* [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN
@ 2018-11-28 18:44 Paul Moore
2018-11-28 18:47 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2018-11-28 18:44 UTC (permalink / raw)
To: selinux; +Cc: netdev, Jiri Pirko
Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
added new RTM_* definitions without properly updating SELinux, this
patch adds the necessary SELinux support.
While there was a BUILD_BUG_ON() in the SELinux code to protect from
exactly this case, it was bypassed in the broken commit. In order to
hopefully prevent this from happening in the future, add additional
comments which provide some instructions on how to resolve the
BUILD_BUG_ON() failures.
Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
Cc: <stable@vger.kernel.org> # 4.19
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/selinux/nlmsgtab.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 74b951f55608..9cec81209617 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
{ RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
{ RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
{ RTM_NEWCACHEREPORT, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_NEWCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+ { RTM_DELCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+ { RTM_GETCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
};
static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
@@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
switch (sclass) {
case SECCLASS_NETLINK_ROUTE_SOCKET:
- /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
+ /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
+ * If the BUILD_BUG_ON() below fails you must update the
+ * structures at the top of this file with the new mappings
+ * before updating the BUILD_BUG_ON() macro!
+ */
BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
sizeof(nlmsg_route_perms));
@@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
break;
case SECCLASS_NETLINK_XFRM_SOCKET:
+ /* If the BUILD_BUG_ON() below fails you must update the
+ * structures at the top of this file with the new mappings
+ * before updating the BUILD_BUG_ON() macro!
+ */
BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
sizeof(nlmsg_xfrm_perms));
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN
2018-11-28 18:44 [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN Paul Moore
@ 2018-11-28 18:47 ` Paul Moore
2018-11-28 19:34 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2018-11-28 18:47 UTC (permalink / raw)
To: selinux; +Cc: netdev, jiri
On Wed, Nov 28, 2018 at 1:44 PM Paul Moore <paul@paul-moore.com> wrote:
> Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> added new RTM_* definitions without properly updating SELinux, this
> patch adds the necessary SELinux support.
>
> While there was a BUILD_BUG_ON() in the SELinux code to protect from
> exactly this case, it was bypassed in the broken commit. In order to
> hopefully prevent this from happening in the future, add additional
> comments which provide some instructions on how to resolve the
> BUILD_BUG_ON() failures.
>
> Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> Cc: <stable@vger.kernel.org> # 4.19
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
> security/selinux/nlmsgtab.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
I'm building a test kernel right now, assuming all goes well I'm going
to send this up to Linus for v4.20.
> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 74b951f55608..9cec81209617 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
> { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_NEWCACHEREPORT, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> + { RTM_NEWCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> + { RTM_DELCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> + { RTM_GETCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> };
>
> static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
> @@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>
> switch (sclass) {
> case SECCLASS_NETLINK_ROUTE_SOCKET:
> - /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
> + /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
> + * If the BUILD_BUG_ON() below fails you must update the
> + * structures at the top of this file with the new mappings
> + * before updating the BUILD_BUG_ON() macro!
> + */
> BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
> err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
> sizeof(nlmsg_route_perms));
> @@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
> break;
>
> case SECCLASS_NETLINK_XFRM_SOCKET:
> + /* If the BUILD_BUG_ON() below fails you must update the
> + * structures at the top of this file with the new mappings
> + * before updating the BUILD_BUG_ON() macro!
> + */
> BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
> err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
> sizeof(nlmsg_xfrm_perms));
>
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN
2018-11-28 18:47 ` Paul Moore
@ 2018-11-28 19:34 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2018-11-28 19:34 UTC (permalink / raw)
To: paul; +Cc: selinux, netdev, jiri
From: Paul Moore <paul@paul-moore.com>
Date: Wed, 28 Nov 2018 13:47:25 -0500
> On Wed, Nov 28, 2018 at 1:44 PM Paul Moore <paul@paul-moore.com> wrote:
>> Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
>> added new RTM_* definitions without properly updating SELinux, this
>> patch adds the necessary SELinux support.
>>
>> While there was a BUILD_BUG_ON() in the SELinux code to protect from
>> exactly this case, it was bypassed in the broken commit. In order to
>> hopefully prevent this from happening in the future, add additional
>> comments which provide some instructions on how to resolve the
>> BUILD_BUG_ON() failures.
>>
>> Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
>> Cc: <stable@vger.kernel.org> # 4.19
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>> security/selinux/nlmsgtab.c | 13 ++++++++++++-
>> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> I'm building a test kernel right now, assuming all goes well I'm going
> to send this up to Linus for v4.20.
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-11-29 6:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-11-28 18:44 [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN Paul Moore
2018-11-28 18:47 ` Paul Moore
2018-11-28 19:34 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).