Blame view
security/selinux/netport.c
6.73 KB
27cc2a6e5 SELinux: add netp... |
1 2 3 4 5 6 7 |
/* * Network port table * * SELinux must keep a mapping of network ports to labels/SIDs. This * mapping is maintained as part of the normal policy but a fast cache is * needed to reduce the lookup overhead. * |
82c21bfab doc: Update the e... |
8 |
* Author: Paul Moore <paul@paul-moore.com> |
27cc2a6e5 SELinux: add netp... |
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
* * This code is heavily based on the "netif" concept originally developed by * James Morris <jmorris@redhat.com> * (see security/selinux/netif.c for more information) * */ /* * (c) Copyright Hewlett-Packard Development Company, L.P., 2008 * * This program is free software: you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as * published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * */ #include <linux/types.h> #include <linux/rcupdate.h> #include <linux/list.h> |
5a0e3ad6a include cleanup: ... |
33 |
#include <linux/slab.h> |
27cc2a6e5 SELinux: add netp... |
34 35 36 37 38 39 40 |
#include <linux/spinlock.h> #include <linux/in.h> #include <linux/in6.h> #include <linux/ip.h> #include <linux/ipv6.h> #include <net/ip.h> #include <net/ipv6.h> |
27cc2a6e5 SELinux: add netp... |
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
#include "netport.h" #include "objsec.h" #define SEL_NETPORT_HASH_SIZE 256 #define SEL_NETPORT_HASH_BKT_LIMIT 16 struct sel_netport_bkt { int size; struct list_head list; }; struct sel_netport { struct netport_security_struct psec; struct list_head list; struct rcu_head rcu; }; /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason * for this is that I suspect most users will not make heavy use of both * address families at the same time so one table will usually end up wasted, * if this becomes a problem we can always add a hash table for each address * family later */ static LIST_HEAD(sel_netport_list); static DEFINE_SPINLOCK(sel_netport_lock); static struct sel_netport_bkt sel_netport_hash[SEL_NETPORT_HASH_SIZE]; /** |
27cc2a6e5 SELinux: add netp... |
71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 |
* sel_netport_hashfn - Hashing function for the port table * @pnum: port number * * Description: * This is the hashing function for the port table, it returns the bucket * number for the given port. * */ static unsigned int sel_netport_hashfn(u16 pnum) { return (pnum & (SEL_NETPORT_HASH_SIZE - 1)); } /** * sel_netport_find - Search for a port record * @protocol: protocol * @port: pnum * * Description: * Search the network port table and return the matching record. If an entry * can not be found in the table return NULL. * */ static struct sel_netport *sel_netport_find(u8 protocol, u16 pnum) { unsigned int idx; struct sel_netport *port; idx = sel_netport_hashfn(pnum); list_for_each_entry_rcu(port, &sel_netport_hash[idx].list, list) |
c9b7b9793 SELinux: Fix a RC... |
101 |
if (port->psec.port == pnum && port->psec.protocol == protocol) |
27cc2a6e5 SELinux: add netp... |
102 103 104 105 106 107 108 109 110 111 |
return port; return NULL; } /** * sel_netport_insert - Insert a new port into the table * @port: the new port record * * Description: |
c9b7b9793 SELinux: Fix a RC... |
112 |
* Add a new port record to the network address hash table. |
27cc2a6e5 SELinux: add netp... |
113 114 |
* */ |
c9b7b9793 SELinux: Fix a RC... |
115 |
static void sel_netport_insert(struct sel_netport *port) |
27cc2a6e5 SELinux: add netp... |
116 117 118 119 120 121 122 123 124 |
{ unsigned int idx; /* we need to impose a limit on the growth of the hash table so check * this bucket to make sure it is within the specified bounds */ idx = sel_netport_hashfn(port->psec.port); list_add_rcu(&port->list, &sel_netport_hash[idx].list); if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) { struct sel_netport *tail; |
c9b7b9793 SELinux: Fix a RC... |
125 |
tail = list_entry( |
50345f1ea SELinux: Fix RCU ... |
126 127 128 |
rcu_dereference_protected( sel_netport_hash[idx].list.prev, lockdep_is_held(&sel_netport_lock)), |
c9b7b9793 SELinux: Fix a RC... |
129 130 |
struct sel_netport, list); list_del_rcu(&tail->list); |
449a68cc6 security,rcu: Con... |
131 |
kfree_rcu(tail, rcu); |
27cc2a6e5 SELinux: add netp... |
132 133 |
} else sel_netport_hash[idx].size++; |
27cc2a6e5 SELinux: add netp... |
134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 |
} /** * sel_netport_sid_slow - Lookup the SID of a network address using the policy * @protocol: protocol * @pnum: port * @sid: port SID * * Description: * This function determines the SID of a network port by quering the security * policy. The result is added to the network port table to speedup future * queries. Returns zero on success, negative values on failure. * */ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid) { |
c9b7b9793 SELinux: Fix a RC... |
150 |
int ret = -ENOMEM; |
27cc2a6e5 SELinux: add netp... |
151 152 153 154 155 156 157 |
struct sel_netport *port; struct sel_netport *new = NULL; spin_lock_bh(&sel_netport_lock); port = sel_netport_find(protocol, pnum); if (port != NULL) { *sid = port->psec.sid; |
c9b7b9793 SELinux: Fix a RC... |
158 159 |
spin_unlock_bh(&sel_netport_lock); return 0; |
27cc2a6e5 SELinux: add netp... |
160 161 |
} new = kzalloc(sizeof(*new), GFP_ATOMIC); |
c9b7b9793 SELinux: Fix a RC... |
162 |
if (new == NULL) |
27cc2a6e5 SELinux: add netp... |
163 |
goto out; |
c9b7b9793 SELinux: Fix a RC... |
164 |
ret = security_port_sid(protocol, pnum, sid); |
27cc2a6e5 SELinux: add netp... |
165 166 |
if (ret != 0) goto out; |
c9b7b9793 SELinux: Fix a RC... |
167 |
|
27cc2a6e5 SELinux: add netp... |
168 169 |
new->psec.port = pnum; new->psec.protocol = protocol; |
c9b7b9793 SELinux: Fix a RC... |
170 171 |
new->psec.sid = *sid; sel_netport_insert(new); |
27cc2a6e5 SELinux: add netp... |
172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 |
out: spin_unlock_bh(&sel_netport_lock); if (unlikely(ret)) { printk(KERN_WARNING "SELinux: failure in sel_netport_sid_slow()," " unable to determine network port label "); kfree(new); } return ret; } /** * sel_netport_sid - Lookup the SID of a network port * @protocol: protocol * @pnum: port * @sid: port SID * * Description: * This function determines the SID of a network port using the fastest method * possible. First the port table is queried, but if an entry can't be found * then the policy is queried and the result is added to the table to speedup * future queries. Returns zero on success, negative values on failure. * */ int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid) { struct sel_netport *port; rcu_read_lock(); port = sel_netport_find(protocol, pnum); if (port != NULL) { *sid = port->psec.sid; rcu_read_unlock(); return 0; } rcu_read_unlock(); return sel_netport_sid_slow(protocol, pnum, sid); } /** * sel_netport_flush - Flush the entire network port table * * Description: * Remove all entries from the network address table. * */ static void sel_netport_flush(void) { unsigned int idx; |
c9b7b9793 SELinux: Fix a RC... |
224 |
struct sel_netport *port, *port_tmp; |
27cc2a6e5 SELinux: add netp... |
225 226 227 |
spin_lock_bh(&sel_netport_lock); for (idx = 0; idx < SEL_NETPORT_HASH_SIZE; idx++) { |
c9b7b9793 SELinux: Fix a RC... |
228 229 |
list_for_each_entry_safe(port, port_tmp, &sel_netport_hash[idx].list, list) { |
27cc2a6e5 SELinux: add netp... |
230 |
list_del_rcu(&port->list); |
449a68cc6 security,rcu: Con... |
231 |
kfree_rcu(port, rcu); |
27cc2a6e5 SELinux: add netp... |
232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 |
} sel_netport_hash[idx].size = 0; } spin_unlock_bh(&sel_netport_lock); } static int sel_netport_avc_callback(u32 event, u32 ssid, u32 tsid, u16 class, u32 perms, u32 *retained) { if (event == AVC_CALLBACK_RESET) { sel_netport_flush(); synchronize_net(); } return 0; } static __init int sel_netport_init(void) { int iter; int ret; if (!selinux_enabled) return 0; for (iter = 0; iter < SEL_NETPORT_HASH_SIZE; iter++) { INIT_LIST_HEAD(&sel_netport_hash[iter].list); sel_netport_hash[iter].size = 0; } ret = avc_add_callback(sel_netport_avc_callback, AVC_CALLBACK_RESET, |
f52697107 SELinux: keep the... |
262 |
SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); |
27cc2a6e5 SELinux: add netp... |
263 264 265 266 267 268 269 270 |
if (ret != 0) panic("avc_add_callback() failed, error %d ", ret); return ret; } __initcall(sel_netport_init); |