Re: [RFC PATCH 2/2] [SELINUX] Better integration between peer labeling subsystems

[Paul Moore <paul.moore@hp.com>]

On Tuesday 25 September 2007 5:37:53 pm Eric Paris wrote:
> On 9/25/07, Paul Moore <paul.moore@hp.com> wrote:
> > -static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
> > +static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u32 *sid)
> >  {
> >         u32 xfrm_sid;
> >         u32 nlbl_sid;
> >
> >         selinux_skb_xfrm_sid(skb, &xfrm_sid);
> > -       if (selinux_netlbl_skbuff_getsid(skb,
> > -                                        (xfrm_sid == SECSID_NULL ?
> > -                                         SECINITSID_NETMSG : xfrm_sid),
> > -                                        &nlbl_sid) != 0)
> > -               nlbl_sid = SECSID_NULL;
> > -       *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
> > +       selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &nlbl_sid);
> > +
> > +       if (nlbl_sid != SECSID_NULL && xfrm_sid != SECSID_NULL) {
> > +               if (nlbl_sid != xfrm_sid &&
>
> for now nlbl_sid will NEVER == xfrm_sid since netlbl_sid cannot be of
> an interesting type, correct?  So this code works.  If the mls portion
> is wrong bomb, if the mls portion is right allow.  Since that's all we
> are testing lets get that misleading nlbl_sid != xfrm_sid out of there
> they can never be the same and it implies we actually check something
> other than the mls portion.

[NOTE: pseudo code removed to protect the eyesight of anyone who happens to 
wander onto the mailing list]

Presently you are correct that is the case, I'll yank it out and we can add it 
back in later when we need it.  How about this?

static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u32 *sid)
{
	u32 xfrm_sid;
	u32 nlbl_sid;

	selinux_skb_xfrm_sid(skb, &xfrm_sid);
	selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &nlbl_sid);

	if (nlbl_sid != SECSID_NULL && xfrm_sid != SECSID_NULL)
		if (security_sid_mls_cmp(nlbl_sid, xfrm_sid) != 0) {
			*sid = SECSID_NULL;
			return -EACCES;
		} else
			/* at present NetLabel SIDs/labels really only carry
			 * MLS information so if the MLS portion of the
			 * NetLabel SID matches the MLS portion of the labeled
			 * XFRM SID/label then pass along the XFRM SID as it
			 * has the most peer label information */
			*sid = xfrm_sid;
	else if (nlbl_sid != SECSID_NULL)
		*sid = nlbl_sid;
	else if (xfrm_sid != SECSID_NULL)
		*sid = xfrm_sid;
	else
		*sid = SECSID_NULL;

	return 0;
}

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.