From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Richard Haines <richard_c_haines@btinternet.com>
Cc: selinux@vger.kernel.org, linux-security-module@vger.kernel.org,
osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org,
stephen.smalley.work@gmail.com, paul@paul-moore.com,
laforge@gnumonks.org, jmorris@namei.org
Subject: Re: [PATCH 0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP)
Date: Wed, 30 Sep 2020 14:30:16 +0200 [thread overview]
Message-ID: <20200930123016.GA24952@salvia> (raw)
In-Reply-To: <0a5e4f19d7bb5c61985dece7614dc33329858f36.camel@btinternet.com>
On Wed, Sep 30, 2020 at 01:20:41PM +0100, Richard Haines wrote:
> On Wed, 2020-09-30 at 12:17 +0200, Pablo Neira Ayuso wrote:
> > On Wed, Sep 30, 2020 at 10:49:31AM +0100, Richard Haines wrote:
> > > These patches came about after looking at 5G open source in
> > > particular
> > > the updated 5G GTP driver at [1]. As this driver is still under
> > > development, added the LSM/SELinux hooks to the current stable GTP
> > > version in kernel selinux-next [2]. Similar hooks have also been
> > > implemented in [1] as it uses the same base code as the current 3G
> > > version (except that it handles different packet types).
> >
> > Yes, [1] looks like it is based on the existing 3G driver in the
> > Linux
> > tree.
>
> After a few fixes to [1], I now have the gtp5g version driver running
> on 5.9 with security hooks and passing their couple of tests.
>
> >
> > > To test the 3G GTP driver there is an RFC patch for the selinux-
> > > testsuite
> > > at [3].
> > >
> > > To enable the selinux-testsuite GTP tests, the libgtpnl [4] library
> > > and
> > > tools needed to be modified to:
> > > Return ERRNO on error to detect EACCES, Add gtp_match_tunnel
> > > function,
> > > Allow gtp-link to specify port numbers for multiple instances to
> > > run in the same namespace.
> > >
> > > A patch for libgtpnl is supplied in the selinux-testsuite patch as
> > > well
> > > as setup/test instructions (libgtpnl is not packaged by Fedora)
> > >
> > > These patches were tested on Fedora 32 with kernel [2] using the
> > > 'targeted' policy. Also ran the Linux Kernel GTP-U basic tests [5].
> >
> > I don't remember to have seen anything similar in the existing tunnel
> > net_devices.
> >
> > Why do you need this?
>
> I don't actually have a use for this, I only did it out of idle
> curiosity. If it is useful to the community then okay. Given the
> attemped move to Open 5G I thought adding MAC support might be useful
> somewhere along the line.
No worries.
I'd suggest you send us patches to integrate missing code into the
existing driver, probably leaving the SELinux support aside - until we
learn how to use it or we understand the original motivation to make
it, I currently don't find any.
Thanks.
next prev parent reply other threads:[~2020-09-30 12:30 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 9:49 [PATCH 0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP) Richard Haines
2020-09-30 9:49 ` [PATCH 1/3] security: Add GPRS Tunneling Protocol (GTP) security hooks Richard Haines
2020-09-30 9:49 ` [PATCH 2/3] gtp: Add LSM hooks to GPRS Tunneling Protocol (GTP) Richard Haines
2020-09-30 9:49 ` [PATCH 3/3] selinux: Add SELinux GTP support Richard Haines
2020-09-30 11:01 ` Harald Welte
2020-09-30 12:25 ` Richard Haines
2020-09-30 13:38 ` Harald Welte
2020-10-12 2:09 ` Paul Moore
2020-10-12 9:38 ` Harald Welte
2020-10-13 13:55 ` Paul Moore
2020-10-13 16:38 ` Richard Haines
2020-10-13 20:42 ` Harald Welte
2020-09-30 10:17 ` [PATCH 0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP) Pablo Neira Ayuso
2020-09-30 12:20 ` Richard Haines
2020-09-30 12:30 ` Pablo Neira Ayuso [this message]
2020-09-30 15:56 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200930123016.GA24952@salvia \
--to=pablo@netfilter.org \
--cc=jmorris@namei.org \
--cc=laforge@gnumonks.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=osmocom-net-gprs@lists.osmocom.org \
--cc=paul@paul-moore.com \
--cc=richard_c_haines@btinternet.com \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.