[mirror_ubuntu-bionic-kernel.git] / security / smack / smack_netfilter.c

/*
 *  Simplified MAC Kernel (smack) security module
 *
 *  This file contains the Smack netfilter implementation
 *
 *  Author:
 *	Casey Schaufler <casey@schaufler-ca.com>
 *
 *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
 *  Copyright (C) 2014 Intel Corporation.
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2,
 *	as published by the Free Software Foundation.
 */

#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netdevice.h>
#include <net/inet_sock.h>
#include <net/net_namespace.h>
#include "smack.h"

#if IS_ENABLED(CONFIG_IPV6)

static unsigned int smack_ipv6_output(void *priv,
					struct sk_buff *skb,
					const struct nf_hook_state *state)
{
	struct sock *sk = skb_to_full_sk(skb);
	struct socket_smack *ssp;
	struct smack_known *skp;

	if (sk && sk->sk_security) {
		ssp = sk->sk_security;
		skp = ssp->smk_out;
		skb->secmark = skp->smk_secid;
	}

	return NF_ACCEPT;
}
#endif	/* IPV6 */

static unsigned int smack_ipv4_output(void *priv,
					struct sk_buff *skb,
					const struct nf_hook_state *state)
{
	struct sock *sk = skb_to_full_sk(skb);
	struct socket_smack *ssp;
	struct smack_known *skp;

	if (sk && sk->sk_security) {
		ssp = sk->sk_security;
		skp = ssp->smk_out;
		skb->secmark = skp->smk_secid;
	}

	return NF_ACCEPT;
}

static const struct nf_hook_ops smack_nf_ops[] = {
	{
		.hook =		smack_ipv4_output,
		.pf =		NFPROTO_IPV4,
		.hooknum =	NF_INET_LOCAL_OUT,
		.priority =	NF_IP_PRI_SELINUX_FIRST,
	},
#if IS_ENABLED(CONFIG_IPV6)
	{
		.hook =		smack_ipv6_output,
		.pf =		NFPROTO_IPV6,
		.hooknum =	NF_INET_LOCAL_OUT,
		.priority =	NF_IP6_PRI_SELINUX_FIRST,
	},
#endif	/* IPV6 */
};

static int __net_init smack_nf_register(struct net *net)
{
	return nf_register_net_hooks(net, smack_nf_ops,
				     ARRAY_SIZE(smack_nf_ops));
}

static void __net_exit smack_nf_unregister(struct net *net)
{
	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
}

static struct pernet_operations smack_net_ops = {
	.init = smack_nf_register,
	.exit = smack_nf_unregister,
};

static int __init smack_nf_ip_init(void)
{
	if (smack_enabled == 0)
		return 0;

	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
	return register_pernet_subsys(&smack_net_ops);
}

__initcall(smack_nf_ip_init);
Commit	Line	Data
69f287ae CS	1	/*
	2	* Simplified MAC Kernel (smack) security module
	3	*
	4	* This file contains the Smack netfilter implementation
	5	*
	6	* Author:
	7	* Casey Schaufler <casey@schaufler-ca.com>
	8	*
	9	* Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
	10	* Copyright (C) 2014 Intel Corporation.
	11	*
	12	* This program is free software; you can redistribute it and/or modify
	13	* it under the terms of the GNU General Public License version 2,
	14	* as published by the Free Software Foundation.
	15	*/
	16
	17	#include <linux/netfilter_ipv4.h>
	18	#include <linux/netfilter_ipv6.h>
	19	#include <linux/netdevice.h>
8827d90e	20	#include <net/inet_sock.h>
e661a582	21	#include <net/net_namespace.h>
69f287ae CS	22	#include "smack.h"
69f287ae CS	23
1a93a6ea	24	#if IS_ENABLED(CONFIG_IPV6)
69f287ae	25
06198b34	26	static unsigned int smack_ipv6_output(void *priv,
69f287ae	27	struct sk_buff *skb,
238e54c9	28	const struct nf_hook_state *state)
69f287ae	29	{
8827d90e	30	struct sock *sk = skb_to_full_sk(skb);
69f287ae CS	31	struct socket_smack *ssp;
	32	struct smack_known *skp;
	33
8827d90e ED	34	if (sk && sk->sk_security) {
8827d90e ED	35	ssp = sk->sk_security;
69f287ae CS	36	skp = ssp->smk_out;
	37	skb->secmark = skp->smk_secid;
	38	}
	39
	40	return NF_ACCEPT;
	41	}
	42	#endif /* IPV6 */
	43
06198b34	44	static unsigned int smack_ipv4_output(void *priv,
69f287ae	45	struct sk_buff *skb,
238e54c9	46	const struct nf_hook_state *state)
69f287ae	47	{
8827d90e	48	struct sock *sk = skb_to_full_sk(skb);
69f287ae CS	49	struct socket_smack *ssp;
	50	struct smack_known *skp;
	51
8827d90e ED	52	if (sk && sk->sk_security) {
8827d90e ED	53	ssp = sk->sk_security;
69f287ae CS	54	skp = ssp->smk_out;
	55	skb->secmark = skp->smk_secid;
	56	}
	57
	58	return NF_ACCEPT;
	59	}
	60
591bb278	61	static const struct nf_hook_ops smack_nf_ops[] = {
69f287ae CS	62	{
69f287ae CS	63	.hook = smack_ipv4_output,
69f287ae CS	64	.pf = NFPROTO_IPV4,
	65	.hooknum = NF_INET_LOCAL_OUT,
	66	.priority = NF_IP_PRI_SELINUX_FIRST,
	67	},
1a93a6ea	68	#if IS_ENABLED(CONFIG_IPV6)
69f287ae CS	69	{
69f287ae CS	70	.hook = smack_ipv6_output,
69f287ae CS	71	.pf = NFPROTO_IPV6,
	72	.hooknum = NF_INET_LOCAL_OUT,
	73	.priority = NF_IP6_PRI_SELINUX_FIRST,
	74	},
	75	#endif /* IPV6 */
	76	};
	77
e661a582 FW	78	static int __net_init smack_nf_register(struct net *net)
	79	{
	80	return nf_register_net_hooks(net, smack_nf_ops,
	81	ARRAY_SIZE(smack_nf_ops));
	82	}
	83
	84	static void __net_exit smack_nf_unregister(struct net *net)
69f287ae	85	{
e661a582 FW	86	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
e661a582 FW	87	}
69f287ae	88
e661a582 FW	89	static struct pernet_operations smack_net_ops = {
	90	.init = smack_nf_register,
	91	.exit = smack_nf_unregister,
	92	};
	93
	94	static int __init smack_nf_ip_init(void)
	95	{
69f287ae CS	96	if (smack_enabled == 0)
	97	return 0;
	98
	99	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
e661a582	100	return register_pernet_subsys(&smack_net_ops);
69f287ae CS	101	}
	102
	103	__initcall(smack_nf_ip_init);