[PATCH v7 13/16] LSM: Remember the NLTYPE of netlabel sockets
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-08-07 22:43:18
Also in:
selinux
Subsystem:
security subsystem, selinux security module, smack security module, the rest · Maintainers:
Paul Moore, James Morris, "Serge E. Hallyn", Stephen Smalley, Casey Schaufler, Linus Torvalds
Add the NLTYPE returned when setting labels on sockets to the information retained by SELinux and Smack. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- security/selinux/include/objsec.h | 1 + security/selinux/netlabel.c | 20 ++++++++++++++------ security/smack/smack.h | 1 + security/smack/smack_lsm.c | 17 ++++++++++++----- 4 files changed, 28 insertions(+), 11 deletions(-)
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 3b78aa4ee98f..5ab0d0d212bd 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h@@ -124,6 +124,7 @@ struct sk_security_struct { NLBL_REQSKB, NLBL_CONNLABELED, } nlbl_state; + int nlbl_set; /* Raw NLTYPE */ struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */ #endif u32 sid; /* SID of this object */
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 8088a787777a..56e780340114 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c@@ -185,6 +185,7 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec) void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec) { sksec->nlbl_state = NLBL_UNSET; + sksec->nlbl_set = NETLBL_NLTYPE_NONE; } /**
@@ -244,14 +245,14 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, int rc; struct netlbl_lsm_secattr secattr_storage; struct netlbl_lsm_secattr *secattr = NULL; + struct sk_security_struct *sksec; struct sock *sk; /* if this is a locally generated packet check to see if it is already * being labeled by it's parent socket, if it is just exit */ sk = skb_to_full_sk(skb); if (sk != NULL) { - struct sk_security_struct *sksec = selinux_sock(sk); - + sksec = selinux_sock(sk); if (sksec->nlbl_state != NLBL_REQSKB) return 0; secattr = selinux_netlbl_sock_getattr(sk, sid);
@@ -266,8 +267,11 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, } rc = netlbl_skbuff_setattr(skb, family, secattr); - if (rc > 0) + if (rc >= 0) { + if (sk != NULL) + sksec->nlbl_set = rc; rc = 0; + } skbuff_setsid_return: if (secattr == &secattr_storage)
@@ -325,6 +329,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep, rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr); if (rc >= 0) { sksec->nlbl_state = NLBL_LABELED; + sksec->nlbl_set = rc; rc = 0; }
@@ -428,8 +433,10 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) sksec->nlbl_state = NLBL_REQSKB; else if (rc >= 0) sksec->nlbl_state = NLBL_LABELED; - if (rc > 0) + if (rc >= 0) { + sksec->nlbl_set = rc; rc = 0; + } return rc; }
@@ -573,8 +580,8 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, if (addr->sa_family == AF_UNSPEC) { netlbl_sock_delattr(sk); sksec->nlbl_state = NLBL_REQSKB; - rc = 0; - return rc; + sksec->nlbl_set = NETLBL_NLTYPE_ADDRSELECT; + return 0; } secattr = selinux_netlbl_sock_genattr(sk); if (secattr == NULL) {
@@ -584,6 +591,7 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, rc = netlbl_conn_setattr(sk, addr, secattr); if (rc >= 0) { sksec->nlbl_state = NLBL_CONNLABELED; + sksec->nlbl_set = rc; rc = 0; }
diff --git a/security/smack/smack.h b/security/smack/smack.h
index f28db5a42b7b..b531f7ea21a7 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h@@ -104,6 +104,7 @@ struct socket_smack { struct smack_known *smk_out; /* outbound label */ struct smack_known *smk_in; /* inbound label */ struct smack_known *smk_packet; /* TCP peer label */ + int smk_set; /* Netlabel NLTYPE */ }; /*
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 62189558bb6a..87c81cbc8c67 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c@@ -2409,13 +2409,16 @@ static int smack_netlabel(struct sock *sk, int labeled) bh_lock_sock_nested(sk); if (ssp->smk_out == smack_net_ambient || - labeled == SMACK_UNLABELED_SOCKET) + labeled == SMACK_UNLABELED_SOCKET) { netlbl_sock_delattr(sk); - else { + ssp->smk_set = NETLBL_NLTYPE_UNLABELED; + } else { skp = ssp->smk_out; rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); - if (rc > 0) + if (rc >= 0) { rc = 0; + ssp->smk_set = rc; + } } bh_unlock_sock(sk);
@@ -4145,10 +4148,14 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, if (hskp == NULL) { rc = netlbl_req_setattr(req, &skp->smk_netlabel); - if (rc > 0) + if (rc >= 0) { + ssp->smk_set = rc; rc = 0; - } else + } + } else { netlbl_req_delattr(req); + rc = NETLBL_NLTYPE_UNLABELED; + } return rc; }
--
2.20.1