From da6e57a2e6bd7939f610d957afacaf6a131e75ed Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Sun, 18 Jan 2004 18:38:13 -0800 Subject: [PATCH] [PATCH] selinux: Add SO_PEERSEC socket option and getpeersec LSM hook. From: James Morris This patch adds a new option for Unix sockets, SO_PEERSEC, and an associated LSM hook, getpeersec. The SELinux handler is also included. The purpose of this is to allow applications to obtain each others security credentials, analagously to the existing SO_PEERCRED option. Examples of use are Security Enhanced D-BUS and Security Enhanced X. This patch was previously approved in principle by David, and has been updated with feedback from Chris Wright and extended to cover all architectures. --- include/asm-alpha/socket.h | 2 + include/asm-arm/socket.h | 2 + include/asm-arm26/socket.h | 2 + include/asm-cris/socket.h | 2 + include/asm-h8300/socket.h | 2 + include/asm-i386/socket.h | 2 + include/asm-ia64/socket.h | 2 + include/asm-m68k/socket.h | 2 + include/asm-mips/socket.h | 2 + include/asm-parisc/socket.h | 2 + include/asm-ppc/socket.h | 2 + include/asm-ppc64/socket.h | 2 + include/asm-s390/socket.h | 2 + include/asm-sh/socket.h | 2 + include/asm-sparc/socket.h | 2 + include/asm-sparc64/socket.h | 2 + include/asm-v850/socket.h | 2 + include/asm-x86_64/socket.h | 2 + include/linux/security.h | 50 ++++++++++++++++ include/net/sock.h | 1 + net/core/sock.c | 9 +++ security/dummy.c | 18 ++++++ security/selinux/hooks.c | 94 +++++++++++++++++++++++++++++++ security/selinux/include/objsec.h | 6 ++ 24 files changed, 214 insertions(+) diff --git a/include/asm-alpha/socket.h b/include/asm-alpha/socket.h index e821ac3724649..88912c4c8931f 100644 --- a/include/asm-alpha/socket.h +++ b/include/asm-alpha/socket.h @@ -48,6 +48,8 @@ #define SO_TIMESTAMP 29 #define SCM_TIMESTAMP SO_TIMESTAMP +#define SO_PEERSEC 30 + /* Security levels - as per NRL IPv6 - don't actually do anything */ #define SO_SECURITY_AUTHENTICATION 19 #define SO_SECURITY_ENCRYPTION_TRANSPORT 20 diff --git a/include/asm-arm/socket.h b/include/asm-arm/socket.h index 5c1428e41b065..b05e717397a1c 100644 --- a/include/asm-arm/socket.h +++ b/include/asm-arm/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-arm26/socket.h b/include/asm-arm26/socket.h index 5c1428e41b065..b05e717397a1c 100644 --- a/include/asm-arm26/socket.h +++ b/include/asm-arm26/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-cris/socket.h b/include/asm-cris/socket.h index 89edfb11650f0..b4421808b6762 100644 --- a/include/asm-cris/socket.h +++ b/include/asm-cris/socket.h @@ -47,6 +47,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + #if defined(__KERNEL__) /* Socket types. */ #define SOCK_STREAM 1 /* stream (connection) socket */ diff --git a/include/asm-h8300/socket.h b/include/asm-h8300/socket.h index a328c84b9f239..070d46d2344e5 100644 --- a/include/asm-h8300/socket.h +++ b/include/asm-h8300/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-i386/socket.h b/include/asm-i386/socket.h index 525f83218cd80..711f906193fd9 100644 --- a/include/asm-i386/socket.h +++ b/include/asm-i386/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nasty libc5 fixup - bletch */ #if defined(__KERNEL__) || !defined(__GLIBC__) || (__GLIBC__ < 2) /* Socket types. */ diff --git a/include/asm-ia64/socket.h b/include/asm-ia64/socket.h index 01e3b50760d30..5935d3e7d5aa4 100644 --- a/include/asm-ia64/socket.h +++ b/include/asm-ia64/socket.h @@ -52,6 +52,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-m68k/socket.h b/include/asm-m68k/socket.h index 1959b608d477f..68a33bfbae03c 100644 --- a/include/asm-m68k/socket.h +++ b/include/asm-m68k/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-mips/socket.h b/include/asm-mips/socket.h index df9fcb53d71e1..8713443300470 100644 --- a/include/asm-mips/socket.h +++ b/include/asm-mips/socket.h @@ -66,6 +66,8 @@ To add: #define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */ #define SO_TIMESTAMP 29 #define SCM_TIMESTAMP SO_TIMESTAMP +#define SO_PEERSEC 30 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-parisc/socket.h b/include/asm-parisc/socket.h index 7833ff68f2e45..fd3f0f29eb3cd 100644 --- a/include/asm-parisc/socket.h +++ b/include/asm-parisc/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 0x401c +#define SO_PEERSEC 0x401d + #if defined(__KERNEL__) #define SOCK_STREAM 1 /* stream (connection) socket */ #define SOCK_DGRAM 2 /* datagram (conn.less) socket */ diff --git a/include/asm-ppc/socket.h b/include/asm-ppc/socket.h index d513b3238efde..bad94c36f1b8c 100644 --- a/include/asm-ppc/socket.h +++ b/include/asm-ppc/socket.h @@ -51,6 +51,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-ppc64/socket.h b/include/asm-ppc64/socket.h index 9f23b2f3b59b2..1021a52683468 100644 --- a/include/asm-ppc64/socket.h +++ b/include/asm-ppc64/socket.h @@ -52,6 +52,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-s390/socket.h b/include/asm-s390/socket.h index d7b7f5bb6a397..1855ec7a112b2 100644 --- a/include/asm-s390/socket.h +++ b/include/asm-s390/socket.h @@ -53,6 +53,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-sh/socket.h b/include/asm-sh/socket.h index 918e2f2259591..2b9469472f76b 100644 --- a/include/asm-sh/socket.h +++ b/include/asm-sh/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-sparc/socket.h b/include/asm-sparc/socket.h index 254d446bdcf90..cfa529d9bb968 100644 --- a/include/asm-sparc/socket.h +++ b/include/asm-sparc/socket.h @@ -45,6 +45,8 @@ #define SO_TIMESTAMP 0x001d #define SCM_TIMESTAMP SO_TIMESTAMP +#define SO_PEERSEC 0x100e + /* Security levels - as per NRL IPv6 - don't actually do anything */ #define SO_SECURITY_AUTHENTICATION 0x5001 #define SO_SECURITY_ENCRYPTION_TRANSPORT 0x5002 diff --git a/include/asm-sparc64/socket.h b/include/asm-sparc64/socket.h index d041e33529702..ba2230ba1d7de 100644 --- a/include/asm-sparc64/socket.h +++ b/include/asm-sparc64/socket.h @@ -45,6 +45,8 @@ #define SO_TIMESTAMP 0x001d #define SCM_TIMESTAMP SO_TIMESTAMP +#define SO_PEERSEC 0x001e + /* Security levels - as per NRL IPv6 - don't actually do anything */ #define SO_SECURITY_AUTHENTICATION 0x5001 #define SO_SECURITY_ENCRYPTION_TRANSPORT 0x5002 diff --git a/include/asm-v850/socket.h b/include/asm-v850/socket.h index d1dddefa9eaa6..7d7f80efa8b36 100644 --- a/include/asm-v850/socket.h +++ b/include/asm-v850/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nast libc5 fixup - bletch */ #if defined(__KERNEL__) /* Socket types. */ diff --git a/include/asm-x86_64/socket.h b/include/asm-x86_64/socket.h index 525f83218cd80..373e7abadfb57 100644 --- a/include/asm-x86_64/socket.h +++ b/include/asm-x86_64/socket.h @@ -45,6 +45,8 @@ #define SO_ACCEPTCONN 30 +#define SO_PEERSEC 31 + /* Nasty libc5 fixup - bletch */ #if defined(__KERNEL__) || !defined(__GLIBC__) || (__GLIBC__ < 2) /* Socket types. */ diff --git a/include/linux/security.h b/include/linux/security.h index 9794223e8e178..06b2c60a48f84 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -757,6 +757,22 @@ struct swap_info_struct; * incoming sk_buff @skb has been associated with a particular socket, @sk. * @sk contains the sock (not socket) associated with the incoming sk_buff. * @skb contains the incoming network data. + * @socket_getpeersec: + * This hook allows the security module to provide peer socket security + * state to userspace via getsockopt SO_GETPEERSEC. + * @sock is the local socket. + * @optval userspace memory where the security state is to be copied. + * @optlen userspace int where the module should copy the actual length + * of the security state. + * @len as input is the maximum length to copy to userspace provided + * by the caller. + * Return 0 if all is well, otherwise, typical getsockopt return + * values. + * @sk_alloc_security: + * Allocate and attach a security structure to the sk->sk_security field, + * which is used to copy security attributes between local stream sockets. + * @sk_free_security: + * Deallocate security structure. * * Security hooks affecting all System V IPC operations. * @@ -1183,6 +1199,9 @@ struct security_operations { int (*socket_setsockopt) (struct socket * sock, int level, int optname); int (*socket_shutdown) (struct socket * sock, int how); int (*socket_sock_rcv_skb) (struct sock * sk, struct sk_buff * skb); + int (*socket_getpeersec) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len); + int (*sk_alloc_security) (struct sock *sk, int family, int priority); + void (*sk_free_security) (struct sock *sk); #endif /* CONFIG_SECURITY_NETWORK */ }; @@ -2564,6 +2583,22 @@ static inline int security_sock_rcv_skb (struct sock * sk, { return security_ops->socket_sock_rcv_skb (sk, skb); } + +static inline int security_socket_getpeersec(struct socket *sock, char __user *optval, + int __user *optlen, unsigned len) +{ + return security_ops->socket_getpeersec(sock, optval, optlen, len); +} + +static inline int security_sk_alloc(struct sock *sk, int family, int priority) +{ + return security_ops->sk_alloc_security(sk, family, priority); +} + +static inline void security_sk_free(struct sock *sk) +{ + return security_ops->sk_free_security(sk); +} #else /* CONFIG_SECURITY_NETWORK */ static inline int security_unix_stream_connect(struct socket * sock, struct socket * other, @@ -2664,6 +2699,21 @@ static inline int security_sock_rcv_skb (struct sock * sk, { return 0; } + +static inline int security_socket_getpeersec(struct socket *sock, char __user *optval, + int __user *optlen, unsigned len) +{ + return -ENOPROTOOPT; +} + +static inline int security_sk_alloc(struct sock *sk, int family, int priority) +{ + return 0; +} + +static inline void security_sk_free(struct sock *sk) +{ +} #endif /* CONFIG_SECURITY_NETWORK */ #endif /* ! __LINUX_SECURITY_H */ diff --git a/include/net/sock.h b/include/net/sock.h index 7b38c08f0f64e..16e129f90426f 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -246,6 +246,7 @@ struct sock { struct socket *sk_socket; void *sk_user_data; struct module *sk_owner; + void *sk_security; void (*sk_state_change)(struct sock *sk); void (*sk_data_ready)(struct sock *sk, int bytes); void (*sk_write_space)(struct sock *sk); diff --git a/net/core/sock.c b/net/core/sock.c index 27dfe373e59fa..007ed8c8888ea 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -564,6 +564,9 @@ int sock_getsockopt(struct socket *sock, int level, int optname, v.val = sk->sk_state == TCP_LISTEN; break; + case SO_PEERSEC: + return security_socket_getpeersec(sock, optval, optlen, len); + default: return(-ENOPROTOOPT); } @@ -606,6 +609,11 @@ struct sock *sk_alloc(int family, int priority, int zero_it, kmem_cache_t *slab) sock_lock_init(sk); } sk->sk_slab = slab; + + if (security_sk_alloc(sk, family, priority)) { + kmem_cache_free(slab, sk); + sk = NULL; + } } return sk; } @@ -628,6 +636,7 @@ void sk_free(struct sock *sk) printk(KERN_DEBUG "%s: optmem leakage (%d bytes) detected.\n", __FUNCTION__, atomic_read(&sk->sk_omem_alloc)); + security_sk_free(sk); kmem_cache_free(sk->sk_slab, sk); module_put(owner); } diff --git a/security/dummy.c b/security/dummy.c index 336e92cce44e1..58ee41e25f961 100644 --- a/security/dummy.c +++ b/security/dummy.c @@ -793,6 +793,21 @@ static int dummy_socket_sock_rcv_skb (struct sock *sk, struct sk_buff *skb) { return 0; } + +static int dummy_socket_getpeersec(struct socket *sock, char __user *optval, + int __user *optlen, unsigned len) +{ + return -ENOPROTOOPT; +} + +static inline int dummy_sk_alloc_security (struct sock *sk, int family, int priority) +{ + return 0; +} + +static inline void dummy_sk_free_security (struct sock *sk) +{ +} #endif /* CONFIG_SECURITY_NETWORK */ static int dummy_register_security (const char *name, struct security_operations *ops) @@ -969,6 +984,9 @@ void security_fixup_ops (struct security_operations *ops) set_to_dummy_if_null(ops, socket_getsockopt); set_to_dummy_if_null(ops, socket_shutdown); set_to_dummy_if_null(ops, socket_sock_rcv_skb); + set_to_dummy_if_null(ops, socket_getpeersec); + set_to_dummy_if_null(ops, sk_alloc_security); + set_to_dummy_if_null(ops, sk_free_security); #endif /* CONFIG_SECURITY_NETWORK */ } diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3892af7fc6785..0c799b808af9b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -244,6 +244,39 @@ static void superblock_free_security(struct super_block *sb) kfree(sbsec); } +#ifdef CONFIG_SECURITY_NETWORK +static int sk_alloc_security(struct sock *sk, int family, int priority) +{ + struct sk_security_struct *ssec; + + if (family != PF_UNIX) + return 0; + + ssec = kmalloc(sizeof(*ssec), priority); + if (!ssec) + return -ENOMEM; + + memset(ssec, 0, sizeof(*ssec)); + ssec->magic = SELINUX_MAGIC; + ssec->sk = sk; + ssec->peer_sid = SECINITSID_UNLABELED; + sk->sk_security = ssec; + + return 0; +} + +static void sk_free_security(struct sock *sk) +{ + struct task_security_struct *ssec = sk->sk_security; + + if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC) + return; + + sk->sk_security = NULL; + kfree(ssec); +} +#endif /* CONFIG_SECURITY_NETWORK */ + /* The security server must be initialized before any labeling or access decisions can be provided. */ extern int ss_initialized; @@ -2540,6 +2573,7 @@ static int selinux_socket_unix_stream_connect(struct socket *sock, struct socket *other, struct sock *newsk) { + struct sk_security_struct *ssec; struct inode_security_struct *isec; struct inode_security_struct *other_isec; struct avc_audit_data ad; @@ -2558,6 +2592,14 @@ static int selinux_socket_unix_stream_connect(struct socket *sock, if (err) return err; + /* connecting socket */ + ssec = sock->sk->sk_security; + ssec->peer_sid = other_isec->sid; + + /* server child socket */ + ssec = newsk->sk_security; + ssec->peer_sid = isec->sid; + return 0; } @@ -2664,6 +2706,54 @@ out: return err; } +static int selinux_socket_getpeersec(struct socket *sock, char __user *optval, + int __user *optlen, unsigned len) +{ + int err = 0; + char *scontext; + u32 scontext_len; + struct sk_security_struct *ssec; + struct inode_security_struct *isec; + + isec = SOCK_INODE(sock)->i_security; + if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) { + err = -ENOPROTOOPT; + goto out; + } + + ssec = sock->sk->sk_security; + + err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len); + if (err) + goto out; + + if (scontext_len > len) { + err = -ERANGE; + goto out_len; + } + + if (copy_to_user(optval, scontext, scontext_len)) + err = -EFAULT; + +out_len: + if (put_user(scontext_len, optlen)) + err = -EFAULT; + + kfree(scontext); +out: + return err; +} + +static int selinux_sk_alloc_security(struct sock *sk, int family, int priority) +{ + return sk_alloc_security(sk, family, priority); +} + +static void selinux_sk_free_security(struct sock *sk) +{ + sk_free_security(sk); +} + #ifdef CONFIG_NETFILTER static unsigned int selinux_ip_postroute_last(unsigned int hooknum, struct sk_buff **pskb, @@ -2741,6 +2831,7 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum, out: return err; } + #endif /* CONFIG_NETFILTER */ #endif /* CONFIG_SECURITY_NETWORK */ @@ -3479,6 +3570,9 @@ struct security_operations selinux_ops = { .socket_setsockopt = selinux_socket_setsockopt, .socket_shutdown = selinux_socket_shutdown, .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb, + .socket_getpeersec = selinux_socket_getpeersec, + .sk_alloc_security = selinux_sk_alloc_security, + .sk_free_security = selinux_sk_free_security, #endif }; diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 37a992ba0468e..28f77f23257ba 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -100,6 +100,12 @@ struct netif_security_struct { struct avc_entry_ref avcr; /* reference to permissions */ }; +struct sk_security_struct { + unsigned long magic; /* magic number for this module */ + struct sock *sk; /* back pointer to sk object */ + u32 peer_sid; /* SID of peer */ +}; + extern int inode_security_set_sid(struct inode *inode, u32 sid); #endif /* _SELINUX_OBJSEC_H_ */ -- 2.53.0