secmark: make secmark object handling generic (2606fd1f) · Commits · 戴 / test

include/linux/netfilter/xt_SECMARK.h

+3 −9

Original line number	Diff line number	Diff line
		@@ -11,18 +11,12 @@
		* packets are being marked for.
		*/
		#define SECMARK_MODE_SEL 0x01 /* SELinux */
		#define SECMARK_SELCTX_MAX 256

		struct xt_secmark_target_selinux_info {
		__u32 selsid;
		char selctx[SECMARK_SELCTX_MAX];
		};
		#define SECMARK_SECCTX_MAX 256

		struct xt_secmark_target_info {
		__u8 mode;
		union {
		struct xt_secmark_target_selinux_info sel;
		} u;
		__u32 secid;
		char secctx[SECMARK_SECCTX_MAX];
		};

		#endif /_XT_SECMARK_H_target /

include/linux/security.h

+25 −0

Original line number	Diff line number	Diff line
		@@ -959,6 +959,12 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
		* Sets the new child socket's sid to the openreq sid.
		* @inet_conn_established:
		* Sets the connection's peersid to the secmark on skb.
		* @secmark_relabel_packet:
		* check if the process should be allowed to relabel packets to the given secid
		* @security_secmark_refcount_inc
		* tells the LSM to increment the number of secmark labeling rules loaded
		* @security_secmark_refcount_dec
		* tells the LSM to decrement the number of secmark labeling rules loaded
		* @req_classify_flow:
		* Sets the flow's sid to the openreq sid.
		* @tun_dev_create:
		@@ -1593,6 +1599,9 @@ struct security_operations {
		struct request_sock *req);
		void (inet_csk_clone) (struct sock newsk, const struct request_sock *req);
		void (inet_conn_established) (struct sock sk, struct sk_buff *skb);
		int (*secmark_relabel_packet) (u32 secid);
		void (*secmark_refcount_inc) (void);
		void (*secmark_refcount_dec) (void);
		void (req_classify_flow) (const struct request_sock req, struct flowi *fl);
		int (*tun_dev_create)(void);
		void (tun_dev_post_create)(struct sock sk);
		@@ -2547,6 +2556,9 @@ void security_inet_csk_clone(struct sock *newsk,
		const struct request_sock *req);
		void security_inet_conn_established(struct sock *sk,
		struct sk_buff *skb);
		int security_secmark_relabel_packet(u32 secid);
		void security_secmark_refcount_inc(void);
		void security_secmark_refcount_dec(void);
		int security_tun_dev_create(void);
		void security_tun_dev_post_create(struct sock *sk);
		int security_tun_dev_attach(struct sock *sk);
		@@ -2701,6 +2713,19 @@ static inline void security_inet_conn_established(struct sock *sk,
		{
		}

		static inline int security_secmark_relabel_packet(u32 secid)
		{
		return 0;
		}

		static inline void security_secmark_refcount_inc(void)
		{
		}

		static inline void security_secmark_refcount_dec(void)
		{
		}

		static inline int security_tun_dev_create(void)
		{
		return 0;

include/linux/selinux.h

+0 −63

Original line number	Diff line number	Diff line
		@@ -20,75 +20,12 @@ struct kern_ipc_perm;

		#ifdef CONFIG_SECURITY_SELINUX

		/**
		* selinux_string_to_sid - map a security context string to a security ID
		* @str: the security context string to be mapped
		* @sid: ID value returned via this.
		*
		* Returns 0 if successful, with the SID stored in sid. A value
		* of zero for sid indicates no SID could be determined (but no error
		* occurred).
		*/
		int selinux_string_to_sid(char str, u32 sid);

		/**
		* selinux_secmark_relabel_packet_permission - secmark permission check
		* @sid: SECMARK ID value to be applied to network packet
		*
		* Returns 0 if the current task is allowed to set the SECMARK label of
		* packets with the supplied security ID. Note that it is implicit that
		* the packet is always being relabeled from the default unlabeled value,
		* and that the access control decision is made in the AVC.
		*/
		int selinux_secmark_relabel_packet_permission(u32 sid);

		/**
		* selinux_secmark_refcount_inc - increments the secmark use counter
		*
		* SELinux keeps track of the current SECMARK targets in use so it knows
		* when to apply SECMARK label access checks to network packets. This
		* function incements this reference count to indicate that a new SECMARK
		* target has been configured.
		*/
		void selinux_secmark_refcount_inc(void);

		/**
		* selinux_secmark_refcount_dec - decrements the secmark use counter
		*
		* SELinux keeps track of the current SECMARK targets in use so it knows
		* when to apply SECMARK label access checks to network packets. This
		* function decements this reference count to indicate that one of the
		* existing SECMARK targets has been removed/flushed.
		*/
		void selinux_secmark_refcount_dec(void);

		/**
		* selinux_is_enabled - is SELinux enabled?
		*/
		bool selinux_is_enabled(void);
		#else

		static inline int selinux_string_to_sid(const char str, u32 sid)
		{
		*sid = 0;
		return 0;
		}

		static inline int selinux_secmark_relabel_packet_permission(u32 sid)
		{
		return 0;
		}

		static inline void selinux_secmark_refcount_inc(void)
		{
		return;
		}

		static inline void selinux_secmark_refcount_dec(void)
		{
		return;
		}

		static inline bool selinux_is_enabled(void)
		{
		return false;

net/netfilter/xt_CT.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -9,7 +9,6 @@
		#include <linux/module.h>
		#include <linux/gfp.h>
		#include <linux/skbuff.h>
		#include <linux/selinux.h>
		#include <linux/netfilter_ipv4/ip_tables.h>
		#include <linux/netfilter_ipv6/ip6_tables.h>
		#include <linux/netfilter/x_tables.h>

net/netfilter/xt_SECMARK.c

+17 −18

Original line number	Diff line number	Diff line
		@@ -14,8 +14,8 @@
		*/
		#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
		#include <linux/module.h>
		#include <linux/security.h>
		#include <linux/skbuff.h>
		#include <linux/selinux.h>
		#include <linux/netfilter/x_tables.h>
		#include <linux/netfilter/xt_SECMARK.h>

		@@ -39,9 +39,8 @@ secmark_tg(struct sk_buff skb, const struct xt_action_param par)

		switch (mode) {
		case SECMARK_MODE_SEL:
		secmark = info->u.sel.selsid;
		secmark = info->secid;
		break;

		default:
		BUG();
		}
		@@ -50,33 +49,33 @@ secmark_tg(struct sk_buff skb, const struct xt_action_param par)
		return XT_CONTINUE;
		}

		static int checkentry_selinux(struct xt_secmark_target_info *info)
		static int checkentry_lsm(struct xt_secmark_target_info *info)
		{
		int err;
		struct xt_secmark_target_selinux_info *sel = &info->u.sel;

		sel->selctx[SECMARK_SELCTX_MAX - 1] = '\0';
		info->secctx[SECMARK_SECCTX_MAX - 1] = '\0';
		info->secid = 0;

		err = selinux_string_to_sid(sel->selctx, &sel->selsid);
		err = security_secctx_to_secid(info->secctx, strlen(info->secctx),
		&info->secid);
		if (err) {
		if (err == -EINVAL)
		pr_info("invalid SELinux context \'%s\'\n",
		sel->selctx);
		pr_info("invalid security context \'%s\'\n", info->secctx);
		return err;
		}

		if (!sel->selsid) {
		pr_info("unable to map SELinux context \'%s\'\n", sel->selctx);
		if (!info->secid) {
		pr_info("unable to map security context \'%s\'\n", info->secctx);
		return -ENOENT;
		}

		err = selinux_secmark_relabel_packet_permission(sel->selsid);
		err = security_secmark_relabel_packet(info->secid);
		if (err) {
		pr_info("unable to obtain relabeling permission\n");
		return err;
		}

		selinux_secmark_refcount_inc();
		security_secmark_refcount_inc();
		return 0;
		}

		@@ -100,16 +99,16 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)

		switch (info->mode) {
		case SECMARK_MODE_SEL:
		err = checkentry_selinux(info);
		if (err)
		return err;
		break;

		default:
		pr_info("invalid mode: %hu\n", info->mode);
		return -EINVAL;
		}

		err = checkentry_lsm(info);
		if (err)
		return err;

		if (!mode)
		mode = info->mode;
		return 0;
		@@ -119,7 +118,7 @@ static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
		{
		switch (mode) {
		case SECMARK_MODE_SEL:
		selinux_secmark_refcount_dec();
		security_secmark_refcount_dec();
		}
		}

Admin message