[PATCH] SELinux: add finer grained permissions to Netlink audit processing

This patch provides finer grained permissions for the audit family of
Netlink sockets under SELinux.

1.  We need a way to differentiate between privileged and unprivileged
   reads of kernel data maintained by the audit subsystem.  The AUDIT_GET
   operation is unprivileged: it returns the current status of the audit
   subsystem (e.g.  whether it's enabled etc.).  The AUDIT_LIST operation
   however returns a list of the current audit ruleset, which is considered
   privileged by the audit folk.  To deal with this, a new SELinux
   permission has been implemented and applied to the operation:
   nlmsg_readpriv, which can be allocated to appropriately privileged
   domains.  Unprivileged domains would only be allocated nlmsg_read.

2.  There is a requirement for certain domains to generate audit events
   from userspace.  These events need to be collected by the kernel,
   collated and transmitted sequentially back to the audit daemon.  An
   example is user level login, an auditable event under CAPP, where
   login-related domains generate AUDIT_USER messages via PAM which are
   relayed back to auditd via the kernel.  To prevent handing out
   nlmsg_write permissions to such domains, a new permission has been
   added, nlmsg_relay, which is intended for this type of purpose: data is
   passed via the kernel back to userspace but no privileged information is
   written to the kernel.

Also, AUDIT_LOGIN messages are now valid only for kernel->user messaging,
so this value has been removed from the SELinux nlmsgtab (which is only
used to check user->kernel messages).

Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index eb340b45bc6f240d5d0a25c3d1f5f0e4c8d1db4f..8928bb4d3c538145e41e8db8c92ba1d67b4f0504 100644 (file)
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -220,6 +220,8 @@
    S_(SECCLASS_NETLINK_XFRM_SOCKET, NETLINK_XFRM_SOCKET__NLMSG_WRITE, "nlmsg_write")
    S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READ, "nlmsg_read")
    S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE, "nlmsg_write")
+   S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_RELAY, "nlmsg_relay")
+   S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV, "nlmsg_readpriv")
    S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read")
    S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write")
    S_(SECCLASS_DBUS, DBUS__ACQUIRE_SVC, "acquire_svc")

diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index f9de0f966559cb0cbb658c6b66f82edf2329b37f..bdfce4ca8f8e06366f7d831f8637b3af755a02b9 100644 (file)
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -840,6 +840,8 @@
 
 #define NETLINK_AUDIT_SOCKET__NLMSG_READ          0x00400000UL
 #define NETLINK_AUDIT_SOCKET__NLMSG_WRITE         0x00800000UL
+#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY         0x01000000UL
+#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV      0x02000000UL
 
 #define NETLINK_IP6FW_SOCKET__IOCTL               0x00000001UL
 #define NETLINK_IP6FW_SOCKET__READ                0x00000002UL

diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index f79408252730567a3e82e9b4a4eca445ac46a7c1..b3adb481bc250bf49c5a82aad706c6bf8c7b16db 100644 (file)
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -91,13 +91,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
 
 static struct nlmsg_perm nlmsg_audit_perms[] =
 {
-       { AUDIT_GET,            NETLINK_AUDIT_SOCKET__NLMSG_READ  },
-       { AUDIT_SET,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-       { AUDIT_LIST,           NETLINK_AUDIT_SOCKET__NLMSG_READ  },
-       { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-       { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-       { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-       { AUDIT_LOGIN,          NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
+       { AUDIT_GET,            NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+       { AUDIT_SET,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+       { AUDIT_LIST,           NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
+       { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+       { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+       { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
 };