* [PATCH][SELINUX] 3/7 Add node controls
[not found] <Xine.LNX.4.44.0401091012460.21309@thoron.boston.redhat.com>
@ 2004-01-09 15:39 ` James Morris
0 siblings, 0 replies; 6+ messages in thread
From: James Morris @ 2004-01-09 15:39 UTC (permalink / raw)
To: Andrew Morton; +Cc: linux-kernel, Stephen Smalley, selinux
This patch against 2.6.1-mm2 adds 'node' access controls for SELinux,
which allows network traffic to be controlled on the basis of remote
address.
Like the previous patch, similar functionality was present in earlier
SELinux implementations; this is a rework within the constraints of the
LSM hooks present in the mainline kernel.
Please apply.
hooks.c | 36 ++++++++++++++++++++++++++++++++----
1 files changed, 32 insertions(+), 4 deletions(-)
diff -urN -X dontdiff linux-2.6.1-rc2.pending/security/selinux/hooks.c linux-2.6.1-rc2.w1/security/selinux/hooks.c
--- linux-2.6.1-rc2.pending/security/selinux/hooks.c 2004-01-07 11:46:47.687890256 -0500
+++ linux-2.6.1-rc2.w1/security/selinux/hooks.c 2004-01-07 11:48:08.107664592 -0500
@@ -2668,10 +2668,11 @@
static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
int err = 0;
- u32 netif_perm;
+ u32 netif_perm, node_perm, node_sid;
struct socket *sock;
struct inode *inode;
struct net_device *dev;
+ struct iphdr *iph;
struct sel_netif *netif;
struct netif_security_struct *nsec;
struct inode_security_struct *isec;
@@ -2707,14 +2708,17 @@
switch (isec->sclass) {
case SECCLASS_UDP_SOCKET:
netif_perm = NETIF__UDP_RECV;
+ node_perm = NODE__UDP_RECV;
break;
case SECCLASS_TCP_SOCKET:
netif_perm = NETIF__TCP_RECV;
+ node_perm = NODE__TCP_RECV;
break;
default:
netif_perm = NETIF__RAWIP_RECV;
+ node_perm = NODE__RAWIP_RECV;
break;
}
@@ -2724,8 +2728,18 @@
err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
netif_perm, &nsec->avcr, &ad);
-
sel_netif_put(netif);
+ if (err)
+ goto out;
+
+ /* Fixme: this lookup is inefficient */
+ iph = skb->nh.iph;
+ err = security_node_sid(PF_INET, &iph->saddr, sizeof(iph->saddr), &node_sid);
+ if (err)
+ goto out;
+
+ err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);
+
out:
return err;
}
@@ -2738,9 +2752,10 @@
int (*okfn)(struct sk_buff *))
{
int err = NF_ACCEPT;
- u32 netif_perm;
+ u32 netif_perm, node_perm, node_sid;
struct socket *sock;
struct inode *inode;
+ struct iphdr *iph;
struct sel_netif *netif;
struct sk_buff *skb = *pskb;
struct netif_security_struct *nsec;
@@ -2771,14 +2786,17 @@
switch (isec->sclass) {
case SECCLASS_UDP_SOCKET:
netif_perm = NETIF__UDP_SEND;
+ node_perm = NODE__UDP_SEND;
break;
case SECCLASS_TCP_SOCKET:
netif_perm = NETIF__TCP_SEND;
+ node_perm = NODE__TCP_SEND;
break;
default:
netif_perm = NETIF__RAWIP_SEND;
+ node_perm = NODE__RAWIP_SEND;
break;
}
@@ -2788,8 +2806,18 @@
err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
netif_perm, &nsec->avcr, &ad) ? NF_DROP : NF_ACCEPT;
-
sel_netif_put(netif);
+ if (err != NF_ACCEPT)
+ goto out;
+
+ /* Fixme: this lookup is inefficient */
+ iph = skb->nh.iph;
+ err = security_node_sid(PF_INET, &iph->daddr, sizeof(iph->daddr), &node_sid);
+ if (err)
+ goto out;
+
+ err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
+ node_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
out:
return err;
}
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH][SELINUX] 3/7 Add node controls
@ 2004-01-09 15:39 ` James Morris
0 siblings, 0 replies; 6+ messages in thread
From: James Morris @ 2004-01-09 15:39 UTC (permalink / raw)
To: Andrew Morton; +Cc: linux-kernel, Stephen Smalley, selinux
This patch against 2.6.1-mm2 adds 'node' access controls for SELinux,
which allows network traffic to be controlled on the basis of remote
address.
Like the previous patch, similar functionality was present in earlier
SELinux implementations; this is a rework within the constraints of the
LSM hooks present in the mainline kernel.
Please apply.
hooks.c | 36 ++++++++++++++++++++++++++++++++----
1 files changed, 32 insertions(+), 4 deletions(-)
diff -urN -X dontdiff linux-2.6.1-rc2.pending/security/selinux/hooks.c linux-2.6.1-rc2.w1/security/selinux/hooks.c
--- linux-2.6.1-rc2.pending/security/selinux/hooks.c 2004-01-07 11:46:47.687890256 -0500
+++ linux-2.6.1-rc2.w1/security/selinux/hooks.c 2004-01-07 11:48:08.107664592 -0500
@@ -2668,10 +2668,11 @@
static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
int err = 0;
- u32 netif_perm;
+ u32 netif_perm, node_perm, node_sid;
struct socket *sock;
struct inode *inode;
struct net_device *dev;
+ struct iphdr *iph;
struct sel_netif *netif;
struct netif_security_struct *nsec;
struct inode_security_struct *isec;
@@ -2707,14 +2708,17 @@
switch (isec->sclass) {
case SECCLASS_UDP_SOCKET:
netif_perm = NETIF__UDP_RECV;
+ node_perm = NODE__UDP_RECV;
break;
case SECCLASS_TCP_SOCKET:
netif_perm = NETIF__TCP_RECV;
+ node_perm = NODE__TCP_RECV;
break;
default:
netif_perm = NETIF__RAWIP_RECV;
+ node_perm = NODE__RAWIP_RECV;
break;
}
@@ -2724,8 +2728,18 @@
err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
netif_perm, &nsec->avcr, &ad);
-
sel_netif_put(netif);
+ if (err)
+ goto out;
+
+ /* Fixme: this lookup is inefficient */
+ iph = skb->nh.iph;
+ err = security_node_sid(PF_INET, &iph->saddr, sizeof(iph->saddr), &node_sid);
+ if (err)
+ goto out;
+
+ err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);
+
out:
return err;
}
@@ -2738,9 +2752,10 @@
int (*okfn)(struct sk_buff *))
{
int err = NF_ACCEPT;
- u32 netif_perm;
+ u32 netif_perm, node_perm, node_sid;
struct socket *sock;
struct inode *inode;
+ struct iphdr *iph;
struct sel_netif *netif;
struct sk_buff *skb = *pskb;
struct netif_security_struct *nsec;
@@ -2771,14 +2786,17 @@
switch (isec->sclass) {
case SECCLASS_UDP_SOCKET:
netif_perm = NETIF__UDP_SEND;
+ node_perm = NODE__UDP_SEND;
break;
case SECCLASS_TCP_SOCKET:
netif_perm = NETIF__TCP_SEND;
+ node_perm = NODE__TCP_SEND;
break;
default:
netif_perm = NETIF__RAWIP_SEND;
+ node_perm = NODE__RAWIP_SEND;
break;
}
@@ -2788,8 +2806,18 @@
err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
netif_perm, &nsec->avcr, &ad) ? NF_DROP : NF_ACCEPT;
-
sel_netif_put(netif);
+ if (err != NF_ACCEPT)
+ goto out;
+
+ /* Fixme: this lookup is inefficient */
+ iph = skb->nh.iph;
+ err = security_node_sid(PF_INET, &iph->daddr, sizeof(iph->daddr), &node_sid);
+ if (err)
+ goto out;
+
+ err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
+ node_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
out:
return err;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH][SELINUX] 3/7 Add node controls
2004-01-09 15:39 ` James Morris
(?)
@ 2004-01-09 18:53 ` Arkadiusz Miskiewicz
2004-01-09 20:17 ` James Morris
-1 siblings, 1 reply; 6+ messages in thread
From: Arkadiusz Miskiewicz @ 2004-01-09 18:53 UTC (permalink / raw)
To: James Morris; +Cc: linux-kernel
On Friday 09 of January 2004 16:39, James Morris wrote:
> This patch against 2.6.1-mm2 adds 'node' access controls for SELinux,
> which allows network traffic to be controlled on the basis of remote
> address.
>
> Like the previous patch, similar functionality was present in earlier
> SELinux implementations; this is a rework within the constraints of the
> LSM hooks present in the mainline kernel.
But only for IPv4 right? What about IPv6 part - is SELinux able to deal with
IPv6 at all?
> Please apply.
--
Arkadiusz Miśkiewicz CS at FoE, Wroclaw University of Technology
arekm.pld-linux.org AM2-6BONE, 1024/3DB19BBD, arekm(at)ircnet, PLD/Linux
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH][SELINUX] 3/7 Add node controls
2004-01-09 18:53 ` Arkadiusz Miskiewicz
@ 2004-01-09 20:17 ` James Morris
0 siblings, 0 replies; 6+ messages in thread
From: James Morris @ 2004-01-09 20:17 UTC (permalink / raw)
To: Arkadiusz Miskiewicz; +Cc: linux-kernel
On Fri, 9 Jan 2004, Arkadiusz Miskiewicz wrote:
> > Like the previous patch, similar functionality was present in earlier
> > SELinux implementations; this is a rework within the constraints of the
> > LSM hooks present in the mainline kernel.
> But only for IPv4 right? What about IPv6 part - is SELinux able to deal with
> IPv6 at all?
Not at this level yet. There are socket controls which provide coverage
all protocols, and finer grained controls for IPv4 and Unix. Duplication
of the IPv4-specific controls for IPv6 is expected to be implemented soon.
- James
--
James Morris
<jmorris@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH][SELINUX] 3/7 Add node controls
@ 2005-02-25 19:00 Park Lee
2005-02-25 21:29 ` James Morris
0 siblings, 1 reply; 6+ messages in thread
From: Park Lee @ 2005-02-25 19:00 UTC (permalink / raw)
To: jmorris; +Cc: SELinux
On Fri 9 Jan 2004 - at 10:39, James Morris wrote:
> This patch against 2.6.1-mm2 adds 'node' access
> controls for SELinux, which allows network traffic
> to be controlled on the basis of remote address.
Can 'node' access controls now permit controls
on inbound messages based on the source address in
addition to permit controls on outbound messages based
on the destination address you mentioned above.
Thanx.
=====
Best Regards,
Park Lee
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH][SELINUX] 3/7 Add node controls
2005-02-25 19:00 Park Lee
@ 2005-02-25 21:29 ` James Morris
0 siblings, 0 replies; 6+ messages in thread
From: James Morris @ 2005-02-25 21:29 UTC (permalink / raw)
To: Park Lee; +Cc: SELinux
On Fri, 25 Feb 2005, Park Lee wrote:
> On Fri 9 Jan 2004 - at 10:39, James Morris wrote:
> > This patch against 2.6.1-mm2 adds 'node' access
> > controls for SELinux, which allows network traffic
> > to be controlled on the basis of remote address.
>
> Can 'node' access controls now permit controls
> on inbound messages based on the source address in
> addition to permit controls on outbound messages based
> on the destination address you mentioned above.
Yes, these controls are always specify the remote node.
- James
--
James Morris
<jmorris@redhat.com>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-02-25 21:29 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <Xine.LNX.4.44.0401091012460.21309@thoron.boston.redhat.com>
2004-01-09 15:39 ` [PATCH][SELINUX] 3/7 Add node controls James Morris
2004-01-09 15:39 ` James Morris
2004-01-09 18:53 ` Arkadiusz Miskiewicz
2004-01-09 20:17 ` James Morris
2005-02-25 19:00 Park Lee
2005-02-25 21:29 ` James Morris
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.