cregit-Linux how code gets into the kernel

Release 4.7 security/selinux/xfrm.c

Directory: security/selinux
/*
 *  NSA Security-Enhanced Linux (SELinux) security module
 *
 *  This file contains the SELinux XFRM hook function implementations.
 *
 *  Authors:  Serge Hallyn <sergeh@us.ibm.com>
 *            Trent Jaeger <jaegert@us.ibm.com>
 *
 *  Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com>
 *
 *           Granular IPSec Associations for use in MLS environments.
 *
 *  Copyright (C) 2005 International Business Machines Corporation
 *  Copyright (C) 2006 Trusted Computer Solutions, Inc.
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License version 2,
 *      as published by the Free Software Foundation.
 */

/*
 * USAGE:
 * NOTES:
 *   1. Make sure to enable the following options in your kernel config:
 *      CONFIG_SECURITY=y
 *      CONFIG_SECURITY_NETWORK=y
 *      CONFIG_SECURITY_NETWORK_XFRM=y
 *      CONFIG_SECURITY_SELINUX=m/y
 * ISSUES:
 *   1. Caching packets, so they are not dropped during negotiation
 *   2. Emulating a reasonable SO_PEERSEC across machines
 *   3. Testing addition of sk_policy's with security context via setsockopt
 */
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/security.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/skbuff.h>
#include <linux/xfrm.h>
#include <net/xfrm.h>
#include <net/checksum.h>
#include <net/udp.h>
#include <linux/atomic.h>

#include "avc.h"
#include "objsec.h"
#include "xfrm.h"

/* Labeled XFRM instance counter */

atomic_t selinux_xfrm_refcount = ATOMIC_INIT(0);

/*
 * Returns true if the context is an LSM/SELinux context.
 */

static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx) { return (ctx && (ctx->ctx_doi == XFRM_SC_DOI_LSM) && (ctx->ctx_alg == XFRM_SC_ALG_SELINUX)); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger33100.00%1100.00%
Total33100.00%1100.00%

/* * Returns true if the xfrm contains a security blob for SELinux. */
static inline int selinux_authorizable_xfrm(struct xfrm_state *x) { return selinux_authorizable_ctx(x->security); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger20100.00%1100.00%
Total20100.00%1100.00%

/* * Allocates a xfrm_sec_state and populates it using the supplied security * xfrm_user_sec_ctx context. */
static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *uctx, gfp_t gfp) { int rc; const struct task_security_struct *tsec = current_security(); struct xfrm_sec_ctx *ctx = NULL; u32 str_len; if (ctxp == NULL || uctx == NULL || uctx->ctx_doi != XFRM_SC_DOI_LSM || uctx->ctx_alg != XFRM_SC_ALG_SELINUX) return -EINVAL; str_len = uctx->ctx_len; if (str_len >= PAGE_SIZE) return -ENOMEM; ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp); if (!ctx) return -ENOMEM; ctx->ctx_doi = XFRM_SC_DOI_LSM; ctx->ctx_alg = XFRM_SC_ALG_SELINUX; ctx->ctx_len = str_len; memcpy(ctx->ctx_str, &uctx[1], str_len); ctx->ctx_str[str_len] = '\0'; rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp); if (rc) goto err; rc = avc_has_perm(tsec->sid, ctx->ctx_sid, SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL); if (rc) goto err; *ctxp = ctx; atomic_inc(&selinux_xfrm_refcount); return 0; err: kfree(ctx); return rc; }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore22197.36%150.00%
nikolay aleksandrovnikolay aleksandrov62.64%150.00%
Total227100.00%2100.00%

/* * Free the xfrm_sec_ctx structure. */
static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx) { if (!ctx) return; atomic_dec(&selinux_xfrm_refcount); kfree(ctx); }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore28100.00%1100.00%
Total28100.00%1100.00%

/* * Authorize the deletion of a labeled SA or policy rule. */
static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx) { const struct task_security_struct *tsec = current_security(); if (!ctx) return 0; return avc_has_perm(tsec->sid, ctx->ctx_sid, SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL); }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore46100.00%1100.00%
Total46100.00%1100.00%

/* * LSM hook implementation that authorizes that a flow can use a xfrm policy * rule. */
int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) { int rc; /* All flows should be treated as polmatch'ing an otherwise applicable * "non-labeled" policy. This would prevent inadvertent "leaks". */ if (!ctx) return 0; /* Context sid is either set to label or ANY_ASSOC */ if (!selinux_authorizable_ctx(ctx)) return -EINVAL; rc = avc_has_perm(fl_secid, ctx->ctx_sid, SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL); return (rc == -EACCES ? -ESRCH : rc); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger3954.93%120.00%
paul moorepaul moore1622.54%240.00%
venkat yekkiralavenkat yekkirala1622.54%240.00%
Total71100.00%5100.00%

/* * LSM hook implementation that authorizes that a state matches * the given policy, flow combo. */
int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp, const struct flowi *fl) { u32 state_sid; if (!xp->security) if (x->security) /* unlabeled policy and labeled SA can't match */ return 0; else /* unlabeled policy and unlabeled SA match all flows */ return 1; else if (!x->security) /* unlabeled SA and labeled policy can't match */ return 0; else if (!selinux_authorizable_xfrm(x)) /* Not a SELinux-labeled SA */ return 0; state_sid = x->security->ctx_sid; if (fl->flowi_secid != state_sid) return 0; /* We don't need a separate SA Vs. policy polmatch check since the SA * is now of the same label as the flow and a flow Vs. policy polmatch * check had already happened in selinux_xfrm_policy_lookup() above. */ return (avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, NULL) ? 0 : 1); }

Contributors

PersonTokensPropCommitsCommitProp
venkat yekkiralavenkat yekkirala10492.04%342.86%
paul moorepaul moore43.54%114.29%
david s. millerdavid s. miller32.65%228.57%
trent jaegertrent jaeger21.77%114.29%
Total113100.00%7100.00%


static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb) { struct dst_entry *dst = skb_dst(skb); struct xfrm_state *x; if (dst == NULL) return SECSID_NULL; x = dst->xfrm; if (x == NULL || !selinux_authorizable_xfrm(x)) return SECSID_NULL; return x->security->ctx_sid; }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore63100.00%1100.00%
Total63100.00%1100.00%


static int selinux_xfrm_skb_sid_ingress(struct sk_buff *skb, u32 *sid, int ckall) { u32 sid_session = SECSID_NULL; struct sec_path *sp = skb->sp; if (sp) { int i; for (i = sp->len - 1; i >= 0; i--) { struct xfrm_state *x = sp->xvec[i]; if (selinux_authorizable_xfrm(x)) { struct xfrm_sec_ctx *ctx = x->security; if (sid_session == SECSID_NULL) { sid_session = ctx->ctx_sid; if (!ckall) goto out; } else if (sid_session != ctx->ctx_sid) { *sid = SECSID_NULL; return -EINVAL; } } } } out: *sid = sid_session; return 0; }

Contributors

PersonTokensPropCommitsCommitProp
venkat yekkiralavenkat yekkirala10775.35%240.00%
paul moorepaul moore3121.83%240.00%
trent jaegertrent jaeger42.82%120.00%
Total142100.00%5100.00%

/* * LSM hook implementation that checks and/or returns the xfrm sid for the * incoming packet. */
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall) { if (skb == NULL) { *sid = SECSID_NULL; return 0; } return selinux_xfrm_skb_sid_ingress(skb, sid, ckall); }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore43100.00%1100.00%
Total43100.00%1100.00%


int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid) { int rc; rc = selinux_xfrm_skb_sid_ingress(skb, sid, 0); if (rc == 0 && *sid == SECSID_NULL) *sid = selinux_xfrm_skb_sid_egress(skb); return rc; }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore50100.00%1100.00%
Total50100.00%1100.00%

/* * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy. */
int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *uctx, gfp_t gfp) { return selinux_xfrm_alloc_user(ctxp, uctx, gfp); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger1448.28%133.33%
paul moorepaul moore1034.48%133.33%
nikolay aleksandrovnikolay aleksandrov517.24%133.33%
Total29100.00%3100.00%

/* * LSM hook implementation that copies security data structure from old to new * for policy cloning. */
int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp) { struct xfrm_sec_ctx *new_ctx; if (!old_ctx) return 0; new_ctx = kmemdup(old_ctx, sizeof(*old_ctx) + old_ctx->ctx_len, GFP_ATOMIC); if (!new_ctx) return -ENOMEM; atomic_inc(&selinux_xfrm_refcount); *new_ctxp = new_ctx; return 0; }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger4461.97%114.29%
paul moorepaul moore2332.39%457.14%
duan jiongduan jiong34.23%114.29%
dan carpenterdan carpenter11.41%114.29%
Total71100.00%7100.00%

/* * LSM hook implementation that frees xfrm_sec_ctx security information. */
void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx) { selinux_xfrm_free(ctx); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger1280.00%133.33%
paul moorepaul moore320.00%266.67%
Total15100.00%3100.00%

/* * LSM hook implementation that authorizes deletion of labeled policies. */
int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) { return selinux_xfrm_delete(ctx); }

Contributors

PersonTokensPropCommitsCommitProp
catherine zhangcatherine zhang1275.00%125.00%
paul moorepaul moore425.00%375.00%
Total16100.00%4100.00%

/* * LSM hook implementation that allocates a xfrm_sec_state, populates it using * the supplied security context, and assigns it to the xfrm_state. */
int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx) { return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL); }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore1450.00%133.33%
trent jaegertrent jaeger1242.86%133.33%
nikolay aleksandrovnikolay aleksandrov27.14%133.33%
Total28100.00%3100.00%

/* * LSM hook implementation that allocates a xfrm_sec_state and populates based * on a secid. */
int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, struct xfrm_sec_ctx *polsec, u32 secid) { int rc; struct xfrm_sec_ctx *ctx; char *ctx_str = NULL; int str_len; if (!polsec) return 0; if (secid == 0) return -EINVAL; rc = security_sid_to_context(secid, &ctx_str, &str_len); if (rc) return rc; ctx = kmalloc(sizeof(*ctx) + str_len, GFP_ATOMIC); if (!ctx) { rc = -ENOMEM; goto out; } ctx->ctx_doi = XFRM_SC_DOI_LSM; ctx->ctx_alg = XFRM_SC_ALG_SELINUX; ctx->ctx_sid = secid; ctx->ctx_len = str_len; memcpy(ctx->ctx_str, ctx_str, str_len); x->security = ctx; atomic_inc(&selinux_xfrm_refcount); out: kfree(ctx_str); return rc; }

Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore12678.75%240.00%
geyslan g. bemgeyslan g. bem1610.00%120.00%
trent jaegertrent jaeger148.75%120.00%
venkat yekkiralavenkat yekkirala42.50%120.00%
Total160100.00%5100.00%

/* * LSM hook implementation that frees xfrm_state security information. */
void selinux_xfrm_state_free(struct xfrm_state *x) { selinux_xfrm_free(x->security); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger1588.24%133.33%
paul moorepaul moore211.76%266.67%
Total17100.00%3100.00%

/* * LSM hook implementation that authorizes deletion of labeled SAs. */
int selinux_xfrm_state_delete(struct xfrm_state *x) { return selinux_xfrm_delete(x->security); }

Contributors

PersonTokensPropCommitsCommitProp
catherine zhangcatherine zhang1477.78%133.33%
paul moorepaul moore422.22%266.67%
Total18100.00%3100.00%

/* * LSM hook that controls access to unlabelled packets. If * a xfrm_state is authorizable (defined by macro) then it was * already authorized by the IPSec process. If not, then * we need to check for unlabelled access since this may not have * gone thru the IPSec process. */
int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb, struct common_audit_data *ad) { int i; struct sec_path *sp = skb->sp; u32 peer_sid = SECINITSID_UNLABELED; if (sp) { for (i = 0; i < sp->len; i++) { struct xfrm_state *x = sp->xvec[i]; if (x && selinux_authorizable_xfrm(x)) { struct xfrm_sec_ctx *ctx = x->security; peer_sid = ctx->ctx_sid; break; } } } /* This check even when there's no association involved is intended, * according to Trent Jaeger, to make sure a process can't engage in * non-IPsec communication unless explicitly allowed by policy. */ return avc_has_perm(sk_sid, peer_sid, SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger7365.18%120.00%
venkat yekkiralavenkat yekkirala2623.21%120.00%
paul moorepaul moore119.82%120.00%
dave jonesdave jones10.89%120.00%
thomas liuthomas liu10.89%120.00%
Total112100.00%5100.00%

/* * POSTROUTE_LAST hook's XFRM processing: * If we have no security association, then we need to determine * whether the socket is allowed to send to an unlabelled destination. * If we do have a authorizable security association, then it has already been * checked in the selinux_xfrm_state_pol_flow_match hook above. */
int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb, struct common_audit_data *ad, u8 proto) { struct dst_entry *dst; switch (proto) { case IPPROTO_AH: case IPPROTO_ESP: case IPPROTO_COMP: /* We should have already seen this packet once before it * underwent xfrm(s). No need to subject it to the unlabeled * check. */ return 0; default: break; } dst = skb_dst(skb); if (dst) { struct dst_entry *iter; for (iter = dst; iter != NULL; iter = iter->child) { struct xfrm_state *x = iter->xfrm; if (x && selinux_authorizable_xfrm(x)) return 0; } } /* This check even when there's no association involved is intended, * according to Trent Jaeger, to make sure a process can't engage in * non-IPsec communication unless explicitly allowed by policy. */ return avc_has_perm(sk_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad); }

Contributors

PersonTokensPropCommitsCommitProp
trent jaegertrent jaeger7361.34%114.29%
paul moorepaul moore3327.73%114.29%
venkat yekkiralavenkat yekkirala86.72%228.57%
eric dumazeteric dumazet32.52%114.29%
stephen hemmingerstephen hemminger10.84%114.29%
thomas liuthomas liu10.84%114.29%
Total119100.00%7100.00%


Overall Contributors

PersonTokensPropCommitsCommitProp
paul moorepaul moore75650.47%1035.71%
trent jaegertrent jaeger40026.70%13.57%
venkat yekkiralavenkat yekkirala26817.89%414.29%
catherine zhangcatherine zhang271.80%13.57%
geyslan g. bemgeyslan g. bem161.07%13.57%
nikolay aleksandrovnikolay aleksandrov130.87%13.57%
eric dumazeteric dumazet30.20%13.57%
david s. millerdavid s. miller30.20%27.14%
tejun heotejun heo30.20%13.57%
duan jiongduan jiong30.20%13.57%
thomas liuthomas liu20.13%13.57%
arun sharmaarun sharma10.07%13.57%
stephen hemmingerstephen hemminger10.07%13.57%
dave jonesdave jones10.07%13.57%
dan carpenterdan carpenter10.07%13.57%
Total1498100.00%28100.00%
Directory: security/selinux
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
{% endraw %}