Eric Lee / smarc-fsl-linux-kernel

07 Dec, 2006

1 commit

03 Dec, 2006

2 commits

12 Oct, 2006

1 commit

  • 5b368e61c   IPsec: correct semantics for SELinux policy matching ... Browse Code »

    Currently when an IPSec policy rule doesn't specify a security
    context, it is assumed to be "unlabeled" by SELinux, and so
    the IPSec policy rule fails to match to a flow that it would
    otherwise match to, unless one has explicitly added an SELinux
    policy rule allowing the flow to "polmatch" to the "unlabeled"
    IPSec policy rules. In the absence of such an explicitly added
    SELinux policy rule, the IPSec policy rule fails to match and
    so the packet(s) flow in clear text without the otherwise applicable
    xfrm(s) applied.

    The above SELinux behavior violates the SELinux security notion of
    "deny by default" which should actually translate to "encrypt by
    default" in the above case.

    This was first reported by Evgeniy Polyakov and the way James Morris
    was seeing the problem was when connecting via IPsec to a
    confined service on an SELinux box (vsftpd), which did not have the
    appropriate SELinux policy permissions to send packets via IPsec.

    With this patch applied, SELinux "polmatching" of flows Vs. IPSec
    policy rules will only come into play when there's a explicit context
    specified for the IPSec policy rule (which also means there's corresponding
    SELinux policy allowing appropriate domains/flows to polmatch to this context).

    Secondly, when a security module is loaded (in this case, SELinux), the
    security_xfrm_policy_lookup() hook can return errors other than access denied,
    such as -EINVAL. We were not handling that correctly, and in fact
    inverting the return logic and propagating a false "ok" back up to
    xfrm_lookup(), which then allowed packets to pass as if they were not
    associated with an xfrm policy.

    The solution for this is to first ensure that errno values are
    correctly propagated all the way back up through the various call chains
    from security_xfrm_policy_lookup(), and handled correctly.

    Then, flow_cache_lookup() is modified, so that if the policy resolver
    fails (typically a permission denied via the security module), the flow
    cache entry is killed rather than having a null policy assigned (which
    indicates that the packet can pass freely). This also forces any future
    lookups for the same flow to consult the security module (e.g. SELinux)
    for current security policy (rather than, say, caching the error on the
    flow cache entry).

    This patch: Fix the selinux side of things.

    This makes sure SELinux polmatching of flow contexts to IPSec policy
    rules comes into play only when an explicit context is associated
    with the IPSec policy rule.

    Also, this no longer defaults the context of a socket policy to
    the context of the socket since the "no explicit context" case
    is now handled properly.

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: James Morris

    Venkat Yekkirala
     

29 Sep, 2006

1 commit

23 Sep, 2006

4 commits

01 Jul, 2006

1 commit

18 Jun, 2006

1 commit

  • c8c05a8ee   [LSM-IPsec]: SELinux Authorize ... Browse Code »

    This patch contains a fix for the previous patch that adds security
    contexts to IPsec policies and security associations. In the previous
    patch, no authorization (besides the check for write permissions to
    SAD and SPD) is required to delete IPsec policies and security
    assocations with security contexts. Thus a user authorized to change
    SAD and SPD can bypass the IPsec policy authorization by simply
    deleteing policies with security contexts. To fix this security hole,
    an additional authorization check is added for removing security
    policies and security associations with security contexts.

    Note that if no security context is supplied on add or present on
    policy to be deleted, the SELinux module allows the change
    unconditionally. The hook is called on deletion when no context is
    present, which we may want to change. At present, I left it up to the
    module.

    LSM changes:

    The patch adds two new LSM hooks: xfrm_policy_delete and
    xfrm_state_delete. The new hooks are necessary to authorize deletion
    of IPsec policies that have security contexts. The existing hooks
    xfrm_policy_free and xfrm_state_free lack the context to do the
    authorization, so I decided to split authorization of deletion and
    memory management of security data, as is typical in the LSM
    interface.

    Use:

    The new delete hooks are checked when xfrm_policy or xfrm_state are
    deleted by either the xfrm_user interface (xfrm_get_policy,
    xfrm_del_sa) or the pfkey interface (pfkey_spddelete, pfkey_delete).

    SELinux changes:

    The new policy_delete and state_delete functions are added.

    Signed-off-by: Catherine Zhang
    Signed-off-by: Trent Jaeger
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Catherine Zhang
     

21 Mar, 2006

2 commits

24 Feb, 2006

1 commit

  • 21380b81e   [XFRM]: Eliminate refcounting confusion by creating __xfrm_state_put(). ... Browse Code »

    We often just do an atomic_dec(&x->refcnt) on an xfrm_state object
    because we know there is more than 1 reference remaining and thus
    we can elide the heavier xfrm_state_put() call.

    Do this behind an inline function called __xfrm_state_put() so that is
    more obvious and also to allow us to more cleanly add refcount
    debugging later.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

25 Jan, 2006

1 commit

  • 151bb0ffe   [AF_KEY]: no message type set ... Browse Code »

    When returning a message to userspace in reply to a SADB_FLUSH or
    SADB_X_SPDFLUSH message, the type was not set for the returned PFKEY
    message. The patch below corrects this problem.

    Signed-off-by: Jerome Borsboom
    Signed-off-by: David S. Miller

    Jerome Borsboom
     

12 Jan, 2006

1 commit

10 Jan, 2006

1 commit

04 Jan, 2006

2 commits

  • 90ddc4f04   [NET]: move struct proto_ops to const ... Browse Code »

    I noticed that some of 'struct proto_ops' used in the kernel may share
    a cache line used by locks or other heavily modified data. (default
    linker alignement is 32 bytes, and L1_CACHE_LINE is 64 or 128 at
    least)

    This patch makes sure a 'struct proto_ops' can be declared as const,
    so that all cpus can share all parts of it without false sharing.

    This is not mandatory : a driver can still use a read/write structure
    if it needs to (and eventually a __read_mostly)

    I made a global stubstitute to change all existing occurences to make
    them const.

    This should reduce the possibility of false sharing on SMP, and
    speedup some socket system calls.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • df71837d5   [LSM-IPSec]: Security association restriction. ... Browse Code »

    This patch series implements per packet access control via the
    extension of the Linux Security Modules (LSM) interface by hooks in
    the XFRM and pfkey subsystems that leverage IPSec security
    associations to label packets. Extensions to the SELinux LSM are
    included that leverage the patch for this purpose.

    This patch implements the changes necessary to the XFRM subsystem,
    pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
    socket to use only authorized security associations (or no security
    association) to send/receive network packets.

    Patch purpose:

    The patch is designed to enable access control per packets based on
    the strongly authenticated IPSec security association. Such access
    controls augment the existing ones based on network interface and IP
    address. The former are very coarse-grained, and the latter can be
    spoofed. By using IPSec, the system can control access to remote
    hosts based on cryptographic keys generated using the IPSec mechanism.
    This enables access control on a per-machine basis or per-application
    if the remote machine is running the same mechanism and trusted to
    enforce the access control policy.

    Patch design approach:

    The overall approach is that policy (xfrm_policy) entries set by
    user-level programs (e.g., setkey for ipsec-tools) are extended with a
    security context that is used at policy selection time in the XFRM
    subsystem to restrict the sockets that can send/receive packets via
    security associations (xfrm_states) that are built from those
    policies.

    A presentation available at
    www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
    from the SELinux symposium describes the overall approach.

    Patch implementation details:

    On output, the policy retrieved (via xfrm_policy_lookup or
    xfrm_sk_policy_lookup) must be authorized for the security context of
    the socket and the same security context is required for resultant
    security association (retrieved or negotiated via racoon in
    ipsec-tools). This is enforced in xfrm_state_find.

    On input, the policy retrieved must also be authorized for the socket
    (at __xfrm_policy_check), and the security context of the policy must
    also match the security association being used.

    The patch has virtually no impact on packets that do not use IPSec.
    The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
    before.

    Also, if IPSec is used without security contexts, the impact is
    minimal. The LSM must allow such policies to be selected for the
    combination of socket and remote machine, but subsequent IPSec
    processing proceeds as in the original case.

    Testing:

    The pfkey interface is tested using the ipsec-tools. ipsec-tools have
    been modified (a separate ipsec-tools patch is available for version
    0.5) that supports assignment of xfrm_policy entries and security
    associations with security contexts via setkey and the negotiation
    using the security contexts via racoon.

    The xfrm_user interface is tested via ad hoc programs that set
    security contexts. These programs are also available from me, and
    contain programs for setting, getting, and deleting policy for testing
    this interface. Testing of sa functions was done by tracing kernel
    behavior.

    Signed-off-by: Trent Jaeger
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Trent Jaeger
     

09 Oct, 2005

1 commit

  • dd0fc66fb   [PATCH] gfp flags annotations - part 1 ... Browse Code »

    - added typedef unsigned int __nocast gfp_t;

    - replaced __nocast uses for gfp flags with gfp_t - it gives exactly
    the same warnings as far as sparse is concerned, doesn't change
    generated code (from gcc point of view we replaced unsigned int with
    typedef) and documents what's going on far better.

    Signed-off-by: Al Viro
    Signed-off-by: Linus Torvalds

    Al Viro
     

06 Oct, 2005

1 commit

05 Oct, 2005

1 commit

21 Jun, 2005

2 commits

  • dd87147ee   [IPSEC]: Add XFRM_STATE_NOPMTUDISC flag ... Browse Code »

    This patch adds the flag XFRM_STATE_NOPMTUDISC for xfrm states. It is
    similar to the nopmtudisc on IPIP/GRE tunnels. It only has an effect
    on IPv4 tunnel mode states. For these states, it will ensure that the
    DF flag is always cleared.

    This is primarily useful to work around ICMP blackholes.

    In future this flag could also allow a larger MTU to be set within the
    tunnel just like IPIP/GRE tunnels. This could be useful for short haul
    tunnels where temporary fragmentation outside the tunnel is desired over
    smaller fragments inside the tunnel.

    Signed-off-by: Herbert Xu
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 72cb6962a   [IPSEC]: Add xfrm_init_state ... Browse Code »

    This patch adds xfrm_init_state which is simply a wrapper that calls
    xfrm_get_type and subsequently x->type->init_state. It also gets rid
    of the unused args argument.

    Abstracting it out allows us to add common initialisation code, e.g.,
    to set family-specific flags.

    The add_time setting in xfrm_user.c was deleted because it's already
    set by xfrm_state_alloc.

    Signed-off-by: Herbert Xu
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Herbert Xu
     

19 Jun, 2005

5 commits

  • 7d6dfe1f5   [IPSEC] Fix xfrm_state leaks in error path ... Browse Code »

    Herbert Xu wrote:
    > @@ -1254,6 +1326,7 @@ static int pfkey_add(struct sock *sk, st
    > if (IS_ERR(x))
    > return PTR_ERR(x);
    >
    > + xfrm_state_hold(x);

    This introduces a leak when xfrm_state_add()/xfrm_state_update()
    fail. We hold two references (one from xfrm_state_alloc(), one
    from xfrm_state_hold()), but only drop one. We need to take the
    reference because the reference from xfrm_state_alloc() can
    be dropped by __xfrm_state_delete(), so the fix is to drop both
    references on error. Same problem in xfrm_user.c.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • f60f6b8f7   [IPSEC] Use XFRM_MSG_* instead of XFRM_SAP_* ... Browse Code »

    This patch removes XFRM_SAP_* and converts them over to XFRM_MSG_*.
    The netlink interface is meant to map directly onto the underlying
    xfrm subsystem. Therefore rather than using a new independent
    representation for the events we can simply use the existing ones
    from xfrm_user.

    Signed-off-by: Herbert Xu

    Herbert Xu
     
  • bf08867f9   [IPSEC] Turn km_event.data into a union ... Browse Code »

    This patch turns km_event.data into a union. This makes code that
    uses it clearer.

    Signed-off-by: Herbert Xu

    Herbert Xu
     
  • 4f09f0bbc   [IPSEC] Fix xfrm to pfkey SA state conversion ... Browse Code »

    This patch adjusts the SA state conversion in af_key such that
    XFRM_STATE_ERROR/XFRM_STATE_DEAD will be converted to SADB_STATE_DEAD
    instead of SADB_STATE_DYING.

    According to RFC 2367, SADB_STATE_DYING SAs can be turned into
    mature ones through updating their lifetime settings. Since SAs
    which are in the states XFRM_STATE_ERROR/XFRM_STATE_DEAD cannot
    be resurrected, this value is unsuitable.

    Signed-off-by: Herbert Xu

    Herbert Xu
     
  • 26b15dad9   [IPSEC] Add complete xfrm event notification ... Browse Code »

    Heres the final patch.
    What this patch provides

    - netlink xfrm events
    - ability to have events generated by netlink propagated to pfkey
    and vice versa.
    - fixes the acquire lets-be-happy-with-one-success issue

    Signed-off-by: Jamal Hadi Salim
    Signed-off-by: Herbert Xu

    Jamal Hadi Salim
     

17 Apr, 2005

1 commit

  • 1da177e4c   Linux-2.6.12-rc2 ... Browse Code »

    Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds