[linux-block.git] / security / selinux / netlabel.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * SELinux NetLabel Support
 *
 * This file provides the necessary glue to tie NetLabel into the SELinux
 * subsystem.
 *
 * Author: Paul Moore <paul@paul-moore.com>
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
 */

#include <linux/spinlock.h>
#include <linux/rcupdate.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/sock.h>
#include <net/netlabel.h>
#include <net/ip.h>
#include <net/ipv6.h>

#include "objsec.h"
#include "security.h"
#include "netlabel.h"

/**
 * selinux_netlbl_sidlookup_cached - Cache a SID lookup
 * @skb: the packet
 * @family: the packet's address family
 * @secattr: the NetLabel security attributes
 * @sid: the SID
 *
 * Description:
 * Query the SELinux security server to lookup the correct SID for the given
 * security attributes.  If the query is successful, cache the result to speed
 * up future lookups.  Returns zero on success, negative values on failure.
 *
 */
static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
					   u16 family,
					   struct netlbl_lsm_secattr *secattr,
					   u32 *sid)
{
	int rc;

	rc = security_netlbl_secattr_to_sid(secattr, sid);
	if (rc == 0 &&
	    (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	    (secattr->flags & NETLBL_SECATTR_CACHE))
		netlbl_cache_add(skb, family, secattr);

	return rc;
}

/**
 * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
 * @sk: the socket
 *
 * Description:
 * Generate the NetLabel security attributes for a socket, making full use of
 * the socket's attribute cache.  Returns a pointer to the security attributes
 * on success, NULL on failure.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_secattr != NULL)
		return sksec->nlbl_secattr;

	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	if (secattr == NULL)
		return NULL;
	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
	if (rc != 0) {
		netlbl_secattr_free(secattr);
		return NULL;
	}
	sksec->nlbl_secattr = secattr;

	return secattr;
}

/**
 * selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
 * @sk: the socket
 * @sid: the SID
 *
 * Query the socket's cached secattr and if the SID matches the cached value
 * return the cache, otherwise return NULL.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
							const struct sock *sk,
							u32 sid)
{
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;

	if (secattr == NULL)
		return NULL;

	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	    (secattr->attr.secid == sid))
		return secattr;

	return NULL;
}

/**
 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
 *
 * Description:
 * Invalidate the NetLabel security attribute mapping cache.
 *
 */
void selinux_netlbl_cache_invalidate(void)
{
	netlbl_cache_invalidate();
}

/**
 * selinux_netlbl_err - Handle a NetLabel packet error
 * @skb: the packet
 * @family: the packet's address family
 * @error: the error code
 * @gateway: true if host is acting as a gateway, false otherwise
 *
 * Description:
 * When a packet is dropped due to a call to avc_has_perm() pass the error
 * code to the NetLabel subsystem so any protocol specific processing can be
 * done.  This is safe to call even if you are unsure if NetLabel labeling is
 * present on the packet, NetLabel is smart enough to only act when it should.
 *
 */
void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
{
	netlbl_skbuff_err(skb, family, error, gateway);
}

/**
 * selinux_netlbl_sk_security_free - Free the NetLabel fields
 * @sksec: the sk_security_struct
 *
 * Description:
 * Free all of the memory in the NetLabel fields of a sk_security_struct.
 *
 */
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
{
	if (!sksec->nlbl_secattr)
		return;

	netlbl_secattr_free(sksec->nlbl_secattr);
	sksec->nlbl_secattr = NULL;
	sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
 * @sksec: the sk_security_struct
 *
 * Description:
 * Called when the NetLabel state of a sk_security_struct needs to be reset.
 * The caller is responsible for all the NetLabel sk_security_struct locking.
 *
 */
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
{
	sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
 * @skb: the packet
 * @family: protocol family
 * @type: NetLabel labeling protocol type
 * @sid: the SID
 *
 * Description:
 * Call the NetLabel mechanism to get the security attributes of the given
 * packet and use those attributes to determine the correct context/SID to
 * assign to the packet.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
				 u16 family,
				 u32 *type,
				 u32 *sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled()) {
		*sid = SECSID_NULL;
		return 0;
	}

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, sid);
	else
		*sid = SECSID_NULL;
	*type = secattr.type;
	netlbl_secattr_destroy(&secattr);

	return rc;
}

/**
 * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
 * @skb: the packet
 * @family: protocol family
 * @sid: the SID
 *
 * Description
 * Call the NetLabel mechanism to set the label of a packet using @sid.
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
				 u16 family,
				 u32 sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr_storage;
	struct netlbl_lsm_secattr *secattr = NULL;
	struct sock *sk;

	/* if this is a locally generated packet check to see if it is already
	 * being labeled by it's parent socket, if it is just exit */
	sk = skb_to_full_sk(skb);
	if (sk != NULL) {
		struct sk_security_struct *sksec = sk->sk_security;

		if (sksec->nlbl_state != NLBL_REQSKB)
			return 0;
		secattr = selinux_netlbl_sock_getattr(sk, sid);
	}
	if (secattr == NULL) {
		secattr = &secattr_storage;
		netlbl_secattr_init(secattr);
		rc = security_netlbl_sid_to_secattr(sid, secattr);
		if (rc != 0)
			goto skbuff_setsid_return;
	}

	rc = netlbl_skbuff_setattr(skb, family, secattr);

skbuff_setsid_return:
	if (secattr == &secattr_storage)
		netlbl_secattr_destroy(secattr);
	return rc;
}

/**
 * selinux_netlbl_sctp_assoc_request - Label an incoming sctp association.
 * @asoc: incoming association.
 * @skb: the packet.
 *
 * Description:
 * A new incoming connection is represented by @asoc, ......
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
				     struct sk_buff *skb)
{
	int rc;
	struct netlbl_lsm_secattr secattr;
	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
	struct sockaddr_in addr4;
	struct sockaddr_in6 addr6;

	if (asoc->base.sk->sk_family != PF_INET &&
	    asoc->base.sk->sk_family != PF_INET6)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(asoc->secid, &secattr);
	if (rc != 0)
		goto assoc_request_return;

	/* Move skb hdr address info to a struct sockaddr and then call
	 * netlbl_conn_setattr().
	 */
	if (ip_hdr(skb)->version == 4) {
		addr4.sin_family = AF_INET;
		addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
		rc = netlbl_conn_setattr(asoc->base.sk, (void *)&addr4, &secattr);
	} else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
		addr6.sin6_family = AF_INET6;
		addr6.sin6_addr = ipv6_hdr(skb)->saddr;
		rc = netlbl_conn_setattr(asoc->base.sk, (void *)&addr6, &secattr);
	} else {
		rc = -EAFNOSUPPORT;
	}

	if (rc == 0)
		sksec->nlbl_state = NLBL_LABELED;

assoc_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_conn_request - Label an incoming stream connection
 * @req: incoming connection request socket
 * @family: the request socket's address family
 *
 * Description:
 * A new incoming connection request is represented by @req, we need to label
 * the new request_sock here and the stack will ensure the on-the-wire label
 * will get preserved when a full sock is created once the connection handshake
 * is complete.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
	if (rc != 0)
		goto inet_conn_request_return;
	rc = netlbl_req_setattr(req, &secattr);
inet_conn_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
 * @sk: the new sock
 * @family: the sock's address family
 *
 * Description:
 * A new connection has been established using @sk, we've already labeled the
 * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
 * we need to set the NetLabel state here since we now have a sock structure.
 *
 */
void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (family == PF_INET)
		sksec->nlbl_state = NLBL_LABELED;
	else
		sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_sctp_sk_clone - Copy state to the newly created sock
 * @sk: current sock
 * @newsk: the new sock
 *
 * Description:
 * Called whenever a new socket is created by accept(2) or sctp_peeloff(3).
 */
void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk)
{
	struct sk_security_struct *sksec = sk->sk_security;
	struct sk_security_struct *newsksec = newsk->sk_security;

	newsksec->nlbl_state = sksec->nlbl_state;
}

/**
 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
 * @sk: the sock to label
 * @family: protocol family
 *
 * Description:
 * Attempt to label a socket using the NetLabel mechanism using the given
 * SID.  Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL)
		return -ENOMEM;
	rc = netlbl_sock_setattr(sk, family, secattr);
	switch (rc) {
	case 0:
		sksec->nlbl_state = NLBL_LABELED;
		break;
	case -EDESTADDRREQ:
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		break;
	}

	return rc;
}

/**
 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
 * @sksec: the sock's sk_security_struct
 * @skb: the packet
 * @family: protocol family
 * @ad: the audit data
 *
 * Description:
 * Fetch the NetLabel security attributes from @skb and perform an access check
 * against the receiving socket.  Returns zero on success, negative values on
 * error.
 *
 */
int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
				struct sk_buff *skb,
				u16 family,
				struct common_audit_data *ad)
{
	int rc;
	u32 nlbl_sid;
	u32 perm;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled())
		return 0;

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, &nlbl_sid);
	else
		nlbl_sid = SECINITSID_UNLABELED;
	netlbl_secattr_destroy(&secattr);
	if (rc != 0)
		return rc;

	switch (sksec->sclass) {
	case SECCLASS_UDP_SOCKET:
		perm = UDP_SOCKET__RECVFROM;
		break;
	case SECCLASS_TCP_SOCKET:
		perm = TCP_SOCKET__RECVFROM;
		break;
	default:
		perm = RAWIP_SOCKET__RECVFROM;
	}

	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
	if (rc == 0)
		return 0;

	if (nlbl_sid != SECINITSID_UNLABELED)
		netlbl_skbuff_err(skb, family, rc, 0);
	return rc;
}

/**
 * selinux_netlbl_option - Is this a NetLabel option
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Returns true if @level and @optname refer to a NetLabel option.
 * Helper for selinux_netlbl_socket_setsockopt().
 */
static inline int selinux_netlbl_option(int level, int optname)
{
	return (level == IPPROTO_IP && optname == IP_OPTIONS) ||
		(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
}

/**
 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
 * @sock: the socket
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Check the setsockopt() call and if the user is trying to replace the IP
 * options on a socket and a NetLabel is in place for the socket deny the
 * access; otherwise allow the access.  Returns zero when the access is
 * allowed, -EACCES when denied, and other negative values on error.
 *
 */
int selinux_netlbl_socket_setsockopt(struct socket *sock,
				     int level,
				     int optname)
{
	int rc = 0;
	struct sock *sk = sock->sk;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr secattr;

	if (selinux_netlbl_option(level, optname) &&
	    (sksec->nlbl_state == NLBL_LABELED ||
	     sksec->nlbl_state == NLBL_CONNLABELED)) {
		netlbl_secattr_init(&secattr);
		lock_sock(sk);
		/* call the netlabel function directly as we want to see the
		 * on-the-wire label that is assigned via the socket's options
		 * and not the cached netlabel/lsm attributes */
		rc = netlbl_sock_getattr(sk, &secattr);
		release_sock(sk);
		if (rc == 0)
			rc = -EACCES;
		else if (rc == -ENOMSG)
			rc = 0;
		netlbl_secattr_destroy(&secattr);
	}

	return rc;
}

/**
 * selinux_netlbl_socket_connect_helper - Help label a client-side socket on
 * connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
static int selinux_netlbl_socket_connect_helper(struct sock *sk,
						struct sockaddr *addr)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	/* connected sockets are allowed to disconnect when the address family
	 * is set to AF_UNSPEC, if that is what is happening we want to reset
	 * the socket */
	if (addr->sa_family == AF_UNSPEC) {
		netlbl_sock_delattr(sk);
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		return rc;
	}
	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL) {
		rc = -ENOMEM;
		return rc;
	}
	rc = netlbl_conn_setattr(sk, addr, secattr);
	if (rc == 0)
		sksec->nlbl_state = NLBL_CONNLABELED;

	return rc;
}

/**
 * selinux_netlbl_socket_connect_locked - Label a client-side socket on
 * connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket that already has the socket locked
 * with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect_locked(struct sock *sk,
					 struct sockaddr *addr)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (sksec->nlbl_state != NLBL_REQSKB &&
	    sksec->nlbl_state != NLBL_CONNLABELED)
		return 0;

	return selinux_netlbl_socket_connect_helper(sk, addr);
}

/**
 * selinux_netlbl_socket_connect - Label a client-side socket on connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
{
	int rc;

	lock_sock(sk);
	rc = selinux_netlbl_socket_connect_locked(sk, addr);
	release_sock(sk);

	return rc;
}
Commit	Line	Data
1ccea77e	1	// SPDX-License-Identifier: GPL-2.0-or-later
5778eabd PM	2	/*
	3	* SELinux NetLabel Support
	4	*
	5	* This file provides the necessary glue to tie NetLabel into the SELinux
	6	* subsystem.
	7	*
82c21bfa	8	* Author: Paul Moore <paul@paul-moore.com>
5778eabd PM	9	*/
	10
	11	/*
948bf85c	12	* (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
5778eabd PM	13	*/
	14
	15	#include <linux/spinlock.h>
	16	#include <linux/rcupdate.h>
5a0e3ad6	17	#include <linux/gfp.h>
014ab19a PM	18	#include <linux/ip.h>
014ab19a PM	19	#include <linux/ipv6.h>
5778eabd PM	20	#include <net/sock.h>
5778eabd PM	21	#include <net/netlabel.h>
014ab19a PM	22	#include <net/ip.h>
014ab19a PM	23	#include <net/ipv6.h>
5778eabd PM	24
	25	#include "objsec.h"
	26	#include "security.h"
d4ee4231	27	#include "netlabel.h"
5778eabd	28
5dbe1eb0 PM	29	/**
	30	* selinux_netlbl_sidlookup_cached - Cache a SID lookup
	31	* @skb: the packet
e9fd7292	32	* @family: the packet's address family
5dbe1eb0 PM	33	* @secattr: the NetLabel security attributes
	34	* @sid: the SID
	35	*
	36	* Description:
	37	* Query the SELinux security server to lookup the correct SID for the given
	38	* security attributes. If the query is successful, cache the result to speed
	39	* up future lookups. Returns zero on success, negative values on failure.
	40	*
	41	*/
	42	static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
4fee5242	43	u16 family,
5dbe1eb0 PM	44	struct netlbl_lsm_secattr *secattr,
	45	u32 *sid)
	46	{
	47	int rc;
	48
e67b7985	49	rc = security_netlbl_secattr_to_sid(secattr, sid);
5dbe1eb0 PM	50	if (rc == 0 &&
	51	(secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	52	(secattr->flags & NETLBL_SECATTR_CACHE))
4fee5242	53	netlbl_cache_add(skb, family, secattr);
5dbe1eb0 PM	54
	55	return rc;
	56	}
	57
6c5b3fc0 PM	58	/**
	59	* selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
	60	* @sk: the socket
	61	*
	62	* Description:
	63	* Generate the NetLabel security attributes for a socket, making full use of
	64	* the socket's attribute cache. Returns a pointer to the security attributes
	65	* on success, NULL on failure.
	66	*
	67	*/
	68	static struct netlbl_lsm_secattr selinux_netlbl_sock_genattr(struct sock sk)
	69	{
	70	int rc;
	71	struct sk_security_struct *sksec = sk->sk_security;
	72	struct netlbl_lsm_secattr *secattr;
	73
	74	if (sksec->nlbl_secattr != NULL)
	75	return sksec->nlbl_secattr;
	76
	77	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	78	if (secattr == NULL)
	79	return NULL;
e67b7985	80	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
6c5b3fc0 PM	81	if (rc != 0) {
	82	netlbl_secattr_free(secattr);
	83	return NULL;
	84	}
	85	sksec->nlbl_secattr = secattr;
	86
	87	return secattr;
	88	}
	89
050d032b PM	90	/**
	91	* selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
	92	* @sk: the socket
	93	* @sid: the SID
	94	*
	95	* Query the socket's cached secattr and if the SID matches the cached value
	96	* return the cache, otherwise return NULL.
	97	*
	98	*/
	99	static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
	100	const struct sock *sk,
	101	u32 sid)
	102	{
	103	struct sk_security_struct *sksec = sk->sk_security;
	104	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;
	105
	106	if (secattr == NULL)
	107	return NULL;
	108
	109	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	110	(secattr->attr.secid == sid))
	111	return secattr;
	112
	113	return NULL;
	114	}
	115
5778eabd PM	116	/**
	117	* selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
	118	*
	119	* Description:
	120	* Invalidate the NetLabel security attribute mapping cache.
	121	*
	122	*/
	123	void selinux_netlbl_cache_invalidate(void)
	124	{
	125	netlbl_cache_invalidate();
	126	}
	127
dfaebe98 PM	128	/**
	129	* selinux_netlbl_err - Handle a NetLabel packet error
	130	* @skb: the packet
e9fd7292	131	* @family: the packet's address family
dfaebe98 PM	132	* @error: the error code
	133	* @gateway: true if host is acting as a gateway, false otherwise
	134	*
	135	* Description:
	136	* When a packet is dropped due to a call to avc_has_perm() pass the error
	137	* code to the NetLabel subsystem so any protocol specific processing can be
	138	* done. This is safe to call even if you are unsure if NetLabel labeling is
	139	* present on the packet, NetLabel is smart enough to only act when it should.
	140	*
	141	*/
a04e71f6	142	void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
dfaebe98	143	{
a04e71f6	144	netlbl_skbuff_err(skb, family, error, gateway);
dfaebe98 PM	145	}
dfaebe98 PM	146
6c5b3fc0 PM	147	/**
6c5b3fc0 PM	148	* selinux_netlbl_sk_security_free - Free the NetLabel fields
dd3e7836	149	* @sksec: the sk_security_struct
6c5b3fc0 PM	150	*
	151	* Description:
	152	* Free all of the memory in the NetLabel fields of a sk_security_struct.
	153	*
	154	*/
dd3e7836	155	void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
6c5b3fc0	156	{
85c3222d PA	157	if (!sksec->nlbl_secattr)
	158	return;
	159
	160	netlbl_secattr_free(sksec->nlbl_secattr);
	161	sksec->nlbl_secattr = NULL;
	162	sksec->nlbl_state = NLBL_UNSET;
6c5b3fc0 PM	163	}
6c5b3fc0 PM	164
5778eabd PM	165	/**
5778eabd PM	166	* selinux_netlbl_sk_security_reset - Reset the NetLabel fields
dd3e7836	167	* @sksec: the sk_security_struct
5778eabd PM	168	*
	169	* Description:
	170	* Called when the NetLabel state of a sk_security_struct needs to be reset.
25985edc	171	* The caller is responsible for all the NetLabel sk_security_struct locking.
5778eabd PM	172	*
5778eabd PM	173	*/
dd3e7836	174	void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
5778eabd	175	{
dd3e7836	176	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	177	}
5778eabd PM	178
5778eabd PM	179	/**
	180	* selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
	181	* @skb: the packet
75e22910	182	* @family: protocol family
220deb96	183	* @type: NetLabel labeling protocol type
5778eabd PM	184	* @sid: the SID
	185	*
	186	* Description:
	187	* Call the NetLabel mechanism to get the security attributes of the given
	188	* packet and use those attributes to determine the correct context/SID to
	189	* assign to the packet. Returns zero on success, negative values on failure.
	190	*
	191	*/
75e22910 PM	192	int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
75e22910 PM	193	u16 family,
220deb96	194	u32 *type,
75e22910	195	u32 *sid)
5778eabd PM	196	{
	197	int rc;
	198	struct netlbl_lsm_secattr secattr;
	199
23bcdc1a PM	200	if (!netlbl_enabled()) {
	201	*sid = SECSID_NULL;
	202	return 0;
	203	}
	204
5778eabd	205	netlbl_secattr_init(&secattr);
75e22910	206	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	207	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	208	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	209	&secattr, sid);
5dbe1eb0	210	else
5778eabd	211	*sid = SECSID_NULL;
220deb96	212	*type = secattr.type;
5778eabd PM	213	netlbl_secattr_destroy(&secattr);
	214
	215	return rc;
	216	}
	217
948bf85c PM	218	/**
	219	* selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
	220	* @skb: the packet
	221	* @family: protocol family
	222	* @sid: the SID
	223	*
	224	* Description
	225	* Call the NetLabel mechanism to set the label of a packet using @sid.
af901ca1	226	* Returns zero on success, negative values on failure.
948bf85c PM	227	*
	228	*/
	229	int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
	230	u16 family,
	231	u32 sid)
	232	{
	233	int rc;
6c5b3fc0 PM	234	struct netlbl_lsm_secattr secattr_storage;
6c5b3fc0 PM	235	struct netlbl_lsm_secattr *secattr = NULL;
948bf85c PM	236	struct sock *sk;
	237
	238	/* if this is a locally generated packet check to see if it is already
	239	* being labeled by it's parent socket, if it is just exit */
54abc686	240	sk = skb_to_full_sk(skb);
948bf85c PM	241	if (sk != NULL) {
948bf85c PM	242	struct sk_security_struct *sksec = sk->sk_security;
d452930f	243
948bf85c PM	244	if (sksec->nlbl_state != NLBL_REQSKB)
948bf85c PM	245	return 0;
050d032b	246	secattr = selinux_netlbl_sock_getattr(sk, sid);
6c5b3fc0 PM	247	}
	248	if (secattr == NULL) {
	249	secattr = &secattr_storage;
	250	netlbl_secattr_init(secattr);
e67b7985	251	rc = security_netlbl_sid_to_secattr(sid, secattr);
6c5b3fc0 PM	252	if (rc != 0)
6c5b3fc0 PM	253	goto skbuff_setsid_return;
948bf85c PM	254	}
948bf85c PM	255
6c5b3fc0	256	rc = netlbl_skbuff_setattr(skb, family, secattr);
948bf85c PM	257
948bf85c PM	258	skbuff_setsid_return:
6c5b3fc0 PM	259	if (secattr == &secattr_storage)
6c5b3fc0 PM	260	netlbl_secattr_destroy(secattr);
948bf85c PM	261	return rc;
	262	}
	263
d452930f RH	264	/**
d452930f RH	265	* selinux_netlbl_sctp_assoc_request - Label an incoming sctp association.
c081d53f	266	* @asoc: incoming association.
d452930f RH	267	* @skb: the packet.
	268	*
	269	* Description:
c081d53f	270	* A new incoming connection is represented by @asoc, ......
d452930f RH	271	* Returns zero on success, negative values on failure.
	272	*
	273	*/
c081d53f	274	int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
d452930f RH	275	struct sk_buff *skb)
	276	{
	277	int rc;
	278	struct netlbl_lsm_secattr secattr;
c081d53f	279	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
d452930f	280	struct sockaddr_in addr4;
d452930f	281	struct sockaddr_in6 addr6;
d452930f	282
c081d53f XL	283	if (asoc->base.sk->sk_family != PF_INET &&
c081d53f XL	284	asoc->base.sk->sk_family != PF_INET6)
d452930f RH	285	return 0;
	286
	287	netlbl_secattr_init(&secattr);
e67b7985	288	rc = security_netlbl_sid_to_secattr(asoc->secid, &secattr);
d452930f RH	289	if (rc != 0)
	290	goto assoc_request_return;
	291
	292	/* Move skb hdr address info to a struct sockaddr and then call
	293	* netlbl_conn_setattr().
	294	*/
	295	if (ip_hdr(skb)->version == 4) {
	296	addr4.sin_family = AF_INET;
	297	addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
c081d53f	298	rc = netlbl_conn_setattr(asoc->base.sk, (void *)&addr4, &secattr);
98bbbb76	299	} else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
d452930f RH	300	addr6.sin6_family = AF_INET6;
d452930f RH	301	addr6.sin6_addr = ipv6_hdr(skb)->saddr;
c081d53f	302	rc = netlbl_conn_setattr(asoc->base.sk, (void *)&addr6, &secattr);
98bbbb76 AB	303	} else {
98bbbb76 AB	304	rc = -EAFNOSUPPORT;
d452930f RH	305	}
d452930f RH	306
d452930f RH	307	if (rc == 0)
	308	sksec->nlbl_state = NLBL_LABELED;
	309
	310	assoc_request_return:
	311	netlbl_secattr_destroy(&secattr);
	312	return rc;
	313	}
	314
5778eabd	315	/**
389fb800 PM	316	* selinux_netlbl_inet_conn_request - Label an incoming stream connection
389fb800 PM	317	* @req: incoming connection request socket
e9fd7292	318	* @family: the request socket's address family
5778eabd PM	319	*
5778eabd PM	320	* Description:
389fb800 PM	321	* A new incoming connection request is represented by @req, we need to label
	322	* the new request_sock here and the stack will ensure the on-the-wire label
	323	* will get preserved when a full sock is created once the connection handshake
	324	* is complete. Returns zero on success, negative values on failure.
5778eabd PM	325	*
5778eabd PM	326	*/
389fb800	327	int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
5778eabd	328	{
014ab19a	329	int rc;
389fb800	330	struct netlbl_lsm_secattr secattr;
014ab19a	331
e1adea92	332	if (family != PF_INET && family != PF_INET6)
389fb800	333	return 0;
014ab19a	334
389fb800	335	netlbl_secattr_init(&secattr);
e67b7985	336	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
389fb800 PM	337	if (rc != 0)
	338	goto inet_conn_request_return;
	339	rc = netlbl_req_setattr(req, &secattr);
	340	inet_conn_request_return:
	341	netlbl_secattr_destroy(&secattr);
	342	return rc;
5778eabd PM	343	}
	344
	345	/**
389fb800 PM	346	* selinux_netlbl_inet_csk_clone - Initialize the newly created sock
389fb800 PM	347	* @sk: the new sock
e9fd7292	348	* @family: the sock's address family
5778eabd PM	349	*
5778eabd PM	350	* Description:
389fb800 PM	351	* A new connection has been established using @sk, we've already labeled the
	352	* socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
	353	* we need to set the NetLabel state here since we now have a sock structure.
5778eabd PM	354	*
5778eabd PM	355	*/
389fb800	356	void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
5778eabd	357	{
389fb800 PM	358	struct sk_security_struct *sksec = sk->sk_security;
	359
	360	if (family == PF_INET)
	361	sksec->nlbl_state = NLBL_LABELED;
	362	else
	363	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	364	}
5778eabd PM	365
d452930f RH	366	/**
	367	* selinux_netlbl_sctp_sk_clone - Copy state to the newly created sock
	368	* @sk: current sock
	369	* @newsk: the new sock
	370	*
	371	* Description:
	372	* Called whenever a new socket is created by accept(2) or sctp_peeloff(3).
	373	*/
	374	void selinux_netlbl_sctp_sk_clone(struct sock sk, struct sock newsk)
	375	{
	376	struct sk_security_struct *sksec = sk->sk_security;
	377	struct sk_security_struct *newsksec = newsk->sk_security;
	378
	379	newsksec->nlbl_state = sksec->nlbl_state;
	380	}
	381
5778eabd	382	/**
389fb800	383	* selinux_netlbl_socket_post_create - Label a socket using NetLabel
e9fd7292	384	* @sk: the sock to label
389fb800	385	* @family: protocol family
5778eabd PM	386	*
5778eabd PM	387	* Description:
389fb800 PM	388	* Attempt to label a socket using the NetLabel mechanism using the given
389fb800 PM	389	* SID. Returns zero values on success, negative values on failure.
5778eabd PM	390	*
5778eabd PM	391	*/
389fb800	392	int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
5778eabd PM	393	{
5778eabd PM	394	int rc;
389fb800 PM	395	struct sk_security_struct *sksec = sk->sk_security;
389fb800 PM	396	struct netlbl_lsm_secattr *secattr;
5778eabd	397
ceba1832	398	if (family != PF_INET && family != PF_INET6)
5778eabd	399	return 0;
f74af6e8	400
389fb800 PM	401	secattr = selinux_netlbl_sock_genattr(sk);
	402	if (secattr == NULL)
	403	return -ENOMEM;
	404	rc = netlbl_sock_setattr(sk, family, secattr);
	405	switch (rc) {
	406	case 0:
	407	sksec->nlbl_state = NLBL_LABELED;
	408	break;
	409	case -EDESTADDRREQ:
	410	sksec->nlbl_state = NLBL_REQSKB;
f74af6e8	411	rc = 0;
389fb800 PM	412	break;
389fb800 PM	413	}
5778eabd PM	414
	415	return rc;
	416	}
	417
	418	/**
	419	* selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
	420	* @sksec: the sock's sk_security_struct
	421	* @skb: the packet
75e22910	422	* @family: protocol family
5778eabd PM	423	* @ad: the audit data
	424	*
	425	* Description:
	426	* Fetch the NetLabel security attributes from @skb and perform an access check
	427	* against the receiving socket. Returns zero on success, negative values on
	428	* error.
	429	*
	430	*/
	431	int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
	432	struct sk_buff *skb,
75e22910	433	u16 family,
2bf49690	434	struct common_audit_data *ad)
5778eabd PM	435	{
5778eabd PM	436	int rc;
f36158c4 PM	437	u32 nlbl_sid;
	438	u32 perm;
	439	struct netlbl_lsm_secattr secattr;
5778eabd	440
23bcdc1a PM	441	if (!netlbl_enabled())
	442	return 0;
	443
f36158c4	444	netlbl_secattr_init(&secattr);
75e22910	445	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	446	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	447	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	448	&secattr, &nlbl_sid);
5dbe1eb0	449	else
f36158c4 PM	450	nlbl_sid = SECINITSID_UNLABELED;
f36158c4 PM	451	netlbl_secattr_destroy(&secattr);
5778eabd PM	452	if (rc != 0)
5778eabd PM	453	return rc;
8d9107e8	454
5778eabd PM	455	switch (sksec->sclass) {
5778eabd PM	456	case SECCLASS_UDP_SOCKET:
f36158c4	457	perm = UDP_SOCKET__RECVFROM;
5778eabd PM	458	break;
5778eabd PM	459	case SECCLASS_TCP_SOCKET:
f36158c4	460	perm = TCP_SOCKET__RECVFROM;
5778eabd PM	461	break;
5778eabd PM	462	default:
f36158c4	463	perm = RAWIP_SOCKET__RECVFROM;
5778eabd PM	464	}
5778eabd PM	465
e67b7985	466	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
5778eabd PM	467	if (rc == 0)
	468	return 0;
	469
f36158c4	470	if (nlbl_sid != SECINITSID_UNLABELED)
a04e71f6	471	netlbl_skbuff_err(skb, family, rc, 0);
5778eabd PM	472	return rc;
	473	}
	474
1f440c99 HD	475	/**
	476	* selinux_netlbl_option - Is this a NetLabel option
	477	* @level: the socket level or protocol
	478	* @optname: the socket option name
	479	*
	480	* Description:
	481	* Returns true if @level and @optname refer to a NetLabel option.
	482	* Helper for selinux_netlbl_socket_setsockopt().
	483	*/
	484	static inline int selinux_netlbl_option(int level, int optname)
	485	{
	486	return (level == IPPROTO_IP && optname == IP_OPTIONS) \|\|
	487	(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
	488	}
	489
5778eabd PM	490	/**
	491	* selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
	492	* @sock: the socket
	493	* @level: the socket level or protocol
	494	* @optname: the socket option name
	495	*
	496	* Description:
	497	* Check the setsockopt() call and if the user is trying to replace the IP
	498	* options on a socket and a NetLabel is in place for the socket deny the
	499	* access; otherwise allow the access. Returns zero when the access is
	500	* allowed, -EACCES when denied, and other negative values on error.
	501	*
	502	*/
	503	int selinux_netlbl_socket_setsockopt(struct socket *sock,
	504	int level,
	505	int optname)
	506	{
	507	int rc = 0;
ba6ff9f2 PM	508	struct sock *sk = sock->sk;
ba6ff9f2 PM	509	struct sk_security_struct *sksec = sk->sk_security;
5778eabd PM	510	struct netlbl_lsm_secattr secattr;
5778eabd PM	511
1f440c99	512	if (selinux_netlbl_option(level, optname) &&
014ab19a PM	513	(sksec->nlbl_state == NLBL_LABELED \|\|
014ab19a PM	514	sksec->nlbl_state == NLBL_CONNLABELED)) {
5778eabd	515	netlbl_secattr_init(&secattr);
ba6ff9f2	516	lock_sock(sk);
050d032b PM	517	/* call the netlabel function directly as we want to see the
	518	* on-the-wire label that is assigned via the socket's options
	519	* and not the cached netlabel/lsm attributes */
ba6ff9f2 PM	520	rc = netlbl_sock_getattr(sk, &secattr);
ba6ff9f2 PM	521	release_sock(sk);
09c50b4a	522	if (rc == 0)
5778eabd	523	rc = -EACCES;
09c50b4a PM	524	else if (rc == -ENOMSG)
09c50b4a PM	525	rc = 0;
5778eabd PM	526	netlbl_secattr_destroy(&secattr);
5778eabd PM	527	}
5778eabd PM	528
	529	return rc;
	530	}
014ab19a PM	531
014ab19a PM	532	/**
d452930f RH	533	* selinux_netlbl_socket_connect_helper - Help label a client-side socket on
d452930f RH	534	* connect
014ab19a PM	535	* @sk: the socket to label
	536	* @addr: the destination address
	537	*
	538	* Description:
	539	* Attempt to label a connected socket with NetLabel using the given address.
	540	* Returns zero values on success, negative values on failure.
	541	*
	542	*/
d452930f RH	543	static int selinux_netlbl_socket_connect_helper(struct sock *sk,
d452930f RH	544	struct sockaddr *addr)
014ab19a PM	545	{
	546	int rc;
	547	struct sk_security_struct *sksec = sk->sk_security;
6c5b3fc0	548	struct netlbl_lsm_secattr *secattr;
014ab19a	549
014ab19a PM	550	/* connected sockets are allowed to disconnect when the address family
	551	* is set to AF_UNSPEC, if that is what is happening we want to reset
	552	* the socket */
	553	if (addr->sa_family == AF_UNSPEC) {
	554	netlbl_sock_delattr(sk);
	555	sksec->nlbl_state = NLBL_REQSKB;
	556	rc = 0;
d452930f	557	return rc;
014ab19a	558	}
6c5b3fc0 PM	559	secattr = selinux_netlbl_sock_genattr(sk);
	560	if (secattr == NULL) {
	561	rc = -ENOMEM;
d452930f	562	return rc;
6c5b3fc0 PM	563	}
	564	rc = netlbl_conn_setattr(sk, addr, secattr);
	565	if (rc == 0)
	566	sksec->nlbl_state = NLBL_CONNLABELED;
014ab19a	567
d452930f RH	568	return rc;
	569	}
	570
	571	/**
	572	* selinux_netlbl_socket_connect_locked - Label a client-side socket on
	573	* connect
	574	* @sk: the socket to label
	575	* @addr: the destination address
	576	*
	577	* Description:
	578	* Attempt to label a connected socket that already has the socket locked
	579	* with NetLabel using the given address.
	580	* Returns zero values on success, negative values on failure.
	581	*
	582	*/
	583	int selinux_netlbl_socket_connect_locked(struct sock *sk,
	584	struct sockaddr *addr)
	585	{
	586	struct sk_security_struct *sksec = sk->sk_security;
	587
	588	if (sksec->nlbl_state != NLBL_REQSKB &&
	589	sksec->nlbl_state != NLBL_CONNLABELED)
	590	return 0;
	591
	592	return selinux_netlbl_socket_connect_helper(sk, addr);
	593	}
	594
	595	/**
	596	* selinux_netlbl_socket_connect - Label a client-side socket on connect
	597	* @sk: the socket to label
	598	* @addr: the destination address
	599	*
	600	* Description:
	601	* Attempt to label a connected socket with NetLabel using the given address.
	602	* Returns zero values on success, negative values on failure.
	603	*
	604	*/
	605	int selinux_netlbl_socket_connect(struct sock sk, struct sockaddr addr)
	606	{
	607	int rc;
	608
	609	lock_sock(sk);
	610	rc = selinux_netlbl_socket_connect_locked(sk, addr);
42d64e1a	611	release_sock(sk);
d452930f	612
014ab19a PM	613	return rc;
014ab19a PM	614	}