Release 4.7 security/selinux/xfrm.c

Directory: security/selinux
/*
 *  NSA Security-Enhanced Linux (SELinux) security module
 *
 *  This file contains the SELinux XFRM hook function implementations.
 *
 *  Authors:  Serge Hallyn <sergeh@us.ibm.com>
 *            Trent Jaeger <jaegert@us.ibm.com>
 *
 *  Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com>
 *
 *           Granular IPSec Associations for use in MLS environments.
 *
 *  Copyright (C) 2005 International Business Machines Corporation
 *  Copyright (C) 2006 Trusted Computer Solutions, Inc.
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License version 2,
 *      as published by the Free Software Foundation.
 */

/*
 * USAGE:
 * NOTES:
 *   1. Make sure to enable the following options in your kernel config:
 *      CONFIG_SECURITY=y
 *      CONFIG_SECURITY_NETWORK=y
 *      CONFIG_SECURITY_NETWORK_XFRM=y
 *      CONFIG_SECURITY_SELINUX=m/y
 * ISSUES:
 *   1. Caching packets, so they are not dropped during negotiation
 *   2. Emulating a reasonable SO_PEERSEC across machines
 *   3. Testing addition of sk_policy's with security context via setsockopt
 */
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/security.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/skbuff.h>
#include <linux/xfrm.h>
#include <net/xfrm.h>
#include <net/checksum.h>
#include <net/udp.h>
#include <linux/atomic.h>

#include "avc.h"
#include "objsec.h"
#include "xfrm.h"

/* Labeled XFRM instance counter */

atomic_t selinux_xfrm_refcount = ATOMIC_INIT(0);

/*
 * Returns true if the context is an LSM/SELinux context.
 */


static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
{
	return (ctx &&
		(ctx->ctx_doi == XFRM_SC_DOI_LSM) &&
		(ctx->ctx_alg == XFRM_SC_ALG_SELINUX));
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 33 100.00% 1 100.00%
Total 33 100.00% 1 100.00%

/*
 * Returns true if the xfrm contains a security blob for SELinux.
 */


static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
{
	return selinux_authorizable_ctx(x->security);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 20 100.00% 1 100.00%
Total 20 100.00% 1 100.00%

/*
 * Allocates a xfrm_sec_state and populates it using the supplied security
 * xfrm_user_sec_ctx context.
 */


static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
				   struct xfrm_user_sec_ctx *uctx,
				   gfp_t gfp)
{
	int rc;
	const struct task_security_struct *tsec = current_security();
	struct xfrm_sec_ctx *ctx = NULL;
	u32 str_len;

	if (ctxp == NULL || uctx == NULL ||
	    uctx->ctx_doi != XFRM_SC_DOI_LSM ||
	    uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
		return -EINVAL;

	str_len = uctx->ctx_len;
	if (str_len >= PAGE_SIZE)
		return -ENOMEM;

	ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
	if (!ctx)
		return -ENOMEM;

	ctx->ctx_doi = XFRM_SC_DOI_LSM;
	ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
	ctx->ctx_len = str_len;
	memcpy(ctx->ctx_str, &uctx[1], str_len);
	ctx->ctx_str[str_len] = '\0';
	rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp);
	if (rc)
		goto err;

	rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
			  SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL);
	if (rc)
		goto err;

	*ctxp = ctx;
	atomic_inc(&selinux_xfrm_refcount);
	return 0;

err:
	kfree(ctx);
	return rc;
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 221 97.36% 1 50.00%
nikolay aleksandrov nikolay aleksandrov 6 2.64% 1 50.00%
Total 227 100.00% 2 100.00%

/*
 * Free the xfrm_sec_ctx structure.
 */


static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx)
{
	if (!ctx)
		return;

	atomic_dec(&selinux_xfrm_refcount);
	kfree(ctx);
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 28 100.00% 1 100.00%
Total 28 100.00% 1 100.00%

/*
 * Authorize the deletion of a labeled SA or policy rule.
 */


static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx)
{
	const struct task_security_struct *tsec = current_security();

	if (!ctx)
		return 0;

	return avc_has_perm(tsec->sid, ctx->ctx_sid,
			    SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
			    NULL);
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 46 100.00% 1 100.00%
Total 46 100.00% 1 100.00%

/*
 * LSM hook implementation that authorizes that a flow can use a xfrm policy
 * rule.
 */


int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
{
	int rc;

	/* All flows should be treated as polmatch'ing an otherwise applicable
         * "non-labeled" policy. This would prevent inadvertent "leaks". */
	if (!ctx)
		return 0;

	/* Context sid is either set to label or ANY_ASSOC */
	if (!selinux_authorizable_ctx(ctx))
		return -EINVAL;

	rc = avc_has_perm(fl_secid, ctx->ctx_sid,
			  SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL);
	return (rc == -EACCES ? -ESRCH : rc);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 39 54.93% 1 20.00%
paul moore paul moore 16 22.54% 2 40.00%
venkat yekkirala venkat yekkirala 16 22.54% 2 40.00%
Total 71 100.00% 5 100.00%

/*
 * LSM hook implementation that authorizes that a state matches
 * the given policy, flow combo.
 */


int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
				      struct xfrm_policy *xp,
				      const struct flowi *fl)
{
	u32 state_sid;

	if (!xp->security)
		if (x->security)
			/* unlabeled policy and labeled SA can't match */
			return 0;
		else
			/* unlabeled policy and unlabeled SA match all flows */
			return 1;
	else
		if (!x->security)
			/* unlabeled SA and labeled policy can't match */
			return 0;
		else
			if (!selinux_authorizable_xfrm(x))
				/* Not a SELinux-labeled SA */
				return 0;

	state_sid = x->security->ctx_sid;

	if (fl->flowi_secid != state_sid)
		return 0;

	/* We don't need a separate SA Vs. policy polmatch check since the SA
         * is now of the same label as the flow and a flow Vs. policy polmatch
         * check had already happened in selinux_xfrm_policy_lookup() above. */
	return (avc_has_perm(fl->flowi_secid, state_sid,
			    SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
			    NULL) ? 0 : 1);
}

Contributors
Person Tokens Prop Commits CommitProp
venkat yekkirala venkat yekkirala 104 92.04% 3 42.86%
paul moore paul moore 4 3.54% 1 14.29%
david s. miller david s. miller 3 2.65% 2 28.57%
trent jaeger trent jaeger 2 1.77% 1 14.29%
Total 113 100.00% 7 100.00%



static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb)
{
	struct dst_entry *dst = skb_dst(skb);
	struct xfrm_state *x;

	if (dst == NULL)
		return SECSID_NULL;
	x = dst->xfrm;
	if (x == NULL || !selinux_authorizable_xfrm(x))
		return SECSID_NULL;

	return x->security->ctx_sid;
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 63 100.00% 1 100.00%
Total 63 100.00% 1 100.00%



static int selinux_xfrm_skb_sid_ingress(struct sk_buff *skb,
					u32 *sid, int ckall)
{
	u32 sid_session = SECSID_NULL;
	struct sec_path *sp = skb->sp;

	if (sp) {
		int i;

		for (i = sp->len - 1; i >= 0; i--) {
			struct xfrm_state *x = sp->xvec[i];
			if (selinux_authorizable_xfrm(x)) {
				struct xfrm_sec_ctx *ctx = x->security;

				if (sid_session == SECSID_NULL) {
					sid_session = ctx->ctx_sid;
					if (!ckall)
						goto out;
				} else if (sid_session != ctx->ctx_sid) {
					*sid = SECSID_NULL;
					return -EINVAL;
				}
			}
		}
	}

out:
	*sid = sid_session;
	return 0;
}

Contributors
Person Tokens Prop Commits CommitProp
venkat yekkirala venkat yekkirala 107 75.35% 2 40.00%
paul moore paul moore 31 21.83% 2 40.00%
trent jaeger trent jaeger 4 2.82% 1 20.00%
Total 142 100.00% 5 100.00%

/*
 * LSM hook implementation that checks and/or returns the xfrm sid for the
 * incoming packet.
 */


int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
{
	if (skb == NULL) {
		*sid = SECSID_NULL;
		return 0;
	}
	return selinux_xfrm_skb_sid_ingress(skb, sid, ckall);
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 43 100.00% 1 100.00%
Total 43 100.00% 1 100.00%



int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
{
	int rc;

	rc = selinux_xfrm_skb_sid_ingress(skb, sid, 0);
	if (rc == 0 && *sid == SECSID_NULL)
		*sid = selinux_xfrm_skb_sid_egress(skb);

	return rc;
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 50 100.00% 1 100.00%
Total 50 100.00% 1 100.00%

/*
 * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
 */


int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
			      struct xfrm_user_sec_ctx *uctx,
			      gfp_t gfp)
{
	return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 14 48.28% 1 33.33%
paul moore paul moore 10 34.48% 1 33.33%
nikolay aleksandrov nikolay aleksandrov 5 17.24% 1 33.33%
Total 29 100.00% 3 100.00%

/*
 * LSM hook implementation that copies security data structure from old to new
 * for policy cloning.
 */


int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
			      struct xfrm_sec_ctx **new_ctxp)
{
	struct xfrm_sec_ctx *new_ctx;

	if (!old_ctx)
		return 0;

	new_ctx = kmemdup(old_ctx, sizeof(*old_ctx) + old_ctx->ctx_len,
			  GFP_ATOMIC);
	if (!new_ctx)
		return -ENOMEM;
	atomic_inc(&selinux_xfrm_refcount);
	*new_ctxp = new_ctx;

	return 0;
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 44 61.97% 1 14.29%
paul moore paul moore 23 32.39% 4 57.14%
duan jiong duan jiong 3 4.23% 1 14.29%
dan carpenter dan carpenter 1 1.41% 1 14.29%
Total 71 100.00% 7 100.00%

/*
 * LSM hook implementation that frees xfrm_sec_ctx security information.
 */


void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
{
	selinux_xfrm_free(ctx);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 12 80.00% 1 33.33%
paul moore paul moore 3 20.00% 2 66.67%
Total 15 100.00% 3 100.00%

/*
 * LSM hook implementation that authorizes deletion of labeled policies.
 */


int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
{
	return selinux_xfrm_delete(ctx);
}

Contributors
Person Tokens Prop Commits CommitProp
catherine zhang catherine zhang 12 75.00% 1 25.00%
paul moore paul moore 4 25.00% 3 75.00%
Total 16 100.00% 4 100.00%

/*
 * LSM hook implementation that allocates a xfrm_sec_state, populates it using
 * the supplied security context, and assigns it to the xfrm_state.
 */


int selinux_xfrm_state_alloc(struct xfrm_state *x,
			     struct xfrm_user_sec_ctx *uctx)
{
	return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 14 50.00% 1 33.33%
trent jaeger trent jaeger 12 42.86% 1 33.33%
nikolay aleksandrov nikolay aleksandrov 2 7.14% 1 33.33%
Total 28 100.00% 3 100.00%

/*
 * LSM hook implementation that allocates a xfrm_sec_state and populates based
 * on a secid.
 */


int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
				     struct xfrm_sec_ctx *polsec, u32 secid)
{
	int rc;
	struct xfrm_sec_ctx *ctx;
	char *ctx_str = NULL;
	int str_len;

	if (!polsec)
		return 0;

	if (secid == 0)
		return -EINVAL;

	rc = security_sid_to_context(secid, &ctx_str, &str_len);
	if (rc)
		return rc;

	ctx = kmalloc(sizeof(*ctx) + str_len, GFP_ATOMIC);
	if (!ctx) {
		rc = -ENOMEM;
		goto out;
	}

	ctx->ctx_doi = XFRM_SC_DOI_LSM;
	ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
	ctx->ctx_sid = secid;
	ctx->ctx_len = str_len;
	memcpy(ctx->ctx_str, ctx_str, str_len);

	x->security = ctx;
	atomic_inc(&selinux_xfrm_refcount);
out:
	kfree(ctx_str);
	return rc;
}

Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 126 78.75% 2 40.00%
geyslan g. bem geyslan g. bem 16 10.00% 1 20.00%
trent jaeger trent jaeger 14 8.75% 1 20.00%
venkat yekkirala venkat yekkirala 4 2.50% 1 20.00%
Total 160 100.00% 5 100.00%

/*
 * LSM hook implementation that frees xfrm_state security information.
 */


void selinux_xfrm_state_free(struct xfrm_state *x)
{
	selinux_xfrm_free(x->security);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 15 88.24% 1 33.33%
paul moore paul moore 2 11.76% 2 66.67%
Total 17 100.00% 3 100.00%

/*
 * LSM hook implementation that authorizes deletion of labeled SAs.
 */


int selinux_xfrm_state_delete(struct xfrm_state *x)
{
	return selinux_xfrm_delete(x->security);
}

Contributors
Person Tokens Prop Commits CommitProp
catherine zhang catherine zhang 14 77.78% 1 33.33%
paul moore paul moore 4 22.22% 2 66.67%
Total 18 100.00% 3 100.00%

/*
 * LSM hook that controls access to unlabelled packets.  If
 * a xfrm_state is authorizable (defined by macro) then it was
 * already authorized by the IPSec process.  If not, then
 * we need to check for unlabelled access since this may not have
 * gone thru the IPSec process.
 */


int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
			      struct common_audit_data *ad)
{
	int i;
	struct sec_path *sp = skb->sp;
	u32 peer_sid = SECINITSID_UNLABELED;

	if (sp) {
		for (i = 0; i < sp->len; i++) {
			struct xfrm_state *x = sp->xvec[i];

			if (x && selinux_authorizable_xfrm(x)) {
				struct xfrm_sec_ctx *ctx = x->security;
				peer_sid = ctx->ctx_sid;
				break;
			}
		}
	}

	/* This check even when there's no association involved is intended,
         * according to Trent Jaeger, to make sure a process can't engage in
         * non-IPsec communication unless explicitly allowed by policy. */
	return avc_has_perm(sk_sid, peer_sid,
			    SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad);
}

Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 73 65.18% 1 20.00%
venkat yekkirala venkat yekkirala 26 23.21% 1 20.00%
paul moore paul moore 11 9.82% 1 20.00%
dave jones dave jones 1 0.89% 1 20.00%
thomas liu thomas liu 1 0.89% 1 20.00%
Total 112 100.00% 5 100.00%

/*
 * POSTROUTE_LAST hook's XFRM processing:
 * If we have no security association, then we need to determine
 * whether the socket is allowed to send to an unlabelled destination.
 * If we do have a authorizable security association, then it has already been
 * checked in the selinux_xfrm_state_pol_flow_match hook above.
 */


int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
				struct common_audit_data *ad, u8 proto)
{
	struct dst_entry *dst;

	switch (proto) {
	case IPPROTO_AH:
	case IPPROTO_ESP:
	case IPPROTO_COMP:
		/* We should have already seen this packet once before it
                 * underwent xfrm(s). No need to subject it to the unlabeled
                 * check. */
		return 0;
	default:
		break;
	}

	dst = skb_dst(skb);
	if (dst) {
		struct dst_entry *iter;

		for (iter = dst; iter != NULL; iter = iter->child) {
			struct xfrm_state *x = iter->xfrm;

			if (x && selinux_authorizable_xfrm(x))
				return 0;
		}
	}

	/* This check even when there's no association involved is intended,
         * according to Trent Jaeger, to make sure a process can't engage in
         * non-IPsec communication unless explicitly allowed by policy. */
	return avc_has_perm(sk_sid, SECINITSID_UNLABELED,
			    SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad);
}
Contributors
Person Tokens Prop Commits CommitProp
trent jaeger trent jaeger 73 61.34% 1 14.29%
paul moore paul moore 33 27.73% 1 14.29%
venkat yekkirala venkat yekkirala 8 6.72% 2 28.57%
eric dumazet eric dumazet 3 2.52% 1 14.29%
stephen hemminger stephen hemminger 1 0.84% 1 14.29%
thomas liu thomas liu 1 0.84% 1 14.29%
Total 119 100.00% 7 100.00%

Overall Contributors
Person Tokens Prop Commits CommitProp
paul moore paul moore 756 50.47% 10 35.71%
trent jaeger trent jaeger 400 26.70% 1 3.57%
venkat yekkirala venkat yekkirala 268 17.89% 4 14.29%
catherine zhang catherine zhang 27 1.80% 1 3.57%
geyslan g. bem geyslan g. bem 16 1.07% 1 3.57%
nikolay aleksandrov nikolay aleksandrov 13 0.87% 1 3.57%
eric dumazet eric dumazet 3 0.20% 1 3.57%
david s. miller david s. miller 3 0.20% 2 7.14%
tejun heo tejun heo 3 0.20% 1 3.57%
duan jiong duan jiong 3 0.20% 1 3.57%
thomas liu thomas liu 2 0.13% 1 3.57%
arun sharma arun sharma 1 0.07% 1 3.57%
stephen hemminger stephen hemminger 1 0.07% 1 3.57%
dave jones dave jones 1 0.07% 1 3.57%
dan carpenter dan carpenter 1 0.07% 1 3.57%
Total 1498 100.00% 28 100.00%
  Directory: security/selinux

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
	Person	Tokens	Prop	Commits	CommitProp
trent jaeger	trent jaeger	33	100.00%	1	100.00%
	Total	33	100.00%	1	100.00%
cregit-Linux how code gets into the kernel

Release 4.7 security/selinux/xfrm.c

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Overall Contributors
