[MLSXFRM]: Auto-labeling of child sockets (4237c75c) · Commits · 戴 / test

include/linux/security.h

+55 −0

Original line number	Original line	Diff line number	Diff line
	@@ -90,6 +90,7 @@ extern int cap_netlink_recv(struct sk_buff *skb, int cap);
	struct nfsctl_arg;		struct nfsctl_arg;
	struct sched_param;		struct sched_param;
	struct swap_info_struct;		struct swap_info_struct;
			struct request_sock;

	/* bprm_apply_creds unsafe reasons */		/* bprm_apply_creds unsafe reasons */
	#define LSM_UNSAFE_SHARE 1		#define LSM_UNSAFE_SHARE 1
	@@ -819,6 +820,14 @@ struct swap_info_struct;
	* @sk_getsecid:		* @sk_getsecid:
	* Retrieve the LSM-specific secid for the sock to enable caching of network		* Retrieve the LSM-specific secid for the sock to enable caching of network
	* authorizations.		* authorizations.
			* @sock_graft:
			* Sets the socket's isec sid to the sock's sid.
			* @inet_conn_request:
			* Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
			* @inet_csk_clone:
			* Sets the new child socket's sid to the openreq sid.
			* @req_classify_flow:
			* Sets the flow's sid to the openreq sid.
	*		*
	* Security hooks for XFRM operations.		* Security hooks for XFRM operations.
	*		*
	@@ -1358,6 +1367,11 @@ struct security_operations {
	void (sk_free_security) (struct sock sk);		void (sk_free_security) (struct sock sk);
	void (sk_clone_security) (const struct sock sk, struct sock *newsk);		void (sk_clone_security) (const struct sock sk, struct sock *newsk);
	void (sk_getsecid) (struct sock sk, u32 *secid);		void (sk_getsecid) (struct sock sk, u32 *secid);
			void (sock_graft)(struct sock sk, struct socket *parent);
			int (inet_conn_request)(struct sock sk, struct sk_buff *skb,
			struct request_sock *req);
			void (inet_csk_clone)(struct sock newsk, const struct request_sock *req);
			void (req_classify_flow)(const struct request_sock req, struct flowi *fl);
	#endif /* CONFIG_SECURITY_NETWORK */		#endif /* CONFIG_SECURITY_NETWORK */

	#ifdef CONFIG_SECURITY_NETWORK_XFRM		#ifdef CONFIG_SECURITY_NETWORK_XFRM
	@@ -2926,6 +2940,28 @@ static inline void security_sk_classify_flow(struct sock sk, struct flowi fl)
	{		{
	security_ops->sk_getsecid(sk, &fl->secid);		security_ops->sk_getsecid(sk, &fl->secid);
	}		}

			static inline void security_req_classify_flow(const struct request_sock req, struct flowi fl)
			{
			security_ops->req_classify_flow(req, fl);
			}

			static inline void security_sock_graft(struct sock* sk, struct socket *parent)
			{
			security_ops->sock_graft(sk, parent);
			}

			static inline int security_inet_conn_request(struct sock *sk,
			struct sk_buff skb, struct request_sock req)
			{
			return security_ops->inet_conn_request(sk, skb, req);
			}

			static inline void security_inet_csk_clone(struct sock *newsk,
			const struct request_sock *req)
			{
			security_ops->inet_csk_clone(newsk, req);
			}
	#else /* CONFIG_SECURITY_NETWORK */		#else /* CONFIG_SECURITY_NETWORK */
	static inline int security_unix_stream_connect(struct socket * sock,		static inline int security_unix_stream_connect(struct socket * sock,
	struct socket * other,		struct socket * other,
	@@ -3055,6 +3091,25 @@ static inline void security_sk_clone(const struct sock sk, struct sock newsk)
	static inline void security_sk_classify_flow(struct sock sk, struct flowi fl)		static inline void security_sk_classify_flow(struct sock sk, struct flowi fl)
	{		{
	}		}

			static inline void security_req_classify_flow(const struct request_sock req, struct flowi fl)
			{
			}

			static inline void security_sock_graft(struct sock* sk, struct socket *parent)
			{
			}

			static inline int security_inet_conn_request(struct sock *sk,
			struct sk_buff skb, struct request_sock req)
			{
			return 0;
			}

			static inline void security_inet_csk_clone(struct sock *newsk,
			const struct request_sock *req)
			{
			}
	#endif /* CONFIG_SECURITY_NETWORK */		#endif /* CONFIG_SECURITY_NETWORK */

	#ifdef CONFIG_SECURITY_NETWORK_XFRM		#ifdef CONFIG_SECURITY_NETWORK_XFRM

include/net/request_sock.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -53,6 +53,7 @@ struct request_sock {
	unsigned long expires;		unsigned long expires;
	struct request_sock_ops *rsk_ops;		struct request_sock_ops *rsk_ops;
	struct sock *sk;		struct sock *sk;
			u32 secid;
	};		};

	static inline struct request_sock reqsk_alloc(struct request_sock_ops ops)		static inline struct request_sock reqsk_alloc(struct request_sock_ops ops)

include/net/sock.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -969,6 +969,7 @@ static inline void sock_graft(struct sock sk, struct socket parent)
	sk->sk_sleep = &parent->wait;		sk->sk_sleep = &parent->wait;
	parent->sk = sk;		parent->sk = sk;
	sk->sk_socket = parent;		sk->sk_socket = parent;
			security_sock_graft(sk, parent);
	write_unlock_bh(&sk->sk_callback_lock);		write_unlock_bh(&sk->sk_callback_lock);
	}		}

net/dccp/ipv4.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -501,6 +501,9 @@ int dccp_v4_conn_request(struct sock sk, struct sk_buff skb)

	dccp_openreq_init(req, &dp, skb);		dccp_openreq_init(req, &dp, skb);

			if (security_inet_conn_request(sk, skb, req))
			goto drop_and_free;

	ireq = inet_rsk(req);		ireq = inet_rsk(req);
	ireq->loc_addr = daddr;		ireq->loc_addr = daddr;
	ireq->rmt_addr = saddr;		ireq->rmt_addr = saddr;

net/dccp/ipv6.c

+5 −2

Original line number	Original line	Diff line number	Diff line
	@@ -424,7 +424,7 @@ static int dccp_v6_send_response(struct sock sk, struct request_sock req,
	fl.oif = ireq6->iif;		fl.oif = ireq6->iif;
	fl.fl_ip_dport = inet_rsk(req)->rmt_port;		fl.fl_ip_dport = inet_rsk(req)->rmt_port;
	fl.fl_ip_sport = inet_sk(sk)->sport;		fl.fl_ip_sport = inet_sk(sk)->sport;
	security_sk_classify_flow(sk, &fl);		security_req_classify_flow(req, &fl);

	if (dst == NULL) {		if (dst == NULL) {
	opt = np->opt;		opt = np->opt;
	@@ -626,7 +626,7 @@ static void dccp_v6_reqsk_send_ack(struct sk_buff *rxskb,
	fl.oif = inet6_iif(rxskb);		fl.oif = inet6_iif(rxskb);
	fl.fl_ip_dport = dh->dccph_dport;		fl.fl_ip_dport = dh->dccph_dport;
	fl.fl_ip_sport = dh->dccph_sport;		fl.fl_ip_sport = dh->dccph_sport;
	security_skb_classify_flow(rxskb, &fl);		security_req_classify_flow(req, &fl);

	if (!ip6_dst_lookup(NULL, &skb->dst, &fl)) {		if (!ip6_dst_lookup(NULL, &skb->dst, &fl)) {
	if (xfrm_lookup(&skb->dst, &fl, NULL, 0) >= 0) {		if (xfrm_lookup(&skb->dst, &fl, NULL, 0) >= 0) {
	@@ -709,6 +709,9 @@ static int dccp_v6_conn_request(struct sock sk, struct sk_buff skb)

	dccp_openreq_init(req, &dp, skb);		dccp_openreq_init(req, &dp, skb);

			if (security_inet_conn_request(sk, skb, req))
			goto drop_and_free;

	ireq6 = inet6_rsk(req);		ireq6 = inet6_rsk(req);
	ireq = inet_rsk(req);		ireq = inet_rsk(req);
	ipv6_addr_copy(&ireq6->rmt_addr, &skb->nh.ipv6h->saddr);		ipv6_addr_copy(&ireq6->rmt_addr, &skb->nh.ipv6h->saddr);

Admin message