xfrm.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * NSA Security-Enhanced Linux (SELinux) security module
  4. *
  5. * This file contains the SELinux XFRM hook function implementations.
  6. *
  7. * Authors: Serge Hallyn <sergeh@us.ibm.com>
  8. * Trent Jaeger <jaegert@us.ibm.com>
  9. *
  10. * Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com>
  11. *
  12. * Granular IPSec Associations for use in MLS environments.
  13. *
  14. * Copyright (C) 2005 International Business Machines Corporation
  15. * Copyright (C) 2006 Trusted Computer Solutions, Inc.
  16. */
  17. /*
  18. * USAGE:
  19. * NOTES:
  20. * 1. Make sure to enable the following options in your kernel config:
  21. * CONFIG_SECURITY=y
  22. * CONFIG_SECURITY_NETWORK=y
  23. * CONFIG_SECURITY_NETWORK_XFRM=y
  24. * CONFIG_SECURITY_SELINUX=m/y
  25. * ISSUES:
  26. * 1. Caching packets, so they are not dropped during negotiation
  27. * 2. Emulating a reasonable SO_PEERSEC across machines
  28. * 3. Testing addition of sk_policy's with security context via setsockopt
  29. */
  30. #include <linux/kernel.h>
  31. #include <linux/init.h>
  32. #include <linux/security.h>
  33. #include <linux/types.h>
  34. #include <linux/slab.h>
  35. #include <linux/ip.h>
  36. #include <linux/tcp.h>
  37. #include <linux/skbuff.h>
  38. #include <linux/xfrm.h>
  39. #include <net/xfrm.h>
  40. #include <net/checksum.h>
  41. #include <net/udp.h>
  42. #include <linux/atomic.h>
  43. #include "avc.h"
  44. #include "objsec.h"
  45. #include "xfrm.h"
  46. /* Labeled XFRM instance counter */
  47. atomic_t selinux_xfrm_refcount = ATOMIC_INIT(0);
  48. /*
  49. * Returns true if the context is an LSM/SELinux context.
  50. */
  51. static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
  52. {
  53. return (ctx &&
  54. (ctx->ctx_doi == XFRM_SC_DOI_LSM) &&
  55. (ctx->ctx_alg == XFRM_SC_ALG_SELINUX));
  56. }
  57. /*
  58. * Returns true if the xfrm contains a security blob for SELinux.
  59. */
  60. static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
  61. {
  62. return selinux_authorizable_ctx(x->security);
  63. }
  64. /*
  65. * Allocates a xfrm_sec_state and populates it using the supplied security
  66. * xfrm_user_sec_ctx context.
  67. */
  68. static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
  69. struct xfrm_user_sec_ctx *uctx,
  70. gfp_t gfp)
  71. {
  72. int rc;
  73. const struct task_security_struct *tsec = selinux_cred(current_cred());
  74. struct xfrm_sec_ctx *ctx = NULL;
  75. u32 str_len;
  76. if (ctxp == NULL || uctx == NULL ||
  77. uctx->ctx_doi != XFRM_SC_DOI_LSM ||
  78. uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
  79. return -EINVAL;
  80. str_len = uctx->ctx_len;
  81. if (str_len >= PAGE_SIZE)
  82. return -ENOMEM;
  83. ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
  84. if (!ctx)
  85. return -ENOMEM;
  86. ctx->ctx_doi = XFRM_SC_DOI_LSM;
  87. ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
  88. ctx->ctx_len = str_len;
  89. memcpy(ctx->ctx_str, &uctx[1], str_len);
  90. ctx->ctx_str[str_len] = '\0';
  91. rc = security_context_to_sid(&selinux_state, ctx->ctx_str, str_len,
  92. &ctx->ctx_sid, gfp);
  93. if (rc)
  94. goto err;
  95. rc = avc_has_perm(&selinux_state,
  96. tsec->sid, ctx->ctx_sid,
  97. SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL);
  98. if (rc)
  99. goto err;
  100. *ctxp = ctx;
  101. atomic_inc(&selinux_xfrm_refcount);
  102. return 0;
  103. err:
  104. kfree(ctx);
  105. return rc;
  106. }
  107. /*
  108. * Free the xfrm_sec_ctx structure.
  109. */
  110. static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx)
  111. {
  112. if (!ctx)
  113. return;
  114. atomic_dec(&selinux_xfrm_refcount);
  115. kfree(ctx);
  116. }
  117. /*
  118. * Authorize the deletion of a labeled SA or policy rule.
  119. */
  120. static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx)
  121. {
  122. const struct task_security_struct *tsec = selinux_cred(current_cred());
  123. if (!ctx)
  124. return 0;
  125. return avc_has_perm(&selinux_state,
  126. tsec->sid, ctx->ctx_sid,
  127. SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
  128. NULL);
  129. }
  130. /*
  131. * LSM hook implementation that authorizes that a flow can use a xfrm policy
  132. * rule.
  133. */
  134. int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  135. {
  136. int rc;
  137. /* All flows should be treated as polmatch'ing an otherwise applicable
  138. * "non-labeled" policy. This would prevent inadvertent "leaks". */
  139. if (!ctx)
  140. return 0;
  141. /* Context sid is either set to label or ANY_ASSOC */
  142. if (!selinux_authorizable_ctx(ctx))
  143. return -EINVAL;
  144. rc = avc_has_perm(&selinux_state,
  145. fl_secid, ctx->ctx_sid,
  146. SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL);
  147. return (rc == -EACCES ? -ESRCH : rc);
  148. }
  149. /*
  150. * LSM hook implementation that authorizes that a state matches
  151. * the given policy, flow combo.
  152. */
  153. int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
  154. struct xfrm_policy *xp,
  155. const struct flowi *fl)
  156. {
  157. u32 state_sid;
  158. if (!xp->security)
  159. if (x->security)
  160. /* unlabeled policy and labeled SA can't match */
  161. return 0;
  162. else
  163. /* unlabeled policy and unlabeled SA match all flows */
  164. return 1;
  165. else
  166. if (!x->security)
  167. /* unlabeled SA and labeled policy can't match */
  168. return 0;
  169. else
  170. if (!selinux_authorizable_xfrm(x))
  171. /* Not a SELinux-labeled SA */
  172. return 0;
  173. state_sid = x->security->ctx_sid;
  174. if (fl->flowi_secid != state_sid)
  175. return 0;
  176. /* We don't need a separate SA Vs. policy polmatch check since the SA
  177. * is now of the same label as the flow and a flow Vs. policy polmatch
  178. * check had already happened in selinux_xfrm_policy_lookup() above. */
  179. return (avc_has_perm(&selinux_state,
  180. fl->flowi_secid, state_sid,
  181. SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
  182. NULL) ? 0 : 1);
  183. }
  184. static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb)
  185. {
  186. struct dst_entry *dst = skb_dst(skb);
  187. struct xfrm_state *x;
  188. if (dst == NULL)
  189. return SECSID_NULL;
  190. x = dst->xfrm;
  191. if (x == NULL || !selinux_authorizable_xfrm(x))
  192. return SECSID_NULL;
  193. return x->security->ctx_sid;
  194. }
  195. static int selinux_xfrm_skb_sid_ingress(struct sk_buff *skb,
  196. u32 *sid, int ckall)
  197. {
  198. u32 sid_session = SECSID_NULL;
  199. struct sec_path *sp = skb_sec_path(skb);
  200. if (sp) {
  201. int i;
  202. for (i = sp->len - 1; i >= 0; i--) {
  203. struct xfrm_state *x = sp->xvec[i];
  204. if (selinux_authorizable_xfrm(x)) {
  205. struct xfrm_sec_ctx *ctx = x->security;
  206. if (sid_session == SECSID_NULL) {
  207. sid_session = ctx->ctx_sid;
  208. if (!ckall)
  209. goto out;
  210. } else if (sid_session != ctx->ctx_sid) {
  211. *sid = SECSID_NULL;
  212. return -EINVAL;
  213. }
  214. }
  215. }
  216. }
  217. out:
  218. *sid = sid_session;
  219. return 0;
  220. }
  221. /*
  222. * LSM hook implementation that checks and/or returns the xfrm sid for the
  223. * incoming packet.
  224. */
  225. int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
  226. {
  227. if (skb == NULL) {
  228. *sid = SECSID_NULL;
  229. return 0;
  230. }
  231. return selinux_xfrm_skb_sid_ingress(skb, sid, ckall);
  232. }
  233. int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
  234. {
  235. int rc;
  236. rc = selinux_xfrm_skb_sid_ingress(skb, sid, 0);
  237. if (rc == 0 && *sid == SECSID_NULL)
  238. *sid = selinux_xfrm_skb_sid_egress(skb);
  239. return rc;
  240. }
  241. /*
  242. * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
  243. */
  244. int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
  245. struct xfrm_user_sec_ctx *uctx,
  246. gfp_t gfp)
  247. {
  248. return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
  249. }
  250. /*
  251. * LSM hook implementation that copies security data structure from old to new
  252. * for policy cloning.
  253. */
  254. int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
  255. struct xfrm_sec_ctx **new_ctxp)
  256. {
  257. struct xfrm_sec_ctx *new_ctx;
  258. if (!old_ctx)
  259. return 0;
  260. new_ctx = kmemdup(old_ctx, sizeof(*old_ctx) + old_ctx->ctx_len,
  261. GFP_ATOMIC);
  262. if (!new_ctx)
  263. return -ENOMEM;
  264. atomic_inc(&selinux_xfrm_refcount);
  265. *new_ctxp = new_ctx;
  266. return 0;
  267. }
  268. /*
  269. * LSM hook implementation that frees xfrm_sec_ctx security information.
  270. */
  271. void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
  272. {
  273. selinux_xfrm_free(ctx);
  274. }
  275. /*
  276. * LSM hook implementation that authorizes deletion of labeled policies.
  277. */
  278. int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
  279. {
  280. return selinux_xfrm_delete(ctx);
  281. }
  282. /*
  283. * LSM hook implementation that allocates a xfrm_sec_state, populates it using
  284. * the supplied security context, and assigns it to the xfrm_state.
  285. */
  286. int selinux_xfrm_state_alloc(struct xfrm_state *x,
  287. struct xfrm_user_sec_ctx *uctx)
  288. {
  289. return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
  290. }
  291. /*
  292. * LSM hook implementation that allocates a xfrm_sec_state and populates based
  293. * on a secid.
  294. */
  295. int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
  296. struct xfrm_sec_ctx *polsec, u32 secid)
  297. {
  298. int rc;
  299. struct xfrm_sec_ctx *ctx;
  300. char *ctx_str = NULL;
  301. u32 str_len;
  302. if (!polsec)
  303. return 0;
  304. if (secid == 0)
  305. return -EINVAL;
  306. rc = security_sid_to_context(&selinux_state, secid, &ctx_str,
  307. &str_len);
  308. if (rc)
  309. return rc;
  310. ctx = kmalloc(sizeof(*ctx) + str_len, GFP_ATOMIC);
  311. if (!ctx) {
  312. rc = -ENOMEM;
  313. goto out;
  314. }
  315. ctx->ctx_doi = XFRM_SC_DOI_LSM;
  316. ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
  317. ctx->ctx_sid = secid;
  318. ctx->ctx_len = str_len;
  319. memcpy(ctx->ctx_str, ctx_str, str_len);
  320. x->security = ctx;
  321. atomic_inc(&selinux_xfrm_refcount);
  322. out:
  323. kfree(ctx_str);
  324. return rc;
  325. }
  326. /*
  327. * LSM hook implementation that frees xfrm_state security information.
  328. */
  329. void selinux_xfrm_state_free(struct xfrm_state *x)
  330. {
  331. selinux_xfrm_free(x->security);
  332. }
  333. /*
  334. * LSM hook implementation that authorizes deletion of labeled SAs.
  335. */
  336. int selinux_xfrm_state_delete(struct xfrm_state *x)
  337. {
  338. return selinux_xfrm_delete(x->security);
  339. }
  340. /*
  341. * LSM hook that controls access to unlabelled packets. If
  342. * a xfrm_state is authorizable (defined by macro) then it was
  343. * already authorized by the IPSec process. If not, then
  344. * we need to check for unlabelled access since this may not have
  345. * gone thru the IPSec process.
  346. */
  347. int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
  348. struct common_audit_data *ad)
  349. {
  350. int i;
  351. struct sec_path *sp = skb_sec_path(skb);
  352. u32 peer_sid = SECINITSID_UNLABELED;
  353. if (sp) {
  354. for (i = 0; i < sp->len; i++) {
  355. struct xfrm_state *x = sp->xvec[i];
  356. if (x && selinux_authorizable_xfrm(x)) {
  357. struct xfrm_sec_ctx *ctx = x->security;
  358. peer_sid = ctx->ctx_sid;
  359. break;
  360. }
  361. }
  362. }
  363. /* This check even when there's no association involved is intended,
  364. * according to Trent Jaeger, to make sure a process can't engage in
  365. * non-IPsec communication unless explicitly allowed by policy. */
  366. return avc_has_perm(&selinux_state,
  367. sk_sid, peer_sid,
  368. SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad);
  369. }
  370. /*
  371. * POSTROUTE_LAST hook's XFRM processing:
  372. * If we have no security association, then we need to determine
  373. * whether the socket is allowed to send to an unlabelled destination.
  374. * If we do have a authorizable security association, then it has already been
  375. * checked in the selinux_xfrm_state_pol_flow_match hook above.
  376. */
  377. int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
  378. struct common_audit_data *ad, u8 proto)
  379. {
  380. struct dst_entry *dst;
  381. switch (proto) {
  382. case IPPROTO_AH:
  383. case IPPROTO_ESP:
  384. case IPPROTO_COMP:
  385. /* We should have already seen this packet once before it
  386. * underwent xfrm(s). No need to subject it to the unlabeled
  387. * check. */
  388. return 0;
  389. default:
  390. break;
  391. }
  392. dst = skb_dst(skb);
  393. if (dst) {
  394. struct dst_entry *iter;
  395. for (iter = dst; iter != NULL; iter = xfrm_dst_child(iter)) {
  396. struct xfrm_state *x = iter->xfrm;
  397. if (x && selinux_authorizable_xfrm(x))
  398. return 0;
  399. }
  400. }
  401. /* This check even when there's no association involved is intended,
  402. * according to Trent Jaeger, to make sure a process can't engage in
  403. * non-IPsec communication unless explicitly allowed by policy. */
  404. return avc_has_perm(&selinux_state, sk_sid, SECINITSID_UNLABELED,
  405. SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad);
  406. }