[linux.git] / security / selinux / netlabel.c

/*
 * SELinux NetLabel Support
 *
 * This file provides the necessary glue to tie NetLabel into the SELinux
 * subsystem.
 *
 * Author: Paul Moore <[email protected]>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
 *
 * This program is free software;  you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program;  if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */

#include <linux/spinlock.h>
#include <linux/rcupdate.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/sock.h>
#include <net/netlabel.h>
#include <net/ip.h>
#include <net/ipv6.h>

#include "objsec.h"
#include "security.h"
#include "netlabel.h"

/**
 * selinux_netlbl_sidlookup_cached - Cache a SID lookup
 * @skb: the packet
 * @secattr: the NetLabel security attributes
 * @sid: the SID
 *
 * Description:
 * Query the SELinux security server to lookup the correct SID for the given
 * security attributes.  If the query is successful, cache the result to speed
 * up future lookups.  Returns zero on success, negative values on failure.
 *
 */
static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
					   u16 family,
					   struct netlbl_lsm_secattr *secattr,
					   u32 *sid)
{
	int rc;

	rc = security_netlbl_secattr_to_sid(secattr, sid);
	if (rc == 0 &&
	    (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	    (secattr->flags & NETLBL_SECATTR_CACHE))
		netlbl_cache_add(skb, family, secattr);

	return rc;
}

/**
 * selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
 * @sk: the socket
 *
 * Description:
 * Generate the NetLabel security attributes for a socket, making full use of
 * the socket's attribute cache.  Returns a pointer to the security attributes
 * on success, NULL on failure.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_secattr != NULL)
		return sksec->nlbl_secattr;

	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	if (secattr == NULL)
		return NULL;
	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
	if (rc != 0) {
		netlbl_secattr_free(secattr);
		return NULL;
	}
	sksec->nlbl_secattr = secattr;

	return secattr;
}

/**
 * selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
 * @sk: the socket
 * @sid: the SID
 *
 * Query the socket's cached secattr and if the SID matches the cached value
 * return the cache, otherwise return NULL.
 *
 */
static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
							const struct sock *sk,
							u32 sid)
{
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;

	if (secattr == NULL)
		return NULL;

	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	    (secattr->attr.secid == sid))
		return secattr;

	return NULL;
}

/**
 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
 *
 * Description:
 * Invalidate the NetLabel security attribute mapping cache.
 *
 */
void selinux_netlbl_cache_invalidate(void)
{
	netlbl_cache_invalidate();
}

/**
 * selinux_netlbl_err - Handle a NetLabel packet error
 * @skb: the packet
 * @error: the error code
 * @gateway: true if host is acting as a gateway, false otherwise
 *
 * Description:
 * When a packet is dropped due to a call to avc_has_perm() pass the error
 * code to the NetLabel subsystem so any protocol specific processing can be
 * done.  This is safe to call even if you are unsure if NetLabel labeling is
 * present on the packet, NetLabel is smart enough to only act when it should.
 *
 */
void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
{
	netlbl_skbuff_err(skb, family, error, gateway);
}

/**
 * selinux_netlbl_sk_security_free - Free the NetLabel fields
 * @sksec: the sk_security_struct
 *
 * Description:
 * Free all of the memory in the NetLabel fields of a sk_security_struct.
 *
 */
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
{
	if (sksec->nlbl_secattr != NULL)
		netlbl_secattr_free(sksec->nlbl_secattr);
}

/**
 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
 * @sksec: the sk_security_struct
 * @family: the socket family
 *
 * Description:
 * Called when the NetLabel state of a sk_security_struct needs to be reset.
 * The caller is responsible for all the NetLabel sk_security_struct locking.
 *
 */
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
{
	sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
 * @skb: the packet
 * @family: protocol family
 * @type: NetLabel labeling protocol type
 * @sid: the SID
 *
 * Description:
 * Call the NetLabel mechanism to get the security attributes of the given
 * packet and use those attributes to determine the correct context/SID to
 * assign to the packet.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
				 u16 family,
				 u32 *type,
				 u32 *sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled()) {
		*sid = SECSID_NULL;
		return 0;
	}

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, sid);
	else
		*sid = SECSID_NULL;
	*type = secattr.type;
	netlbl_secattr_destroy(&secattr);

	return rc;
}

/**
 * selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
 * @skb: the packet
 * @family: protocol family
 * @sid: the SID
 *
 * Description
 * Call the NetLabel mechanism to set the label of a packet using @sid.
 * Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
				 u16 family,
				 u32 sid)
{
	int rc;
	struct netlbl_lsm_secattr secattr_storage;
	struct netlbl_lsm_secattr *secattr = NULL;
	struct sock *sk;

	/* if this is a locally generated packet check to see if it is already
	 * being labeled by it's parent socket, if it is just exit */
	sk = skb_to_full_sk(skb);
	if (sk != NULL) {
		struct sk_security_struct *sksec = sk->sk_security;
		if (sksec->nlbl_state != NLBL_REQSKB)
			return 0;
		secattr = selinux_netlbl_sock_getattr(sk, sid);
	}
	if (secattr == NULL) {
		secattr = &secattr_storage;
		netlbl_secattr_init(secattr);
		rc = security_netlbl_sid_to_secattr(sid, secattr);
		if (rc != 0)
			goto skbuff_setsid_return;
	}

	rc = netlbl_skbuff_setattr(skb, family, secattr);

skbuff_setsid_return:
	if (secattr == &secattr_storage)
		netlbl_secattr_destroy(secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_conn_request - Label an incoming stream connection
 * @req: incoming connection request socket
 *
 * Description:
 * A new incoming connection request is represented by @req, we need to label
 * the new request_sock here and the stack will ensure the on-the-wire label
 * will get preserved when a full sock is created once the connection handshake
 * is complete.  Returns zero on success, negative values on failure.
 *
 */
int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
{
	int rc;
	struct netlbl_lsm_secattr secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	netlbl_secattr_init(&secattr);
	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
	if (rc != 0)
		goto inet_conn_request_return;
	rc = netlbl_req_setattr(req, &secattr);
inet_conn_request_return:
	netlbl_secattr_destroy(&secattr);
	return rc;
}

/**
 * selinux_netlbl_inet_csk_clone - Initialize the newly created sock
 * @sk: the new sock
 *
 * Description:
 * A new connection has been established using @sk, we've already labeled the
 * socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
 * we need to set the NetLabel state here since we now have a sock structure.
 *
 */
void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
{
	struct sk_security_struct *sksec = sk->sk_security;

	if (family == PF_INET)
		sksec->nlbl_state = NLBL_LABELED;
	else
		sksec->nlbl_state = NLBL_UNSET;
}

/**
 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
 * @sock: the socket to label
 * @family: protocol family
 *
 * Description:
 * Attempt to label a socket using the NetLabel mechanism using the given
 * SID.  Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (family != PF_INET && family != PF_INET6)
		return 0;

	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL)
		return -ENOMEM;
	rc = netlbl_sock_setattr(sk, family, secattr);
	switch (rc) {
	case 0:
		sksec->nlbl_state = NLBL_LABELED;
		break;
	case -EDESTADDRREQ:
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		break;
	}

	return rc;
}

/**
 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
 * @sksec: the sock's sk_security_struct
 * @skb: the packet
 * @family: protocol family
 * @ad: the audit data
 *
 * Description:
 * Fetch the NetLabel security attributes from @skb and perform an access check
 * against the receiving socket.  Returns zero on success, negative values on
 * error.
 *
 */
int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
				struct sk_buff *skb,
				u16 family,
				struct common_audit_data *ad)
{
	int rc;
	u32 nlbl_sid;
	u32 perm;
	struct netlbl_lsm_secattr secattr;

	if (!netlbl_enabled())
		return 0;

	netlbl_secattr_init(&secattr);
	rc = netlbl_skbuff_getattr(skb, family, &secattr);
	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
		rc = selinux_netlbl_sidlookup_cached(skb, family,
						     &secattr, &nlbl_sid);
	else
		nlbl_sid = SECINITSID_UNLABELED;
	netlbl_secattr_destroy(&secattr);
	if (rc != 0)
		return rc;

	switch (sksec->sclass) {
	case SECCLASS_UDP_SOCKET:
		perm = UDP_SOCKET__RECVFROM;
		break;
	case SECCLASS_TCP_SOCKET:
		perm = TCP_SOCKET__RECVFROM;
		break;
	default:
		perm = RAWIP_SOCKET__RECVFROM;
	}

	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
	if (rc == 0)
		return 0;

	if (nlbl_sid != SECINITSID_UNLABELED)
		netlbl_skbuff_err(skb, family, rc, 0);
	return rc;
}

/**
 * selinux_netlbl_option - Is this a NetLabel option
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Returns true if @level and @optname refer to a NetLabel option.
 * Helper for selinux_netlbl_socket_setsockopt().
 */
static inline int selinux_netlbl_option(int level, int optname)
{
	return (level == IPPROTO_IP && optname == IP_OPTIONS) ||
		(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
}

/**
 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
 * @sock: the socket
 * @level: the socket level or protocol
 * @optname: the socket option name
 *
 * Description:
 * Check the setsockopt() call and if the user is trying to replace the IP
 * options on a socket and a NetLabel is in place for the socket deny the
 * access; otherwise allow the access.  Returns zero when the access is
 * allowed, -EACCES when denied, and other negative values on error.
 *
 */
int selinux_netlbl_socket_setsockopt(struct socket *sock,
				     int level,
				     int optname)
{
	int rc = 0;
	struct sock *sk = sock->sk;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr secattr;

	if (selinux_netlbl_option(level, optname) &&
	    (sksec->nlbl_state == NLBL_LABELED ||
	     sksec->nlbl_state == NLBL_CONNLABELED)) {
		netlbl_secattr_init(&secattr);
		lock_sock(sk);
		/* call the netlabel function directly as we want to see the
		 * on-the-wire label that is assigned via the socket's options
		 * and not the cached netlabel/lsm attributes */
		rc = netlbl_sock_getattr(sk, &secattr);
		release_sock(sk);
		if (rc == 0)
			rc = -EACCES;
		else if (rc == -ENOMSG)
			rc = 0;
		netlbl_secattr_destroy(&secattr);
	}

	return rc;
}

/**
 * selinux_netlbl_socket_connect - Label a client-side socket on connect
 * @sk: the socket to label
 * @addr: the destination address
 *
 * Description:
 * Attempt to label a connected socket with NetLabel using the given address.
 * Returns zero values on success, negative values on failure.
 *
 */
int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
{
	int rc;
	struct sk_security_struct *sksec = sk->sk_security;
	struct netlbl_lsm_secattr *secattr;

	if (sksec->nlbl_state != NLBL_REQSKB &&
	    sksec->nlbl_state != NLBL_CONNLABELED)
		return 0;

	lock_sock(sk);

	/* connected sockets are allowed to disconnect when the address family
	 * is set to AF_UNSPEC, if that is what is happening we want to reset
	 * the socket */
	if (addr->sa_family == AF_UNSPEC) {
		netlbl_sock_delattr(sk);
		sksec->nlbl_state = NLBL_REQSKB;
		rc = 0;
		goto socket_connect_return;
	}
	secattr = selinux_netlbl_sock_genattr(sk);
	if (secattr == NULL) {
		rc = -ENOMEM;
		goto socket_connect_return;
	}
	rc = netlbl_conn_setattr(sk, addr, secattr);
	if (rc == 0)
		sksec->nlbl_state = NLBL_CONNLABELED;

socket_connect_return:
	release_sock(sk);
	return rc;
}
Commit	Line	Data
5778eabd PM	1	/*
	2	* SELinux NetLabel Support
	3	*
	4	* This file provides the necessary glue to tie NetLabel into the SELinux
	5	* subsystem.
	6	*
82c21bfa	7	* Author: Paul Moore <[email protected]>
5778eabd PM	8	*
	9	*/
	10
	11	/*
948bf85c	12	* (c) Copyright Hewlett-Packard Development Company, L.P., 2007, 2008
5778eabd PM	13	*
	14	* This program is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU General Public License as published by
	16	* the Free Software Foundation; either version 2 of the License, or
	17	* (at your option) any later version.
	18	*
	19	* This program is distributed in the hope that it will be useful,
	20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	22	* the GNU General Public License for more details.
	23	*
	24	* You should have received a copy of the GNU General Public License
	25	* along with this program; if not, write to the Free Software
	26	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	27	*
	28	*/
	29
	30	#include <linux/spinlock.h>
	31	#include <linux/rcupdate.h>
5a0e3ad6	32	#include <linux/gfp.h>
014ab19a PM	33	#include <linux/ip.h>
014ab19a PM	34	#include <linux/ipv6.h>
5778eabd PM	35	#include <net/sock.h>
5778eabd PM	36	#include <net/netlabel.h>
014ab19a PM	37	#include <net/ip.h>
014ab19a PM	38	#include <net/ipv6.h>
5778eabd PM	39
	40	#include "objsec.h"
	41	#include "security.h"
d4ee4231	42	#include "netlabel.h"
5778eabd	43
5dbe1eb0 PM	44	/**
	45	* selinux_netlbl_sidlookup_cached - Cache a SID lookup
	46	* @skb: the packet
	47	* @secattr: the NetLabel security attributes
	48	* @sid: the SID
	49	*
	50	* Description:
	51	* Query the SELinux security server to lookup the correct SID for the given
	52	* security attributes. If the query is successful, cache the result to speed
	53	* up future lookups. Returns zero on success, negative values on failure.
	54	*
	55	*/
	56	static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
4fee5242	57	u16 family,
5dbe1eb0 PM	58	struct netlbl_lsm_secattr *secattr,
	59	u32 *sid)
	60	{
	61	int rc;
	62
	63	rc = security_netlbl_secattr_to_sid(secattr, sid);
	64	if (rc == 0 &&
	65	(secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
	66	(secattr->flags & NETLBL_SECATTR_CACHE))
4fee5242	67	netlbl_cache_add(skb, family, secattr);
5dbe1eb0 PM	68
	69	return rc;
	70	}
	71
6c5b3fc0 PM	72	/**
	73	* selinux_netlbl_sock_genattr - Generate the NetLabel socket secattr
	74	* @sk: the socket
	75	*
	76	* Description:
	77	* Generate the NetLabel security attributes for a socket, making full use of
	78	* the socket's attribute cache. Returns a pointer to the security attributes
	79	* on success, NULL on failure.
	80	*
	81	*/
	82	static struct netlbl_lsm_secattr selinux_netlbl_sock_genattr(struct sock sk)
	83	{
	84	int rc;
	85	struct sk_security_struct *sksec = sk->sk_security;
	86	struct netlbl_lsm_secattr *secattr;
	87
	88	if (sksec->nlbl_secattr != NULL)
	89	return sksec->nlbl_secattr;
	90
	91	secattr = netlbl_secattr_alloc(GFP_ATOMIC);
	92	if (secattr == NULL)
	93	return NULL;
	94	rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
	95	if (rc != 0) {
	96	netlbl_secattr_free(secattr);
	97	return NULL;
	98	}
	99	sksec->nlbl_secattr = secattr;
	100
	101	return secattr;
	102	}
	103
050d032b PM	104	/**
	105	* selinux_netlbl_sock_getattr - Get the cached NetLabel secattr
	106	* @sk: the socket
	107	* @sid: the SID
	108	*
	109	* Query the socket's cached secattr and if the SID matches the cached value
	110	* return the cache, otherwise return NULL.
	111	*
	112	*/
	113	static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr(
	114	const struct sock *sk,
	115	u32 sid)
	116	{
	117	struct sk_security_struct *sksec = sk->sk_security;
	118	struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr;
	119
	120	if (secattr == NULL)
	121	return NULL;
	122
	123	if ((secattr->flags & NETLBL_SECATTR_SECID) &&
	124	(secattr->attr.secid == sid))
	125	return secattr;
	126
	127	return NULL;
	128	}
	129
5778eabd PM	130	/**
	131	* selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
	132	*
	133	* Description:
	134	* Invalidate the NetLabel security attribute mapping cache.
	135	*
	136	*/
	137	void selinux_netlbl_cache_invalidate(void)
	138	{
	139	netlbl_cache_invalidate();
	140	}
	141
dfaebe98 PM	142	/**
	143	* selinux_netlbl_err - Handle a NetLabel packet error
	144	* @skb: the packet
	145	* @error: the error code
	146	* @gateway: true if host is acting as a gateway, false otherwise
	147	*
	148	* Description:
	149	* When a packet is dropped due to a call to avc_has_perm() pass the error
	150	* code to the NetLabel subsystem so any protocol specific processing can be
	151	* done. This is safe to call even if you are unsure if NetLabel labeling is
	152	* present on the packet, NetLabel is smart enough to only act when it should.
	153	*
	154	*/
a04e71f6	155	void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
dfaebe98	156	{
a04e71f6	157	netlbl_skbuff_err(skb, family, error, gateway);
dfaebe98 PM	158	}
dfaebe98 PM	159
6c5b3fc0 PM	160	/**
6c5b3fc0 PM	161	* selinux_netlbl_sk_security_free - Free the NetLabel fields
dd3e7836	162	* @sksec: the sk_security_struct
6c5b3fc0 PM	163	*
	164	* Description:
	165	* Free all of the memory in the NetLabel fields of a sk_security_struct.
	166	*
	167	*/
dd3e7836	168	void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
6c5b3fc0	169	{
dd3e7836 EP	170	if (sksec->nlbl_secattr != NULL)
dd3e7836 EP	171	netlbl_secattr_free(sksec->nlbl_secattr);
6c5b3fc0 PM	172	}
6c5b3fc0 PM	173
5778eabd PM	174	/**
5778eabd PM	175	* selinux_netlbl_sk_security_reset - Reset the NetLabel fields
dd3e7836	176	* @sksec: the sk_security_struct
5778eabd PM	177	* @family: the socket family
	178	*
	179	* Description:
	180	* Called when the NetLabel state of a sk_security_struct needs to be reset.
25985edc	181	* The caller is responsible for all the NetLabel sk_security_struct locking.
5778eabd PM	182	*
5778eabd PM	183	*/
dd3e7836	184	void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
5778eabd	185	{
dd3e7836	186	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	187	}
5778eabd PM	188
5778eabd PM	189	/**
	190	* selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
	191	* @skb: the packet
75e22910	192	* @family: protocol family
220deb96	193	* @type: NetLabel labeling protocol type
5778eabd PM	194	* @sid: the SID
	195	*
	196	* Description:
	197	* Call the NetLabel mechanism to get the security attributes of the given
	198	* packet and use those attributes to determine the correct context/SID to
	199	* assign to the packet. Returns zero on success, negative values on failure.
	200	*
	201	*/
75e22910 PM	202	int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
75e22910 PM	203	u16 family,
220deb96	204	u32 *type,
75e22910	205	u32 *sid)
5778eabd PM	206	{
	207	int rc;
	208	struct netlbl_lsm_secattr secattr;
	209
23bcdc1a PM	210	if (!netlbl_enabled()) {
	211	*sid = SECSID_NULL;
	212	return 0;
	213	}
	214
5778eabd	215	netlbl_secattr_init(&secattr);
75e22910	216	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	217	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	218	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	219	&secattr, sid);
5dbe1eb0	220	else
5778eabd	221	*sid = SECSID_NULL;
220deb96	222	*type = secattr.type;
5778eabd PM	223	netlbl_secattr_destroy(&secattr);
	224
	225	return rc;
	226	}
	227
948bf85c PM	228	/**
	229	* selinux_netlbl_skbuff_setsid - Set the NetLabel on a packet given a sid
	230	* @skb: the packet
	231	* @family: protocol family
	232	* @sid: the SID
	233	*
	234	* Description
	235	* Call the NetLabel mechanism to set the label of a packet using @sid.
af901ca1	236	* Returns zero on success, negative values on failure.
948bf85c PM	237	*
	238	*/
	239	int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
	240	u16 family,
	241	u32 sid)
	242	{
	243	int rc;
6c5b3fc0 PM	244	struct netlbl_lsm_secattr secattr_storage;
6c5b3fc0 PM	245	struct netlbl_lsm_secattr *secattr = NULL;
948bf85c PM	246	struct sock *sk;
	247
	248	/* if this is a locally generated packet check to see if it is already
	249	* being labeled by it's parent socket, if it is just exit */
54abc686	250	sk = skb_to_full_sk(skb);
948bf85c PM	251	if (sk != NULL) {
	252	struct sk_security_struct *sksec = sk->sk_security;
	253	if (sksec->nlbl_state != NLBL_REQSKB)
	254	return 0;
050d032b	255	secattr = selinux_netlbl_sock_getattr(sk, sid);
6c5b3fc0 PM	256	}
	257	if (secattr == NULL) {
	258	secattr = &secattr_storage;
	259	netlbl_secattr_init(secattr);
	260	rc = security_netlbl_sid_to_secattr(sid, secattr);
	261	if (rc != 0)
	262	goto skbuff_setsid_return;
948bf85c PM	263	}
948bf85c PM	264
6c5b3fc0	265	rc = netlbl_skbuff_setattr(skb, family, secattr);
948bf85c PM	266
948bf85c PM	267	skbuff_setsid_return:
6c5b3fc0 PM	268	if (secattr == &secattr_storage)
6c5b3fc0 PM	269	netlbl_secattr_destroy(secattr);
948bf85c PM	270	return rc;
	271	}
	272
5778eabd	273	/**
389fb800 PM	274	* selinux_netlbl_inet_conn_request - Label an incoming stream connection
389fb800 PM	275	* @req: incoming connection request socket
5778eabd PM	276	*
5778eabd PM	277	* Description:
389fb800 PM	278	* A new incoming connection request is represented by @req, we need to label
	279	* the new request_sock here and the stack will ensure the on-the-wire label
	280	* will get preserved when a full sock is created once the connection handshake
	281	* is complete. Returns zero on success, negative values on failure.
5778eabd PM	282	*
5778eabd PM	283	*/
389fb800	284	int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
5778eabd	285	{
014ab19a	286	int rc;
389fb800	287	struct netlbl_lsm_secattr secattr;
014ab19a	288
e1adea92	289	if (family != PF_INET && family != PF_INET6)
389fb800	290	return 0;
014ab19a	291
389fb800 PM	292	netlbl_secattr_init(&secattr);
	293	rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
	294	if (rc != 0)
	295	goto inet_conn_request_return;
	296	rc = netlbl_req_setattr(req, &secattr);
	297	inet_conn_request_return:
	298	netlbl_secattr_destroy(&secattr);
	299	return rc;
5778eabd PM	300	}
	301
	302	/**
389fb800 PM	303	* selinux_netlbl_inet_csk_clone - Initialize the newly created sock
389fb800 PM	304	* @sk: the new sock
5778eabd PM	305	*
5778eabd PM	306	* Description:
389fb800 PM	307	* A new connection has been established using @sk, we've already labeled the
	308	* socket via the request_sock struct in selinux_netlbl_inet_conn_request() but
	309	* we need to set the NetLabel state here since we now have a sock structure.
5778eabd PM	310	*
5778eabd PM	311	*/
389fb800	312	void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
5778eabd	313	{
389fb800 PM	314	struct sk_security_struct *sksec = sk->sk_security;
	315
	316	if (family == PF_INET)
	317	sksec->nlbl_state = NLBL_LABELED;
	318	else
	319	sksec->nlbl_state = NLBL_UNSET;
5778eabd PM	320	}
	321
	322	/**
389fb800 PM	323	* selinux_netlbl_socket_post_create - Label a socket using NetLabel
	324	* @sock: the socket to label
	325	* @family: protocol family
5778eabd PM	326	*
5778eabd PM	327	* Description:
389fb800 PM	328	* Attempt to label a socket using the NetLabel mechanism using the given
389fb800 PM	329	* SID. Returns zero values on success, negative values on failure.
5778eabd PM	330	*
5778eabd PM	331	*/
389fb800	332	int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
5778eabd PM	333	{
5778eabd PM	334	int rc;
389fb800 PM	335	struct sk_security_struct *sksec = sk->sk_security;
389fb800 PM	336	struct netlbl_lsm_secattr *secattr;
5778eabd	337
ceba1832	338	if (family != PF_INET && family != PF_INET6)
5778eabd	339	return 0;
f74af6e8	340
389fb800 PM	341	secattr = selinux_netlbl_sock_genattr(sk);
	342	if (secattr == NULL)
	343	return -ENOMEM;
	344	rc = netlbl_sock_setattr(sk, family, secattr);
	345	switch (rc) {
	346	case 0:
	347	sksec->nlbl_state = NLBL_LABELED;
	348	break;
	349	case -EDESTADDRREQ:
	350	sksec->nlbl_state = NLBL_REQSKB;
f74af6e8	351	rc = 0;
389fb800 PM	352	break;
389fb800 PM	353	}
5778eabd PM	354
	355	return rc;
	356	}
	357
	358	/**
	359	* selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
	360	* @sksec: the sock's sk_security_struct
	361	* @skb: the packet
75e22910	362	* @family: protocol family
5778eabd PM	363	* @ad: the audit data
	364	*
	365	* Description:
	366	* Fetch the NetLabel security attributes from @skb and perform an access check
	367	* against the receiving socket. Returns zero on success, negative values on
	368	* error.
	369	*
	370	*/
	371	int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
	372	struct sk_buff *skb,
75e22910	373	u16 family,
2bf49690	374	struct common_audit_data *ad)
5778eabd PM	375	{
5778eabd PM	376	int rc;
f36158c4 PM	377	u32 nlbl_sid;
	378	u32 perm;
	379	struct netlbl_lsm_secattr secattr;
5778eabd	380
23bcdc1a PM	381	if (!netlbl_enabled())
	382	return 0;
	383
f36158c4	384	netlbl_secattr_init(&secattr);
75e22910	385	rc = netlbl_skbuff_getattr(skb, family, &secattr);
5dbe1eb0	386	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
4fee5242 HD	387	rc = selinux_netlbl_sidlookup_cached(skb, family,
4fee5242 HD	388	&secattr, &nlbl_sid);
5dbe1eb0	389	else
f36158c4 PM	390	nlbl_sid = SECINITSID_UNLABELED;
f36158c4 PM	391	netlbl_secattr_destroy(&secattr);
5778eabd PM	392	if (rc != 0)
5778eabd PM	393	return rc;
8d9107e8	394
5778eabd PM	395	switch (sksec->sclass) {
5778eabd PM	396	case SECCLASS_UDP_SOCKET:
f36158c4	397	perm = UDP_SOCKET__RECVFROM;
5778eabd PM	398	break;
5778eabd PM	399	case SECCLASS_TCP_SOCKET:
f36158c4	400	perm = TCP_SOCKET__RECVFROM;
5778eabd PM	401	break;
5778eabd PM	402	default:
f36158c4	403	perm = RAWIP_SOCKET__RECVFROM;
5778eabd PM	404	}
5778eabd PM	405
f36158c4	406	rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
5778eabd PM	407	if (rc == 0)
	408	return 0;
	409
f36158c4	410	if (nlbl_sid != SECINITSID_UNLABELED)
a04e71f6	411	netlbl_skbuff_err(skb, family, rc, 0);
5778eabd PM	412	return rc;
	413	}
	414
1f440c99 HD	415	/**
	416	* selinux_netlbl_option - Is this a NetLabel option
	417	* @level: the socket level or protocol
	418	* @optname: the socket option name
	419	*
	420	* Description:
	421	* Returns true if @level and @optname refer to a NetLabel option.
	422	* Helper for selinux_netlbl_socket_setsockopt().
	423	*/
	424	static inline int selinux_netlbl_option(int level, int optname)
	425	{
	426	return (level == IPPROTO_IP && optname == IP_OPTIONS) \|\|
	427	(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
	428	}
	429
5778eabd PM	430	/**
	431	* selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
	432	* @sock: the socket
	433	* @level: the socket level or protocol
	434	* @optname: the socket option name
	435	*
	436	* Description:
	437	* Check the setsockopt() call and if the user is trying to replace the IP
	438	* options on a socket and a NetLabel is in place for the socket deny the
	439	* access; otherwise allow the access. Returns zero when the access is
	440	* allowed, -EACCES when denied, and other negative values on error.
	441	*
	442	*/
	443	int selinux_netlbl_socket_setsockopt(struct socket *sock,
	444	int level,
	445	int optname)
	446	{
	447	int rc = 0;
ba6ff9f2 PM	448	struct sock *sk = sock->sk;
ba6ff9f2 PM	449	struct sk_security_struct *sksec = sk->sk_security;
5778eabd PM	450	struct netlbl_lsm_secattr secattr;
5778eabd PM	451
1f440c99	452	if (selinux_netlbl_option(level, optname) &&
014ab19a PM	453	(sksec->nlbl_state == NLBL_LABELED \|\|
014ab19a PM	454	sksec->nlbl_state == NLBL_CONNLABELED)) {
5778eabd	455	netlbl_secattr_init(&secattr);
ba6ff9f2	456	lock_sock(sk);
050d032b PM	457	/* call the netlabel function directly as we want to see the
	458	* on-the-wire label that is assigned via the socket's options
	459	* and not the cached netlabel/lsm attributes */
ba6ff9f2 PM	460	rc = netlbl_sock_getattr(sk, &secattr);
ba6ff9f2 PM	461	release_sock(sk);
09c50b4a	462	if (rc == 0)
5778eabd	463	rc = -EACCES;
09c50b4a PM	464	else if (rc == -ENOMSG)
09c50b4a PM	465	rc = 0;
5778eabd PM	466	netlbl_secattr_destroy(&secattr);
5778eabd PM	467	}
5778eabd PM	468
	469	return rc;
	470	}
014ab19a PM	471
	472	/**
	473	* selinux_netlbl_socket_connect - Label a client-side socket on connect
	474	* @sk: the socket to label
	475	* @addr: the destination address
	476	*
	477	* Description:
	478	* Attempt to label a connected socket with NetLabel using the given address.
	479	* Returns zero values on success, negative values on failure.
	480	*
	481	*/
	482	int selinux_netlbl_socket_connect(struct sock sk, struct sockaddr addr)
	483	{
	484	int rc;
	485	struct sk_security_struct *sksec = sk->sk_security;
6c5b3fc0	486	struct netlbl_lsm_secattr *secattr;
014ab19a PM	487
	488	if (sksec->nlbl_state != NLBL_REQSKB &&
	489	sksec->nlbl_state != NLBL_CONNLABELED)
	490	return 0;
	491
42d64e1a	492	lock_sock(sk);
014ab19a PM	493
	494	/* connected sockets are allowed to disconnect when the address family
	495	* is set to AF_UNSPEC, if that is what is happening we want to reset
	496	* the socket */
	497	if (addr->sa_family == AF_UNSPEC) {
	498	netlbl_sock_delattr(sk);
	499	sksec->nlbl_state = NLBL_REQSKB;
	500	rc = 0;
	501	goto socket_connect_return;
	502	}
6c5b3fc0 PM	503	secattr = selinux_netlbl_sock_genattr(sk);
	504	if (secattr == NULL) {
	505	rc = -ENOMEM;
014ab19a	506	goto socket_connect_return;
6c5b3fc0 PM	507	}
	508	rc = netlbl_conn_setattr(sk, addr, secattr);
	509	if (rc == 0)
	510	sksec->nlbl_state = NLBL_CONNLABELED;
014ab19a PM	511
014ab19a PM	512	socket_connect_return:
42d64e1a	513	release_sock(sk);
014ab19a PM	514	return rc;
014ab19a PM	515	}