1 /* 2 * Network interface table. 3 * 4 * Network interfaces (devices) do not have a security field, so we 5 * maintain a table associating each interface with a SID. 6 * 7 * Author: James Morris <jmorris@redhat.com> 8 * 9 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License version 2, 13 * as published by the Free Software Foundation. 14 */ 15 #include <linux/init.h> 16 #include <linux/types.h> 17 #include <linux/stddef.h> 18 #include <linux/kernel.h> 19 #include <linux/list.h> 20 #include <linux/notifier.h> 21 #include <linux/netdevice.h> 22 #include <linux/rcupdate.h> 23 #include <net/net_namespace.h> 24 25 #include "security.h" 26 #include "objsec.h" 27 #include "netif.h" 28 29 #define SEL_NETIF_HASH_SIZE 64 30 #define SEL_NETIF_HASH_MAX 1024 31 32 #undef DEBUG 33 34 #ifdef DEBUG 35 #define DEBUGP printk 36 #else 37 #define DEBUGP(format, args...) 38 #endif 39 40 struct sel_netif 41 { 42 struct list_head list; 43 struct netif_security_struct nsec; 44 struct rcu_head rcu_head; 45 }; 46 47 static u32 sel_netif_total; 48 static LIST_HEAD(sel_netif_list); 49 static DEFINE_SPINLOCK(sel_netif_lock); 50 static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE]; 51 52 static inline u32 sel_netif_hasfn(struct net_device *dev) 53 { 54 return (dev->ifindex & (SEL_NETIF_HASH_SIZE - 1)); 55 } 56 57 /* 58 * All of the devices should normally fit in the hash, so we optimize 59 * for that case. 60 */ 61 static inline struct sel_netif *sel_netif_find(struct net_device *dev) 62 { 63 struct list_head *pos; 64 int idx = sel_netif_hasfn(dev); 65 66 __list_for_each_rcu(pos, &sel_netif_hash[idx]) { 67 struct sel_netif *netif = list_entry(pos, 68 struct sel_netif, list); 69 if (likely(netif->nsec.dev == dev)) 70 return netif; 71 } 72 return NULL; 73 } 74 75 static int sel_netif_insert(struct sel_netif *netif) 76 { 77 int idx, ret = 0; 78 79 if (sel_netif_total >= SEL_NETIF_HASH_MAX) { 80 ret = -ENOSPC; 81 goto out; 82 } 83 84 idx = sel_netif_hasfn(netif->nsec.dev); 85 list_add_rcu(&netif->list, &sel_netif_hash[idx]); 86 sel_netif_total++; 87 out: 88 return ret; 89 } 90 91 static void sel_netif_free(struct rcu_head *p) 92 { 93 struct sel_netif *netif = container_of(p, struct sel_netif, rcu_head); 94 95 DEBUGP("%s: %s\n", __FUNCTION__, netif->nsec.dev->name); 96 kfree(netif); 97 } 98 99 static void sel_netif_destroy(struct sel_netif *netif) 100 { 101 DEBUGP("%s: %s\n", __FUNCTION__, netif->nsec.dev->name); 102 103 list_del_rcu(&netif->list); 104 sel_netif_total--; 105 call_rcu(&netif->rcu_head, sel_netif_free); 106 } 107 108 static struct sel_netif *sel_netif_lookup(struct net_device *dev) 109 { 110 int ret; 111 struct sel_netif *netif, *new; 112 struct netif_security_struct *nsec; 113 114 netif = sel_netif_find(dev); 115 if (likely(netif != NULL)) 116 goto out; 117 118 new = kzalloc(sizeof(*new), GFP_ATOMIC); 119 if (!new) { 120 netif = ERR_PTR(-ENOMEM); 121 goto out; 122 } 123 124 nsec = &new->nsec; 125 126 ret = security_netif_sid(dev->name, &nsec->if_sid, &nsec->msg_sid); 127 if (ret < 0) { 128 kfree(new); 129 netif = ERR_PTR(ret); 130 goto out; 131 } 132 133 nsec->dev = dev; 134 135 spin_lock_bh(&sel_netif_lock); 136 137 netif = sel_netif_find(dev); 138 if (netif) { 139 spin_unlock_bh(&sel_netif_lock); 140 kfree(new); 141 goto out; 142 } 143 144 ret = sel_netif_insert(new); 145 spin_unlock_bh(&sel_netif_lock); 146 147 if (ret) { 148 kfree(new); 149 netif = ERR_PTR(ret); 150 goto out; 151 } 152 153 netif = new; 154 155 DEBUGP("new: ifindex=%u name=%s if_sid=%u msg_sid=%u\n", dev->ifindex, dev->name, 156 nsec->if_sid, nsec->msg_sid); 157 out: 158 return netif; 159 } 160 161 static void sel_netif_assign_sids(u32 if_sid_in, u32 msg_sid_in, u32 *if_sid_out, u32 *msg_sid_out) 162 { 163 if (if_sid_out) 164 *if_sid_out = if_sid_in; 165 if (msg_sid_out) 166 *msg_sid_out = msg_sid_in; 167 } 168 169 static int sel_netif_sids_slow(struct net_device *dev, u32 *if_sid, u32 *msg_sid) 170 { 171 int ret = 0; 172 u32 tmp_if_sid, tmp_msg_sid; 173 174 ret = security_netif_sid(dev->name, &tmp_if_sid, &tmp_msg_sid); 175 if (!ret) 176 sel_netif_assign_sids(tmp_if_sid, tmp_msg_sid, if_sid, msg_sid); 177 return ret; 178 } 179 180 int sel_netif_sids(struct net_device *dev, u32 *if_sid, u32 *msg_sid) 181 { 182 int ret = 0; 183 struct sel_netif *netif; 184 185 rcu_read_lock(); 186 netif = sel_netif_lookup(dev); 187 if (IS_ERR(netif)) { 188 rcu_read_unlock(); 189 ret = sel_netif_sids_slow(dev, if_sid, msg_sid); 190 goto out; 191 } 192 sel_netif_assign_sids(netif->nsec.if_sid, netif->nsec.msg_sid, if_sid, msg_sid); 193 rcu_read_unlock(); 194 out: 195 return ret; 196 } 197 198 static void sel_netif_kill(struct net_device *dev) 199 { 200 struct sel_netif *netif; 201 202 spin_lock_bh(&sel_netif_lock); 203 netif = sel_netif_find(dev); 204 if (netif) 205 sel_netif_destroy(netif); 206 spin_unlock_bh(&sel_netif_lock); 207 } 208 209 static void sel_netif_flush(void) 210 { 211 int idx; 212 213 spin_lock_bh(&sel_netif_lock); 214 for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++) { 215 struct sel_netif *netif; 216 217 list_for_each_entry(netif, &sel_netif_hash[idx], list) 218 sel_netif_destroy(netif); 219 } 220 spin_unlock_bh(&sel_netif_lock); 221 } 222 223 static int sel_netif_avc_callback(u32 event, u32 ssid, u32 tsid, 224 u16 class, u32 perms, u32 *retained) 225 { 226 if (event == AVC_CALLBACK_RESET) { 227 sel_netif_flush(); 228 synchronize_net(); 229 } 230 return 0; 231 } 232 233 static int sel_netif_netdev_notifier_handler(struct notifier_block *this, 234 unsigned long event, void *ptr) 235 { 236 struct net_device *dev = ptr; 237 238 if (dev->nd_net != &init_net) 239 return NOTIFY_DONE; 240 241 if (event == NETDEV_DOWN) 242 sel_netif_kill(dev); 243 244 return NOTIFY_DONE; 245 } 246 247 static struct notifier_block sel_netif_netdev_notifier = { 248 .notifier_call = sel_netif_netdev_notifier_handler, 249 }; 250 251 static __init int sel_netif_init(void) 252 { 253 int i, err = 0; 254 255 if (!selinux_enabled) 256 goto out; 257 258 for (i = 0; i < SEL_NETIF_HASH_SIZE; i++) 259 INIT_LIST_HEAD(&sel_netif_hash[i]); 260 261 register_netdevice_notifier(&sel_netif_netdev_notifier); 262 263 err = avc_add_callback(sel_netif_avc_callback, AVC_CALLBACK_RESET, 264 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); 265 if (err) 266 panic("avc_add_callback() failed, error %d\n", err); 267 268 out: 269 return err; 270 } 271 272 __initcall(sel_netif_init); 273 274