[mirror_ubuntu-hirsute-kernel.git] / security / selinux / netlabel.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * SELinux NetLabel Support
 *
 * This file provides the necessary glue to tie NetLabel into the SELinux
 * subsystem.
 *
 * Author: Paul Moore <paul@paul-moore.com>
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
 */

#include <linux/spinlock.h>
#include <linux/rcupdate.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/sock.h>
#include <net/netlabel.h>
#include <net/ip.h>
#include <net/ipv6.h>

#include "objsec.h"
#include "security.h"
#include "netlabel.h"

/**
 * selinux_netlbl_sidlookup_cached - Cache a SID lookup
 * @skb: the packet
 * @secattr: the NetLabel security attributes
 * @sid: the SID
 *
 * Description:
 * Query the SELinux security server to lookup the correct SID for the given
 * security attributes.  If the query is successful, cache the result to speed
 * up future lookups.  Returns zero on success, negative values on failure.
 *
 */
static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
					   u16 family,
					   struct netlbl_lsm_secattr *secattr,
					   u32 *sid)
{
	int rc;

	rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid);
	if (rc == 0 &&
	    (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	    (secattr->flags & NETLBL_SECATTR_CACHE))
		netlbl_cache_add(skb, family, secattr);

	return rc;
}

/**
 * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
 * @sk: the socket
 *
 * Description:
 * Generate the NetLabel security attributes for a socket, making full use of
 * the socket's attribute cache.  Returns a pointer to the security attributes
 * on success, NULL on failure.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_secattr != NULL)
		return sksec->nlbl_secattr;

	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	if (secattr == NULL)
		return NULL;
	rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid,
					    secattr);
	if (rc != 0) {
		netlbl_secattr_free(secattr);
		return NULL;
	}
	sksec->nlbl_secattr = secattr;

	return secattr;
}

/**
 * selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
 * @sk: the socket
 * @sid: the SID
 *
 * Query the socket's cached secattr and if the SID matches the cached value
 * return the cache, otherwise return NULL.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
							const struct sock *sk,
							u32 sid)
{
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;

	if (secattr == NULL)
		return NULL;

	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	    (secattr->attr.secid == sid))
		return secattr;

	return NULL;
}

/**
 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
 *
 * Description:
 * Invalidate the NetLabel security attribute mapping cache.
 *
 */
void selinux_netlbl_cache_invalidate(void)
{
	netlbl_cache_invalidate();
}

/**
 * selinux_netlbl_err - Handle a NetLabel packet error
 * @skb: the packet
 * @error: the error code
 * @gateway: true if host is acting as a gateway, false otherwise
 *
 * Description:
 * When a packet is dropped due to a call to avc_has_perm() pass the error
 * code to the NetLabel subsystem so any protocol specific processing can be
 * done.  This is safe to call even if you are unsure if NetLabel labeling is
 * present on the packet, NetLabel is smart enough to only act when it should.
 *
 */
void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
{
	netlbl_skbuff_err(skb, family, error, gateway);
}

/**
 * selinux_netlbl_sk_security_free - Free the NetLabel fields
 * @sksec: the sk_security_struct
 *
 * Description:
 * Free all of the memory in the NetLabel fields of a sk_security_struct.
 *
 */
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
{
	if (sksec->nlbl_secattr != NULL)
		netlbl_secattr_free(sksec->nlbl_secattr);
}

/**
 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
 * @sksec: the sk_security_struct
 * @family: the socket family
 *
 * Description:
 * Called when the NetLabel state of a sk_security_struct needs to be reset.
 * The caller is responsible for all the NetLabel sk_security_struct locking.
 *
 */
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
{
	sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
 * @skb: the packet
 * @family: protocol family
 * @type: NetLabel labeling protocol type
 * @sid: the SID
 *
 * Description:
 * Call the NetLabel mechanism to get the security attributes of the given
 * packet and use those attributes to determine the correct context/SID to
 * assign to the packet.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
				 u16 family,
				 u32 *type,
				 u32 *sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled()) {
		*sid = SECSID_NULL;
		return 0;
	}

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, sid);
	else
		*sid = SECSID_NULL;
	*type = secattr.type;
	netlbl_secattr_destroy(&secattr);

	return rc;
}

/**
 * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
 * @skb: the packet
 * @family: protocol family
 * @sid: the SID
 *
 * Description
 * Call the NetLabel mechanism to set the label of a packet using @sid.
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
				 u16 family,
				 u32 sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr_storage;
	struct netlbl_lsm_secattr *secattr = NULL;
	struct sock *sk;

	/* if this is a locally generated packet check to see if it is already
	 * being labeled by it's parent socket, if it is just exit */
	sk = skb_to_full_sk(skb);
	if (sk != NULL) {
		struct sk_security_struct *sksec = sk->sk_security;

		if (sksec->nlbl_state != NLBL_REQSKB)
			return 0;
		secattr = selinux_netlbl_sock_getattr(sk, sid);
	}
	if (secattr == NULL) {
		secattr = &secattr_storage;
		netlbl_secattr_init(secattr);
		rc = security_netlbl_sid_to_secattr(&selinux_state, sid,
						    secattr);
		if (rc != 0)
			goto skbuff_setsid_return;
	}

	rc = netlbl_skbuff_setattr(skb, family, secattr);

skbuff_setsid_return:
	if (secattr == &secattr_storage)
		netlbl_secattr_destroy(secattr);
	return rc;
}

/**
 * selinux_netlbl_sctp_assoc_request - Label an incoming sctp association.
 * @ep: incoming association endpoint.
 * @skb: the packet.
 *
 * Description:
 * A new incoming connection is represented by @ep, ......
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
				     struct sk_buff *skb)
{
	int rc;
	struct netlbl_lsm_secattr secattr;
	struct sk_security_struct *sksec = ep->base.sk->sk_security;
	struct sockaddr_in addr4;
	struct sockaddr_in6 addr6;

	if (ep->base.sk->sk_family != PF_INET &&
				ep->base.sk->sk_family != PF_INET6)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(&selinux_state,
					    ep->secid, &secattr);
	if (rc != 0)
		goto assoc_request_return;

	/* Move skb hdr address info to a struct sockaddr and then call
	 * netlbl_conn_setattr().
	 */
	if (ip_hdr(skb)->version == 4) {
		addr4.sin_family = AF_INET;
		addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
		rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr4, &secattr);
	} else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
		addr6.sin6_family = AF_INET6;
		addr6.sin6_addr = ipv6_hdr(skb)->saddr;
		rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr6, &secattr);
	} else {
		rc = -EAFNOSUPPORT;
	}

	if (rc == 0)
		sksec->nlbl_state = NLBL_LABELED;

assoc_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_conn_request - Label an incoming stream connection
 * @req: incoming connection request socket
 *
 * Description:
 * A new incoming connection request is represented by @req, we need to label
 * the new request_sock here and the stack will ensure the on-the-wire label
 * will get preserved when a full sock is created once the connection handshake
 * is complete.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid,
					    &secattr);
	if (rc != 0)
		goto inet_conn_request_return;
	rc = netlbl_req_setattr(req, &secattr);
inet_conn_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
 * @sk: the new sock
 *
 * Description:
 * A new connection has been established using @sk, we've already labeled the
 * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
 * we need to set the NetLabel state here since we now have a sock structure.
 *
 */
void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (family == PF_INET)
		sksec->nlbl_state = NLBL_LABELED;
	else
		sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_sctp_sk_clone - Copy state to the newly created sock
 * @sk: current sock
 * @newsk: the new sock
 *
 * Description:
 * Called whenever a new socket is created by accept(2) or sctp_peeloff(3).
 */
void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk)
{
	struct sk_security_struct *sksec = sk->sk_security;
	struct sk_security_struct *newsksec = newsk->sk_security;

	newsksec->nlbl_state = sksec->nlbl_state;
}

/**
 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
 * @sock: the socket to label
 * @family: protocol family
 *
 * Description:
 * Attempt to label a socket using the NetLabel mechanism using the given
 * SID.  Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL)
		return -ENOMEM;
	rc = netlbl_sock_setattr(sk, family, secattr);
	switch (rc) {
	case 0:
		sksec->nlbl_state = NLBL_LABELED;
		break;
	case -EDESTADDRREQ:
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		break;
	}

	return rc;
}

/**
 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
 * @sksec: the sock's sk_security_struct
 * @skb: the packet
 * @family: protocol family
 * @ad: the audit data
 *
 * Description:
 * Fetch the NetLabel security attributes from @skb and perform an access check
 * against the receiving socket.  Returns zero on success, negative values on
 * error.
 *
 */
int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
				struct sk_buff *skb,
				u16 family,
				struct common_audit_data *ad)
{
	int rc;
	u32 nlbl_sid;
	u32 perm;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled())
		return 0;

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, &nlbl_sid);
	else
		nlbl_sid = SECINITSID_UNLABELED;
	netlbl_secattr_destroy(&secattr);
	if (rc != 0)
		return rc;

	switch (sksec->sclass) {
	case SECCLASS_UDP_SOCKET:
		perm = UDP_SOCKET__RECVFROM;
		break;
	case SECCLASS_TCP_SOCKET:
		perm = TCP_SOCKET__RECVFROM;
		break;
	default:
		perm = RAWIP_SOCKET__RECVFROM;
	}

	rc = avc_has_perm(&selinux_state,
			  sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
	if (rc == 0)
		return 0;

	if (nlbl_sid != SECINITSID_UNLABELED)
		netlbl_skbuff_err(skb, family, rc, 0);
	return rc;
}

/**
 * selinux_netlbl_option - Is this a NetLabel option
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Returns true if @level and @optname refer to a NetLabel option.
 * Helper for selinux_netlbl_socket_setsockopt().
 */
static inline int selinux_netlbl_option(int level, int optname)
{
	return (level == IPPROTO_IP && optname == IP_OPTIONS) ||
		(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
}

/**
 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
 * @sock: the socket
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Check the setsockopt() call and if the user is trying to replace the IP
 * options on a socket and a NetLabel is in place for the socket deny the
 * access; otherwise allow the access.  Returns zero when the access is
 * allowed, -EACCES when denied, and other negative values on error.
 *
 */
int selinux_netlbl_socket_setsockopt(struct socket *sock,
				     int level,
				     int optname)
{
	int rc = 0;
	struct sock *sk = sock->sk;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr secattr;

	if (selinux_netlbl_option(level, optname) &&
	    (sksec->nlbl_state == NLBL_LABELED ||
	     sksec->nlbl_state == NLBL_CONNLABELED)) {
		netlbl_secattr_init(&secattr);
		lock_sock(sk);
		/* call the netlabel function directly as we want to see the
		 * on-the-wire label that is assigned via the socket's options
		 * and not the cached netlabel/lsm attributes */
		rc = netlbl_sock_getattr(sk, &secattr);
		release_sock(sk);
		if (rc == 0)
			rc = -EACCES;
		else if (rc == -ENOMSG)
			rc = 0;
		netlbl_secattr_destroy(&secattr);
	}

	return rc;
}

/**
 * selinux_netlbl_socket_connect_helper - Help label a client-side socket on
 * connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
static int selinux_netlbl_socket_connect_helper(struct sock *sk,
						struct sockaddr *addr)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	/* connected sockets are allowed to disconnect when the address family
	 * is set to AF_UNSPEC, if that is what is happening we want to reset
	 * the socket */
	if (addr->sa_family == AF_UNSPEC) {
		netlbl_sock_delattr(sk);
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		return rc;
	}
	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL) {
		rc = -ENOMEM;
		return rc;
	}
	rc = netlbl_conn_setattr(sk, addr, secattr);
	if (rc == 0)
		sksec->nlbl_state = NLBL_CONNLABELED;

	return rc;
}

/**
 * selinux_netlbl_socket_connect_locked - Label a client-side socket on
 * connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket that already has the socket locked
 * with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect_locked(struct sock *sk,
					 struct sockaddr *addr)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (sksec->nlbl_state != NLBL_REQSKB &&
	    sksec->nlbl_state != NLBL_CONNLABELED)
		return 0;

	return selinux_netlbl_socket_connect_helper(sk, addr);
}

/**
 * selinux_netlbl_socket_connect - Label a client-side socket on connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
{
	int rc;

	lock_sock(sk);
	rc = selinux_netlbl_socket_connect_locked(sk, addr);
	release_sock(sk);

	return rc;
}
Commit	Line	Data
1ccea77e	1	// SPDX-License-Identifier: GPL-2.0-or-later
5778eabd PM	2	/*
	3	* SELinux NetLabel Support
	4	*
	5	* This file provides the necessary glue to tie NetLabel into the SELinux
	6	* subsystem.
	7	*
82c21bfa	8	* Author: Paul Moore <paul@paul-moore.com>
5778eabd PM	9	*/
	10
	11	/*
948bf85c	12	* (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
5778eabd PM	13	*/
	14
	15	#include <linux/spinlock.h>
	16	#include <linux/rcupdate.h>
5a0e3ad6	17	#include <linux/gfp.h>
014ab19a PM	18	#include <linux/ip.h>
014ab19a PM	19	#include <linux/ipv6.h>
5778eabd PM	20	#include <net/sock.h>
5778eabd PM	21	#include <net/netlabel.h>
014ab19a PM	22	#include <net/ip.h>
014ab19a PM	23	#include <net/ipv6.h>
5778eabd PM	24
	25	#include "objsec.h"
	26	#include "security.h"
d4ee4231	27	#include "netlabel.h"
5778eabd	28
5dbe1eb0 PM	29	/**
	30	* selinux_netlbl_sidlookup_cached - Cache a SID lookup
	31	* @skb: the packet
	32	* @secattr: the NetLabel security attributes
	33	* @sid: the SID
	34	*
	35	* Description:
	36	* Query the SELinux security server to lookup the correct SID for the given
	37	* security attributes. If the query is successful, cache the result to speed
	38	* up future lookups. Returns zero on success, negative values on failure.
	39	*
	40	*/
	41	static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
4fee5242	42	u16 family,
5dbe1eb0 PM	43	struct netlbl_lsm_secattr *secattr,
	44	u32 *sid)
	45	{
	46	int rc;
	47
aa8e712c	48	rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid);
5dbe1eb0 PM	49	if (rc == 0 &&
	50	(secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	51	(secattr->flags & NETLBL_SECATTR_CACHE))
4fee5242	52	netlbl_cache_add(skb, family, secattr);
5dbe1eb0 PM	53
	54	return rc;
	55	}
	56
6c5b3fc0 PM	57	/**
	58	* selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
	59	* @sk: the socket
	60	*
	61	* Description:
	62	* Generate the NetLabel security attributes for a socket, making full use of
	63	* the socket's attribute cache. Returns a pointer to the security attributes
	64	* on success, NULL on failure.
	65	*
	66	*/
	67	static struct netlbl_lsm_secattr selinux_netlbl_sock_genattr(struct sock sk)
	68	{
	69	int rc;
	70	struct sk_security_struct *sksec = sk->sk_security;
	71	struct netlbl_lsm_secattr *secattr;
	72
	73	if (sksec->nlbl_secattr != NULL)
	74	return sksec->nlbl_secattr;
	75
	76	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	77	if (secattr == NULL)
	78	return NULL;
aa8e712c SS	79	rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid,
aa8e712c SS	80	secattr);
6c5b3fc0 PM	81	if (rc != 0) {
	82	netlbl_secattr_free(secattr);
	83	return NULL;
	84	}
	85	sksec->nlbl_secattr = secattr;
	86
	87	return secattr;
	88	}
	89
050d032b PM	90	/**
	91	* selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
	92	* @sk: the socket
	93	* @sid: the SID
	94	*
	95	* Query the socket's cached secattr and if the SID matches the cached value
	96	* return the cache, otherwise return NULL.
	97	*
	98	*/
	99	static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
	100	const struct sock *sk,
	101	u32 sid)
	102	{
	103	struct sk_security_struct *sksec = sk->sk_security;
	104	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;
	105
	106	if (secattr == NULL)
	107	return NULL;
	108
	109	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	110	(secattr->attr.secid == sid))
	111	return secattr;
	112
	113	return NULL;
	114	}
	115
5778eabd PM	116	/**
	117	* selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
	118	*
	119	* Description:
	120	* Invalidate the NetLabel security attribute mapping cache.
	121	*
	122	*/
	123	void selinux_netlbl_cache_invalidate(void)
	124	{
	125	netlbl_cache_invalidate();
	126	}
	127
dfaebe98 PM	128	/**
	129	* selinux_netlbl_err - Handle a NetLabel packet error
	130	* @skb: the packet
	131	* @error: the error code
	132	* @gateway: true if host is acting as a gateway, false otherwise
	133	*
	134	* Description:
	135	* When a packet is dropped due to a call to avc_has_perm() pass the error
	136	* code to the NetLabel subsystem so any protocol specific processing can be
	137	* done. This is safe to call even if you are unsure if NetLabel labeling is
	138	* present on the packet, NetLabel is smart enough to only act when it should.
	139	*
	140	*/
a04e71f6	141	void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
dfaebe98	142	{
a04e71f6	143	netlbl_skbuff_err(skb, family, error, gateway);
dfaebe98 PM	144	}
dfaebe98 PM	145
6c5b3fc0 PM	146	/**
6c5b3fc0 PM	147	* selinux_netlbl_sk_security_free - Free the NetLabel fields
dd3e7836	148	* @sksec: the sk_security_struct
6c5b3fc0 PM	149	*
	150	* Description:
	151	* Free all of the memory in the NetLabel fields of a sk_security_struct.
	152	*
	153	*/
dd3e7836	154	void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
6c5b3fc0	155	{
dd3e7836 EP	156	if (sksec->nlbl_secattr != NULL)
dd3e7836 EP	157	netlbl_secattr_free(sksec->nlbl_secattr);
6c5b3fc0 PM	158	}
6c5b3fc0 PM	159
5778eabd PM	160	/**
5778eabd PM	161	* selinux_netlbl_sk_security_reset - Reset the NetLabel fields
dd3e7836	162	* @sksec: the sk_security_struct
5778eabd PM	163	* @family: the socket family
	164	*
	165	* Description:
	166	* Called when the NetLabel state of a sk_security_struct needs to be reset.
25985edc	167	* The caller is responsible for all the NetLabel sk_security_struct locking.
5778eabd PM	168	*
5778eabd PM	169	*/
dd3e7836	170	void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
5778eabd	171	{
dd3e7836	172	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	173	}
5778eabd PM	174
5778eabd PM	175	/**
	176	* selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
	177	* @skb: the packet
75e22910	178	* @family: protocol family
220deb96	179	* @type: NetLabel labeling protocol type
5778eabd PM	180	* @sid: the SID
	181	*
	182	* Description:
	183	* Call the NetLabel mechanism to get the security attributes of the given
	184	* packet and use those attributes to determine the correct context/SID to
	185	* assign to the packet. Returns zero on success, negative values on failure.
	186	*
	187	*/
75e22910 PM	188	int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
75e22910 PM	189	u16 family,
220deb96	190	u32 *type,
75e22910	191	u32 *sid)
5778eabd PM	192	{
	193	int rc;
	194	struct netlbl_lsm_secattr secattr;
	195
23bcdc1a PM	196	if (!netlbl_enabled()) {
	197	*sid = SECSID_NULL;
	198	return 0;
	199	}
	200
5778eabd	201	netlbl_secattr_init(&secattr);
75e22910	202	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	203	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	204	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	205	&secattr, sid);
5dbe1eb0	206	else
5778eabd	207	*sid = SECSID_NULL;
220deb96	208	*type = secattr.type;
5778eabd PM	209	netlbl_secattr_destroy(&secattr);
	210
	211	return rc;
	212	}
	213
948bf85c PM	214	/**
	215	* selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
	216	* @skb: the packet
	217	* @family: protocol family
	218	* @sid: the SID
	219	*
	220	* Description
	221	* Call the NetLabel mechanism to set the label of a packet using @sid.
af901ca1	222	* Returns zero on success, negative values on failure.
948bf85c PM	223	*
	224	*/
	225	int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
	226	u16 family,
	227	u32 sid)
	228	{
	229	int rc;
6c5b3fc0 PM	230	struct netlbl_lsm_secattr secattr_storage;
6c5b3fc0 PM	231	struct netlbl_lsm_secattr *secattr = NULL;
948bf85c PM	232	struct sock *sk;
	233
	234	/* if this is a locally generated packet check to see if it is already
	235	* being labeled by it's parent socket, if it is just exit */
54abc686	236	sk = skb_to_full_sk(skb);
948bf85c PM	237	if (sk != NULL) {
948bf85c PM	238	struct sk_security_struct *sksec = sk->sk_security;
d452930f	239
948bf85c PM	240	if (sksec->nlbl_state != NLBL_REQSKB)
948bf85c PM	241	return 0;
050d032b	242	secattr = selinux_netlbl_sock_getattr(sk, sid);
6c5b3fc0 PM	243	}
	244	if (secattr == NULL) {
	245	secattr = &secattr_storage;
	246	netlbl_secattr_init(secattr);
aa8e712c SS	247	rc = security_netlbl_sid_to_secattr(&selinux_state, sid,
aa8e712c SS	248	secattr);
6c5b3fc0 PM	249	if (rc != 0)
6c5b3fc0 PM	250	goto skbuff_setsid_return;
948bf85c PM	251	}
948bf85c PM	252
6c5b3fc0	253	rc = netlbl_skbuff_setattr(skb, family, secattr);
948bf85c PM	254
948bf85c PM	255	skbuff_setsid_return:
6c5b3fc0 PM	256	if (secattr == &secattr_storage)
6c5b3fc0 PM	257	netlbl_secattr_destroy(secattr);
948bf85c PM	258	return rc;
	259	}
	260
d452930f RH	261	/**
	262	* selinux_netlbl_sctp_assoc_request - Label an incoming sctp association.
	263	* @ep: incoming association endpoint.
	264	* @skb: the packet.
	265	*
	266	* Description:
	267	* A new incoming connection is represented by @ep, ......
	268	* Returns zero on success, negative values on failure.
	269	*
	270	*/
	271	int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
	272	struct sk_buff *skb)
	273	{
	274	int rc;
	275	struct netlbl_lsm_secattr secattr;
	276	struct sk_security_struct *sksec = ep->base.sk->sk_security;
d452930f	277	struct sockaddr_in addr4;
d452930f	278	struct sockaddr_in6 addr6;
d452930f RH	279
	280	if (ep->base.sk->sk_family != PF_INET &&
	281	ep->base.sk->sk_family != PF_INET6)
	282	return 0;
	283
	284	netlbl_secattr_init(&secattr);
aa8e712c SS	285	rc = security_netlbl_sid_to_secattr(&selinux_state,
aa8e712c SS	286	ep->secid, &secattr);
d452930f RH	287	if (rc != 0)
	288	goto assoc_request_return;
	289
	290	/* Move skb hdr address info to a struct sockaddr and then call
	291	* netlbl_conn_setattr().
	292	*/
	293	if (ip_hdr(skb)->version == 4) {
	294	addr4.sin_family = AF_INET;
	295	addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
98bbbb76 AB	296	rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr4, &secattr);
98bbbb76 AB	297	} else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
d452930f RH	298	addr6.sin6_family = AF_INET6;
d452930f RH	299	addr6.sin6_addr = ipv6_hdr(skb)->saddr;
98bbbb76 AB	300	rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr6, &secattr);
	301	} else {
	302	rc = -EAFNOSUPPORT;
d452930f RH	303	}
d452930f RH	304
d452930f RH	305	if (rc == 0)
	306	sksec->nlbl_state = NLBL_LABELED;
	307
	308	assoc_request_return:
	309	netlbl_secattr_destroy(&secattr);
	310	return rc;
	311	}
	312
5778eabd	313	/**
389fb800 PM	314	* selinux_netlbl_inet_conn_request - Label an incoming stream connection
389fb800 PM	315	* @req: incoming connection request socket
5778eabd PM	316	*
5778eabd PM	317	* Description:
389fb800 PM	318	* A new incoming connection request is represented by @req, we need to label
	319	* the new request_sock here and the stack will ensure the on-the-wire label
	320	* will get preserved when a full sock is created once the connection handshake
	321	* is complete. Returns zero on success, negative values on failure.
5778eabd PM	322	*
5778eabd PM	323	*/
389fb800	324	int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
5778eabd	325	{
014ab19a	326	int rc;
389fb800	327	struct netlbl_lsm_secattr secattr;
014ab19a	328
e1adea92	329	if (family != PF_INET && family != PF_INET6)
389fb800	330	return 0;
014ab19a	331
389fb800	332	netlbl_secattr_init(&secattr);
aa8e712c SS	333	rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid,
aa8e712c SS	334	&secattr);
389fb800 PM	335	if (rc != 0)
	336	goto inet_conn_request_return;
	337	rc = netlbl_req_setattr(req, &secattr);
	338	inet_conn_request_return:
	339	netlbl_secattr_destroy(&secattr);
	340	return rc;
5778eabd PM	341	}
	342
	343	/**
389fb800 PM	344	* selinux_netlbl_inet_csk_clone - Initialize the newly created sock
389fb800 PM	345	* @sk: the new sock
5778eabd PM	346	*
5778eabd PM	347	* Description:
389fb800 PM	348	* A new connection has been established using @sk, we've already labeled the
	349	* socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
	350	* we need to set the NetLabel state here since we now have a sock structure.
5778eabd PM	351	*
5778eabd PM	352	*/
389fb800	353	void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
5778eabd	354	{
389fb800 PM	355	struct sk_security_struct *sksec = sk->sk_security;
	356
	357	if (family == PF_INET)
	358	sksec->nlbl_state = NLBL_LABELED;
	359	else
	360	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	361	}
5778eabd PM	362
d452930f RH	363	/**
	364	* selinux_netlbl_sctp_sk_clone - Copy state to the newly created sock
	365	* @sk: current sock
	366	* @newsk: the new sock
	367	*
	368	* Description:
	369	* Called whenever a new socket is created by accept(2) or sctp_peeloff(3).
	370	*/
	371	void selinux_netlbl_sctp_sk_clone(struct sock sk, struct sock newsk)
	372	{
	373	struct sk_security_struct *sksec = sk->sk_security;
	374	struct sk_security_struct *newsksec = newsk->sk_security;
	375
	376	newsksec->nlbl_state = sksec->nlbl_state;
	377	}
	378
5778eabd	379	/**
389fb800 PM	380	* selinux_netlbl_socket_post_create - Label a socket using NetLabel
	381	* @sock: the socket to label
	382	* @family: protocol family
5778eabd PM	383	*
5778eabd PM	384	* Description:
389fb800 PM	385	* Attempt to label a socket using the NetLabel mechanism using the given
389fb800 PM	386	* SID. Returns zero values on success, negative values on failure.
5778eabd PM	387	*
5778eabd PM	388	*/
389fb800	389	int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
5778eabd PM	390	{
5778eabd PM	391	int rc;
389fb800 PM	392	struct sk_security_struct *sksec = sk->sk_security;
389fb800 PM	393	struct netlbl_lsm_secattr *secattr;
5778eabd	394
ceba1832	395	if (family != PF_INET && family != PF_INET6)
5778eabd	396	return 0;
f74af6e8	397
389fb800 PM	398	secattr = selinux_netlbl_sock_genattr(sk);
	399	if (secattr == NULL)
	400	return -ENOMEM;
	401	rc = netlbl_sock_setattr(sk, family, secattr);
	402	switch (rc) {
	403	case 0:
	404	sksec->nlbl_state = NLBL_LABELED;
	405	break;
	406	case -EDESTADDRREQ:
	407	sksec->nlbl_state = NLBL_REQSKB;
f74af6e8	408	rc = 0;
389fb800 PM	409	break;
389fb800 PM	410	}
5778eabd PM	411
	412	return rc;
	413	}
	414
	415	/**
	416	* selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
	417	* @sksec: the sock's sk_security_struct
	418	* @skb: the packet
75e22910	419	* @family: protocol family
5778eabd PM	420	* @ad: the audit data
	421	*
	422	* Description:
	423	* Fetch the NetLabel security attributes from @skb and perform an access check
	424	* against the receiving socket. Returns zero on success, negative values on
	425	* error.
	426	*
	427	*/
	428	int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
	429	struct sk_buff *skb,
75e22910	430	u16 family,
2bf49690	431	struct common_audit_data *ad)
5778eabd PM	432	{
5778eabd PM	433	int rc;
f36158c4 PM	434	u32 nlbl_sid;
	435	u32 perm;
	436	struct netlbl_lsm_secattr secattr;
5778eabd	437
23bcdc1a PM	438	if (!netlbl_enabled())
	439	return 0;
	440
f36158c4	441	netlbl_secattr_init(&secattr);
75e22910	442	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	443	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	444	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	445	&secattr, &nlbl_sid);
5dbe1eb0	446	else
f36158c4 PM	447	nlbl_sid = SECINITSID_UNLABELED;
f36158c4 PM	448	netlbl_secattr_destroy(&secattr);
5778eabd PM	449	if (rc != 0)
5778eabd PM	450	return rc;
8d9107e8	451
5778eabd PM	452	switch (sksec->sclass) {
5778eabd PM	453	case SECCLASS_UDP_SOCKET:
f36158c4	454	perm = UDP_SOCKET__RECVFROM;
5778eabd PM	455	break;
5778eabd PM	456	case SECCLASS_TCP_SOCKET:
f36158c4	457	perm = TCP_SOCKET__RECVFROM;
5778eabd PM	458	break;
5778eabd PM	459	default:
f36158c4	460	perm = RAWIP_SOCKET__RECVFROM;
5778eabd PM	461	}
5778eabd PM	462
6b6bc620 SS	463	rc = avc_has_perm(&selinux_state,
6b6bc620 SS	464	sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
5778eabd PM	465	if (rc == 0)
	466	return 0;
	467
f36158c4	468	if (nlbl_sid != SECINITSID_UNLABELED)
a04e71f6	469	netlbl_skbuff_err(skb, family, rc, 0);
5778eabd PM	470	return rc;
	471	}
	472
1f440c99 HD	473	/**
	474	* selinux_netlbl_option - Is this a NetLabel option
	475	* @level: the socket level or protocol
	476	* @optname: the socket option name
	477	*
	478	* Description:
	479	* Returns true if @level and @optname refer to a NetLabel option.
	480	* Helper for selinux_netlbl_socket_setsockopt().
	481	*/
	482	static inline int selinux_netlbl_option(int level, int optname)
	483	{
	484	return (level == IPPROTO_IP && optname == IP_OPTIONS) \|\|
	485	(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
	486	}
	487
5778eabd PM	488	/**
	489	* selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
	490	* @sock: the socket
	491	* @level: the socket level or protocol
	492	* @optname: the socket option name
	493	*
	494	* Description:
	495	* Check the setsockopt() call and if the user is trying to replace the IP
	496	* options on a socket and a NetLabel is in place for the socket deny the
	497	* access; otherwise allow the access. Returns zero when the access is
	498	* allowed, -EACCES when denied, and other negative values on error.
	499	*
	500	*/
	501	int selinux_netlbl_socket_setsockopt(struct socket *sock,
	502	int level,
	503	int optname)
	504	{
	505	int rc = 0;
ba6ff9f2 PM	506	struct sock *sk = sock->sk;
ba6ff9f2 PM	507	struct sk_security_struct *sksec = sk->sk_security;
5778eabd PM	508	struct netlbl_lsm_secattr secattr;
5778eabd PM	509
1f440c99	510	if (selinux_netlbl_option(level, optname) &&
014ab19a PM	511	(sksec->nlbl_state == NLBL_LABELED \|\|
014ab19a PM	512	sksec->nlbl_state == NLBL_CONNLABELED)) {
5778eabd	513	netlbl_secattr_init(&secattr);
ba6ff9f2	514	lock_sock(sk);
050d032b PM	515	/* call the netlabel function directly as we want to see the
	516	* on-the-wire label that is assigned via the socket's options
	517	* and not the cached netlabel/lsm attributes */
ba6ff9f2 PM	518	rc = netlbl_sock_getattr(sk, &secattr);
ba6ff9f2 PM	519	release_sock(sk);
09c50b4a	520	if (rc == 0)
5778eabd	521	rc = -EACCES;
09c50b4a PM	522	else if (rc == -ENOMSG)
09c50b4a PM	523	rc = 0;
5778eabd PM	524	netlbl_secattr_destroy(&secattr);
5778eabd PM	525	}
5778eabd PM	526
	527	return rc;
	528	}
014ab19a PM	529
014ab19a PM	530	/**
d452930f RH	531	* selinux_netlbl_socket_connect_helper - Help label a client-side socket on
d452930f RH	532	* connect
014ab19a PM	533	* @sk: the socket to label
	534	* @addr: the destination address
	535	*
	536	* Description:
	537	* Attempt to label a connected socket with NetLabel using the given address.
	538	* Returns zero values on success, negative values on failure.
	539	*
	540	*/
d452930f RH	541	static int selinux_netlbl_socket_connect_helper(struct sock *sk,
d452930f RH	542	struct sockaddr *addr)
014ab19a PM	543	{
	544	int rc;
	545	struct sk_security_struct *sksec = sk->sk_security;
6c5b3fc0	546	struct netlbl_lsm_secattr *secattr;
014ab19a	547
014ab19a PM	548	/* connected sockets are allowed to disconnect when the address family
	549	* is set to AF_UNSPEC, if that is what is happening we want to reset
	550	* the socket */
	551	if (addr->sa_family == AF_UNSPEC) {
	552	netlbl_sock_delattr(sk);
	553	sksec->nlbl_state = NLBL_REQSKB;
	554	rc = 0;
d452930f	555	return rc;
014ab19a	556	}
6c5b3fc0 PM	557	secattr = selinux_netlbl_sock_genattr(sk);
	558	if (secattr == NULL) {
	559	rc = -ENOMEM;
d452930f	560	return rc;
6c5b3fc0 PM	561	}
	562	rc = netlbl_conn_setattr(sk, addr, secattr);
	563	if (rc == 0)
	564	sksec->nlbl_state = NLBL_CONNLABELED;
014ab19a	565
d452930f RH	566	return rc;
	567	}
	568
	569	/**
	570	* selinux_netlbl_socket_connect_locked - Label a client-side socket on
	571	* connect
	572	* @sk: the socket to label
	573	* @addr: the destination address
	574	*
	575	* Description:
	576	* Attempt to label a connected socket that already has the socket locked
	577	* with NetLabel using the given address.
	578	* Returns zero values on success, negative values on failure.
	579	*
	580	*/
	581	int selinux_netlbl_socket_connect_locked(struct sock *sk,
	582	struct sockaddr *addr)
	583	{
	584	struct sk_security_struct *sksec = sk->sk_security;
	585
	586	if (sksec->nlbl_state != NLBL_REQSKB &&
	587	sksec->nlbl_state != NLBL_CONNLABELED)
	588	return 0;
	589
	590	return selinux_netlbl_socket_connect_helper(sk, addr);
	591	}
	592
	593	/**
	594	* selinux_netlbl_socket_connect - Label a client-side socket on connect
	595	* @sk: the socket to label
	596	* @addr: the destination address
	597	*
	598	* Description:
	599	* Attempt to label a connected socket with NetLabel using the given address.
	600	* Returns zero values on success, negative values on failure.
	601	*
	602	*/
	603	int selinux_netlbl_socket_connect(struct sock sk, struct sockaddr addr)
	604	{
	605	int rc;
	606
	607	lock_sock(sk);
	608	rc = selinux_netlbl_socket_connect_locked(sk, addr);
42d64e1a	609	release_sock(sk);
d452930f	610
014ab19a PM	611	return rc;
014ab19a PM	612	}