MPTCP Linux Development
 help / color / mirror / Atom feed
* [PATCH v3 mptcp-next 00/15] mptcp: refactor first subflow init
@ 2023-01-26 21:05 Paolo Abeni
  2023-01-26 21:05 ` [PATCH v3 mptcp-next 01/15] mptcp: use mptcp_schedule_work() instead of open-codying it Paolo Abeni
                   ` (15 more replies)
  0 siblings, 16 replies; 27+ messages in thread
From: Paolo Abeni @ 2023-01-26 21:05 UTC (permalink / raw)
  To: mptcp

This is the needed refactor for the selinux fixes, as discussed on
the ML.

Compared to v2 this revision introduces 2 additional patches:
1/15, just another cleanup found while addressing the recent bugs
12/15 factoring out a __inet_listener() helper, as suggested by Mat.

The only other patches with some change is 9/15, adding more
comments and consistently reporting the newly introduced error code
(a bit different from what discussed on the ML, for consistency's sake).

Paolo Abeni (15):
  mptcp: use mptcp_schedule_work() instead of open-codying it
  mptcp: fix locking for setsockopt corner-case
  mptcp: fix locking for in-kernel listener creation.
  mptcp: refactor passive socket initialization.
  mptcp: drop unneeded argument
  mptcp: drop legacy code.
  mptcp: avoid unneeded __mptcp_nmpc_socket() usage
  mptcp: move fastopen subflow check inside mptcp_sendmsg_fastopen()
  mptcp: move first subflow allocation at mpc access time
  mptcp: do not keep around the first subflow after disconnect.
  mptcp: fastclose msk when cleaning unaccepted sockets
  inet: factor out locked section of inet_accept() in a new helper
  mptcp: refactor mptcp_stream_accept()
  security, lsm: Introduce security_mptcp_add_subflow()
  selinux: Implement mptcp_add_subflow hook

 include/linux/lsm_hook_defs.h |   1 +
 include/linux/lsm_hooks.h     |   9 ++
 include/linux/security.h      |   6 ++
 include/net/inet_common.h     |   2 +
 net/ipv4/af_inet.c            |  32 +++----
 net/mptcp/options.c           |   9 +-
 net/mptcp/pm.c                |   4 +-
 net/mptcp/pm_netlink.c        |  14 +--
 net/mptcp/protocol.c          | 158 +++++++++++++++++-----------------
 net/mptcp/protocol.h          |   4 +-
 net/mptcp/sockopt.c           |  31 ++++---
 net/mptcp/subflow.c           |  57 +++++++-----
 security/security.c           |   5 ++
 security/selinux/hooks.c      |  16 ++++
 security/selinux/netlabel.c   |   8 +-
 15 files changed, 215 insertions(+), 141 deletions(-)

-- 
2.39.1


^ permalink raw reply	[flat|nested] 27+ messages in thread
* [PATCH mptcp-next v2 13/13] selinux: Implement mptcp_add_subflow hook
@ 2023-01-17  7:36 Paolo Abeni
  2023-01-17  9:09 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
  0 siblings, 1 reply; 27+ messages in thread
From: Paolo Abeni @ 2023-01-17  7:36 UTC (permalink / raw)
  To: mptcp

Newly added subflows should inherit the LSM label from the associated
msk socket regarless current context.

This patch implements the above copying sid and class from the msk
context, deleting the existing subflow label, if any, and then
re-creating a new one.

The new helper reuses the selinux_netlbl_sk_security_free() function,
and the latter can end-up being called multiple times with the same
argument; we additionally need to make it idempotent.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
v1 -> v2:
 - cleanup selinux_netlbl_sk_security_free() (Paul)
 - inherit label from msk (Paul)

v1 -> v2:
 - fix build issue with !CONFIG_NETLABEL
---
 security/selinux/hooks.c    | 16 ++++++++++++++++
 security/selinux/netlabel.c |  8 ++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3c5be76a9199..1e0ca10a6c02 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5476,6 +5476,21 @@ static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk
 	selinux_netlbl_sctp_sk_clone(sk, newsk);
 }
 
+static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
+{
+	struct sk_security_struct *ssksec = ssk->sk_security;
+	struct sk_security_struct *sksec = sk->sk_security;
+
+	ssksec->sclass = sksec->sclass;
+	ssksec->sid = sksec->sid;
+
+	/* replace the existing subflow label deleting the existing one
+	 * and re-recrating a new label using the current context
+	 */
+	selinux_netlbl_sk_security_free(ssksec);
+	return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
+}
+
 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
 				     struct request_sock *req)
 {
@@ -7216,6 +7231,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
 	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
+	LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 1321f15799e2..33187e38def7 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -155,8 +155,12 @@ void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
  */
 void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
 {
-	if (sksec->nlbl_secattr != NULL)
-		netlbl_secattr_free(sksec->nlbl_secattr);
+	if (!sksec->nlbl_secattr)
+		return;
+
+	netlbl_secattr_free(sksec->nlbl_secattr);
+	sksec->nlbl_secattr = NULL;
+	sksec->nlbl_state = NLBL_UNSET;
 }
 
 /**
-- 
2.39.0


^ permalink raw reply related	[flat|nested] 27+ messages in thread
* [PATCH v2 2/2] selinux: Implement mptcp_add_subflow hook
@ 2022-12-19 17:33 Paolo Abeni
  2022-12-19 19:10 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
  2022-12-19 21:55 ` MPTCP CI
  0 siblings, 2 replies; 27+ messages in thread
From: Paolo Abeni @ 2022-12-19 17:33 UTC (permalink / raw)
  To: linux-security-module; +Cc: Paul Moore, selinux, mptcp

Newly added subflows should inherit the associated label
from the current process context, regarless of the sk_kern_sock
flag value.

This patch implements the above resetting the subflow sid, deleting
the existing subflow label, if any, and then re-creating a new one.

The new helper reuses the selinux_netlbl_sk_security_free() function,
and it can end-up being called multiple times with the same argument;
we additionally need to make it idempotent.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
v1 -> v2:
 - fix build issue with !CONFIG_NETLABEL
---
 security/selinux/hooks.c    | 27 +++++++++++++++++++++++++++
 security/selinux/netlabel.c |  4 +++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3c5be76a9199..f785600b666a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5476,6 +5476,32 @@ static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk
 	selinux_netlbl_sctp_sk_clone(sk, newsk);
 }
 
+static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
+{
+	const struct task_security_struct *tsec = selinux_cred(current_cred());
+	struct sk_security_struct *ssksec = ssk->sk_security;
+	u16 sclass;
+	u32 sid;
+	int err;
+
+	/* create the sid using the current cred, regardless of the ssk kern
+	 * flag
+	 */
+	sclass = socket_type_to_security_class(ssk->sk_family, ssk->sk_type,
+					       ssk->sk_protocol);
+	err = socket_sockcreate_sid(tsec, sclass, &sid);
+	if (err)
+		return err;
+
+	ssksec->sid = sid;
+
+	/* replace the existing subflow label deleting the existing one
+	 * and re-recrating a new label using the current context
+	 */
+	selinux_netlbl_sk_security_free(ssksec);
+	return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
+}
+
 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
 				     struct request_sock *req)
 {
@@ -7216,6 +7242,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
 	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
+	LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 1321f15799e2..8e0080b8a8ef 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -155,8 +155,10 @@ void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
  */
 void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
 {
-	if (sksec->nlbl_secattr != NULL)
+	if (sksec->nlbl_secattr != NULL) {
 		netlbl_secattr_free(sksec->nlbl_secattr);
+		sksec->nlbl_secattr = NULL;
+	}
 }
 
 /**
-- 
2.38.1


^ permalink raw reply related	[flat|nested] 27+ messages in thread
* [PATCH 2/2] selinux: Implement mptcp_add_subflow hook
@ 2022-12-14 22:01 Paolo Abeni
  2022-12-14 23:27 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
  0 siblings, 1 reply; 27+ messages in thread
From: Paolo Abeni @ 2022-12-14 22:01 UTC (permalink / raw)
  To: linux-security-module; +Cc: Paul Moore, selinux, mptcp

Newly added subflows should inherit the associated label
from the current process context, regarless of the sk_kern_sock
flag value.

This patch implements the above resetting the subflow sid, deleting
the existing subflow label, if any, and then re-creating a new one.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
 security/selinux/hooks.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3c5be76a9199..cbb4c711c502 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5476,6 +5476,35 @@ static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk
 	selinux_netlbl_sctp_sk_clone(sk, newsk);
 }
 
+static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
+{
+	const struct task_security_struct *tsec = selinux_cred(current_cred());
+	struct sk_security_struct *ssksec = ssk->sk_security;
+	u16 sclass;
+	u32 sid;
+	int err;
+
+	/* create the sid using the current cred, regardless of the ssk kern
+	 * flag
+	 */
+	sclass = socket_type_to_security_class(ssk->sk_family, ssk->sk_type,
+					       ssk->sk_protocol);
+	err = socket_sockcreate_sid(tsec, sclass, &sid);
+	if (err)
+		return err;
+
+	ssksec->sid = sid;
+
+	/* replace the existing subflow label with the new one
+	 * inherited from the mptcp socket
+	 */
+	if (ssksec->nlbl_secattr != NULL) {
+		netlbl_secattr_free(ssksec->nlbl_secattr);
+		ssksec->nlbl_secattr = NULL;
+	}
+	return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
+}
+
 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
 				     struct request_sock *req)
 {
@@ -7216,6 +7245,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
 	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
+	LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
-- 
2.38.1


^ permalink raw reply related	[flat|nested] 27+ messages in thread
end of thread, other threads:[~2023-01-30 11:27 UTC | newest]

Thread overview: 27+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-26 21:05 [PATCH v3 mptcp-next 00/15] mptcp: refactor first subflow init Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 01/15] mptcp: use mptcp_schedule_work() instead of open-codying it Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 02/15] mptcp: fix locking for setsockopt corner-case Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 03/15] mptcp: fix locking for in-kernel listener creation Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 04/15] mptcp: refactor passive socket initialization Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 05/15] mptcp: drop unneeded argument Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 06/15] mptcp: drop legacy code Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 07/15] mptcp: avoid unneeded __mptcp_nmpc_socket() usage Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 08/15] mptcp: move fastopen subflow check inside mptcp_sendmsg_fastopen() Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 09/15] mptcp: move first subflow allocation at mpc access time Paolo Abeni
2023-01-27 14:04   ` Matthieu Baerts
2023-01-26 21:05 ` [PATCH v3 mptcp-next 10/15] mptcp: do not keep around the first subflow after disconnect Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 11/15] mptcp: fastclose msk when cleaning unaccepted sockets Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 12/15] inet: factor out locked section of inet_accept() in a new helper Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 13/15] mptcp: refactor mptcp_stream_accept() Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 14/15] security, lsm: Introduce security_mptcp_add_subflow() Paolo Abeni
2023-01-26 21:05 ` [PATCH v3 mptcp-next 15/15] selinux: Implement mptcp_add_subflow hook Paolo Abeni
2023-01-26 22:24   ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
2023-01-27 16:16   ` MPTCP CI
2023-01-27 16:27     ` Matthieu Baerts
2023-01-27 14:04 ` [PATCH v3 mptcp-next 00/15] mptcp: refactor first subflow init Matthieu Baerts
2023-01-30 11:27   ` Matthieu Baerts
  -- strict thread matches above, loose matches on Subject: below --
2023-01-17  7:36 [PATCH mptcp-next v2 13/13] selinux: Implement mptcp_add_subflow hook Paolo Abeni
2023-01-17  9:09 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
2023-01-17 15:17   ` Paolo Abeni
2022-12-19 17:33 [PATCH v2 2/2] selinux: Implement mptcp_add_subflow hook Paolo Abeni
2022-12-19 19:10 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI
2022-12-19 21:55 ` MPTCP CI
2022-12-14 22:01 [PATCH 2/2] selinux: Implement mptcp_add_subflow hook Paolo Abeni
2022-12-14 23:27 ` selinux: Implement mptcp_add_subflow hook: Tests Results MPTCP CI

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox