netif.c 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269
  1. /*
  2. * Network interface table.
  3. *
  4. * Network interfaces (devices) do not have a security field, so we
  5. * maintain a table associating each interface with a SID.
  6. *
  7. * Author: James Morris <jmorris@redhat.com>
  8. *
  9. * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  10. *
  11. * This program is free software; you can redistribute it and/or modify
  12. * it under the terms of the GNU General Public License version 2,
  13. * as published by the Free Software Foundation.
  14. */
  15. #include <linux/init.h>
  16. #include <linux/types.h>
  17. #include <linux/stddef.h>
  18. #include <linux/kernel.h>
  19. #include <linux/list.h>
  20. #include <linux/notifier.h>
  21. #include <linux/netdevice.h>
  22. #include <linux/rcupdate.h>
  23. #include "security.h"
  24. #include "objsec.h"
  25. #include "netif.h"
  26. #define SEL_NETIF_HASH_SIZE 64
  27. #define SEL_NETIF_HASH_MAX 1024
  28. #undef DEBUG
  29. #ifdef DEBUG
  30. #define DEBUGP printk
  31. #else
  32. #define DEBUGP(format, args...)
  33. #endif
  34. struct sel_netif
  35. {
  36. struct list_head list;
  37. struct netif_security_struct nsec;
  38. struct rcu_head rcu_head;
  39. };
  40. static u32 sel_netif_total;
  41. static LIST_HEAD(sel_netif_list);
  42. static DEFINE_SPINLOCK(sel_netif_lock);
  43. static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE];
  44. static inline u32 sel_netif_hasfn(struct net_device *dev)
  45. {
  46. return (dev->ifindex & (SEL_NETIF_HASH_SIZE - 1));
  47. }
  48. /*
  49. * All of the devices should normally fit in the hash, so we optimize
  50. * for that case.
  51. */
  52. static inline struct sel_netif *sel_netif_find(struct net_device *dev)
  53. {
  54. struct list_head *pos;
  55. int idx = sel_netif_hasfn(dev);
  56. __list_for_each_rcu(pos, &sel_netif_hash[idx]) {
  57. struct sel_netif *netif = list_entry(pos,
  58. struct sel_netif, list);
  59. if (likely(netif->nsec.dev == dev))
  60. return netif;
  61. }
  62. return NULL;
  63. }
  64. static int sel_netif_insert(struct sel_netif *netif)
  65. {
  66. int idx, ret = 0;
  67. if (sel_netif_total >= SEL_NETIF_HASH_MAX) {
  68. ret = -ENOSPC;
  69. goto out;
  70. }
  71. idx = sel_netif_hasfn(netif->nsec.dev);
  72. list_add_rcu(&netif->list, &sel_netif_hash[idx]);
  73. sel_netif_total++;
  74. out:
  75. return ret;
  76. }
  77. static void sel_netif_free(struct rcu_head *p)
  78. {
  79. struct sel_netif *netif = container_of(p, struct sel_netif, rcu_head);
  80. DEBUGP("%s: %s\n", __FUNCTION__, netif->nsec.dev->name);
  81. kfree(netif);
  82. }
  83. static void sel_netif_destroy(struct sel_netif *netif)
  84. {
  85. DEBUGP("%s: %s\n", __FUNCTION__, netif->nsec.dev->name);
  86. list_del_rcu(&netif->list);
  87. sel_netif_total--;
  88. call_rcu(&netif->rcu_head, sel_netif_free);
  89. }
  90. static struct sel_netif *sel_netif_lookup(struct net_device *dev)
  91. {
  92. int ret;
  93. struct sel_netif *netif, *new;
  94. struct netif_security_struct *nsec;
  95. netif = sel_netif_find(dev);
  96. if (likely(netif != NULL))
  97. goto out;
  98. new = kzalloc(sizeof(*new), GFP_ATOMIC);
  99. if (!new) {
  100. netif = ERR_PTR(-ENOMEM);
  101. goto out;
  102. }
  103. nsec = &new->nsec;
  104. ret = security_netif_sid(dev->name, &nsec->if_sid, &nsec->msg_sid);
  105. if (ret < 0) {
  106. kfree(new);
  107. netif = ERR_PTR(ret);
  108. goto out;
  109. }
  110. nsec->dev = dev;
  111. spin_lock_bh(&sel_netif_lock);
  112. netif = sel_netif_find(dev);
  113. if (netif) {
  114. spin_unlock_bh(&sel_netif_lock);
  115. kfree(new);
  116. goto out;
  117. }
  118. ret = sel_netif_insert(new);
  119. spin_unlock_bh(&sel_netif_lock);
  120. if (ret) {
  121. kfree(new);
  122. netif = ERR_PTR(ret);
  123. goto out;
  124. }
  125. netif = new;
  126. DEBUGP("new: ifindex=%u name=%s if_sid=%u msg_sid=%u\n", dev->ifindex, dev->name,
  127. nsec->if_sid, nsec->msg_sid);
  128. out:
  129. return netif;
  130. }
  131. static void sel_netif_assign_sids(u32 if_sid_in, u32 msg_sid_in, u32 *if_sid_out, u32 *msg_sid_out)
  132. {
  133. if (if_sid_out)
  134. *if_sid_out = if_sid_in;
  135. if (msg_sid_out)
  136. *msg_sid_out = msg_sid_in;
  137. }
  138. static int sel_netif_sids_slow(struct net_device *dev, u32 *if_sid, u32 *msg_sid)
  139. {
  140. int ret = 0;
  141. u32 tmp_if_sid, tmp_msg_sid;
  142. ret = security_netif_sid(dev->name, &tmp_if_sid, &tmp_msg_sid);
  143. if (!ret)
  144. sel_netif_assign_sids(tmp_if_sid, tmp_msg_sid, if_sid, msg_sid);
  145. return ret;
  146. }
  147. int sel_netif_sids(struct net_device *dev, u32 *if_sid, u32 *msg_sid)
  148. {
  149. int ret = 0;
  150. struct sel_netif *netif;
  151. rcu_read_lock();
  152. netif = sel_netif_lookup(dev);
  153. if (IS_ERR(netif)) {
  154. rcu_read_unlock();
  155. ret = sel_netif_sids_slow(dev, if_sid, msg_sid);
  156. goto out;
  157. }
  158. sel_netif_assign_sids(netif->nsec.if_sid, netif->nsec.msg_sid, if_sid, msg_sid);
  159. rcu_read_unlock();
  160. out:
  161. return ret;
  162. }
  163. static void sel_netif_kill(struct net_device *dev)
  164. {
  165. struct sel_netif *netif;
  166. spin_lock_bh(&sel_netif_lock);
  167. netif = sel_netif_find(dev);
  168. if (netif)
  169. sel_netif_destroy(netif);
  170. spin_unlock_bh(&sel_netif_lock);
  171. }
  172. static void sel_netif_flush(void)
  173. {
  174. int idx;
  175. spin_lock_bh(&sel_netif_lock);
  176. for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++) {
  177. struct sel_netif *netif;
  178. list_for_each_entry(netif, &sel_netif_hash[idx], list)
  179. sel_netif_destroy(netif);
  180. }
  181. spin_unlock_bh(&sel_netif_lock);
  182. }
  183. static int sel_netif_avc_callback(u32 event, u32 ssid, u32 tsid,
  184. u16 class, u32 perms, u32 *retained)
  185. {
  186. if (event == AVC_CALLBACK_RESET) {
  187. sel_netif_flush();
  188. synchronize_net();
  189. }
  190. return 0;
  191. }
  192. static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
  193. unsigned long event, void *ptr)
  194. {
  195. struct net_device *dev = ptr;
  196. if (event == NETDEV_DOWN)
  197. sel_netif_kill(dev);
  198. return NOTIFY_DONE;
  199. }
  200. static struct notifier_block sel_netif_netdev_notifier = {
  201. .notifier_call = sel_netif_netdev_notifier_handler,
  202. };
  203. static __init int sel_netif_init(void)
  204. {
  205. int i, err = 0;
  206. if (!selinux_enabled)
  207. goto out;
  208. for (i = 0; i < SEL_NETIF_HASH_SIZE; i++)
  209. INIT_LIST_HEAD(&sel_netif_hash[i]);
  210. register_netdevice_notifier(&sel_netif_netdev_notifier);
  211. err = avc_add_callback(sel_netif_avc_callback, AVC_CALLBACK_RESET,
  212. SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0);
  213. if (err)
  214. panic("avc_add_callback() failed, error %d\n", err);
  215. out:
  216. return err;
  217. }
  218. __initcall(sel_netif_init);