2 * SELinux NetLabel Support
4 * This file provides the necessary glue to tie NetLabel into the SELinux
7 * Author: Paul Moore <paul@paul-moore.com>
12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
22 * the GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
30 #include <linux/spinlock.h>
31 #include <linux/rcupdate.h>
32 #include <linux/gfp.h>
34 #include <linux/ipv6.h>
35 #include <linux/lsm_hooks.h>
37 #include <net/netlabel.h>
46 * selinux_netlbl_sidlookup_cached - Cache a SID lookup
48 * @secattr: the NetLabel security attributes
52 * Query the SELinux security server to lookup the correct SID for the given
53 * security attributes. If the query is successful, cache the result to speed
54 * up future lookups. Returns zero on success, negative values on failure.
57 static int selinux_netlbl_sidlookup_cached(struct sk_buff
*skb
,
59 struct netlbl_lsm_secattr
*secattr
,
64 rc
= security_netlbl_secattr_to_sid(secattr
, sid
);
66 (secattr
->flags
& NETLBL_SECATTR_CACHEABLE
) &&
67 (secattr
->flags
& NETLBL_SECATTR_CACHE
))
68 netlbl_cache_add(skb
, family
, secattr
);
74 * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
78 * Generate the NetLabel security attributes for a socket, making full use of
79 * the socket's attribute cache. Returns a pointer to the security attributes
80 * on success, NULL on failure.
83 static struct netlbl_lsm_secattr
*selinux_netlbl_sock_genattr(struct sock
*sk
)
86 struct sk_security_struct
*sksec
= selinux_sock(sk
);
87 struct netlbl_lsm_secattr
*secattr
;
89 if (sksec
->nlbl_secattr
!= NULL
)
90 return sksec
->nlbl_secattr
;
92 secattr
= netlbl_secattr_alloc(GFP_ATOMIC
);
95 rc
= security_netlbl_sid_to_secattr(sksec
->sid
, secattr
);
97 netlbl_secattr_free(secattr
);
100 sksec
->nlbl_secattr
= secattr
;
106 * selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
110 * Query the socket's cached secattr and if the SID matches the cached value
111 * return the cache, otherwise return NULL.
114 static struct netlbl_lsm_secattr
*selinux_netlbl_sock_getattr(
115 const struct sock
*sk
,
118 struct sk_security_struct
*sksec
= selinux_sock(sk
);
119 struct netlbl_lsm_secattr
*secattr
= sksec
->nlbl_secattr
;
124 if ((secattr
->flags
& NETLBL_SECATTR_SECID
) &&
125 (secattr
->attr
.secid
== sid
))
132 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
135 * Invalidate the NetLabel security attribute mapping cache.
138 void selinux_netlbl_cache_invalidate(void)
140 netlbl_cache_invalidate();
144 * selinux_netlbl_err - Handle a NetLabel packet error
146 * @error: the error code
147 * @gateway: true if host is acting as a gateway, false otherwise
150 * When a packet is dropped due to a call to avc_has_perm() pass the error
151 * code to the NetLabel subsystem so any protocol specific processing can be
152 * done. This is safe to call even if you are unsure if NetLabel labeling is
153 * present on the packet, NetLabel is smart enough to only act when it should.
156 void selinux_netlbl_err(struct sk_buff
*skb
, u16 family
, int error
, int gateway
)
158 netlbl_skbuff_err(skb
, family
, error
, gateway
);
162 * selinux_netlbl_sk_security_free - Free the NetLabel fields
163 * @sksec: the sk_security_struct
166 * Free all of the memory in the NetLabel fields of a sk_security_struct.
169 void selinux_netlbl_sk_security_free(struct sk_security_struct
*sksec
)
171 if (sksec
->nlbl_secattr
!= NULL
)
172 netlbl_secattr_free(sksec
->nlbl_secattr
);
176 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
177 * @sksec: the sk_security_struct
178 * @family: the socket family
181 * Called when the NetLabel state of a sk_security_struct needs to be reset.
182 * The caller is responsible for all the NetLabel sk_security_struct locking.
185 void selinux_netlbl_sk_security_reset(struct sk_security_struct
*sksec
)
187 sksec
->nlbl_state
= NLBL_UNSET
;
191 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
193 * @family: protocol family
194 * @type: NetLabel labeling protocol type
198 * Call the NetLabel mechanism to get the security attributes of the given
199 * packet and use those attributes to determine the correct context/SID to
200 * assign to the packet. Returns zero on success, negative values on failure.
203 int selinux_netlbl_skbuff_getsid(struct sk_buff
*skb
,
209 struct netlbl_lsm_secattr secattr
;
211 if (!netlbl_enabled()) {
216 netlbl_secattr_init(&secattr
);
217 rc
= netlbl_skbuff_getattr(skb
, family
, &secattr
);
218 if (rc
== 0 && secattr
.flags
!= NETLBL_SECATTR_NONE
)
219 rc
= selinux_netlbl_sidlookup_cached(skb
, family
,
223 *type
= secattr
.type
;
224 netlbl_secattr_destroy(&secattr
);
230 * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
232 * @family: protocol family
236 * Call the NetLabel mechanism to set the label of a packet using @sid.
237 * Returns zero on success, negative values on failure.
240 int selinux_netlbl_skbuff_setsid(struct sk_buff
*skb
,
245 struct netlbl_lsm_secattr secattr_storage
;
246 struct netlbl_lsm_secattr
*secattr
= NULL
;
249 /* if this is a locally generated packet check to see if it is already
250 * being labeled by it's parent socket, if it is just exit */
251 sk
= skb_to_full_sk(skb
);
253 struct sk_security_struct
*sksec
= selinux_sock(sk
);
254 if (sksec
->nlbl_state
!= NLBL_REQSKB
)
256 secattr
= selinux_netlbl_sock_getattr(sk
, sid
);
258 if (secattr
== NULL
) {
259 secattr
= &secattr_storage
;
260 netlbl_secattr_init(secattr
);
261 rc
= security_netlbl_sid_to_secattr(sid
, secattr
);
263 goto skbuff_setsid_return
;
266 rc
= netlbl_skbuff_setattr(skb
, family
, secattr
);
268 skbuff_setsid_return
:
269 if (secattr
== &secattr_storage
)
270 netlbl_secattr_destroy(secattr
);
275 * selinux_netlbl_inet_conn_request - Label an incoming stream connection
276 * @req: incoming connection request socket
279 * A new incoming connection request is represented by @req, we need to label
280 * the new request_sock here and the stack will ensure the on-the-wire label
281 * will get preserved when a full sock is created once the connection handshake
282 * is complete. Returns zero on success, negative values on failure.
285 int selinux_netlbl_inet_conn_request(struct request_sock
*req
, u16 family
)
288 struct netlbl_lsm_secattr secattr
;
290 if (family
!= PF_INET
&& family
!= PF_INET6
)
293 netlbl_secattr_init(&secattr
);
294 rc
= security_netlbl_sid_to_secattr(req
->secid
, &secattr
);
296 goto inet_conn_request_return
;
297 rc
= netlbl_req_setattr(req
, &secattr
);
298 inet_conn_request_return
:
299 netlbl_secattr_destroy(&secattr
);
304 * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
308 * A new connection has been established using @sk, we've already labeled the
309 * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
310 * we need to set the NetLabel state here since we now have a sock structure.
313 void selinux_netlbl_inet_csk_clone(struct sock
*sk
, u16 family
)
315 struct sk_security_struct
*sksec
= selinux_sock(sk
);
317 if (family
== PF_INET
)
318 sksec
->nlbl_state
= NLBL_LABELED
;
320 sksec
->nlbl_state
= NLBL_UNSET
;
324 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
325 * @sock: the socket to label
326 * @family: protocol family
329 * Attempt to label a socket using the NetLabel mechanism using the given
330 * SID. Returns zero values on success, negative values on failure.
333 int selinux_netlbl_socket_post_create(struct sock
*sk
, u16 family
)
336 struct sk_security_struct
*sksec
= selinux_sock(sk
);
337 struct netlbl_lsm_secattr
*secattr
;
339 if (family
!= PF_INET
&& family
!= PF_INET6
)
342 secattr
= selinux_netlbl_sock_genattr(sk
);
345 rc
= netlbl_sock_setattr(sk
, family
, secattr
);
348 sksec
->nlbl_state
= NLBL_LABELED
;
351 sksec
->nlbl_state
= NLBL_REQSKB
;
360 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
361 * @sksec: the sock's sk_security_struct
363 * @family: protocol family
364 * @ad: the audit data
367 * Fetch the NetLabel security attributes from @skb and perform an access check
368 * against the receiving socket. Returns zero on success, negative values on
372 int selinux_netlbl_sock_rcv_skb(struct sk_security_struct
*sksec
,
375 struct common_audit_data
*ad
)
380 struct netlbl_lsm_secattr secattr
;
382 if (!netlbl_enabled())
385 netlbl_secattr_init(&secattr
);
386 rc
= netlbl_skbuff_getattr(skb
, family
, &secattr
);
387 if (rc
== 0 && secattr
.flags
!= NETLBL_SECATTR_NONE
)
388 rc
= selinux_netlbl_sidlookup_cached(skb
, family
,
389 &secattr
, &nlbl_sid
);
391 nlbl_sid
= SECINITSID_UNLABELED
;
392 netlbl_secattr_destroy(&secattr
);
396 switch (sksec
->sclass
) {
397 case SECCLASS_UDP_SOCKET
:
398 perm
= UDP_SOCKET__RECVFROM
;
400 case SECCLASS_TCP_SOCKET
:
401 perm
= TCP_SOCKET__RECVFROM
;
404 perm
= RAWIP_SOCKET__RECVFROM
;
407 rc
= avc_has_perm(sksec
->sid
, nlbl_sid
, sksec
->sclass
, perm
, ad
);
411 if (nlbl_sid
!= SECINITSID_UNLABELED
)
412 netlbl_skbuff_err(skb
, family
, rc
, 0);
417 * selinux_netlbl_option - Is this a NetLabel option
418 * @level: the socket level or protocol
419 * @optname: the socket option name
422 * Returns true if @level and @optname refer to a NetLabel option.
423 * Helper for selinux_netlbl_socket_setsockopt().
425 static inline int selinux_netlbl_option(int level
, int optname
)
427 return (level
== IPPROTO_IP
&& optname
== IP_OPTIONS
) ||
428 (level
== IPPROTO_IPV6
&& optname
== IPV6_HOPOPTS
);
432 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
434 * @level: the socket level or protocol
435 * @optname: the socket option name
438 * Check the setsockopt() call and if the user is trying to replace the IP
439 * options on a socket and a NetLabel is in place for the socket deny the
440 * access; otherwise allow the access. Returns zero when the access is
441 * allowed, -EACCES when denied, and other negative values on error.
444 int selinux_netlbl_socket_setsockopt(struct socket
*sock
,
449 struct sock
*sk
= sock
->sk
;
450 struct sk_security_struct
*sksec
= selinux_sock(sk
);
451 struct netlbl_lsm_secattr secattr
;
453 if (selinux_netlbl_option(level
, optname
) &&
454 (sksec
->nlbl_state
== NLBL_LABELED
||
455 sksec
->nlbl_state
== NLBL_CONNLABELED
)) {
456 netlbl_secattr_init(&secattr
);
458 /* call the netlabel function directly as we want to see the
459 * on-the-wire label that is assigned via the socket's options
460 * and not the cached netlabel/lsm attributes */
461 rc
= netlbl_sock_getattr(sk
, &secattr
);
465 else if (rc
== -ENOMSG
)
467 netlbl_secattr_destroy(&secattr
);
474 * selinux_netlbl_socket_connect - Label a client-side socket on connect
475 * @sk: the socket to label
476 * @addr: the destination address
479 * Attempt to label a connected socket with NetLabel using the given address.
480 * Returns zero values on success, negative values on failure.
483 int selinux_netlbl_socket_connect(struct sock
*sk
, struct sockaddr
*addr
)
486 struct sk_security_struct
*sksec
= selinux_sock(sk
);
487 struct netlbl_lsm_secattr
*secattr
;
489 if (sksec
->nlbl_state
!= NLBL_REQSKB
&&
490 sksec
->nlbl_state
!= NLBL_CONNLABELED
)
495 /* connected sockets are allowed to disconnect when the address family
496 * is set to AF_UNSPEC, if that is what is happening we want to reset
498 if (addr
->sa_family
== AF_UNSPEC
) {
499 netlbl_sock_delattr(sk
);
500 sksec
->nlbl_state
= NLBL_REQSKB
;
502 goto socket_connect_return
;
504 secattr
= selinux_netlbl_sock_genattr(sk
);
505 if (secattr
== NULL
) {
507 goto socket_connect_return
;
509 rc
= netlbl_conn_setattr(sk
, addr
, secattr
);
511 sksec
->nlbl_state
= NLBL_CONNLABELED
;
513 socket_connect_return
: