selinux: use pernet operations for hook registration

[mirror_ubuntu-artful-kernel.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b005acbcc6e9b381dc22ecf741e1300e5e3ac867..9926adbd50a9624e392ad280ac80198e71ad40d8 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -17,6 +17,7 @@
  *     Paul Moore <paul@paul-moore.com>
  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  *                    Yuichi Nakamura <ynakam@hitachisoft.jp>
+ *  Copyright (C) 2016 Mellanox Technologies
  *
  *     This program is free software; you can redistribute it and/or modify
  *     it under the terms of the GNU General Public License version 2,
@@ -90,6 +91,7 @@
 #include "netif.h"
 #include "netnode.h"
 #include "netport.h"
+#include "ibpkey.h"
 #include "xfrm.h"
 #include "netlabel.h"
 #include "audit.h"
@@ -173,8 +175,10 @@ static int selinux_netcache_avc_callback(u32 event)
 
 static int selinux_lsm_notifier_avc_callback(u32 event)
 {
-       if (event == AVC_CALLBACK_RESET)
+       if (event == AVC_CALLBACK_RESET) {
+               sel_ib_pkey_flush();
                call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
+       }
 
        return 0;
 }
@@ -6144,7 +6148,70 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
        *_buffer = context;
        return rc;
 }
+#endif
+
+#ifdef CONFIG_SECURITY_INFINIBAND
+static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
+{
+       struct common_audit_data ad;
+       int err;
+       u32 sid = 0;
+       struct ib_security_struct *sec = ib_sec;
+       struct lsm_ibpkey_audit ibpkey;
+
+       err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
+       if (err)
+               return err;
+
+       ad.type = LSM_AUDIT_DATA_IBPKEY;
+       ibpkey.subnet_prefix = subnet_prefix;
+       ibpkey.pkey = pkey_val;
+       ad.u.ibpkey = &ibpkey;
+       return avc_has_perm(sec->sid, sid,
+                           SECCLASS_INFINIBAND_PKEY,
+                           INFINIBAND_PKEY__ACCESS, &ad);
+}
+
+static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
+                                           u8 port_num)
+{
+       struct common_audit_data ad;
+       int err;
+       u32 sid = 0;
+       struct ib_security_struct *sec = ib_sec;
+       struct lsm_ibendport_audit ibendport;
+
+       err = security_ib_endport_sid(dev_name, port_num, &sid);
+
+       if (err)
+               return err;
+
+       ad.type = LSM_AUDIT_DATA_IBENDPORT;
+       strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
+       ibendport.port = port_num;
+       ad.u.ibendport = &ibendport;
+       return avc_has_perm(sec->sid, sid,
+                           SECCLASS_INFINIBAND_ENDPORT,
+                           INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
+}
+
+static int selinux_ib_alloc_security(void **ib_sec)
+{
+       struct ib_security_struct *sec;
+
+       sec = kzalloc(sizeof(*sec), GFP_KERNEL);
+       if (!sec)
+               return -ENOMEM;
+       sec->sid = current_sid();
 
+       *ib_sec = sec;
+       return 0;
+}
+
+static void selinux_ib_free_security(void *ib_sec)
+{
+       kfree(ib_sec);
+}
 #endif
 
 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
@@ -6331,7 +6398,13 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
        LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
        LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
-
+#ifdef CONFIG_SECURITY_INFINIBAND
+       LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
+       LSM_HOOK_INIT(ib_endport_manage_subnet,
+                     selinux_ib_endport_manage_subnet),
+       LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
+       LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
+#endif
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
        LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
@@ -6467,6 +6540,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
 #endif /* IPV6 */
 };
 
+static int __net_init selinux_nf_register(struct net *net)
+{
+       return nf_register_net_hooks(net, selinux_nf_ops,
+                                    ARRAY_SIZE(selinux_nf_ops));
+}
+
+static void __net_exit selinux_nf_unregister(struct net *net)
+{
+       nf_unregister_net_hooks(net, selinux_nf_ops,
+                               ARRAY_SIZE(selinux_nf_ops));
+}
+
+static struct pernet_operations selinux_net_ops = {
+       .init = selinux_nf_register,
+       .exit = selinux_nf_unregister,
+};
+
 static int __init selinux_nf_ip_init(void)
 {
        int err;
@@ -6476,13 +6566,12 @@ static int __init selinux_nf_ip_init(void)
 
        printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
 
-       err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       err = register_pernet_subsys(&selinux_net_ops);
        if (err)
-               panic("SELinux: nf_register_hooks: error %d\n", err);
+               panic("SELinux: register_pernet_subsys: error %d\n", err);
 
        return 0;
 }
-
 __initcall(selinux_nf_ip_init);
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
@@ -6490,7 +6579,7 @@ static void selinux_nf_ip_exit(void)
 {
        printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
 
-       nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
+       unregister_pernet_subsys(&selinux_net_ops);
 }
 #endif