nlmsgtab.c 9.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Netlink message type permission tables, for user generated messages.
  4. *
  5. * Author: James Morris <jmorris@redhat.com>
  6. *
  7. * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
  8. */
  9. #include <linux/types.h>
  10. #include <linux/kernel.h>
  11. #include <linux/netlink.h>
  12. #include <linux/rtnetlink.h>
  13. #include <linux/if.h>
  14. #include <linux/inet_diag.h>
  15. #include <linux/xfrm.h>
  16. #include <linux/audit.h>
  17. #include <linux/sock_diag.h>
  18. #include "flask.h"
  19. #include "av_permissions.h"
  20. #include "security.h"
  21. struct nlmsg_perm {
  22. u16 nlmsg_type;
  23. u32 perm;
  24. };
  25. static struct nlmsg_perm nlmsg_route_perms[] =
  26. {
  27. { RTM_NEWLINK, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  28. { RTM_DELLINK, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  29. { RTM_GETLINK, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  30. { RTM_SETLINK, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  31. { RTM_NEWADDR, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  32. { RTM_DELADDR, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  33. { RTM_GETADDR, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  34. { RTM_NEWROUTE, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  35. { RTM_DELROUTE, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  36. { RTM_GETROUTE, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  37. { RTM_NEWNEIGH, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  38. { RTM_DELNEIGH, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  39. { RTM_GETNEIGH, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  40. { RTM_NEWRULE, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  41. { RTM_DELRULE, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  42. { RTM_GETRULE, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  43. { RTM_NEWQDISC, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  44. { RTM_DELQDISC, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  45. { RTM_GETQDISC, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  46. { RTM_NEWTCLASS, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  47. { RTM_DELTCLASS, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  48. { RTM_GETTCLASS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  49. { RTM_NEWTFILTER, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  50. { RTM_DELTFILTER, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  51. { RTM_GETTFILTER, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  52. { RTM_NEWACTION, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  53. { RTM_DELACTION, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  54. { RTM_GETACTION, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  55. { RTM_NEWPREFIX, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  56. { RTM_GETMULTICAST, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  57. { RTM_GETANYCAST, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  58. { RTM_GETNEIGHTBL, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  59. { RTM_SETNEIGHTBL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  60. { RTM_NEWADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  61. { RTM_DELADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  62. { RTM_GETADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  63. { RTM_GETDCB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  64. { RTM_SETDCB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  65. { RTM_NEWNETCONF, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  66. { RTM_DELNETCONF, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  67. { RTM_GETNETCONF, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  68. { RTM_NEWMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  69. { RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  70. { RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  71. { RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  72. { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  73. { RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  74. { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  75. { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  76. { RTM_NEWCACHEREPORT, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  77. { RTM_NEWCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  78. { RTM_DELCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  79. { RTM_GETCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  80. { RTM_NEWNEXTHOP, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  81. { RTM_DELNEXTHOP, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  82. { RTM_GETNEXTHOP, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  83. { RTM_NEWLINKPROP, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  84. { RTM_DELLINKPROP, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  85. { RTM_NEWVLAN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  86. { RTM_DELVLAN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
  87. { RTM_GETVLAN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
  88. };
  89. static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
  90. {
  91. { TCPDIAG_GETSOCK, NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
  92. { DCCPDIAG_GETSOCK, NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
  93. { SOCK_DIAG_BY_FAMILY, NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
  94. { SOCK_DESTROY, NETLINK_TCPDIAG_SOCKET__NLMSG_WRITE },
  95. };
  96. static const struct nlmsg_perm nlmsg_xfrm_perms[] =
  97. {
  98. { XFRM_MSG_NEWSA, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  99. { XFRM_MSG_DELSA, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  100. { XFRM_MSG_GETSA, NETLINK_XFRM_SOCKET__NLMSG_READ },
  101. { XFRM_MSG_NEWPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  102. { XFRM_MSG_DELPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  103. { XFRM_MSG_GETPOLICY, NETLINK_XFRM_SOCKET__NLMSG_READ },
  104. { XFRM_MSG_ALLOCSPI, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  105. { XFRM_MSG_ACQUIRE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  106. { XFRM_MSG_EXPIRE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  107. { XFRM_MSG_UPDPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  108. { XFRM_MSG_UPDSA, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  109. { XFRM_MSG_POLEXPIRE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  110. { XFRM_MSG_FLUSHSA, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  111. { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  112. { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  113. { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
  114. { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
  115. { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  116. { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
  117. { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
  118. { XFRM_MSG_NEWSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
  119. { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
  120. { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
  121. };
  122. static const struct nlmsg_perm nlmsg_audit_perms[] =
  123. {
  124. { AUDIT_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
  125. { AUDIT_SET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  126. { AUDIT_LIST, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
  127. { AUDIT_ADD, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  128. { AUDIT_DEL, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  129. { AUDIT_LIST_RULES, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
  130. { AUDIT_ADD_RULE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  131. { AUDIT_DEL_RULE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  132. { AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_RELAY },
  133. { AUDIT_SIGNAL_INFO, NETLINK_AUDIT_SOCKET__NLMSG_READ },
  134. { AUDIT_TRIM, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  135. { AUDIT_MAKE_EQUIV, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  136. { AUDIT_TTY_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
  137. { AUDIT_TTY_SET, NETLINK_AUDIT_SOCKET__NLMSG_TTY_AUDIT },
  138. { AUDIT_GET_FEATURE, NETLINK_AUDIT_SOCKET__NLMSG_READ },
  139. { AUDIT_SET_FEATURE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
  140. };
  141. static int nlmsg_perm(u16 nlmsg_type, u32 *perm, const struct nlmsg_perm *tab, size_t tabsize)
  142. {
  143. int i, err = -EINVAL;
  144. for (i = 0; i < tabsize/sizeof(struct nlmsg_perm); i++)
  145. if (nlmsg_type == tab[i].nlmsg_type) {
  146. *perm = tab[i].perm;
  147. err = 0;
  148. break;
  149. }
  150. return err;
  151. }
  152. int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
  153. {
  154. int err = 0;
  155. switch (sclass) {
  156. case SECCLASS_NETLINK_ROUTE_SOCKET:
  157. /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
  158. * If the BUILD_BUG_ON() below fails you must update the
  159. * structures at the top of this file with the new mappings
  160. * before updating the BUILD_BUG_ON() macro!
  161. */
  162. BUILD_BUG_ON(RTM_MAX != (RTM_NEWVLAN + 3));
  163. err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
  164. sizeof(nlmsg_route_perms));
  165. break;
  166. case SECCLASS_NETLINK_TCPDIAG_SOCKET:
  167. err = nlmsg_perm(nlmsg_type, perm, nlmsg_tcpdiag_perms,
  168. sizeof(nlmsg_tcpdiag_perms));
  169. break;
  170. case SECCLASS_NETLINK_XFRM_SOCKET:
  171. /* If the BUILD_BUG_ON() below fails you must update the
  172. * structures at the top of this file with the new mappings
  173. * before updating the BUILD_BUG_ON() macro!
  174. */
  175. BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
  176. err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
  177. sizeof(nlmsg_xfrm_perms));
  178. break;
  179. case SECCLASS_NETLINK_AUDIT_SOCKET:
  180. if ((nlmsg_type >= AUDIT_FIRST_USER_MSG &&
  181. nlmsg_type <= AUDIT_LAST_USER_MSG) ||
  182. (nlmsg_type >= AUDIT_FIRST_USER_MSG2 &&
  183. nlmsg_type <= AUDIT_LAST_USER_MSG2)) {
  184. *perm = NETLINK_AUDIT_SOCKET__NLMSG_RELAY;
  185. } else {
  186. err = nlmsg_perm(nlmsg_type, perm, nlmsg_audit_perms,
  187. sizeof(nlmsg_audit_perms));
  188. }
  189. break;
  190. /* No messaging from userspace, or class unknown/unhandled */
  191. default:
  192. err = -ENOENT;
  193. break;
  194. }
  195. return err;
  196. }
  197. static void nlmsg_set_perm_for_type(u32 perm, u16 type)
  198. {
  199. int i;
  200. for (i = 0; i < ARRAY_SIZE(nlmsg_route_perms); i++) {
  201. if (nlmsg_route_perms[i].nlmsg_type == type) {
  202. nlmsg_route_perms[i].perm = perm;
  203. break;
  204. }
  205. }
  206. }
  207. /**
  208. * Use nlmsg_readpriv as the permission for RTM_GETLINK messages if the
  209. * netlink_route_getlink policy capability is set. Otherwise use nlmsg_read.
  210. * Similarly, use nlmsg_getneigh for RTM_GETNEIGH and RTM_GETNEIGHTBL if the
  211. * netlink_route_getneigh policy capability is set. Otherwise use nlmsg_read.
  212. */
  213. void selinux_nlmsg_init(void)
  214. {
  215. if (selinux_android_nlroute_getlink())
  216. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_READPRIV,
  217. RTM_GETLINK);
  218. else
  219. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_READ,
  220. RTM_GETLINK);
  221. if (selinux_android_nlroute_getneigh()) {
  222. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_GETNEIGH,
  223. RTM_GETNEIGH);
  224. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_GETNEIGH,
  225. RTM_GETNEIGHTBL);
  226. } else {
  227. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_READ,
  228. RTM_GETNEIGH);
  229. nlmsg_set_perm_for_type(NETLINK_ROUTE_SOCKET__NLMSG_READ,
  230. RTM_GETNEIGHTBL);
  231. }
  232. }