl_req_setattr(req, &secattr); + if (rc > 0) + rc = 0; inet_conn_request_return: netlbl_secattr_destroy(&secattr); return rc; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 20eed64e91de..086a3f696baa 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4060,6 +4060,8 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, rc = netlbl_req_setattr(req, &skp->smk_netlabel); else rc = netlbl_req_setattr(req, &smack_net_ambient->smk_netlabel); + if (rc >= 0) + return 0; return rc; } From patchwork Thu Feb 28 22:43:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834189 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6F2681390 for ; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 62F812FA84 for ; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 610652FB81; Thu, 28 Feb 2019 22:44:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B76F2FB9D for ; Thu, 28 Feb 2019 22:44:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730965AbfB1Wok (ORCPT ); Thu, 28 Feb 2019 17:44:40 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:46203 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728891AbfB1Wok (ORCPT ); Thu, 28 Feb 2019 17:44:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393878; bh=RSqSEvaBx7UTvvKVvcE/y3/4YoVYdeGn5BMn7pYi34w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=qXL6X91m1HCTM0lgOpG6lXoFIxokR8MlCDffR5oIly76ZzfH/HL3gv5ptDJcJzrLOYu0vlAB6UR+kF6AYFP8acSU5z2F8z9xlU7VTFIZPv1bj4XhP691/Iu59MWhFvMn35oEehuuciLYUqGbKW09++W19yNI3r3TjK7j9gDpAstLKhP6jVggSsDxpeoeUxbJJtY+aCSU+5Sxgxmd2Xhq8AxZhBlz3yzoW58UEDQ7y27AXV1DZNYKoTZePIBt92LUxbEOkruVoGYBOePrQC+pRQQRbsBW6FU+vZmoHRgzgWeXjOGdoIsdyr9BzR20321G0ic82Zklb/qF9gHMjiG5cQ== X-YMail-OSG: NDasVvwVM1lHNtnA9S.LkQOWcDHKY_rKfgqHYnSZtSs1fn64LGTVO9fbTm.ySZn 63f7wJFX4qhH.BR2HaJrzOqWT5_0nxvEJMFoT7anDHU3RT40oO5M00jsIbLWvjib3AIhGOX8IkVc dULVvD3kY3B6nms8bXBLDkL4E66KMH23t9jfFSCYkXh5nDIogwbrDwlzpQWsf8PfqDgYvu1aQznm N4aR8f.d78YOVdsD0f9DPMcenr8KqBLGveGQhQEs4flcXcT70UgIcbpbp70zLc8x5LWfjLw2QnI_ KCfB5NdKwHgrWtsLGP2XU_1hX3EuaEAfxRQ_U73jQ61F1eCyFdVXsKslxzoh.BqpMaEXt93.ZqDH kHrRH0TZFfU9MoaJXmx_4Z1kzqscTgSKH0P..ANSydbpuQZznItFbxmoj78uOkaZ0xNMBrOYP2m_ WtuGfvDYpW7EoO2_XpGMo6_WW245lPC.Es9uE2_mujdTvYQzmTKl2slHwX36h6nkZblA.qqDOu4P KKiNP611lBSuH1pWZ.32TU0M7SL2YqRnHMXyCAwu3SX7yPaYF9KpC7aeYz2tS3ksOamru88BtSgU FCQM.K4VDtlGBAbOWmybTDddhQAY_E9uhQDqKkzZWgPC3xqg3fuPRpX5gREei4A30M99p3EpP0Xh YDGoWveKuaFNGLUDIPq9pb4G6614D5x7rBOqbngOHHp3YAQNqCxjMiL1tyjTHW5v0UflxjVPEev3 kwSdUGfIalfcf.JuJihiASJ5eUxX16.7N7acdT7pTgl64nQU3fhr5Wtmf.IKVnfuS7tGigDosHYG okeZ2TAg3Zt6.F.cwaObIE__gFb2EqF6Y4SCu3t6eQ1nkds.0wmhqEXB7aPii0A2BUzcdo3JgBDA lZokOOC.I7V.1QhddJtAtjtw7.rwi8_qLbZmb_s0DdAblNw7CsrmgytGvA502BuFDbHfpgXQKLqJ F5svrvoC9VPEGnizGDjEFCek7sclYFs8M0WSyaBPcVzOygImqEg7sfpF33wW_VIzFpTk5PIfF9js X8yZLIEermvnmnKItgPRcGfSJDhopI_FCxbwwNwTJo1ji.x60WrUEW0Rk81EqBeIcYxuxeY0FHMT el2rcEecDvFoInUVNGOr_svxBebIBKrMRSdk- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:38 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:34 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 92/97] LSM: Remember the NLTYPE of netlabel sockets Date: Thu, 28 Feb 2019 14:43:51 -0800 Message-Id: <20190228224356.2608-23-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add the NLTYPE returned when setting labels on sockets to the information retained by SELinux and Smack. Signed-off-by: Casey Schaufler --- security/selinux/include/objsec.h | 1 + security/selinux/netlabel.c | 20 ++++++++++++++------ security/smack/smack.h | 1 + security/smack/smack_lsm.c | 10 +++++++--- 4 files changed, 23 insertions(+), 9 deletions(-) diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index c9a88b7a96a7..a860d9936ec5 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -145,6 +145,7 @@ struct sk_security_struct { NLBL_REQSKB, NLBL_CONNLABELED, } nlbl_state; + int nlbl_set; /* Raw NLTYPE */ struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ #endif u32 sid; /* SID of this object */ diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 9fbf22a3ca57..b6fd905e6e9e 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -185,6 +185,7 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec) void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec) { sksec->nlbl_state = NLBL_UNSET; + sksec->nlbl_set = NETLBL_NLTYPE_NONE; } /** @@ -244,14 +245,14 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, int rc; struct netlbl_lsm_secattr secattr_storage; struct netlbl_lsm_secattr *secattr = NULL; + struct sk_security_struct *sksec; struct sock *sk; /* if this is a locally generated packet check to see if it is already * being labeled by it's parent socket, if it is just exit */ sk = skb_to_full_sk(skb); if (sk != NULL) { - struct sk_security_struct *sksec = selinux_sock(sk); - + sksec = selinux_sock(sk); if (sksec->nlbl_state != NLBL_REQSKB) return 0; secattr = selinux_netlbl_sock_getattr(sk, sid); @@ -266,8 +267,11 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, } rc = netlbl_skbuff_setattr(skb, family, secattr); - if (rc > 0) + if (rc >= 0) { + if (sk != NULL) + sksec->nlbl_set = rc; rc = 0; + } skbuff_setsid_return: if (secattr == &secattr_storage) @@ -325,6 +329,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep, rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr); if (rc >= 0) { sksec->nlbl_state = NLBL_LABELED; + sksec->nlbl_set = rc; rc = 0; } @@ -428,8 +433,10 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) sksec->nlbl_state = NLBL_REQSKB; else if (rc >= 0) sksec->nlbl_state = NLBL_LABELED; - if (rc > 0) + if (rc >= 0) { + sksec->nlbl_set = rc; rc = 0; + } return rc; } @@ -573,8 +580,8 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, if (addr->sa_family == AF_UNSPEC) { netlbl_sock_delattr(sk); sksec->nlbl_state = NLBL_REQSKB; - rc = 0; - return rc; + sksec->nlbl_set = NETLBL_NLTYPE_ADDRSELECT; + return 0; } secattr = selinux_netlbl_sock_genattr(sk); if (secattr == NULL) { @@ -584,6 +591,7 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, rc = netlbl_conn_setattr(sk, addr, secattr); if (rc >= 0) { sksec->nlbl_state = NLBL_CONNLABELED; + sksec->nlbl_set = rc; rc = 0; } diff --git a/security/smack/smack.h b/security/smack/smack.h index 147afb9233b4..8df0744ce38c 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -104,6 +104,7 @@ struct socket_smack { struct smack_known *smk_out; /* outbound label */ struct smack_known *smk_in; /* inbound label */ struct smack_known *smk_packet; /* TCP peer label */ + int smk_set; /* Netlabel NLTYPE */ }; /* diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 086a3f696baa..1b9c7e5e801a 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -2326,7 +2326,7 @@ static int smack_netlabel(struct sock *sk) { struct smack_known *skp; struct socket_smack *ssp = smack_sock(sk); - int rc = 0; + int rc; /* * The netlabel code will handle changing the @@ -2337,8 +2337,10 @@ static int smack_netlabel(struct sock *sk) skp = ssp->smk_out; rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); - if (rc > 0) + if (rc >= 0) { + ssp->smk_set = rc; rc = 0; + } bh_unlock_sock(sk); local_bh_enable(); @@ -4060,8 +4062,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, rc = netlbl_req_setattr(req, &skp->smk_netlabel); else rc = netlbl_req_setattr(req, &smack_net_ambient->smk_netlabel); - if (rc >= 0) + if (rc >= 0) { + ssp->smk_set = rc; return 0; + } return rc; } From patchwork Thu Feb 28 22:43:52 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834179 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D132418EC for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C04D92FB9B for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B563C2FBA2; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 698F92FB98 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731348AbfB1Wol (ORCPT ); Thu, 28 Feb 2019 17:44:41 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:37792 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731153AbfB1Wok (ORCPT ); Thu, 28 Feb 2019 17:44:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393879; bh=myo0K4BZ46tU+RPsERMaTfIKTHsxeAeIOvh0XfDHLWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=D7FEnvUWVC9mY20inJ1N7jXfcBDsOiybO5ZjZx9rOIHAgVGLdg14w8LqK9u0g8XVWLp1zXKFmBrInlNilLVM9ke/FGgHyPparov5LDlCzKufsJdtU3/Ixs9vwx3Dn5167xeofA8aq6PdKIFGDbkV2P1mYxZXZ+Y/i1BD3LvulMVkWuc/pdE5Vzg1doAZoj52lpLyvhAigdnCca1PdLamd1g96Tz8L0/UIGriIQl1WT17bx0GhT288JxFzxAyT9EyC96bbl60Tue8DMCadOLhndKW96jRg531wVNjb5CRNQb2rumHkDcERRk6MasBfwWL/9Tfpn8ZknP9yaF7R7cdWQ== X-YMail-OSG: YwYcPBEVM1ldV8IBb1R5NnXlqKCeEWvTUlwbr3CxaY6UmDbHi5EudfbW7QAM._v rsqAqF7nZ_ooxGFgKFuS.mDxhlFEfUJNE3Exphg8MiK.U.fPD9kwcIJX_M7osXuNj7_Ze9Q0OXpu zd9jumm9eNEz4Mhn.SwVLTQ9SRnsXp.pWL5aaXwY2xeQ4oOkDIvtiKJIPAAxAVdoiphvlTRnCnjL 2rSaUpX6vwdOBBT2lCxMnn0TIxEo8UN.4_zt0Nlr7aqgbzkcA_aZ1218doxp_7QYsrfTlD_uRooM zIJ6KmX5a2XRQwJEcNzjB3At0lYYkI5NBv1bBpCoqza0Lol8.5Mfc6wl4T_LYkJ1sbfQC.Rhk6o7 NrYCE2.RRdpbLmRyLgWO1qSJMBphOhEbZ250orHhCaGpCjSUrqIxWOK56O8OM_k2PvLitU15p7I7 QML.Xp8loBIgw_1jaU1JO1h2p2QznW_TbsubjJ2_q.hl4Y1ntqXCGt7ocaE3o60mAUSsKLi5lNsF FHNIfZ2JakJ3fNACX4dYVIPhrxfrRmg3aFWBNEUaCu3jhaa92lxBgfNAv0mHTDo1r.hdsVK4p0bd wQ..BteLq3hDBFSoOzwQpGHYDBuPqGRvi5RG27EYE8K3EGwkc4mHJcgDHXNiwwAtEc0fC2xDMLjm ERhKhaSlhbMEcuAzr5m8mlJgJ2cFZ9kTZOWVl.iE2XX1M2wKSvONfM7kT_YMntTXjgiGxkpowS0U NDWETzLcSRnOvJUUc4n3LL5Ij._3JOqJuOBfjF.okSe6ZGLDqL341s0vtR7nyP2T61Gj2u85VR31 semX4p7MBPhXFQmntEJrAH96TYc4s0tdXDQxQlzlyUgpCVl0JbQW6tRBYvf1mWHE5AaSMaXxGhDX W477DKUgtMR2LmYu0jiNg9znecKiF.t8JQik87wY0Q1QStN8m2wrzDKdxA6q7WMKSrW9Szsk4qFp lg.QPVPsiAwrgjX.nfRjyt7yFAixu_8kxUxtQ0LTK15fOAr296yUA.mhG0bw6i5oUlqWvks7u8X9 l60.rWpp88UJoWv8xdCR1.43LRfcOpbJmxfacPvZMtsV8ew0h4D7BXhYiSMutiy1JgTynMMKF7pl h2oLdhsgww8ouCprNX2eJ1.gvEvWQniyBtVQx_tca9XUjH9pNO.fioKT5 Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:39 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:35 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 93/97] Smack: Use the NLTYPE on output Date: Thu, 28 Feb 2019 14:43:52 -0800 Message-Id: <20190228224356.2608-24-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Use the saved NLTYPE to determine if the packet needs to be labeled in the output path. Signed-off-by: Casey Schaufler --- security/smack/smack_netfilter.c | 42 +++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index ea45b173f8ca..7d202dde75b6 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -26,10 +26,19 @@ static bool smack_checked_secmark; void smack_secmark_refcount_inc(void) { - smack_use_secmark = true; + smack_use_secmark = true; pr_info("Smack: Using network secmarks.\n"); } +static void smack_own_secmark(void) +{ + if (!smack_checked_secmark) { + security_secmark_refcount_inc(); + security_secmark_refcount_dec(); + smack_checked_secmark = true; + } +} + #if IS_ENABLED(CONFIG_IPV6) static unsigned int smack_ipv6_output(void *priv, @@ -40,11 +49,7 @@ static unsigned int smack_ipv6_output(void *priv, struct socket_smack *ssp; struct smack_known *skp; - if (!smack_checked_secmark) { - security_secmark_refcount_inc(); - security_secmark_refcount_dec(); - smack_checked_secmark = true; - } + smack_own_secmark(); if (smack_use_secmark && sk && smack_sock(sk)) { ssp = smack_sock(sk); @@ -63,17 +68,26 @@ static unsigned int smack_ipv4_output(void *priv, struct sock *sk = skb_to_full_sk(skb); struct socket_smack *ssp; struct smack_known *skp; + int rc = 0; - if (!smack_checked_secmark) { - security_secmark_refcount_inc(); - security_secmark_refcount_dec(); - smack_checked_secmark = true; - } + smack_own_secmark(); - if (smack_use_secmark && sk && smack_sock(sk)) { - ssp = smack_sock(sk); - skp = ssp->smk_out; + if (sk == NULL) + return NF_ACCEPT; + + ssp = smack_sock(sk); + if (ssp == NULL) + return NF_ACCEPT; + + skp = ssp->smk_out; + if (smack_use_secmark) skb->secmark = skp->smk_secid; + + if (ssp->smk_set == NETLBL_NLTYPE_ADDRSELECT) { + rc = netlbl_skbuff_setattr(skb, PF_INET, &skp->smk_netlabel); + if (rc < 0) + return NF_DROP; + ssp->smk_set = rc; } return NF_ACCEPT; From patchwork Thu Feb 28 22:43:53 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834177 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D64CB188E for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BFDC32FB98 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B3DDE2FCC1; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4D7B92FBA2 for ; Thu, 28 Feb 2019 22:44:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728891AbfB1Wok (ORCPT ); Thu, 28 Feb 2019 17:44:40 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:36385 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730892AbfB1Wok (ORCPT ); Thu, 28 Feb 2019 17:44:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393879; bh=0s2KBJq36nVFH7MLd6nTz4cocnrI67Rp9WTiPIZnBPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=fYIFN3TyY2IAcPkqAvhmLZk1TnCn+JH6jnn0Y091PwD2zBcGlhXok8+y6FaQhNds1km1vqTFW3Cvk5iYfvitWYbmwFeT7y/OGPA4ecg8wR+lnKyf2m4EbkdE1ZwDp36wCl6PVhnHBVo+Lk3udOhaIRNT/pAtrTpruG2KO0naJKNlVOcnkiNk+RXDH2NaTPLNIaPNi5RDDxsVWbCYiQUlW6R2V298eG2a2eYwVSMalnAxKseFuIWQU5WLRsXbjFYaO7bIxU2NL3g2MgHp69SYDUvyIjfjW7PCwzodrxJCdpVQwIRmeUB/OUrEXLOWxctRW54XcUjRP3YuQTFKYwFQOQ== X-YMail-OSG: DQOAOnsVM1mOAQhI5wtssINR5Zwfh1UvUKF9cTDZ9MyKyl0n3z3EpcdcFHLPgoJ _efwyoUgkWE5u2kSCxixJZotm0bCvd2x2YTXmR08Qjx2hZ9cGJ837sf_UnLTRNKSbxaIHCg3AYmk YonShgey3Da0GPLjQaJgNvh8ayEcbwlSuHRHfWWeXbrEgnZKWwh61CuQuWn43TR3GuQfMAzOBeWt wL6iAbt8batOgvCVtlNShm8d.L4vyDCJ9hGjkZgP057KwVN3xb.mDpYGe.Pr1DgkFGY5NOL7kKxH uB3JWqLC.gaYr3Qo3tGBz_EZKMlc_PPaQshf07N0TEsmSdJPpREByy.pjcHPf6kvpwiI_5gJL1f6 9ydxf4Byp2wAX59IY2G_bbq_rcvuK7Pi6dFEfNTpk.22hBwjWBxBXOwpvl_v.qO7aBtKkhQxiMrv 4ZYPlziR.dAL.396kWd4jYqpjtkF5magptkxJcGHicYoYRYpyReQ2o_8yK2wZfGhuERhInu1yd83 9O.EeZc5fiEIXgVDgchumYoitg5gm6FPTF78deNYdoRFQ6_Jlu2G9I1VtrQhns91YLBcXOMdZ2Md U0LmMtv2Spigt7h5F5HcGe0098b0TyLrQYTjj43NkEYEhL_ohsWpkfMwT2lh6iRGDqLIpnkF1MZu bi.si1wU3VsM8CWp9AjgTdXRVafyYRS.cszfIGGf32dS8UrfrCroD0MThaGtLerJwGXbmEiC3WY0 IyYwa.BUaJSrnyu_Ff50JmejvtX3Xq2ikUgvZjgi7vPkZ5TPyknQDxZ0yIcke3z8qc6pFNamrWlN MohacVjw.ILe7uNKhrFzHBP5dqUwtmd5AZxzofRjDjXV5uMYXO.HdACJZEwta1o2YrDXP76G..Ju M2WNqCdDLdMRQaQwyRc2enbLTGS8fCtVpTXC8_XO9f0dbBhys_TFvLYcigWRJwZZ0RuBJVonA31p 9aZ8VNqRqH.cDOCfXmSNTpOKKa7LeWV8i1Vwk9pKAKo56SF6NceT69q1Ttm8edwRJm0tyAY43vuL AXGQY6TtFPPJGXR1CuKbJrANCMFZ0J1gW17EjajBXTOExm8TXlkwOFnd_N_zxh87lbJglXKbzcsN frP5TlAAonyZpXYpM3AwnmmxJn0G7I6dm_IqxWoxAKnhmCUv8ZSqNmWQ- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:39 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:36 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 94/97] LSM: Hook for netlabel reconciliation Date: Thu, 28 Feb 2019 14:43:53 -0800 Message-Id: <20190228224356.2608-25-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add an LSM function security_reconcile_netlbl() which uses the new LSM hook socket_netlbl_secattr() to decide if the active security modules are in agreement regarding the labeling of a network packet. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 15 +++++++++ include/linux/security.h | 9 ++++++ security/security.c | 50 +++++++++++++++++++++++++++++ security/selinux/hooks.c | 3 ++ security/selinux/include/netlabel.h | 7 ++++ security/selinux/netlabel.c | 9 ++++++ security/smack/smack_lsm.c | 9 ++++++ 7 files changed, 102 insertions(+) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index fec7f86897ea..2a53465f94da 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -29,6 +29,9 @@ #include #include +#ifdef CONFIG_NETLABEL +struct netlbl_lsm_secattr; +#endif /** * union security_list_options - Linux Security Module hook function list * @@ -1416,6 +1419,10 @@ * @bpf_prog_free_security: * Clean up the security information stored inside bpf prog. * + * Security hooks for network labeling (Netlabel) operations. + * + * @socket_netlbl_secattr: + * Report the netlabel attributes this module wants for this socket. */ union security_list_options { int (*binder_set_context_mgr)(struct task_struct *mgr); @@ -1772,6 +1779,11 @@ union security_list_options { int (*bpf_prog_alloc_security)(struct bpf_prog_aux *aux); void (*bpf_prog_free_security)(struct bpf_prog_aux *aux); #endif /* CONFIG_BPF_SYSCALL */ +#ifdef CONFIG_NETLABEL + void (*socket_netlbl_secattr)(struct sock *sk, + struct netlbl_lsm_secattr **secattr, + int *set); +#endif }; struct security_hook_heads { @@ -2006,6 +2018,9 @@ struct security_hook_heads { struct hlist_head bpf_prog_alloc_security; struct hlist_head bpf_prog_free_security; #endif /* CONFIG_BPF_SYSCALL */ +#ifdef CONFIG_NETLABEL + struct hlist_head socket_netlbl_secattr; +#endif } __randomize_layout; /* diff --git a/include/linux/security.h b/include/linux/security.h index 7edceb91d77f..c9d7de811b53 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1878,5 +1878,14 @@ static inline void security_bpf_prog_free(struct bpf_prog_aux *aux) #endif /* CONFIG_SECURITY */ #endif /* CONFIG_BPF_SYSCALL */ +#ifdef CONFIG_NETLABEL +extern int security_reconcile_netlbl(struct sock *sk); +#else +static inline int security_reconcile_netlbl(struct sock *sk) +{ + return 0; +} +#endif + #endif /* ! __LINUX_SECURITY_H */ diff --git a/security/security.c b/security/security.c index ab1050a2dce3..3c1d2f47b09f 100644 --- a/security/security.c +++ b/security/security.c @@ -33,6 +33,9 @@ #include #include #include +#ifdef CONFIG_NETLABEL +#include +#endif #define MAX_LSM_EVM_XATTR 2 @@ -2775,3 +2778,50 @@ void security_bpf_prog_free(struct bpf_prog_aux *aux) call_void_hook(bpf_prog_free_security, aux); } #endif /* CONFIG_BPF_SYSCALL */ + +#ifdef CONFIG_NETLABEL +int security_reconcile_netlbl(struct sock *sk) +{ + struct netlbl_lsm_secattr *prev = NULL; + struct netlbl_lsm_secattr *this = NULL; + int prev_set = 0; + int this_set = 0; + struct security_hook_list *hp; + + hlist_for_each_entry(hp, &security_hook_heads.socket_netlbl_secattr, + list) { + hp->hook.socket_netlbl_secattr(sk, &this, &this_set); + if (this_set == 0 || this == NULL) + continue; + if (prev != NULL) { + /* + * Both unlabeled is easily acceptable. + */ + if (prev_set == NETLBL_NLTYPE_UNLABELED && + this_set == NETLBL_NLTYPE_UNLABELED) + continue; + /* + * The nltype being different means that + * the secattrs aren't comparible. Except + * that ADDRSELECT means that couldn't know + * when the socket was created. + */ + if (prev_set != this_set && + prev_set != NETLBL_NLTYPE_ADDRSELECT && + this_set != NETLBL_NLTYPE_ADDRSELECT) + return -EACCES; + /* + * Count on the Netlabel system's judgement. + */ + if (!netlbl_secattr_equal(prev, this)) + return -EACCES; + } + prev = this; + prev_set = this_set; + } + /* + * No conflicts have been found. + */ + return 0; +} +#endif /* CONFIG_NETLABEL */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 22a190f291c0..84bfcf7ca08b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6769,6 +6769,9 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free), LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free), #endif +#ifdef CONFIG_NETLABEL + LSM_HOOK_INIT(socket_netlbl_secattr, selinux_socket_netlbl_secattr), +#endif }; static __init int selinux_init(void) diff --git a/security/selinux/include/netlabel.h b/security/selinux/include/netlabel.h index 8671de09c363..b316c62e7bcc 100644 --- a/security/selinux/include/netlabel.h +++ b/security/selinux/include/netlabel.h @@ -69,6 +69,9 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock, int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr); int selinux_netlbl_socket_connect_locked(struct sock *sk, struct sockaddr *addr); +void selinux_socket_netlbl_secattr(struct sock *sk, + struct netlbl_lsm_secattr **secattr, + int *set); #else static inline void selinux_netlbl_cache_invalidate(void) @@ -165,6 +168,10 @@ static inline int selinux_netlbl_socket_connect_locked(struct sock *sk, { return 0; } +static inline void selinux_socket_netlbl_secattr(struct sock *sk, + struct netlbl_lsm_secattr **secattr) +{ +} #endif /* CONFIG_NETLABEL */ #endif diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index b6fd905e6e9e..56ae261d2805 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -642,3 +642,12 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr) return rc; } + +void selinux_socket_netlbl_secattr(struct sock *sk, + struct netlbl_lsm_secattr **secattr, + int *set) +{ + struct sk_security_struct *sksec = selinux_sock(sk); + *secattr = sksec->nlbl_secattr; + *set = sksec->nlbl_set; +} diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 1b9c7e5e801a..885e1799df00 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4487,6 +4487,14 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, } return 0; } +void smack_socket_netlbl_secattr(struct sock *sk, + struct netlbl_lsm_secattr **secattr, + int *set) +{ + struct socket_smack *ssp = smack_sock(sk); + *secattr = &ssp->smk_out->smk_netlabel; + *set = ssp->smk_set; +} struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { .lbs_cred = sizeof(struct task_smack), @@ -4638,6 +4646,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up), LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr), LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as), + LSM_HOOK_INIT(socket_netlbl_secattr, smack_socket_netlbl_secattr), }; From patchwork Thu Feb 28 22:43:54 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834175 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BE7191880 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ACF512FB90 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A15D92FB99; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 481262FA84 for ; Thu, 28 Feb 2019 22:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731153AbfB1Wol (ORCPT ); Thu, 28 Feb 2019 17:44:41 -0500 Received: from sonic301-10.consmr.mail.bf2.yahoo.com ([74.6.129.49]:34078 "EHLO sonic301-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731171AbfB1Wol (ORCPT ); Thu, 28 Feb 2019 17:44:41 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393879; bh=oscz6Vi68MsyXM6MI+oD21a/mpleHcjgHRDeaBmng10=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=d2T4fRgiP8iqjNQWRKHk8e7PfBCI/BgXSPH0/meQqZjI0akUDFFCWAXX3XdEVh/fippArV9tuWWAFSt245iA3Y/udCawaKWRCeobEO5bL/8lqsV3NUuqKofFb1lPhZ2K+u1NdNLlqtLIu/BuZgLjX5OrRHLECyFujAoDQ1V9VEIbZtSErSP1yP2XMXGhHeoDezWVAGZ+E0O83+9Ie/GBxMO5X3EUF2FM4c8lqGdpj5B6ogUvSdFf/9vLTYptaS7XN2VtZioAaiq6At2PatB38ikPqmnx83TfLb/DR2EcvWv11kvYKa3l6/Wr9IfvBy5EcnPgAb0PiLIHAtXpmXzgXQ== X-YMail-OSG: bHKYKvAVM1nqT3Z53bdPCQWzoFChJ11sbbcJS.zlYO5wsZK8SkbREayE3urUkKN 7QvYGMblkSrPyy_So2f5ndMeWE4Y7eU2f0oUGy7DrfXMGfFt4pQQOLzsw_S6Z7ZpMMM.lTYoJVus VhJdqv2Egtq2DxefYzdGRbf8fpW1hSOL3DuslrLUmuLM0EoL9e8iLUDE4TY52.xa2ASjfI7XeWvJ uvps6WDVVBAQB8TA6pRiTr8YT5Ub5YtOE75GyoVhTEwVmAcovJgq7c3zWqNCoc8cMAVkP8STvKZk GlytdJRUWFQF8AIRmTn3mC6iHxWWW2_l_PbyxUtvf7VvBxm_uWpAQbXV3D0Hk6XAkwAWP1Df3m1m E00NotMuwndHDutlktLqzA.EGP2SeV4GC.ALeh4ZumazCuR5vqudVP6tyCPr2vrGiPtHAQHvDjKx h4LzlxRVYDS27UIxbzX43A9N4e7nAnOquCZGWQbV.QNORvg0QtGFzTLDY630YQsO5Ob0NSgKOQ01 .scZXKnBINLbiP9RZ5HM3cOCOdFiCaNCwj1UYk..8e_HFHNyD9wleTSa5pKON74fJzDGJUdQVGNc sPiXrZz2fuUWSIvRXcrW9hOcmxpB.tq93JfrolqcvoKUjoCRE.Mh0K20surJAWEjFJvC7Kyq.bIx H.CP_obU8dmBYMhU.JiszQQiUaRjtuySITeD2lsjyWJgESepfMVQu88gyqg5KqDzAyU9xPsNucdf tMM04LNhIK4qXhnhytDWZTM4bhyuPeAkPjvGw7IC_HsD9_VRDAZaBKN9OGeN4HCeutllQWyWN34V oqy0J.YrksBpxPG3968Bj8aKlVKkGRU_q7orqa_YqnRSYmYDJazdfCjZor40fEqFVaF8L90GpvwY vFIhYx8IkaDL3rndkfoqqpQQPiVW9yeFl2IsHnMm5OhS7..Slb5MoKcNCQPS2vC1Ap_FsUdrgd3V QXWBH9wLIqGWMiMrwZqg1zYiyrtnfOIW86ItOffUsIU2EUJqp3KHwn8DMX53Y9RL7YF76lAuNGpN Ov1h_DRR5Asjv0cjXMztDMzBdv4icM.p7S.1kjSoKx.gyYAk707WOQ9WaaYNkZmMTIF1VpZJDsOo qxT1ssqcpN0MjYOTMsi4SAPfcYw46KrrlyeFGIl7TGp.Xs9ZG6uaZAHU- Received: from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:39 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:38 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 95/97] LSM: Avoid network conflicts in SELinux and Smack Date: Thu, 28 Feb 2019 14:43:54 -0800 Message-Id: <20190228224356.2608-26-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add calls to security_reconcile_netlbl() in SELinux and Smack to ensure that only packets that are acceptable to all active security modules get sent. Signed-off-by: Casey Schaufler --- security/selinux/hooks.c | 3 +++ security/smack/smack_netfilter.c | 2 ++ 2 files changed, 5 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 84bfcf7ca08b..4a8996b7b477 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5400,6 +5400,9 @@ static unsigned int selinux_ip_output(struct sk_buff *skb, sid = SECINITSID_KERNEL; if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0) return NF_DROP; + /* verify that this IP option works with other security modules */ + if (sk && security_reconcile_netlbl(sk)) + return NF_DROP; return NF_ACCEPT; } diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 7d202dde75b6..55cc38ae07f5 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -89,6 +89,8 @@ static unsigned int smack_ipv4_output(void *priv, return NF_DROP; ssp->smk_set = rc; } + if (security_reconcile_netlbl(sk)) + return NF_DROP; return NF_ACCEPT; } From patchwork Thu Feb 28 22:43:55 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 32F801880 for ; Thu, 28 Feb 2019 22:44:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 26CD2290F8 for ; Thu, 28 Feb 2019 22:44:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1B78A2FA27; Thu, 28 Feb 2019 22:44:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B4AFA2FB7E for ; Thu, 28 Feb 2019 22:44:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731103AbfB1Wop (ORCPT ); Thu, 28 Feb 2019 17:44:45 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:34565 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729193AbfB1Wop (ORCPT ); Thu, 28 Feb 2019 17:44:45 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393883; bh=veSNDk2QMHk6L9DmOxVle7iGwxSBUaP8rL8t0q/nJ+g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=OljgPz5f+x2qL+3c8pbKwI1RVLdJGOkwqQEmq4jy0EKz4zXBqcOjFEKr1RQSs8qNLVbkeGzGyPArjHlt97VEliKaSxHM0xU8ZHc3RwqZlHmgPmgQ1FbMZd3pCglwvv6eYkjty2JadNHcv+/QC1QT4LS5C3soWWfytz5cvBLO0Y0AC8UaZpB7nRyK+sjTmGjsiOUoQFR9FX77IOn7RPATuE8w0i1U5ykQgvwQTptJKA064dTv9sXAF4RATMKahn8k/xTux+hcZfIRbsi56uY6fBE2aEIGe1PuLBi1/sashuTgtE0pHs7AA9yuo4bGc2ROhso6HE0L3YJvwzRBfuJw6g== X-YMail-OSG: L25urUsVM1lRuG..6p6nduoIu8B4K_.g4Kt8gOBd6wR3ygcKZHAuj0dwBRX9L0o Ycu2mr5KWOXOUBHCUwQT9Z8Hyo41KBn6.pZ8JzGDNvANuoA2Yhsq9E9Nzf4_0Fsf2V2fwOciGjSN hFgXQ8IPqbgcmYctk111RsZvHhih0QFysWM84wlkgSK.74rfKOJjUZHHC5Ke60aPZ5O3Cy8J2jC. LXZsIe.21e7H0Rbjx2ozUZrM4HvRQrzvqAno3yIymTiEvNco90auohhCTgmcFQmehn0YzV8FGIDe 4uxuVNOsJvW8VGQMDaTuz9hLxSPByexICrIv5mVz2zDrK34WPrjPsrUQjqsaV11xseUne6x5CEvX 0f3hmgbgw38LGyc0zPDGhMvyZSbmoZR5iZG8YwYncMFCK607GY_7qNDQUhw5QKDhKJaSrcTzNXOp txWv8a4772_KlsNdo28Wyfgzyo4Rbsa2geOL7Qf5FVnpkgUQBo53UinUS.DyVmcvKoowtRsUc7JB IcwGbcvMnRhBQZZOyyolakLd847WVsB2BA4xoMbOAv8gfTIBEZiLUn9dif_HlL5CPQqZzIZ55oU7 WvObqVcXKvGQcko8IFv2KE.AawgvCFDT8hsg3rV172Z2fywlyLnEI9Fdz8aeYhjR4yDZZDvU3Df7 kNT2bRLrJeYsjnO_YTssIH4UC9YHz_yzDGNY1VPbWMN5xE2QuILprIuWQfWD47QxL5OZXhDI4.AD 4dLnRhJ_XNINavQ7ltr7ET14RSvB3kYnmYNwtOEbzGxWYSk0WCEM.hfjh6dU0Y5EO9tMOzCTCsph ardHiO512pFgFD0I14P51WsLhQP6GnzXnDJvJfai_EH.Sxe.t8IulzOd3c.HwGOyLcqz14wJPVw8 3gxyQmMJ60IFsyDKCyew1hWuQQgM5LkGnRtgEeTl7p_00ZOsD2UPIUpMIfdAEKptWXyRFlOiHC9K xDMhnPt16j3pIH3AgO4ZDSV_dc.dVEWIfqjd4oQ7FTthyp_D_jSkcHSRdFkmBNOVKpzPsw2Y7Knx Hm7EtUBubrff5QMGv8mFg.rNIJXeqV402SUstwIOtaV.oq0d46SYvcM6uDy5o1aLKzZN_5Bl84vT egyGXfs45Tm7Yp7wA8LfwWSD.OqodKg2RTyIJ6Pdc4qK0UN1U7L.qvfw- Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:43 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:39 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 96/97] LSM: Apply Netlabel consitancy checks on send and connect Date: Thu, 28 Feb 2019 14:43:55 -0800 Message-Id: <20190228224356.2608-27-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Verify that all security modules agree on the network labeling for sendmsg and connect. Signed-off-by: Casey Schaufler --- security/security.c | 43 ++++++++++++++++++++++---------- security/selinux/hooks.c | 2 +- security/smack/smack_netfilter.c | 5 ++-- 3 files changed, 34 insertions(+), 16 deletions(-) diff --git a/security/security.c b/security/security.c index 3c1d2f47b09f..dfee44ee4d19 100644 --- a/security/security.c +++ b/security/security.c @@ -2355,7 +2355,13 @@ int security_socket_bind(struct socket *sock, struct sockaddr *address, int addr int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) { - return call_int_hook(socket_connect, 0, sock, address, addrlen); + int rc; + + rc = call_int_hook(socket_connect, 0, sock, address, addrlen); + if (rc) + return rc; + + return security_reconcile_netlbl(sock->sk); } int security_socket_listen(struct socket *sock, int backlog) @@ -2370,6 +2376,12 @@ int security_socket_accept(struct socket *sock, struct socket *newsock) int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) { + int rc; + + rc = security_reconcile_netlbl(sock->sk); + if (rc) + return rc; + return call_int_hook(socket_sendmsg, 0, sock, msg, size); } @@ -2788,28 +2800,33 @@ int security_reconcile_netlbl(struct sock *sk) int this_set = 0; struct security_hook_list *hp; + if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) + return 0; + hlist_for_each_entry(hp, &security_hook_heads.socket_netlbl_secattr, list) { hp->hook.socket_netlbl_secattr(sk, &this, &this_set); + /* + * If the NLTYPE has been deferred it's not + * possible to decide now. A decision will be made + * later. + */ + if (this_set == NETLBL_NLTYPE_ADDRSELECT) + return 0; if (this_set == 0 || this == NULL) continue; if (prev != NULL) { - /* - * Both unlabeled is easily acceptable. - */ - if (prev_set == NETLBL_NLTYPE_UNLABELED && - this_set == NETLBL_NLTYPE_UNLABELED) - continue; /* * The nltype being different means that - * the secattrs aren't comparible. Except - * that ADDRSELECT means that couldn't know - * when the socket was created. + * the secattrs aren't comparible. */ - if (prev_set != this_set && - prev_set != NETLBL_NLTYPE_ADDRSELECT && - this_set != NETLBL_NLTYPE_ADDRSELECT) + if (prev_set != this_set) return -EACCES; + /* + * Both unlabeled is easily acceptable. + */ + if (this_set == NETLBL_NLTYPE_UNLABELED) + continue; /* * Count on the Netlabel system's judgement. */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 4a8996b7b477..c924b454246b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5400,7 +5400,7 @@ static unsigned int selinux_ip_output(struct sk_buff *skb, sid = SECINITSID_KERNEL; if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0) return NF_DROP; - /* verify that this IP option works with other security modules */ + if (sk && security_reconcile_netlbl(sk)) return NF_DROP; diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 55cc38ae07f5..de4145c2cdd5 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -88,9 +88,10 @@ static unsigned int smack_ipv4_output(void *priv, if (rc < 0) return NF_DROP; ssp->smk_set = rc; + rc = security_reconcile_netlbl(sk); + if (rc < 0) + return NF_DROP; } - if (security_reconcile_netlbl(sk)) - return NF_DROP; return NF_ACCEPT; } From patchwork Thu Feb 28 22:43:56 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10834193 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EB5421805 for ; Thu, 28 Feb 2019 22:44:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DEE57290F8 for ; Thu, 28 Feb 2019 22:44:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D2C762FB96; Thu, 28 Feb 2019 22:44:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 922932FA84 for ; Thu, 28 Feb 2019 22:44:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731381AbfB1Wop (ORCPT ); Thu, 28 Feb 2019 17:44:45 -0500 Received: from sonic307-10.consmr.mail.bf2.yahoo.com ([74.6.134.49]:33446 "EHLO sonic307-10.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731103AbfB1Wop (ORCPT ); Thu, 28 Feb 2019 17:44:45 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551393883; bh=ZsUZpEZtwQ2LlXvw3CDUvBCjaKP67jDOCjv0+cURl9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=OIOO8M6mxNWEzaOevJ8E6K6hZHcc5UDfnMllz0mKkmPkBd0jf5kJMrxPEmbJDmGxg2j3gPK6vNrRBpQNGnLzU2MliXZfM1au1nkP/HpzW7i1JijHet0TkhzsrSzKClnx9LY7nCRnfZzLSdyKZc1pf00P+fDVLh05Ou4PKqJMMHIyG1rBNHQUIqEHMK75Mi3QFB+lFoOxQ3uJD5jfpMOQH+XLPeNbuBpTldfmA6iANbtafF/wMQl41KntXQAYE0BHD1wW58XLH7y3Sn5wCNDIa8ACXceYb18CITgN6ZkcH2lq0Sct4aUsy/Op0GH+ilyZqbjAzFV53hT+mcZNAlsuug== X-YMail-OSG: sLVU7BYVM1kevKTfaaFsK2x6SFkZyRxWwiUSDSc.geBg8Z4Y_1K35mMTqx156Ix KfsLbxIaj4HLIMGpVNCRjFIIWo7_1ZWOOMcGjL1ZM0G13gk_3gMg_.0aY1DE27DHj1pF1L5TgsY2 HMJhYQniMFHJJe.uRoZY_L8444v2.nQD4pPM50Z6_Mha4NFeFpEXgzjiQV781_nE.JzcjSlfcv7V ti3oqFZAe.SVv99YEiPixDN3DjyXvDogZrb7clOhZscOeAfFxukjRmFUUDLqN7WCeHMcQ.WWXHSm r_bvWWOWyo4UTj6doqvoi7LbWOQFfLSWcNOOdBUujsZS1PdEZv36VR3KeflDc4mNg79KZ5MPk3CC lrRPIYHvE77YvUIC7E.bXNxavdmAlqZYbuKb1A0cHIp.mzMqScGoeGr7HClLCp84nKjkomkX.num R2u59hnE_Og.DTImQM6fc5WTcgLjZKCVhVKo.NVRwAsNpt4dztEGvb9wkRAAG9PKjAd7XfdV58Ei D2UPRIRiaE2lJNXOgBOgzhAX5JN5dlaRx5mYfAJjUx4mcfJWO22y9bu9aNTxCaxOwgiGHVhm2Iyu Ughc9jQd1_AE2rzfE8WAEVHfXXCTlsXtM0eOJONhUEjRHvQSO9DWdZq.JtJYy9jUzdhTLR6UzEiY Ph6vF4i6LoLqGFVPy9fbtMDJTdW_Gx4PWcqqwrwDoFUxd6g0kjnn1q9xZWDpH7jVsnz6LET7o7PB OAjP2b_eeTu6Pxl4VPKYTOR.8wXSad__rdvvBQlx2GZ98qFFf0zSPqvtqxABNEkX5Ol3tCzLT21D MpVywvIkd2hfC23IkJu8bP0gAW6WPsxtUPT_8Q_UNKsTya.uo2mybxCZEMqhkoqHe0Jkc_9IKvNs C.V20T01mHdPFGJ.laWFRYN.BXipXuz8ml9fZ9FyKqG2mcHHIH1uZzT.29cA7G3WRuujVN71.Wwo BBWnUSBqrFmXRZcUMg_Mjcv6.wuguAHDlZ7WJe3UDIGK9DbG0Qz9iCf6Apyr7yIq6F26hKrWehNn hQUBb7wtneIW8w_u8TA_DXHp.HmhW5bZYGEfa1u57o1dc.BTAUn4WsO8MXAQtQhHLlggHUioZLe9 YybcQ4f61oSCqcPDp8urDo8qhGeADlRMIN5ag0Z13Ffm13bKN7DkFet_a Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Thu, 28 Feb 2019 22:44:43 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp430.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 41bc5dec9e4ecaa87e9a199cc17828e6; Thu, 28 Feb 2019 22:44:40 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 97/97] Smack: Remove the exclusive bit Date: Thu, 28 Feb 2019 14:43:56 -0800 Message-Id: <20190228224356.2608-28-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228224356.2608-1-casey@schaufler-ca.com> References: <20190228224356.2608-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Smack can now be used with any of the existing security modules, so remove the exclusive bit. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 885e1799df00..0c15e108726e 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4727,7 +4727,7 @@ static __init int smack_init(void) */ DEFINE_LSM(smack) = { .name = "smack", - .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, + .flags = LSM_FLAG_LEGACY_MAJOR, .blobs = &smack_blob_sizes, .init = smack_init, };