xfrm.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485
  1. /*
  2. * NSA Security-Enhanced Linux (SELinux) security module
  3. *
  4. * This file contains the SELinux XFRM hook function implementations.
  5. *
  6. * Authors: Serge Hallyn <sergeh@us.ibm.com>
  7. * Trent Jaeger <jaegert@us.ibm.com>
  8. *
  9. * Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com>
  10. *
  11. * Granular IPSec Associations for use in MLS environments.
  12. *
  13. * Copyright (C) 2005 International Business Machines Corporation
  14. * Copyright (C) 2006 Trusted Computer Solutions, Inc.
  15. *
  16. * This program is free software; you can redistribute it and/or modify
  17. * it under the terms of the GNU General Public License version 2,
  18. * as published by the Free Software Foundation.
  19. */
  20. /*
  21. * USAGE:
  22. * NOTES:
  23. * 1. Make sure to enable the following options in your kernel config:
  24. * CONFIG_SECURITY=y
  25. * CONFIG_SECURITY_NETWORK=y
  26. * CONFIG_SECURITY_NETWORK_XFRM=y
  27. * CONFIG_SECURITY_SELINUX=m/y
  28. * ISSUES:
  29. * 1. Caching packets, so they are not dropped during negotiation
  30. * 2. Emulating a reasonable SO_PEERSEC across machines
  31. * 3. Testing addition of sk_policy's with security context via setsockopt
  32. */
  33. #include <linux/module.h>
  34. #include <linux/kernel.h>
  35. #include <linux/init.h>
  36. #include <linux/security.h>
  37. #include <linux/types.h>
  38. #include <linux/netfilter.h>
  39. #include <linux/netfilter_ipv4.h>
  40. #include <linux/netfilter_ipv6.h>
  41. #include <linux/ip.h>
  42. #include <linux/tcp.h>
  43. #include <linux/skbuff.h>
  44. #include <linux/xfrm.h>
  45. #include <net/xfrm.h>
  46. #include <net/checksum.h>
  47. #include <net/udp.h>
  48. #include <asm/semaphore.h>
  49. #include "avc.h"
  50. #include "objsec.h"
  51. #include "xfrm.h"
  52. /*
  53. * Returns true if an LSM/SELinux context
  54. */
  55. static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
  56. {
  57. return (ctx &&
  58. (ctx->ctx_doi == XFRM_SC_DOI_LSM) &&
  59. (ctx->ctx_alg == XFRM_SC_ALG_SELINUX));
  60. }
  61. /*
  62. * Returns true if the xfrm contains a security blob for SELinux
  63. */
  64. static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
  65. {
  66. return selinux_authorizable_ctx(x->security);
  67. }
  68. /*
  69. * LSM hook implementation that authorizes that a flow can use
  70. * a xfrm policy rule.
  71. */
  72. int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
  73. {
  74. int rc;
  75. u32 sel_sid;
  76. struct xfrm_sec_ctx *ctx;
  77. /* Context sid is either set to label or ANY_ASSOC */
  78. if ((ctx = xp->security)) {
  79. if (!selinux_authorizable_ctx(ctx))
  80. return -EINVAL;
  81. sel_sid = ctx->ctx_sid;
  82. }
  83. else
  84. /*
  85. * All flows should be treated as polmatch'ing an
  86. * otherwise applicable "non-labeled" policy. This
  87. * would prevent inadvertent "leaks".
  88. */
  89. return 0;
  90. rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION,
  91. ASSOCIATION__POLMATCH,
  92. NULL);
  93. if (rc == -EACCES)
  94. rc = -ESRCH;
  95. return rc;
  96. }
  97. /*
  98. * LSM hook implementation that authorizes that a state matches
  99. * the given policy, flow combo.
  100. */
  101. int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
  102. struct flowi *fl)
  103. {
  104. u32 state_sid;
  105. int rc;
  106. if (!xp->security)
  107. if (x->security)
  108. /* unlabeled policy and labeled SA can't match */
  109. return 0;
  110. else
  111. /* unlabeled policy and unlabeled SA match all flows */
  112. return 1;
  113. else
  114. if (!x->security)
  115. /* unlabeled SA and labeled policy can't match */
  116. return 0;
  117. else
  118. if (!selinux_authorizable_xfrm(x))
  119. /* Not a SELinux-labeled SA */
  120. return 0;
  121. state_sid = x->security->ctx_sid;
  122. if (fl->secid != state_sid)
  123. return 0;
  124. rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
  125. ASSOCIATION__SENDTO,
  126. NULL)? 0:1;
  127. /*
  128. * We don't need a separate SA Vs. policy polmatch check
  129. * since the SA is now of the same label as the flow and
  130. * a flow Vs. policy polmatch check had already happened
  131. * in selinux_xfrm_policy_lookup() above.
  132. */
  133. return rc;
  134. }
  135. /*
  136. * LSM hook implementation that checks and/or returns the xfrm sid for the
  137. * incoming packet.
  138. */
  139. int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
  140. {
  141. struct sec_path *sp;
  142. *sid = SECSID_NULL;
  143. if (skb == NULL)
  144. return 0;
  145. sp = skb->sp;
  146. if (sp) {
  147. int i, sid_set = 0;
  148. for (i = sp->len-1; i >= 0; i--) {
  149. struct xfrm_state *x = sp->xvec[i];
  150. if (selinux_authorizable_xfrm(x)) {
  151. struct xfrm_sec_ctx *ctx = x->security;
  152. if (!sid_set) {
  153. *sid = ctx->ctx_sid;
  154. sid_set = 1;
  155. if (!ckall)
  156. break;
  157. }
  158. else if (*sid != ctx->ctx_sid)
  159. return -EINVAL;
  160. }
  161. }
  162. }
  163. return 0;
  164. }
  165. /*
  166. * Security blob allocation for xfrm_policy and xfrm_state
  167. * CTX does not have a meaningful value on input
  168. */
  169. static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
  170. struct xfrm_user_sec_ctx *uctx, u32 sid)
  171. {
  172. int rc = 0;
  173. struct task_security_struct *tsec = current->security;
  174. struct xfrm_sec_ctx *ctx = NULL;
  175. char *ctx_str = NULL;
  176. u32 str_len;
  177. BUG_ON(uctx && sid);
  178. if (!uctx)
  179. goto not_from_user;
  180. if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX)
  181. return -EINVAL;
  182. if (uctx->ctx_len >= PAGE_SIZE)
  183. return -ENOMEM;
  184. *ctxp = ctx = kmalloc(sizeof(*ctx) +
  185. uctx->ctx_len,
  186. GFP_KERNEL);
  187. if (!ctx)
  188. return -ENOMEM;
  189. ctx->ctx_doi = uctx->ctx_doi;
  190. ctx->ctx_len = uctx->ctx_len;
  191. ctx->ctx_alg = uctx->ctx_alg;
  192. memcpy(ctx->ctx_str,
  193. uctx+1,
  194. ctx->ctx_len);
  195. rc = security_context_to_sid(ctx->ctx_str,
  196. ctx->ctx_len,
  197. &ctx->ctx_sid);
  198. if (rc)
  199. goto out;
  200. /*
  201. * Does the subject have permission to set security context?
  202. */
  203. rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
  204. SECCLASS_ASSOCIATION,
  205. ASSOCIATION__SETCONTEXT, NULL);
  206. if (rc)
  207. goto out;
  208. return rc;
  209. not_from_user:
  210. rc = security_sid_to_context(sid, &ctx_str, &str_len);
  211. if (rc)
  212. goto out;
  213. *ctxp = ctx = kmalloc(sizeof(*ctx) +
  214. str_len,
  215. GFP_ATOMIC);
  216. if (!ctx) {
  217. rc = -ENOMEM;
  218. goto out;
  219. }
  220. ctx->ctx_doi = XFRM_SC_DOI_LSM;
  221. ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
  222. ctx->ctx_sid = sid;
  223. ctx->ctx_len = str_len;
  224. memcpy(ctx->ctx_str,
  225. ctx_str,
  226. str_len);
  227. goto out2;
  228. out:
  229. *ctxp = NULL;
  230. kfree(ctx);
  231. out2:
  232. kfree(ctx_str);
  233. return rc;
  234. }
  235. /*
  236. * LSM hook implementation that allocs and transfers uctx spec to
  237. * xfrm_policy.
  238. */
  239. int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
  240. struct xfrm_user_sec_ctx *uctx)
  241. {
  242. int err;
  243. BUG_ON(!xp);
  244. BUG_ON(!uctx);
  245. err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, 0);
  246. return err;
  247. }
  248. /*
  249. * LSM hook implementation that copies security data structure from old to
  250. * new for policy cloning.
  251. */
  252. int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
  253. {
  254. struct xfrm_sec_ctx *old_ctx, *new_ctx;
  255. old_ctx = old->security;
  256. if (old_ctx) {
  257. new_ctx = new->security = kmalloc(sizeof(*new_ctx) +
  258. old_ctx->ctx_len,
  259. GFP_KERNEL);
  260. if (!new_ctx)
  261. return -ENOMEM;
  262. memcpy(new_ctx, old_ctx, sizeof(*new_ctx));
  263. memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len);
  264. }
  265. return 0;
  266. }
  267. /*
  268. * LSM hook implementation that frees xfrm_policy security information.
  269. */
  270. void selinux_xfrm_policy_free(struct xfrm_policy *xp)
  271. {
  272. struct xfrm_sec_ctx *ctx = xp->security;
  273. if (ctx)
  274. kfree(ctx);
  275. }
  276. /*
  277. * LSM hook implementation that authorizes deletion of labeled policies.
  278. */
  279. int selinux_xfrm_policy_delete(struct xfrm_policy *xp)
  280. {
  281. struct task_security_struct *tsec = current->security;
  282. struct xfrm_sec_ctx *ctx = xp->security;
  283. int rc = 0;
  284. if (ctx)
  285. rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
  286. SECCLASS_ASSOCIATION,
  287. ASSOCIATION__SETCONTEXT, NULL);
  288. return rc;
  289. }
  290. /*
  291. * LSM hook implementation that allocs and transfers sec_ctx spec to
  292. * xfrm_state.
  293. */
  294. int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx,
  295. u32 secid)
  296. {
  297. int err;
  298. BUG_ON(!x);
  299. err = selinux_xfrm_sec_ctx_alloc(&x->security, uctx, secid);
  300. return err;
  301. }
  302. /*
  303. * LSM hook implementation that frees xfrm_state security information.
  304. */
  305. void selinux_xfrm_state_free(struct xfrm_state *x)
  306. {
  307. struct xfrm_sec_ctx *ctx = x->security;
  308. if (ctx)
  309. kfree(ctx);
  310. }
  311. /*
  312. * LSM hook implementation that authorizes deletion of labeled SAs.
  313. */
  314. int selinux_xfrm_state_delete(struct xfrm_state *x)
  315. {
  316. struct task_security_struct *tsec = current->security;
  317. struct xfrm_sec_ctx *ctx = x->security;
  318. int rc = 0;
  319. if (ctx)
  320. rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
  321. SECCLASS_ASSOCIATION,
  322. ASSOCIATION__SETCONTEXT, NULL);
  323. return rc;
  324. }
  325. /*
  326. * LSM hook that controls access to unlabelled packets. If
  327. * a xfrm_state is authorizable (defined by macro) then it was
  328. * already authorized by the IPSec process. If not, then
  329. * we need to check for unlabelled access since this may not have
  330. * gone thru the IPSec process.
  331. */
  332. int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
  333. struct avc_audit_data *ad)
  334. {
  335. int i, rc = 0;
  336. struct sec_path *sp;
  337. u32 sel_sid = SECINITSID_UNLABELED;
  338. sp = skb->sp;
  339. if (sp) {
  340. for (i = 0; i < sp->len; i++) {
  341. struct xfrm_state *x = sp->xvec[i];
  342. if (x && selinux_authorizable_xfrm(x)) {
  343. struct xfrm_sec_ctx *ctx = x->security;
  344. sel_sid = ctx->ctx_sid;
  345. break;
  346. }
  347. }
  348. }
  349. /*
  350. * This check even when there's no association involved is
  351. * intended, according to Trent Jaeger, to make sure a
  352. * process can't engage in non-ipsec communication unless
  353. * explicitly allowed by policy.
  354. */
  355. rc = avc_has_perm(isec_sid, sel_sid, SECCLASS_ASSOCIATION,
  356. ASSOCIATION__RECVFROM, ad);
  357. return rc;
  358. }
  359. /*
  360. * POSTROUTE_LAST hook's XFRM processing:
  361. * If we have no security association, then we need to determine
  362. * whether the socket is allowed to send to an unlabelled destination.
  363. * If we do have a authorizable security association, then it has already been
  364. * checked in the selinux_xfrm_state_pol_flow_match hook above.
  365. */
  366. int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
  367. struct avc_audit_data *ad, u8 proto)
  368. {
  369. struct dst_entry *dst;
  370. int rc = 0;
  371. dst = skb->dst;
  372. if (dst) {
  373. struct dst_entry *dst_test;
  374. for (dst_test = dst; dst_test != 0;
  375. dst_test = dst_test->child) {
  376. struct xfrm_state *x = dst_test->xfrm;
  377. if (x && selinux_authorizable_xfrm(x))
  378. goto out;
  379. }
  380. }
  381. switch (proto) {
  382. case IPPROTO_AH:
  383. case IPPROTO_ESP:
  384. case IPPROTO_COMP:
  385. /*
  386. * We should have already seen this packet once before
  387. * it underwent xfrm(s). No need to subject it to the
  388. * unlabeled check.
  389. */
  390. goto out;
  391. default:
  392. break;
  393. }
  394. /*
  395. * This check even when there's no association involved is
  396. * intended, according to Trent Jaeger, to make sure a
  397. * process can't engage in non-ipsec communication unless
  398. * explicitly allowed by policy.
  399. */
  400. rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION,
  401. ASSOCIATION__SENDTO, ad);
  402. out:
  403. return rc;
  404. }