1. 23 6月, 2006 1 次提交
  2. 18 6月, 2006 3 次提交
    • J
      [SECMARK]: Add new packet controls to SELinux · 4e5ab4cb
      James Morris 提交于
      Add new per-packet access controls to SELinux, replacing the old
      packet controls.
      
      Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
      then security policy for the packets is enforced with these controls.
      
      To allow for a smooth transition to the new controls, the old code is
      still present, but not active by default.  To restore previous
      behavior, the old controls may be activated at runtime by writing a
      '1' to /selinux/compat_net, and also via the kernel boot parameter
      selinux_compat_net.  Switching between the network control models
      requires the security load_policy permission.  The old controls will
      probably eventually be removed and any continued use is discouraged.
      
      With this patch, the new secmark controls for SElinux are disabled by
      default, so existing behavior is entirely preserved, and the user is
      not affected at all.
      
      It also provides a config option to enable the secmark controls by
      default (which can always be overridden at boot and runtime).  It is
      also noted in the kconfig help that the user will need updated
      userspace if enabling secmark controls for SELinux and that they'll
      probably need the SECMARK and CONNMARK targets, and conntrack protocol
      helpers, although such decisions are beyond the scope of kernel
      configuration.
      Signed-off-by: NJames Morris <jmorris@namei.org>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4e5ab4cb
    • C
      [SELINUX]: add security class for appletalk sockets · 3e3ff15e
      Christopher J. PeBenito 提交于
      Add a security class for appletalk sockets so that they can be
      distinguished in SELinux policy.  Please apply.
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Acked-by: NJames Morris <jmorris@namei.org>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3e3ff15e
    • C
      [LSM-IPsec]: SELinux Authorize · c8c05a8e
      Catherine Zhang 提交于
      This patch contains a fix for the previous patch that adds security
      contexts to IPsec policies and security associations.  In the previous
      patch, no authorization (besides the check for write permissions to
      SAD and SPD) is required to delete IPsec policies and security
      assocations with security contexts.  Thus a user authorized to change
      SAD and SPD can bypass the IPsec policy authorization by simply
      deleteing policies with security contexts.  To fix this security hole,
      an additional authorization check is added for removing security
      policies and security associations with security contexts.
      
      Note that if no security context is supplied on add or present on
      policy to be deleted, the SELinux module allows the change
      unconditionally.  The hook is called on deletion when no context is
      present, which we may want to change.  At present, I left it up to the
      module.
      
      LSM changes:
      
      The patch adds two new LSM hooks: xfrm_policy_delete and
      xfrm_state_delete.  The new hooks are necessary to authorize deletion
      of IPsec policies that have security contexts.  The existing hooks
      xfrm_policy_free and xfrm_state_free lack the context to do the
      authorization, so I decided to split authorization of deletion and
      memory management of security data, as is typical in the LSM
      interface.
      
      Use:
      
      The new delete hooks are checked when xfrm_policy or xfrm_state are
      deleted by either the xfrm_user interface (xfrm_get_policy,
      xfrm_del_sa) or the pfkey interface (pfkey_spddelete, pfkey_delete).
      
      SELinux changes:
      
      The new policy_delete and state_delete functions are added.
      Signed-off-by: NCatherine Zhang <cxzhang@watson.ibm.com>
      Signed-off-by: NTrent Jaeger <tjaeger@cse.psu.edu>
      Acked-by: NJames Morris <jmorris@namei.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c8c05a8e
  3. 06 6月, 2006 1 次提交
  4. 22 5月, 2006 1 次提交
  5. 04 5月, 2006 1 次提交
  6. 01 5月, 2006 1 次提交
  7. 22 3月, 2006 3 次提交
  8. 21 3月, 2006 3 次提交
    • C
      [SECURITY]: TCP/UDP getpeersec · 2c7946a7
      Catherine Zhang 提交于
      This patch implements an application of the LSM-IPSec networking
      controls whereby an application can determine the label of the
      security association its TCP or UDP sockets are currently connected to
      via getsockopt and the auxiliary data mechanism of recvmsg.
      
      Patch purpose:
      
      This patch enables a security-aware application to retrieve the
      security context of an IPSec security association a particular TCP or
      UDP socket is using.  The application can then use this security
      context to determine the security context for processing on behalf of
      the peer at the other end of this connection.  In the case of UDP, the
      security context is for each individual packet.  An example
      application is the inetd daemon, which could be modified to start
      daemons running at security contexts dependent on the remote client.
      
      Patch design approach:
      
      - Design for TCP
      The patch enables the SELinux LSM to set the peer security context for
      a socket based on the security context of the IPSec security
      association.  The application may retrieve this context using
      getsockopt.  When called, the kernel determines if the socket is a
      connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
      cache on the socket to retrieve the security associations.  If a
      security association has a security context, the context string is
      returned, as for UNIX domain sockets.
      
      - Design for UDP
      Unlike TCP, UDP is connectionless.  This requires a somewhat different
      API to retrieve the peer security context.  With TCP, the peer
      security context stays the same throughout the connection, thus it can
      be retrieved at any time between when the connection is established
      and when it is torn down.  With UDP, each read/write can have
      different peer and thus the security context might change every time.
      As a result the security context retrieval must be done TOGETHER with
      the packet retrieval.
      
      The solution is to build upon the existing Unix domain socket API for
      retrieving user credentials.  Linux offers the API for obtaining user
      credentials via ancillary messages (i.e., out of band/control messages
      that are bundled together with a normal message).
      
      Patch implementation details:
      
      - Implementation for TCP
      The security context can be retrieved by applications using getsockopt
      with the existing SO_PEERSEC flag.  As an example (ignoring error
      checking):
      
      getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
      printf("Socket peer context is: %s\n", optbuf);
      
      The SELinux function, selinux_socket_getpeersec, is extended to check
      for labeled security associations for connected (TCP_ESTABLISHED ==
      sk->sk_state) TCP sockets only.  If so, the socket has a dst_cache of
      struct dst_entry values that may refer to security associations.  If
      these have security associations with security contexts, the security
      context is returned.
      
      getsockopt returns a buffer that contains a security context string or
      the buffer is unmodified.
      
      - Implementation for UDP
      To retrieve the security context, the application first indicates to
      the kernel such desire by setting the IP_PASSSEC option via
      getsockopt.  Then the application retrieves the security context using
      the auxiliary data mechanism.
      
      An example server application for UDP should look like this:
      
      toggle = 1;
      toggle_len = sizeof(toggle);
      
      setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
      recvmsg(sockfd, &msg_hdr, 0);
      if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
          cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
          if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
              cmsg_hdr->cmsg_level == SOL_IP &&
              cmsg_hdr->cmsg_type == SCM_SECURITY) {
              memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
          }
      }
      
      ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
      a server socket to receive security context of the peer.  A new
      ancillary message type SCM_SECURITY.
      
      When the packet is received we get the security context from the
      sec_path pointer which is contained in the sk_buff, and copy it to the
      ancillary message space.  An additional LSM hook,
      selinux_socket_getpeersec_udp, is defined to retrieve the security
      context from the SELinux space.  The existing function,
      selinux_socket_getpeersec does not suit our purpose, because the
      security context is copied directly to user space, rather than to
      kernel space.
      
      Testing:
      
      We have tested the patch by setting up TCP and UDP connections between
      applications on two machines using the IPSec policies that result in
      labeled security associations being built.  For TCP, we can then
      extract the peer security context using getsockopt on either end.  For
      UDP, the receiving end can retrieve the security context using the
      auxiliary data mechanism of recvmsg.
      Signed-off-by: NCatherine Zhang <cxzhang@watson.ibm.com>
      Acked-by: NJames Morris <jmorris@namei.org>
      Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2c7946a7
    • D
      [PATCH] Miscellaneous bug and warning fixes · 7306a0b9
      Dustin Kirkland 提交于
      This patch fixes a couple of bugs revealed in new features recently
      added to -mm1:
      * fixes warnings due to inconsistent use of const struct inode *inode
      * fixes bug that prevent a kernel from booting with audit on, and SELinux off
        due to a missing function in security/dummy.c
      * fixes a bug that throws spurious audit_panic() messages due to a missing
        return just before an error_path label
      * some reasonable house cleaning in audit_ipc_context(),
        audit_inode_context(), and audit_log_task_context()
      Signed-off-by: NDustin Kirkland <dustin.kirkland@us.ibm.com>
      Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
      7306a0b9
    • D
      [PATCH] Capture selinux subject/object context information. · 8c8570fb
      Dustin Kirkland 提交于
      This patch extends existing audit records with subject/object context
      information. Audit records associated with filesystem inodes, ipc, and
      tasks now contain SELinux label information in the field "subj" if the
      item is performing the action, or in "obj" if the item is the receiver
      of an action.
      
      These labels are collected via hooks in SELinux and appended to the
      appropriate record in the audit code.
      
      This additional information is required for Common Criteria Labeled
      Security Protection Profile (LSPP).
      
      [AV: fixed kmalloc flags use]
      [folded leak fixes]
      [folded cleanup from akpm (kfree(NULL)]
      [folded audit_inode_context() leak fix]
      [folded akpm's fix for audit_ipc_perm() definition in case of !CONFIG_AUDIT]
      Signed-off-by: NDustin Kirkland <dustin.kirkland@us.ibm.com>
      Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      8c8570fb
  9. 12 3月, 2006 1 次提交
  10. 06 2月, 2006 1 次提交
  11. 02 2月, 2006 3 次提交
  12. 15 1月, 2006 1 次提交
  13. 09 1月, 2006 1 次提交
  14. 04 1月, 2006 1 次提交
    • T
      [LSM-IPSec]: Per-packet access control. · d28d1e08
      Trent Jaeger 提交于
      This patch series implements per packet access control via the
      extension of the Linux Security Modules (LSM) interface by hooks in
      the XFRM and pfkey subsystems that leverage IPSec security
      associations to label packets.  Extensions to the SELinux LSM are
      included that leverage the patch for this purpose.
      
      This patch implements the changes necessary to the SELinux LSM to
      create, deallocate, and use security contexts for policies
      (xfrm_policy) and security associations (xfrm_state) that enable
      control of a socket's ability to send and receive packets.
      
      Patch purpose:
      
      The patch is designed to enable the SELinux LSM to implement access
      control on individual packets based on the strongly authenticated
      IPSec security association.  Such access controls augment the existing
      ones in SELinux based on network interface and IP address.  The former
      are very coarse-grained, and the latter can be spoofed.  By using
      IPSec, the SELinux can control access to remote hosts based on
      cryptographic keys generated using the IPSec mechanism.  This enables
      access control on a per-machine basis or per-application if the remote
      machine is running the same mechanism and trusted to enforce the
      access control policy.
      
      Patch design approach:
      
      The patch's main function is to authorize a socket's access to a IPSec
      policy based on their security contexts.  Since the communication is
      implemented by a security association, the patch ensures that the
      security association's negotiated and used have the same security
      context.  The patch enables allocation and deallocation of such
      security contexts for policies and security associations.  It also
      enables copying of the security context when policies are cloned.
      Lastly, the patch ensures that packets that are sent without using a
      IPSec security assocation with a security context are allowed to be
      sent in that manner.
      
      A presentation available at
      www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
      from the SELinux symposium describes the overall approach.
      
      Patch implementation details:
      
      The function which authorizes a socket to perform a requested
      operation (send/receive) on a IPSec policy (xfrm_policy) is
      selinux_xfrm_policy_lookup.  The Netfilter and rcv_skb hooks ensure
      that if a IPSec SA with a securit y association has not been used,
      then the socket is allowed to send or receive the packet,
      respectively.
      
      The patch implements SELinux function for allocating security contexts
      when policies (xfrm_policy) are created via the pfkey or xfrm_user
      interfaces via selinux_xfrm_policy_alloc.  When a security association
      is built, SELinux allocates the security context designated by the
      XFRM subsystem which is based on that of the authorized policy via
      selinux_xfrm_state_alloc.
      
      When a xfrm_policy is cloned, the security context of that policy, if
      any, is copied to the clone via selinux_xfrm_policy_clone.
      
      When a xfrm_policy or xfrm_state is freed, its security context, if
      any is also freed at selinux_xfrm_policy_free or
      selinux_xfrm_state_free.
      
      Testing:
      
      The SELinux authorization function is tested using ipsec-tools.  We
      created policies and security associations with particular security
      contexts and added SELinux access control policy entries to verify the
      authorization decision.  We also made sure that packets for which no
      security context was supplied (which either did or did not use
      security associations) were authorized using an unlabelled context.
      Signed-off-by: NTrent Jaeger <tjaeger@cse.psu.edu>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d28d1e08
  15. 09 11月, 2005 1 次提交
  16. 31 10月, 2005 6 次提交
  17. 28 10月, 2005 1 次提交
  18. 01 10月, 2005 1 次提交
    • J
      [PATCH] SELinux - fix SCTP socket bug and general IP protocol handling · 13402580
      James Morris 提交于
      The following patch updates the way SELinux classifies and handles IP
      based protocols.
      
      Currently, IP sockets are classified by SELinux as being either TCP, UDP
      or 'Raw', the latter being a default for IP socket that is not TCP or UDP.
      
      The classification code is out of date and uses only the socket type
      parameter to socket(2) to determine the class of IP socket.  So, any
      socket created with SOCK_STREAM will be classified by SELinux as TCP, and
      SOCK_DGRAM as UDP.  Also, other socket types such as SOCK_SEQPACKET and
      SOCK_DCCP are currently ignored by SELinux, which classifies them as
      generic sockets, which means they don't even get basic IP level checking.
      
      This patch changes the SELinux IP socket classification logic, so that
      only an IPPROTO_IP protocol value passed to socket(2) classify the socket
      as TCP or UDP.  The patch also drops the check for SOCK_RAW and converts
      it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET
      are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets).
      
      Note that protocol-specific support for SCTP, DCCP etc. is not addressed
      here, we're just getting these protocols checked at the IP layer.
      
      This fixes a reported problem where SCTP sockets were being recognized as
      generic SELinux sockets yet still being passed in one case to an IP level
      check, which then fails for generic sockets.
      
      It will also fix bugs where any SOCK_STREAM socket is classified as TCP or
      any SOCK_DGRAM socket is classified as UDP.
      
      This patch also unifies the way IP sockets classes are determined in
      selinux_socket_bind(), so we use the already calculated value instead of
      trying to recalculate it.
      Signed-off-by: NJames Morris <jmorris@namei.org>
      Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      13402580
  19. 10 9月, 2005 6 次提交
  20. 30 8月, 2005 1 次提交
  21. 29 7月, 2005 1 次提交
  22. 28 7月, 2005 1 次提交
    • J
      [PATCH] SELinux: default labeling of MLS field · f5c1d5b2
      James Morris 提交于
      Implement kernel labeling of the MLS (multilevel security) field of
      security contexts for files which have no existing MLS field.  This is to
      enable upgrades of a system from non-MLS to MLS without performing a full
      filesystem relabel including all of the mountpoints, which would be quite
      painful for users.
      
      With this patch, with MLS enabled, if a file has no MLS field, the kernel
      internally adds an MLS field to the in-core inode (but not to the on-disk
      file).  This MLS field added is the default for the superblock, allowing
      per-mountpoint control over the values via fixed policy or mount options.
      
      This patch has been tested by enabling MLS without relabeling its
      filesystem, and seems to be working correctly.
      Signed-off-by: NJames Morris <jmorris@redhat.com>
      Signed-off-by: NStephen Smalley <sds@epoch.ncsc.mil>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      f5c1d5b2