[net-next-2.6.git] / security / selinux / netlabel.c

/*
 * SELinux NetLabel Support
 *
 * This file provides the necessary glue to tie NetLabel into the SELinux
 * subsystem.
 *
 * Author: Paul Moore <paul.moore@hp.com>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
 *
 * This program is free software;  you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program;  if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */

#include <linux/spinlock.h>
#include <linux/rcupdate.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/sock.h>
#include <net/netlabel.h>
#include <net/ip.h>
#include <net/ipv6.h>

#include "objsec.h"
#include "security.h"
#include "netlabel.h"

/**
 * selinux_netlbl_sidlookup_cached - Cache a SID lookup
 * @skb: the packet
 * @secattr: the NetLabel security attributes
 * @sid: the SID
 *
 * Description:
 * Query the SELinux security server to lookup the correct SID for the given
 * security attributes.  If the query is successful, cache the result to speed
 * up future lookups.  Returns zero on success, negative values on failure.
 *
 */
static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
					   struct netlbl_lsm_secattr *secattr,
					   u32 *sid)
{
	int rc;

	rc = security_netlbl_secattr_to_sid(secattr, sid);
	if (rc == 0 &&
	    (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	    (secattr->flags & NETLBL_SECATTR_CACHE))
		netlbl_cache_add(skb, secattr);

	return rc;
}

/**
 * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
 * @sk: the socket
 *
 * Description:
 * Generate the NetLabel security attributes for a socket, making full use of
 * the socket's attribute cache.  Returns a pointer to the security attributes
 * on success, NULL on failure.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_secattr != NULL)
		return sksec->nlbl_secattr;

	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	if (secattr == NULL)
		return NULL;
	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
	if (rc != 0) {
		netlbl_secattr_free(secattr);
		return NULL;
	}
	sksec->nlbl_secattr = secattr;

	return secattr;
}

/**
 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
 *
 * Description:
 * Invalidate the NetLabel security attribute mapping cache.
 *
 */
void selinux_netlbl_cache_invalidate(void)
{
	netlbl_cache_invalidate();
}

/**
 * selinux_netlbl_err - Handle a NetLabel packet error
 * @skb: the packet
 * @error: the error code
 * @gateway: true if host is acting as a gateway, false otherwise
 *
 * Description:
 * When a packet is dropped due to a call to avc_has_perm() pass the error
 * code to the NetLabel subsystem so any protocol specific processing can be
 * done.  This is safe to call even if you are unsure if NetLabel labeling is
 * present on the packet, NetLabel is smart enough to only act when it should.
 *
 */
void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway)
{
	netlbl_skbuff_err(skb, error, gateway);
}

/**
 * selinux_netlbl_sk_security_free - Free the NetLabel fields
 * @sksec: the sk_security_struct
 *
 * Description:
 * Free all of the memory in the NetLabel fields of a sk_security_struct.
 *
 */
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
{
	if (sksec->nlbl_secattr != NULL)
		netlbl_secattr_free(sksec->nlbl_secattr);
}

/**
 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
 * @sksec: the sk_security_struct
 * @family: the socket family
 *
 * Description:
 * Called when the NetLabel state of a sk_security_struct needs to be reset.
 * The caller is responsibile for all the NetLabel sk_security_struct locking.
 *
 */
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
{
	sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
 * @skb: the packet
 * @family: protocol family
 * @type: NetLabel labeling protocol type
 * @sid: the SID
 *
 * Description:
 * Call the NetLabel mechanism to get the security attributes of the given
 * packet and use those attributes to determine the correct context/SID to
 * assign to the packet.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
				 u16 family,
				 u32 *type,
				 u32 *sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled()) {
		*sid = SECSID_NULL;
		return 0;
	}

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, &secattr, sid);
	else
		*sid = SECSID_NULL;
	*type = secattr.type;
	netlbl_secattr_destroy(&secattr);

	return rc;
}

/**
 * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
 * @skb: the packet
 * @family: protocol family
 * @sid: the SID
 *
 * Description
 * Call the NetLabel mechanism to set the label of a packet using @sid.
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
				 u16 family,
				 u32 sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr_storage;
	struct netlbl_lsm_secattr *secattr = NULL;
	struct sock *sk;

	/* if this is a locally generated packet check to see if it is already
	 * being labeled by it's parent socket, if it is just exit */
	sk = skb->sk;
	if (sk != NULL) {
		struct sk_security_struct *sksec = sk->sk_security;
		if (sksec->nlbl_state != NLBL_REQSKB)
			return 0;
		secattr = sksec->nlbl_secattr;
	}
	if (secattr == NULL) {
		secattr = &secattr_storage;
		netlbl_secattr_init(secattr);
		rc = security_netlbl_sid_to_secattr(sid, secattr);
		if (rc != 0)
			goto skbuff_setsid_return;
	}

	rc = netlbl_skbuff_setattr(skb, family, secattr);

skbuff_setsid_return:
	if (secattr == &secattr_storage)
		netlbl_secattr_destroy(secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_conn_request - Label an incoming stream connection
 * @req: incoming connection request socket
 *
 * Description:
 * A new incoming connection request is represented by @req, we need to label
 * the new request_sock here and the stack will ensure the on-the-wire label
 * will get preserved when a full sock is created once the connection handshake
 * is complete.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (family != PF_INET)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
	if (rc != 0)
		goto inet_conn_request_return;
	rc = netlbl_req_setattr(req, &secattr);
inet_conn_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
 * @sk: the new sock
 *
 * Description:
 * A new connection has been established using @sk, we've already labeled the
 * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
 * we need to set the NetLabel state here since we now have a sock structure.
 *
 */
void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (family == PF_INET)
		sksec->nlbl_state = NLBL_LABELED;
	else
		sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
 * @sock: the socket to label
 * @family: protocol family
 *
 * Description:
 * Attempt to label a socket using the NetLabel mechanism using the given
 * SID.  Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (family != PF_INET)
		return 0;

	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL)
		return -ENOMEM;
	rc = netlbl_sock_setattr(sk, family, secattr);
	switch (rc) {
	case 0:
		sksec->nlbl_state = NLBL_LABELED;
		break;
	case -EDESTADDRREQ:
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		break;
	}

	return rc;
}

/**
 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
 * @sksec: the sock's sk_security_struct
 * @skb: the packet
 * @family: protocol family
 * @ad: the audit data
 *
 * Description:
 * Fetch the NetLabel security attributes from @skb and perform an access check
 * against the receiving socket.  Returns zero on success, negative values on
 * error.
 *
 */
int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
				struct sk_buff *skb,
				u16 family,
				struct common_audit_data *ad)
{
	int rc;
	u32 nlbl_sid;
	u32 perm;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled())
		return 0;

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, &secattr, &nlbl_sid);
	else
		nlbl_sid = SECINITSID_UNLABELED;
	netlbl_secattr_destroy(&secattr);
	if (rc != 0)
		return rc;

	switch (sksec->sclass) {
	case SECCLASS_UDP_SOCKET:
		perm = UDP_SOCKET__RECVFROM;
		break;
	case SECCLASS_TCP_SOCKET:
		perm = TCP_SOCKET__RECVFROM;
		break;
	default:
		perm = RAWIP_SOCKET__RECVFROM;
	}

	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
	if (rc == 0)
		return 0;

	if (nlbl_sid != SECINITSID_UNLABELED)
		netlbl_skbuff_err(skb, rc, 0);
	return rc;
}

/**
 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
 * @sock: the socket
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Check the setsockopt() call and if the user is trying to replace the IP
 * options on a socket and a NetLabel is in place for the socket deny the
 * access; otherwise allow the access.  Returns zero when the access is
 * allowed, -EACCES when denied, and other negative values on error.
 *
 */
int selinux_netlbl_socket_setsockopt(struct socket *sock,
				     int level,
				     int optname)
{
	int rc = 0;
	struct sock *sk = sock->sk;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr secattr;

	if (level == IPPROTO_IP && optname == IP_OPTIONS &&
	    (sksec->nlbl_state == NLBL_LABELED ||
	     sksec->nlbl_state == NLBL_CONNLABELED)) {
		netlbl_secattr_init(&secattr);
		lock_sock(sk);
		rc = netlbl_sock_getattr(sk, &secattr);
		release_sock(sk);
		if (rc == 0)
			rc = -EACCES;
		else if (rc == -ENOMSG)
			rc = 0;
		netlbl_secattr_destroy(&secattr);
	}

	return rc;
}

/**
 * selinux_netlbl_socket_connect - Label a client-side socket on connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_state != NLBL_REQSKB &&
	    sksec->nlbl_state != NLBL_CONNLABELED)
		return 0;

	local_bh_disable();
	bh_lock_sock_nested(sk);

	/* connected sockets are allowed to disconnect when the address family
	 * is set to AF_UNSPEC, if that is what is happening we want to reset
	 * the socket */
	if (addr->sa_family == AF_UNSPEC) {
		netlbl_sock_delattr(sk);
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		goto socket_connect_return;
	}
	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL) {
		rc = -ENOMEM;
		goto socket_connect_return;
	}
	rc = netlbl_conn_setattr(sk, addr, secattr);
	if (rc == 0)
		sksec->nlbl_state = NLBL_CONNLABELED;

socket_connect_return:
	bh_unlock_sock(sk);
	local_bh_enable();
	return rc;
}
Commit	Line	Data
5778eabd PM	1	/*
	2	* SELinux NetLabel Support
	3	*
	4	* This file provides the necessary glue to tie NetLabel into the SELinux
	5	* subsystem.
	6	*
	7	* Author: Paul Moore <paul.moore@hp.com>
	8	*
	9	*/
	10
	11	/*
948bf85c	12	* (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
5778eabd PM	13	*
	14	* This program is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU General Public License as published by
	16	* the Free Software Foundation; either version 2 of the License, or
	17	* (at your option) any later version.
	18	*
	19	* This program is distributed in the hope that it will be useful,
	20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	22	* the GNU General Public License for more details.
	23	*
	24	* You should have received a copy of the GNU General Public License
	25	* along with this program; if not, write to the Free Software
	26	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	27	*
	28	*/
	29
	30	#include <linux/spinlock.h>
	31	#include <linux/rcupdate.h>
5a0e3ad6	32	#include <linux/gfp.h>
014ab19a PM	33	#include <linux/ip.h>
014ab19a PM	34	#include <linux/ipv6.h>
5778eabd PM	35	#include <net/sock.h>
5778eabd PM	36	#include <net/netlabel.h>
014ab19a PM	37	#include <net/ip.h>
014ab19a PM	38	#include <net/ipv6.h>
5778eabd PM	39
	40	#include "objsec.h"
	41	#include "security.h"
d4ee4231	42	#include "netlabel.h"
5778eabd	43
5dbe1eb0 PM	44	/**
	45	* selinux_netlbl_sidlookup_cached - Cache a SID lookup
	46	* @skb: the packet
	47	* @secattr: the NetLabel security attributes
	48	* @sid: the SID
	49	*
	50	* Description:
	51	* Query the SELinux security server to lookup the correct SID for the given
	52	* security attributes. If the query is successful, cache the result to speed
	53	* up future lookups. Returns zero on success, negative values on failure.
	54	*
	55	*/
	56	static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
	57	struct netlbl_lsm_secattr *secattr,
	58	u32 *sid)
	59	{
	60	int rc;
	61
	62	rc = security_netlbl_secattr_to_sid(secattr, sid);
	63	if (rc == 0 &&
	64	(secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	65	(secattr->flags & NETLBL_SECATTR_CACHE))
	66	netlbl_cache_add(skb, secattr);
	67
	68	return rc;
	69	}
	70
6c5b3fc0 PM	71	/**
	72	* selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
	73	* @sk: the socket
	74	*
	75	* Description:
	76	* Generate the NetLabel security attributes for a socket, making full use of
	77	* the socket's attribute cache. Returns a pointer to the security attributes
	78	* on success, NULL on failure.
	79	*
	80	*/
	81	static struct netlbl_lsm_secattr selinux_netlbl_sock_genattr(struct sock sk)
	82	{
	83	int rc;
	84	struct sk_security_struct *sksec = sk->sk_security;
	85	struct netlbl_lsm_secattr *secattr;
	86
	87	if (sksec->nlbl_secattr != NULL)
	88	return sksec->nlbl_secattr;
	89
	90	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	91	if (secattr == NULL)
	92	return NULL;
	93	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
	94	if (rc != 0) {
	95	netlbl_secattr_free(secattr);
	96	return NULL;
	97	}
	98	sksec->nlbl_secattr = secattr;
	99
	100	return secattr;
	101	}
	102
5778eabd PM	103	/**
	104	* selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
	105	*
	106	* Description:
	107	* Invalidate the NetLabel security attribute mapping cache.
	108	*
	109	*/
	110	void selinux_netlbl_cache_invalidate(void)
	111	{
	112	netlbl_cache_invalidate();
	113	}
	114
dfaebe98 PM	115	/**
	116	* selinux_netlbl_err - Handle a NetLabel packet error
	117	* @skb: the packet
	118	* @error: the error code
	119	* @gateway: true if host is acting as a gateway, false otherwise
	120	*
	121	* Description:
	122	* When a packet is dropped due to a call to avc_has_perm() pass the error
	123	* code to the NetLabel subsystem so any protocol specific processing can be
	124	* done. This is safe to call even if you are unsure if NetLabel labeling is
	125	* present on the packet, NetLabel is smart enough to only act when it should.
	126	*
	127	*/
	128	void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway)
	129	{
	130	netlbl_skbuff_err(skb, error, gateway);
	131	}
	132
6c5b3fc0 PM	133	/**
6c5b3fc0 PM	134	* selinux_netlbl_sk_security_free - Free the NetLabel fields
dd3e7836	135	* @sksec: the sk_security_struct
6c5b3fc0 PM	136	*
	137	* Description:
	138	* Free all of the memory in the NetLabel fields of a sk_security_struct.
	139	*
	140	*/
dd3e7836	141	void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
6c5b3fc0	142	{
dd3e7836 EP	143	if (sksec->nlbl_secattr != NULL)
dd3e7836 EP	144	netlbl_secattr_free(sksec->nlbl_secattr);
6c5b3fc0 PM	145	}
6c5b3fc0 PM	146
5778eabd PM	147	/**
5778eabd PM	148	* selinux_netlbl_sk_security_reset - Reset the NetLabel fields
dd3e7836	149	* @sksec: the sk_security_struct
5778eabd PM	150	* @family: the socket family
	151	*
	152	* Description:
	153	* Called when the NetLabel state of a sk_security_struct needs to be reset.
	154	* The caller is responsibile for all the NetLabel sk_security_struct locking.
	155	*
	156	*/
dd3e7836	157	void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
5778eabd	158	{
dd3e7836	159	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	160	}
5778eabd PM	161
5778eabd PM	162	/**
	163	* selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
	164	* @skb: the packet
75e22910	165	* @family: protocol family
220deb96	166	* @type: NetLabel labeling protocol type
5778eabd PM	167	* @sid: the SID
	168	*
	169	* Description:
	170	* Call the NetLabel mechanism to get the security attributes of the given
	171	* packet and use those attributes to determine the correct context/SID to
	172	* assign to the packet. Returns zero on success, negative values on failure.
	173	*
	174	*/
75e22910 PM	175	int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
75e22910 PM	176	u16 family,
220deb96	177	u32 *type,
75e22910	178	u32 *sid)
5778eabd PM	179	{
	180	int rc;
	181	struct netlbl_lsm_secattr secattr;
	182
23bcdc1a PM	183	if (!netlbl_enabled()) {
	184	*sid = SECSID_NULL;
	185	return 0;
	186	}
	187
5778eabd	188	netlbl_secattr_init(&secattr);
75e22910	189	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0 PM	190	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
	191	rc = selinux_netlbl_sidlookup_cached(skb, &secattr, sid);
	192	else
5778eabd	193	*sid = SECSID_NULL;
220deb96	194	*type = secattr.type;
5778eabd PM	195	netlbl_secattr_destroy(&secattr);
	196
	197	return rc;
	198	}
	199
948bf85c PM	200	/**
	201	* selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
	202	* @skb: the packet
	203	* @family: protocol family
	204	* @sid: the SID
	205	*
	206	* Description
	207	* Call the NetLabel mechanism to set the label of a packet using @sid.
af901ca1	208	* Returns zero on success, negative values on failure.
948bf85c PM	209	*
	210	*/
	211	int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
	212	u16 family,
	213	u32 sid)
	214	{
	215	int rc;
6c5b3fc0 PM	216	struct netlbl_lsm_secattr secattr_storage;
6c5b3fc0 PM	217	struct netlbl_lsm_secattr *secattr = NULL;
948bf85c PM	218	struct sock *sk;
	219
	220	/* if this is a locally generated packet check to see if it is already
	221	* being labeled by it's parent socket, if it is just exit */
	222	sk = skb->sk;
	223	if (sk != NULL) {
	224	struct sk_security_struct *sksec = sk->sk_security;
	225	if (sksec->nlbl_state != NLBL_REQSKB)
	226	return 0;
6c5b3fc0 PM	227	secattr = sksec->nlbl_secattr;
	228	}
	229	if (secattr == NULL) {
	230	secattr = &secattr_storage;
	231	netlbl_secattr_init(secattr);
	232	rc = security_netlbl_sid_to_secattr(sid, secattr);
	233	if (rc != 0)
	234	goto skbuff_setsid_return;
948bf85c PM	235	}
948bf85c PM	236
6c5b3fc0	237	rc = netlbl_skbuff_setattr(skb, family, secattr);
948bf85c PM	238
948bf85c PM	239	skbuff_setsid_return:
6c5b3fc0 PM	240	if (secattr == &secattr_storage)
6c5b3fc0 PM	241	netlbl_secattr_destroy(secattr);
948bf85c PM	242	return rc;
	243	}
	244
5778eabd	245	/**
389fb800 PM	246	* selinux_netlbl_inet_conn_request - Label an incoming stream connection
389fb800 PM	247	* @req: incoming connection request socket
5778eabd PM	248	*
5778eabd PM	249	* Description:
389fb800 PM	250	* A new incoming connection request is represented by @req, we need to label
	251	* the new request_sock here and the stack will ensure the on-the-wire label
	252	* will get preserved when a full sock is created once the connection handshake
	253	* is complete. Returns zero on success, negative values on failure.
5778eabd PM	254	*
5778eabd PM	255	*/
389fb800	256	int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
5778eabd	257	{
014ab19a	258	int rc;
389fb800	259	struct netlbl_lsm_secattr secattr;
014ab19a	260
389fb800 PM	261	if (family != PF_INET)
389fb800 PM	262	return 0;
014ab19a	263
389fb800 PM	264	netlbl_secattr_init(&secattr);
	265	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
	266	if (rc != 0)
	267	goto inet_conn_request_return;
	268	rc = netlbl_req_setattr(req, &secattr);
	269	inet_conn_request_return:
	270	netlbl_secattr_destroy(&secattr);
	271	return rc;
5778eabd PM	272	}
	273
	274	/**
389fb800 PM	275	* selinux_netlbl_inet_csk_clone - Initialize the newly created sock
389fb800 PM	276	* @sk: the new sock
5778eabd PM	277	*
5778eabd PM	278	* Description:
389fb800 PM	279	* A new connection has been established using @sk, we've already labeled the
	280	* socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
	281	* we need to set the NetLabel state here since we now have a sock structure.
5778eabd PM	282	*
5778eabd PM	283	*/
389fb800	284	void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
5778eabd	285	{
389fb800 PM	286	struct sk_security_struct *sksec = sk->sk_security;
	287
	288	if (family == PF_INET)
	289	sksec->nlbl_state = NLBL_LABELED;
	290	else
	291	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	292	}
	293
	294	/**
389fb800 PM	295	* selinux_netlbl_socket_post_create - Label a socket using NetLabel
	296	* @sock: the socket to label
	297	* @family: protocol family
5778eabd PM	298	*
5778eabd PM	299	* Description:
389fb800 PM	300	* Attempt to label a socket using the NetLabel mechanism using the given
389fb800 PM	301	* SID. Returns zero values on success, negative values on failure.
5778eabd PM	302	*
5778eabd PM	303	*/
389fb800	304	int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
5778eabd PM	305	{
5778eabd PM	306	int rc;
389fb800 PM	307	struct sk_security_struct *sksec = sk->sk_security;
389fb800 PM	308	struct netlbl_lsm_secattr *secattr;
5778eabd	309
389fb800	310	if (family != PF_INET)
5778eabd	311	return 0;
f74af6e8	312
389fb800 PM	313	secattr = selinux_netlbl_sock_genattr(sk);
	314	if (secattr == NULL)
	315	return -ENOMEM;
	316	rc = netlbl_sock_setattr(sk, family, secattr);
	317	switch (rc) {
	318	case 0:
	319	sksec->nlbl_state = NLBL_LABELED;
	320	break;
	321	case -EDESTADDRREQ:
	322	sksec->nlbl_state = NLBL_REQSKB;
f74af6e8	323	rc = 0;
389fb800 PM	324	break;
389fb800 PM	325	}
5778eabd PM	326
	327	return rc;
	328	}
	329
	330	/**
	331	* selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
	332	* @sksec: the sock's sk_security_struct
	333	* @skb: the packet
75e22910	334	* @family: protocol family
5778eabd PM	335	* @ad: the audit data
	336	*
	337	* Description:
	338	* Fetch the NetLabel security attributes from @skb and perform an access check
	339	* against the receiving socket. Returns zero on success, negative values on
	340	* error.
	341	*
	342	*/
	343	int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
	344	struct sk_buff *skb,
75e22910	345	u16 family,
2bf49690	346	struct common_audit_data *ad)
5778eabd PM	347	{
5778eabd PM	348	int rc;
f36158c4 PM	349	u32 nlbl_sid;
	350	u32 perm;
	351	struct netlbl_lsm_secattr secattr;
5778eabd	352
23bcdc1a PM	353	if (!netlbl_enabled())
	354	return 0;
	355
f36158c4	356	netlbl_secattr_init(&secattr);
75e22910	357	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0 PM	358	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
	359	rc = selinux_netlbl_sidlookup_cached(skb, &secattr, &nlbl_sid);
	360	else
f36158c4 PM	361	nlbl_sid = SECINITSID_UNLABELED;
f36158c4 PM	362	netlbl_secattr_destroy(&secattr);
5778eabd PM	363	if (rc != 0)
5778eabd PM	364	return rc;
8d9107e8	365
5778eabd PM	366	switch (sksec->sclass) {
5778eabd PM	367	case SECCLASS_UDP_SOCKET:
f36158c4	368	perm = UDP_SOCKET__RECVFROM;
5778eabd PM	369	break;
5778eabd PM	370	case SECCLASS_TCP_SOCKET:
f36158c4	371	perm = TCP_SOCKET__RECVFROM;
5778eabd PM	372	break;
5778eabd PM	373	default:
f36158c4	374	perm = RAWIP_SOCKET__RECVFROM;
5778eabd PM	375	}
5778eabd PM	376
f36158c4	377	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
5778eabd PM	378	if (rc == 0)
	379	return 0;
	380
f36158c4	381	if (nlbl_sid != SECINITSID_UNLABELED)
dfaebe98	382	netlbl_skbuff_err(skb, rc, 0);
5778eabd PM	383	return rc;
	384	}
	385
	386	/**
	387	* selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
	388	* @sock: the socket
	389	* @level: the socket level or protocol
	390	* @optname: the socket option name
	391	*
	392	* Description:
	393	* Check the setsockopt() call and if the user is trying to replace the IP
	394	* options on a socket and a NetLabel is in place for the socket deny the
	395	* access; otherwise allow the access. Returns zero when the access is
	396	* allowed, -EACCES when denied, and other negative values on error.
	397	*
	398	*/
	399	int selinux_netlbl_socket_setsockopt(struct socket *sock,
	400	int level,
	401	int optname)
	402	{
	403	int rc = 0;
ba6ff9f2 PM	404	struct sock *sk = sock->sk;
ba6ff9f2 PM	405	struct sk_security_struct *sksec = sk->sk_security;
5778eabd PM	406	struct netlbl_lsm_secattr secattr;
5778eabd PM	407
5778eabd	408	if (level == IPPROTO_IP && optname == IP_OPTIONS &&
014ab19a PM	409	(sksec->nlbl_state == NLBL_LABELED \|\|
014ab19a PM	410	sksec->nlbl_state == NLBL_CONNLABELED)) {
5778eabd	411	netlbl_secattr_init(&secattr);
ba6ff9f2 PM	412	lock_sock(sk);
	413	rc = netlbl_sock_getattr(sk, &secattr);
	414	release_sock(sk);
09c50b4a	415	if (rc == 0)
5778eabd	416	rc = -EACCES;
09c50b4a PM	417	else if (rc == -ENOMSG)
09c50b4a PM	418	rc = 0;
5778eabd PM	419	netlbl_secattr_destroy(&secattr);
5778eabd PM	420	}
5778eabd PM	421
	422	return rc;
	423	}
014ab19a PM	424
	425	/**
	426	* selinux_netlbl_socket_connect - Label a client-side socket on connect
	427	* @sk: the socket to label
	428	* @addr: the destination address
	429	*
	430	* Description:
	431	* Attempt to label a connected socket with NetLabel using the given address.
	432	* Returns zero values on success, negative values on failure.
	433	*
	434	*/
	435	int selinux_netlbl_socket_connect(struct sock sk, struct sockaddr addr)
	436	{
	437	int rc;
	438	struct sk_security_struct *sksec = sk->sk_security;
6c5b3fc0	439	struct netlbl_lsm_secattr *secattr;
014ab19a PM	440
	441	if (sksec->nlbl_state != NLBL_REQSKB &&
	442	sksec->nlbl_state != NLBL_CONNLABELED)
	443	return 0;
	444
014ab19a PM	445	local_bh_disable();
	446	bh_lock_sock_nested(sk);
	447
	448	/* connected sockets are allowed to disconnect when the address family
	449	* is set to AF_UNSPEC, if that is what is happening we want to reset
	450	* the socket */
	451	if (addr->sa_family == AF_UNSPEC) {
	452	netlbl_sock_delattr(sk);
	453	sksec->nlbl_state = NLBL_REQSKB;
	454	rc = 0;
	455	goto socket_connect_return;
	456	}
6c5b3fc0 PM	457	secattr = selinux_netlbl_sock_genattr(sk);
	458	if (secattr == NULL) {
	459	rc = -ENOMEM;
014ab19a	460	goto socket_connect_return;
6c5b3fc0 PM	461	}
	462	rc = netlbl_conn_setattr(sk, addr, secattr);
	463	if (rc == 0)
	464	sksec->nlbl_state = NLBL_CONNLABELED;
014ab19a PM	465
	466	socket_connect_return:
	467	bh_unlock_sock(sk);
	468	local_bh_enable();
014ab19a PM	469	return rc;
014ab19a PM	470	}