From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E874FC433B4 for ; Thu, 13 May 2021 20:28:29 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4EE6F613E9 for ; Thu, 13 May 2021 20:28:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4EE6F613E9 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-594-sa8Y6rbRNuyyaSDyUS_U4Q-1; Thu, 13 May 2021 16:28:24 -0400 X-MC-Unique: sa8Y6rbRNuyyaSDyUS_U4Q-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 24C8C79EC0; Thu, 13 May 2021 20:28:22 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 063E43807; Thu, 13 May 2021 20:28:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id DE12A18005B6; Thu, 13 May 2021 20:28:21 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 14DKSK9Q023813 for ; Thu, 13 May 2021 16:28:20 -0400 Received: by smtp.corp.redhat.com (Postfix) id 5C49B10BBCCF; Thu, 13 May 2021 20:28:20 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 57CD3109EF71 for ; Thu, 13 May 2021 20:28:17 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4D3C68339A2 for ; Thu, 13 May 2021 20:28:17 +0000 (UTC) Received: from sonic309-27.consmr.mail.ne1.yahoo.com (sonic309-27.consmr.mail.ne1.yahoo.com [66.163.184.153]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-425-CGtthbzvMCiCP2PZXdIKNg-1; Thu, 13 May 2021 16:28:11 -0400 X-MC-Unique: CGtthbzvMCiCP2PZXdIKNg-1 X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1620937690; bh=AFG07ztm7H//CNQNPdbBKGSh8Pj3cSvWwCBlx4qakhj=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=qWoiw38bJRMeHH8IgEWnwUwVxu3gUtHh2gG/L112o0XdGstStErXcA2Vj3yXtiiKKB/pCgSyGxnn5AxijV0wCQZu70uS+PKJONjtrAMpoHwNFNPCuabtABgGa2Lrbezd9kyoNd8bOHr36+Dcc5WK1l3ckDurDImFjjx6lOyuW1+mtx0L4PZKNx0+Gm0eHP/oxvPNAhel5AP5g/xWBZsYY+k0zJ2qBKYCQaoD+scW2lXB7HFI02ulpO/P4DnrXb+iIZtEdzvLaVGpEUCLGDbH3KdHmkLxq3nQoA4VRfS8i6KcQtWD2iN2TJnzftyT3+hHyDro0QnJu58VWfBdIuAn5Q== X-YMail-OSG: IXfK2b4VM1mB7g_Rz9YS8HJ2BslidVrIJl0SWj3yp3HeY5LYDwvnRi1c7bJ8lbD rIh4y8omufct6U0xEB7VomjZDRH0md9ESU9oECKZA7MNXj5zZP2kzQGkgzRqJvyk_PAoC7EAWSkX MGHjnXUWst3avA0SdaVRrS3PINCFc7evaGlsUAXh7v5ItqE22sjKPjO8kjZVK8UM7m1nT4N4rrw7 0ogL2rAcarxE54LQw8WmfceuYIZfB2XzABcYFHiILNLiZLffhszATR18Y1jWz82FAk2VNdsUB6OR axr4dBfAXlLSWyJ7iK3SyzV3KLBFpWsC52dOq9cL3vALczcWnbmpoWpxR9U2vMM76at5fJ5nmNUM .8TzaOFuaypJ_43i61v_I8sWVEwCKXeMYgOUu4GgSoSj3RqIK14C5_WrmhvQCe2U03U6rSa9sFER 8IdeYrh_JGWto8na44lP4ZMoa2NWIWGeW3ujpFKSQagrEGyAdlQmeGsc148Jyu208ARjsbYXMgBM saQSMdJzkFxMvw46hs9UARuZ6921eAWS1qJ.M_qVh2phFgRWBD9tEsC1kEa0SCOaAD7a.8Wp5I2M oxe9J7HT2LvHfSXLAPuYH6zi4ma6tWy3cCnp0L4FlcYdsOUXSgjDUrn3.owgXLNSIizyWUPXdPbh _fGS.Uw59oRj7EAbVDVVeD021Q8SzHcY19e7XvbYNjbYiiLhVmQY7ik1ZoXu4U0q1RBxZ6OJFRz9 A3evX2NyZs15ARaiQ43LeZ7T1lotglFXWFyyapyna9chytRsu3VHww5WS8_RSfIzYeqsEVOkfqG5 8pfX4dE8Sn8jiHQWlp6WhnVC1LRNmj7dR30QTe1AqfvFUa6xLyeTRUemu5W_HnXxuEs0WmuWbWMP 57jbjF4Bs6PRslzF0UxiBtuuAuq89dQ51E3UVK.pK0L.DIT281WBgVnGOTajjH9LXdJAYMHDDlCT DDYrRPl.un1tWBlzcZKOoIuKmuz2S8MOYgZRGM1X3PB.daRC969Or0i44pchsit1l.gfCYn4zwgw .lYpleb4.7oHbq8m7D6Divdg52CXt48ubrCzgIWop_TqKQWwCtcrJHDn62HcxG_ACDFnd7Icsvp2 h_Q4Ai7LY_219G0QbknKB8kDWJeD2jhKDxrlkC15F8Twpgq.aE5gXyuX.lVuIf5U.jrnRTLNMCGS oAkJUeGdhVq4gTNxVDDwo_8j87J.U2TEWx209kjvmX3tneYeCEe1K_.tNoGMl1LjqlwV9FLggWL6 qFCFhDWwyoje9wjehh0F_6J1siL2sx1UvWYrP9Kqefq..SNKxZsZe6UHsEv5TQFSk3ukNWd4q07G FlhpjgPAYJ1PLbkV7we1aC1ymscpP8C1nBzKopfSb1tdRSTwpSKTtItmsYxk0tb0VJ0y9ZesvFSv jYnfuSYDPYCGpWUnXltA07a5B.7lr4HBVBkrTuphKvjxL7qP9vixbsCwN7lRlIT7xZCDfiJyRRKk 9K8P6i7vYW63G1KNswvjsp.aiUiq5bwU3ZEeJg6GlyeiKhPvILJRshhECmvRHZNcb84UfvrJ9H6f j44Gvt_NHhNvqEShzLhSD3TA1ZaJhWgEKZNTO3AcSFh978QxKbvPlTCz4hv4bOATo_rbQBSIX1a9 2O0efmNxVy..M_7Vx91WHli1f_WgQaEy_9ewYTtA1Tr8V1BYolA7nq5uKXRPXiDquUeEUu_C_qzO 75nav3racAQmwo2WNtXIWhaE.pu8EVM5vUuJMI7PzwWiRxoiNZI_gvrUnPaXys_mDDwk3E8gQV6p bV2Peo7IVymZLrJJ45s_jluYX4cwJ.52xQlzsRnvQc6rtAi8zCNzfgFixskQDYe7NEZ31B0SoxbW Mpxd3XmqoN3CygocvNAr42QidyHqAzupHi9pxN66wOLDgZIyufULM2FBgKtJnqHdjI6kGXCHPK7F kxhwY0bAd60GJz.vaFw93G5jYMsOPtObJfluCPGiMuWIST8j0vbBKAg_dRo3B1VxrcwG7ErSeV0Q EoHEzLXcLCspfy26soVmFpboEJ6H300iwwpcgs8zMXnj2wswASOKDWnWqaETQYqosxdZvvMza9HR D7nb2WYUHKTfW0nhL.lfkg8Bl2HsWqyWuWZ3l66jzHSz.MLcgyuyfOhfatNt7k8lgjKvBLURM0uQ aWpo72FdtyH7gxP0CubCBhzB7J_0THAY9g8SIGmGjXqqoEp5UR.0vPrMvnWiJSKqUuBMjyR3zIip RFHqiEoTgDah0DmaMzVbpYpgfKy3Dh.pJBHW3PDdtKN_SbWMJRJkVDQKzT2Xi76umvR0oqANjYRR kEX3Oo2hTXSKNgN8R5B6Y2ms3WMrkDHYI_OxteRHxumukOPHYM0mMqLFkcSexFyxWo8acX1j_BxD 7zwRrgGyVAYz0vvobEWA1GZjzsEeJUpJiR6Km7sxu81rWXeKv2QpLgrQUFm7fQ57qDKy45wQ5L9R yvsB8EEvAlEqXMjuhp7HUpYo8jhQ9Qq28po8DDN7XWNYuV_EvtWRPe5p1eMIlMwGOjCKE53Finp1 Ug5lyfCVVfOp.ZvkI4FPTIeoPuuxTBlB.eJCIe_l07lInkT1heGsZMHyAn9z2gBUG6PKtvH9HwNt 4yYsY0FAl.PV7MG8r8LprnZHLkxE3vYEPfQVE9jeg6g.AS7SE5YiRtGz8KgQjs7tzKoiEoIScFgA V5OHf_Vd5U6A3J11YilVIKw4SdFOYo7QXiop3lwqWM6mXeLbHMdtdcOKo6T8C5hlOHyX4exDXL58 mY5nUcxNw7ccNFtE0JZFtx4h9Pwt1V0LrGXNfk2m5Cr794m8dwx3Sbj2Cg9jHoIndo7OHd.UKSHM 3aD5wzklA_gtVF8m3Y3_.GVAPnp_hq8N0dKVT1FwhUvbxQYciiSP61xL4JdwEk149U2Y5bYi.F4O gsyanQmAikdxO.ZpVkt5OuKrskXUnBU8mRFMXxDe6le85MZkt2rns2a9YrDqPpKJlPpik_e2nyC0 fY_I9b9y5MaMZhuryAsPBspskfzgTRnc5XwjLoqN6LEJOvsyihdKjMzIYI4y2huGOUQbILmjpYke 3zMS9UcoVDYre9ekn.jE1PMM_WTGMYOpwn2z2nbNZKcak6PZqDmMCxiBM7Vk2QSwHxcbKCR7NrBc 3LUhfIpG0CZh5KO4FcSl53h4idIJFPJavWnh9Kk8kwLqAMaB9vr1hNv3nSTqERME1n2QuroUxHdj KaWrTJcIxWe_eW6a3htM99oWEdTygqCvTqBHCxDbc.wguVd3TZ6_kjFHZNjys9fM8dWeZbNMJcyW 75fD0ZLCfJqpM1kaP4KOPtJmaCKR0fxRes0o_qQnF2LVy9B3GQPf24geywP3wRlHHFyvDYwIw99w 3wEloZHhifo0YX5X..kI45QsgO03cgQe.jAXG3zM15RAarpgMBVL_HqFkx4M0_yviHtUc X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic309.consmr.mail.ne1.yahoo.com with HTTP; Thu, 13 May 2021 20:28:10 +0000 Received: by kubenode562.mail-prod1.omega.gq1.yahoo.com (VZM Hermes SMTP Server) with ESMTPA ID 6937fff4db5c11c6fac9189ee4f4cbb7; Thu, 13 May 2021 20:28:09 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH v26 18/25] LSM: security_secid_to_secctx in netlink netfilter Date: Thu, 13 May 2021 13:08:00 -0700 Message-Id: <20210513200807.15910-19-casey@schaufler-ca.com> In-Reply-To: <20210513200807.15910-1-casey@schaufler-ca.com> References: <20210513200807.15910-1-casey@schaufler-ca.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-loop: linux-audit@redhat.com Cc: john.johansen@canonical.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com, netfilter-devel@vger.kernel.org, sds@tycho.nsa.gov, Pablo Neira Ayuso X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Change netlink netfilter interfaces to use lsmcontext pointers, and remove scaffolding. Reviewed-by: Kees Cook Reviewed-by: John Johansen Acked-by: Stephen Smalley Acked-by: Pablo Neira Ayuso Signed-off-by: Casey Schaufler Cc: netdev@vger.kernel.org Cc: netfilter-devel@vger.kernel.org --- net/netfilter/nfnetlink_queue.c | 37 +++++++++++++-------------------- 1 file changed, 14 insertions(+), 23 deletions(-) diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index 719ec0f0f2ab..bf8db099090b 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -301,15 +301,13 @@ static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) return -1; } -static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata) +static void nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsmcontext *context) { - u32 seclen = 0; #if IS_ENABLED(CONFIG_NETWORK_SECMARK) struct lsmblob blob; - struct lsmcontext context = { }; if (!skb || !sk_fullsock(skb->sk)) - return 0; + return; read_lock_bh(&skb->sk->sk_callback_lock); @@ -318,14 +316,12 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata) * blob. security_secid_to_secctx() will know which security * module to use to create the secctx. */ lsmblob_init(&blob, skb->secmark); - security_secid_to_secctx(&blob, &context); - *secdata = context.context; + security_secid_to_secctx(&blob, context); } read_unlock_bh(&skb->sk->sk_callback_lock); - seclen = context.len; #endif - return seclen; + return; } static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry) @@ -397,12 +393,10 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, struct net_device *indev; struct net_device *outdev; struct nf_conn *ct = NULL; + struct lsmcontext context = { }; enum ip_conntrack_info ctinfo; struct nfnl_ct_hook *nfnl_ct; bool csum_verify; - struct lsmcontext scaff; /* scaffolding */ - char *secdata = NULL; - u32 seclen = 0; size = nlmsg_total_size(sizeof(struct nfgenmsg)) + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr)) @@ -470,9 +464,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, } if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) { - seclen = nfqnl_get_sk_secctx(entskb, &secdata); - if (seclen) - size += nla_total_size(seclen); + nfqnl_get_sk_secctx(entskb, &context); + if (context.len) + size += nla_total_size(context.len); } skb = alloc_skb(size, GFP_ATOMIC); @@ -602,7 +596,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, nfqnl_put_sk_uidgid(skb, entskb->sk) < 0) goto nla_put_failure; - if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata)) + if (context.len && + nla_put(skb, NFQA_SECCTX, context.len, context.context)) goto nla_put_failure; if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0) @@ -630,10 +625,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, } nlh->nlmsg_len = skb->len; - if (seclen) { - lsmcontext_init(&scaff, secdata, seclen, 0); - security_release_secctx(&scaff); - } + if (context.len) + security_release_secctx(&context); return skb; nla_put_failure: @@ -641,10 +634,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, kfree_skb(skb); net_err_ratelimited("nf_queue: error creating packet message\n"); nlmsg_failure: - if (seclen) { - lsmcontext_init(&scaff, secdata, seclen, 0); - security_release_secctx(&scaff); - } + if (context.len) + security_release_secctx(&context); return NULL; } -- 2.29.2 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit