[MLSXFRM]: Add security sid to sock

This adds security for IP sockets at the sock level. Security at the
sock level is needed to enforce the SELinux security policy for
security associations even when a sock is orphaned (such as in the TCP
LAST_ACK state).

This will also be used to enforce SELinux controls over data arriving
at or leaving a child socket while it's still waiting to be accepted.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/security.h b/include/linux/security.h
index 6bc2aad494ffcbca799907f15c005991d5ad2bb7..4d7fb59996b03a4250af3738d1ab06d37ee11136 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -812,6 +812,8 @@ struct swap_info_struct;
  *      which is used to copy security attributes between local stream sockets.
  * @sk_free_security:
  *     Deallocate security structure.
+ * @sk_clone_security:
+ *     Clone/copy security structure.
  * @sk_getsid:
  *     Retrieve the LSM-specific sid for the sock to enable caching of network
  *     authorizations.
@@ -1332,6 +1334,7 @@ struct security_operations {
        int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
        int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
        void (*sk_free_security) (struct sock *sk);
+       void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
        unsigned int (*sk_getsid) (struct sock *sk, struct flowi *fl, u8 dir);
 #endif /* CONFIG_SECURITY_NETWORK */
 
@@ -2885,6 +2888,11 @@ static inline void security_sk_free(struct sock *sk)
        return security_ops->sk_free_security(sk);
 }
 
+static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
+{
+       return security_ops->sk_clone_security(sk, newsk);
+}
+
 static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
 {
        return security_ops->sk_getsid(sk, fl, dir);
@@ -3011,6 +3019,10 @@ static inline void security_sk_free(struct sock *sk)
 {
 }
 
+static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
+{
+}
+
 static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
 {
        return 0;

diff --git a/include/net/sock.h b/include/net/sock.h
index 324b3ea233d6000f04e4d5894b799535bb397e6e..91cdceb3c028421e6b27a30d386e53d8ca0ec719 100644 (file)
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -972,6 +972,19 @@ static inline void sock_graft(struct sock *sk, struct socket *parent)
        write_unlock_bh(&sk->sk_callback_lock);
 }
 
+static inline void sock_copy(struct sock *nsk, const struct sock *osk)
+{
+#ifdef CONFIG_SECURITY_NETWORK
+       void *sptr = nsk->sk_security;
+#endif
+
+       memcpy(nsk, osk, osk->sk_prot->obj_size);
+#ifdef CONFIG_SECURITY_NETWORK
+       nsk->sk_security = sptr;
+       security_sk_clone(osk, nsk);
+#endif
+}
+
 extern int sock_i_uid(struct sock *sk);
 extern unsigned long sock_i_ino(struct sock *sk);
 

diff --git a/net/core/sock.c b/net/core/sock.c
index 51fcfbc041a73d38f0172a77c1e5e48b1224f0b7..b67d868649cdb5eacc6d38dcf914edc843c93800 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -911,7 +911,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
        if (newsk != NULL) {
                struct sk_filter *filter;
 
-               memcpy(newsk, sk, sk->sk_prot->obj_size);
+               sock_copy(newsk, sk);
 
                /* SANITY */
                sk_node_init(&newsk->sk_node);

diff --git a/security/dummy.c b/security/dummy.c
index 58c6d399c844bb483c97337adbde561d6e2980d1..bd3bc5faa9a835927a533f1a9efde5abb6ccad8e 100644 (file)
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -805,6 +805,10 @@ static inline void dummy_sk_free_security (struct sock *sk)
 {
 }
 
+static inline void dummy_sk_clone_security (const struct sock *sk, struct sock *newsk)
+{
+}
+
 static unsigned int dummy_sk_getsid(struct sock *sk, struct flowi *fl, u8 dir)
 {
        return 0;
@@ -1060,6 +1064,7 @@ void security_fixup_ops (struct security_operations *ops)
        set_to_dummy_if_null(ops, socket_getpeersec_dgram);
        set_to_dummy_if_null(ops, sk_alloc_security);
        set_to_dummy_if_null(ops, sk_free_security);
+       set_to_dummy_if_null(ops, sk_clone_security);
        set_to_dummy_if_null(ops, sk_getsid);
  #endif        /* CONFIG_SECURITY_NETWORK */
 #ifdef  CONFIG_SECURITY_NETWORK_XFRM

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5d1b8c733199ed57700757ffc1e0b0c3a8077f05..d67abf77584ae7ff8599c0fb0237a3035a3d87aa 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -269,15 +269,13 @@ static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 {
        struct sk_security_struct *ssec;
 
-       if (family != PF_UNIX)
-               return 0;
-
        ssec = kzalloc(sizeof(*ssec), priority);
        if (!ssec)
                return -ENOMEM;
 
        ssec->sk = sk;
        ssec->peer_sid = SECINITSID_UNLABELED;
+       ssec->sid = SECINITSID_UNLABELED;
        sk->sk_security = ssec;
 
        return 0;
@@ -287,9 +285,6 @@ static void sk_free_security(struct sock *sk)
 {
        struct sk_security_struct *ssec = sk->sk_security;
 
-       if (sk->sk_family != PF_UNIX)
-               return;
-
        sk->sk_security = NULL;
        kfree(ssec);
 }
@@ -3068,6 +3063,7 @@ static void selinux_socket_post_create(struct socket *sock, int family,
 {
        struct inode_security_struct *isec;
        struct task_security_struct *tsec;
+       struct sk_security_struct *sksec;
        u32 newsid;
 
        isec = SOCK_INODE(sock)->i_security;
@@ -3078,6 +3074,11 @@ static void selinux_socket_post_create(struct socket *sock, int family,
        isec->sid = kern ? SECINITSID_KERNEL : newsid;
        isec->initialized = 1;
 
+       if (sock->sk) {
+               sksec = sock->sk->sk_security;
+               sksec->sid = isec->sid;
+       }
+
        return;
 }
 
@@ -3551,22 +3552,24 @@ static void selinux_sk_free_security(struct sock *sk)
        sk_free_security(sk);
 }
 
-static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
+static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
 {
-       struct inode_security_struct *isec;
-       u32 sock_sid = SECINITSID_ANY_SOCKET;
+       struct sk_security_struct *ssec = sk->sk_security;
+       struct sk_security_struct *newssec = newsk->sk_security;
 
+       newssec->sid = ssec->sid;
+       newssec->peer_sid = ssec->peer_sid;
+}
+
+static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
+{
        if (!sk)
                return selinux_no_sk_sid(fl);
+       else {
+               struct sk_security_struct *sksec = sk->sk_security;
 
-       read_lock_bh(&sk->sk_callback_lock);
-       isec = get_sock_isec(sk);
-
-       if (isec)
-               sock_sid = isec->sid;
-
-       read_unlock_bh(&sk->sk_callback_lock);
-       return sock_sid;
+               return sksec->sid;
+       }
 }
 
 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
@@ -4618,6 +4621,7 @@ static struct security_operations selinux_ops = {
        .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
        .sk_alloc_security =            selinux_sk_alloc_security,
        .sk_free_security =             selinux_sk_free_security,
+       .sk_clone_security =            selinux_sk_clone_security,
        .sk_getsid =                    selinux_sk_getsid_security,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM

diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 940178865fc78c97e37979f215204b2e1d17fc38..79b9e0af19a0cfc6136439776b9e6a4a8d563a5d 100644 (file)
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -99,6 +99,7 @@ struct netif_security_struct {
 
 struct sk_security_struct {
        struct sock *sk;                /* back pointer to sk object */
+       u32 sid;                        /* SID of this object */
        u32 peer_sid;                   /* SID of peer */
 };