Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9faf65fb6ee2b4e08325ba2d69e5ccf0c46453d0
Commit:     9faf65fb6ee2b4e08325ba2d69e5ccf0c46453d0
Parent:     ed0321895182ffb6ecf210e066d87911b270d587
Author:     Paul Moore <[EMAIL PROTECTED]>
AuthorDate: Fri Jun 29 11:48:16 2007 -0400
Committer:  James Morris <[EMAIL PROTECTED]>
CommitDate: Wed Jul 11 22:52:31 2007 -0400

    SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabel
    
    These changes will make NetLabel behave like labeled IPsec where there is an
    access check for both labeled and unlabeled packets as well as providing the
    ability to restrict domains to receiving only labeled packets when NetLabel
    is in use.  The changes to the policy are straight forward with the
    following necessary to receive labeled traffic (with SECINITSID_NETMSG
    defined as "netlabel_peer_t"):
    
     allow mydom_t netlabel_peer_t:{ tcp_socket udp_socket rawip_socket } 
recvfrom;
    
    The policy for unlabeled traffic would be:
    
     allow mydom_t unlabeled_t:{ tcp_socket udp_socket rawip_socket } recvfrom;
    
    These policy changes, as well as more general NetLabel support, are included
    in the SELinux Reference Policy SVN tree, r2352 or later.  Users who enable
    NetLabel support in the kernel are strongly encouraged to upgrade their
    policy to avoid network problems.
    
    Signed-off-by: Paul Moore <[EMAIL PROTECTED]>
    Signed-off-by: James Morris <[EMAIL PROTECTED]>
---
 security/selinux/hooks.c    |   21 +++++++++++----------
 security/selinux/netlabel.c |   34 +++++++++++++---------------------
 2 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 78c3f98..aff8f46 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3129,17 +3129,19 @@ static int selinux_parse_skb(struct sk_buff *skb, 
struct avc_audit_data *ad,
 /**
  * selinux_skb_extlbl_sid - Determine the external label of a packet
  * @skb: the packet
- * @base_sid: the SELinux SID to use as a context for MLS only external labels
  * @sid: the packet's SID
  *
  * Description:
  * Check the various different forms of external packet labeling and determine
- * the external SID for the packet.
+ * the external SID for the packet.  If only one form of external labeling is
+ * present then it is used, if both labeled IPsec and NetLabel labels are
+ * present then the SELinux type information is taken from the labeled IPsec
+ * SA and the MLS sensitivity label information is taken from the NetLabel
+ * security attributes.  This bit of "magic" is done in the call to
+ * selinux_netlbl_skbuff_getsid().
  *
  */
-static void selinux_skb_extlbl_sid(struct sk_buff *skb,
-                                  u32 base_sid,
-                                  u32 *sid)
+static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
 {
        u32 xfrm_sid;
        u32 nlbl_sid;
@@ -3147,10 +3149,9 @@ static void selinux_skb_extlbl_sid(struct sk_buff *skb,
        selinux_skb_xfrm_sid(skb, &xfrm_sid);
        if (selinux_netlbl_skbuff_getsid(skb,
                                         (xfrm_sid == SECSID_NULL ?
-                                         base_sid : xfrm_sid),
+                                         SECINITSID_NETMSG : xfrm_sid),
                                         &nlbl_sid) != 0)
                nlbl_sid = SECSID_NULL;
-
        *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
 }
 
@@ -3695,7 +3696,7 @@ static int selinux_socket_getpeersec_dgram(struct socket 
*sock, struct sk_buff *
        if (sock && sock->sk->sk_family == PF_UNIX)
                selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
        else if (skb)
-               selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
+               selinux_skb_extlbl_sid(skb, &peer_secid);
 
        if (peer_secid == SECSID_NULL)
                err = -EINVAL;
@@ -3756,7 +3757,7 @@ static int selinux_inet_conn_request(struct sock *sk, 
struct sk_buff *skb,
        u32 newsid;
        u32 peersid;
 
-       selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
+       selinux_skb_extlbl_sid(skb, &peersid);
        if (peersid == SECSID_NULL) {
                req->secid = sksec->sid;
                req->peer_secid = SECSID_NULL;
@@ -3794,7 +3795,7 @@ static void selinux_inet_conn_established(struct sock *sk,
 {
        struct sk_security_struct *sksec = sk->sk_security;
 
-       selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
+       selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
 }
 
 static void selinux_req_classify_flow(const struct request_sock *req,
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index e64eca2..8192e8b 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -158,9 +158,7 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 
base_sid, u32 *sid)
        netlbl_secattr_init(&secattr);
        rc = netlbl_skbuff_getattr(skb, &secattr);
        if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
-               rc = security_netlbl_secattr_to_sid(&secattr,
-                                                   base_sid,
-                                                   sid);
+               rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
        else
                *sid = SECSID_NULL;
        netlbl_secattr_destroy(&secattr);
@@ -198,7 +196,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct 
socket *sock)
        if (netlbl_sock_getattr(sk, &secattr) == 0 &&
            secattr.flags != NETLBL_SECATTR_NONE &&
            security_netlbl_secattr_to_sid(&secattr,
-                                          SECINITSID_UNLABELED,
+                                          SECINITSID_NETMSG,
                                           &nlbl_peer_sid) == 0)
                sksec->peer_sid = nlbl_peer_sid;
        netlbl_secattr_destroy(&secattr);
@@ -295,38 +293,32 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct 
*sksec,
                                struct avc_audit_data *ad)
 {
        int rc;
-       u32 netlbl_sid;
-       u32 recv_perm;
+       u32 nlbl_sid;
+       u32 perm;
 
-       rc = selinux_netlbl_skbuff_getsid(skb,
-                                         SECINITSID_UNLABELED,
-                                         &netlbl_sid);
+       rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &nlbl_sid);
        if (rc != 0)
                return rc;
-
-       if (netlbl_sid == SECSID_NULL)
-               return 0;
+       if (nlbl_sid == SECSID_NULL)
+               nlbl_sid = SECINITSID_UNLABELED;
 
        switch (sksec->sclass) {
        case SECCLASS_UDP_SOCKET:
-               recv_perm = UDP_SOCKET__RECVFROM;
+               perm = UDP_SOCKET__RECVFROM;
                break;
        case SECCLASS_TCP_SOCKET:
-               recv_perm = TCP_SOCKET__RECVFROM;
+               perm = TCP_SOCKET__RECVFROM;
                break;
        default:
-               recv_perm = RAWIP_SOCKET__RECVFROM;
+               perm = RAWIP_SOCKET__RECVFROM;
        }
 
-       rc = avc_has_perm(sksec->sid,
-                         netlbl_sid,
-                         sksec->sclass,
-                         recv_perm,
-                         ad);
+       rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
        if (rc == 0)
                return 0;
 
-       netlbl_skbuff_err(skb, rc);
+       if (nlbl_sid != SECINITSID_UNLABELED)
+               netlbl_skbuff_err(skb, rc);
        return rc;
 }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to