1 /* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux XFRM hook function implementations. 5 * 6 * Authors: Serge Hallyn <sergeh@us.ibm.com> 7 * Trent Jaeger <jaegert@us.ibm.com> 8 * 9 * Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com> 10 * 11 * Granular IPSec Associations for use in MLS environments. 12 * 13 * Copyright (C) 2005 International Business Machines Corporation 14 * Copyright (C) 2006 Trusted Computer Solutions, Inc. 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License version 2, 18 * as published by the Free Software Foundation. 19 */ 20 21 /* 22 * USAGE: 23 * NOTES: 24 * 1. Make sure to enable the following options in your kernel config: 25 * CONFIG_SECURITY=y 26 * CONFIG_SECURITY_NETWORK=y 27 * CONFIG_SECURITY_NETWORK_XFRM=y 28 * CONFIG_SECURITY_SELINUX=m/y 29 * ISSUES: 30 * 1. Caching packets, so they are not dropped during negotiation 31 * 2. Emulating a reasonable SO_PEERSEC across machines 32 * 3. Testing addition of sk_policy's with security context via setsockopt 33 */ 34 #include <linux/module.h> 35 #include <linux/kernel.h> 36 #include <linux/init.h> 37 #include <linux/security.h> 38 #include <linux/types.h> 39 #include <linux/netfilter.h> 40 #include <linux/netfilter_ipv4.h> 41 #include <linux/netfilter_ipv6.h> 42 #include <linux/ip.h> 43 #include <linux/tcp.h> 44 #include <linux/skbuff.h> 45 #include <linux/xfrm.h> 46 #include <net/xfrm.h> 47 #include <net/checksum.h> 48 #include <net/udp.h> 49 #include <asm/semaphore.h> 50 51 #include "avc.h" 52 #include "objsec.h" 53 #include "xfrm.h" 54 55 56 /* 57 * Returns true if an LSM/SELinux context 58 */ 59 static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx) 60 { 61 return (ctx && 62 (ctx->ctx_doi == XFRM_SC_DOI_LSM) && 63 (ctx->ctx_alg == XFRM_SC_ALG_SELINUX)); 64 } 65 66 /* 67 * Returns true if the xfrm contains a security blob for SELinux 68 */ 69 static inline int selinux_authorizable_xfrm(struct xfrm_state *x) 70 { 71 return selinux_authorizable_ctx(x->security); 72 } 73 74 /* 75 * LSM hook implementation that authorizes that a flow can use 76 * a xfrm policy rule. 77 */ 78 int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir) 79 { 80 int rc; 81 u32 sel_sid; 82 struct xfrm_sec_ctx *ctx; 83 84 /* Context sid is either set to label or ANY_ASSOC */ 85 if ((ctx = xp->security)) { 86 if (!selinux_authorizable_ctx(ctx)) 87 return -EINVAL; 88 89 sel_sid = ctx->ctx_sid; 90 } 91 else 92 /* 93 * All flows should be treated as polmatch'ing an 94 * otherwise applicable "non-labeled" policy. This 95 * would prevent inadvertent "leaks". 96 */ 97 return 0; 98 99 rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION, 100 ASSOCIATION__POLMATCH, 101 NULL); 102 103 if (rc == -EACCES) 104 rc = -ESRCH; 105 106 return rc; 107 } 108 109 /* 110 * LSM hook implementation that authorizes that a state matches 111 * the given policy, flow combo. 112 */ 113 114 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp, 115 struct flowi *fl) 116 { 117 u32 state_sid; 118 int rc; 119 120 if (!xp->security) 121 if (x->security) 122 /* unlabeled policy and labeled SA can't match */ 123 return 0; 124 else 125 /* unlabeled policy and unlabeled SA match all flows */ 126 return 1; 127 else 128 if (!x->security) 129 /* unlabeled SA and labeled policy can't match */ 130 return 0; 131 else 132 if (!selinux_authorizable_xfrm(x)) 133 /* Not a SELinux-labeled SA */ 134 return 0; 135 136 state_sid = x->security->ctx_sid; 137 138 if (fl->secid != state_sid) 139 return 0; 140 141 rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION, 142 ASSOCIATION__SENDTO, 143 NULL)? 0:1; 144 145 /* 146 * We don't need a separate SA Vs. policy polmatch check 147 * since the SA is now of the same label as the flow and 148 * a flow Vs. policy polmatch check had already happened 149 * in selinux_xfrm_policy_lookup() above. 150 */ 151 152 return rc; 153 } 154 155 /* 156 * LSM hook implementation that checks and/or returns the xfrm sid for the 157 * incoming packet. 158 */ 159 160 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall) 161 { 162 struct sec_path *sp; 163 164 *sid = SECSID_NULL; 165 166 if (skb == NULL) 167 return 0; 168 169 sp = skb->sp; 170 if (sp) { 171 int i, sid_set = 0; 172 173 for (i = sp->len-1; i >= 0; i--) { 174 struct xfrm_state *x = sp->xvec[i]; 175 if (selinux_authorizable_xfrm(x)) { 176 struct xfrm_sec_ctx *ctx = x->security; 177 178 if (!sid_set) { 179 *sid = ctx->ctx_sid; 180 sid_set = 1; 181 182 if (!ckall) 183 break; 184 } 185 else if (*sid != ctx->ctx_sid) 186 return -EINVAL; 187 } 188 } 189 } 190 191 return 0; 192 } 193 194 /* 195 * Security blob allocation for xfrm_policy and xfrm_state 196 * CTX does not have a meaningful value on input 197 */ 198 static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp, 199 struct xfrm_user_sec_ctx *uctx, u32 sid) 200 { 201 int rc = 0; 202 struct task_security_struct *tsec = current->security; 203 struct xfrm_sec_ctx *ctx = NULL; 204 char *ctx_str = NULL; 205 u32 str_len; 206 207 BUG_ON(uctx && sid); 208 209 if (!uctx) 210 goto not_from_user; 211 212 if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX) 213 return -EINVAL; 214 215 if (uctx->ctx_len >= PAGE_SIZE) 216 return -ENOMEM; 217 218 *ctxp = ctx = kmalloc(sizeof(*ctx) + 219 uctx->ctx_len, 220 GFP_KERNEL); 221 222 if (!ctx) 223 return -ENOMEM; 224 225 ctx->ctx_doi = uctx->ctx_doi; 226 ctx->ctx_len = uctx->ctx_len; 227 ctx->ctx_alg = uctx->ctx_alg; 228 229 memcpy(ctx->ctx_str, 230 uctx+1, 231 ctx->ctx_len); 232 rc = security_context_to_sid(ctx->ctx_str, 233 ctx->ctx_len, 234 &ctx->ctx_sid); 235 236 if (rc) 237 goto out; 238 239 /* 240 * Does the subject have permission to set security context? 241 */ 242 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 243 SECCLASS_ASSOCIATION, 244 ASSOCIATION__SETCONTEXT, NULL); 245 if (rc) 246 goto out; 247 248 return rc; 249 250 not_from_user: 251 rc = security_sid_to_context(sid, &ctx_str, &str_len); 252 if (rc) 253 goto out; 254 255 *ctxp = ctx = kmalloc(sizeof(*ctx) + 256 str_len, 257 GFP_ATOMIC); 258 259 if (!ctx) { 260 rc = -ENOMEM; 261 goto out; 262 } 263 264 ctx->ctx_doi = XFRM_SC_DOI_LSM; 265 ctx->ctx_alg = XFRM_SC_ALG_SELINUX; 266 ctx->ctx_sid = sid; 267 ctx->ctx_len = str_len; 268 memcpy(ctx->ctx_str, 269 ctx_str, 270 str_len); 271 272 goto out2; 273 274 out: 275 *ctxp = NULL; 276 kfree(ctx); 277 out2: 278 kfree(ctx_str); 279 return rc; 280 } 281 282 /* 283 * LSM hook implementation that allocs and transfers uctx spec to 284 * xfrm_policy. 285 */ 286 int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, 287 struct xfrm_user_sec_ctx *uctx) 288 { 289 int err; 290 291 BUG_ON(!xp); 292 BUG_ON(!uctx); 293 294 err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, 0); 295 return err; 296 } 297 298 299 /* 300 * LSM hook implementation that copies security data structure from old to 301 * new for policy cloning. 302 */ 303 int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new) 304 { 305 struct xfrm_sec_ctx *old_ctx, *new_ctx; 306 307 old_ctx = old->security; 308 309 if (old_ctx) { 310 new_ctx = new->security = kmalloc(sizeof(*new_ctx) + 311 old_ctx->ctx_len, 312 GFP_KERNEL); 313 314 if (!new_ctx) 315 return -ENOMEM; 316 317 memcpy(new_ctx, old_ctx, sizeof(*new_ctx)); 318 memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len); 319 } 320 return 0; 321 } 322 323 /* 324 * LSM hook implementation that frees xfrm_policy security information. 325 */ 326 void selinux_xfrm_policy_free(struct xfrm_policy *xp) 327 { 328 struct xfrm_sec_ctx *ctx = xp->security; 329 if (ctx) 330 kfree(ctx); 331 } 332 333 /* 334 * LSM hook implementation that authorizes deletion of labeled policies. 335 */ 336 int selinux_xfrm_policy_delete(struct xfrm_policy *xp) 337 { 338 struct task_security_struct *tsec = current->security; 339 struct xfrm_sec_ctx *ctx = xp->security; 340 int rc = 0; 341 342 if (ctx) 343 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 344 SECCLASS_ASSOCIATION, 345 ASSOCIATION__SETCONTEXT, NULL); 346 347 return rc; 348 } 349 350 /* 351 * LSM hook implementation that allocs and transfers sec_ctx spec to 352 * xfrm_state. 353 */ 354 int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx, 355 u32 secid) 356 { 357 int err; 358 359 BUG_ON(!x); 360 361 err = selinux_xfrm_sec_ctx_alloc(&x->security, uctx, secid); 362 return err; 363 } 364 365 /* 366 * LSM hook implementation that frees xfrm_state security information. 367 */ 368 void selinux_xfrm_state_free(struct xfrm_state *x) 369 { 370 struct xfrm_sec_ctx *ctx = x->security; 371 if (ctx) 372 kfree(ctx); 373 } 374 375 /* 376 * SELinux internal function to retrieve the context of a UDP packet 377 * based on its security association. 378 * 379 * Retrieve via setsockopt IP_PASSSEC and recvmsg with control message 380 * type SCM_SECURITY. 381 */ 382 u32 selinux_socket_getpeer_dgram(struct sk_buff *skb) 383 { 384 struct sec_path *sp; 385 386 if (skb == NULL) 387 return SECSID_NULL; 388 389 if (skb->sk->sk_protocol != IPPROTO_UDP) 390 return SECSID_NULL; 391 392 sp = skb->sp; 393 if (sp) { 394 int i; 395 396 for (i = sp->len-1; i >= 0; i--) { 397 struct xfrm_state *x = sp->xvec[i]; 398 if (selinux_authorizable_xfrm(x)) { 399 struct xfrm_sec_ctx *ctx = x->security; 400 return ctx->ctx_sid; 401 } 402 } 403 } 404 405 return SECSID_NULL; 406 } 407 408 /* 409 * LSM hook implementation that authorizes deletion of labeled SAs. 410 */ 411 int selinux_xfrm_state_delete(struct xfrm_state *x) 412 { 413 struct task_security_struct *tsec = current->security; 414 struct xfrm_sec_ctx *ctx = x->security; 415 int rc = 0; 416 417 if (ctx) 418 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 419 SECCLASS_ASSOCIATION, 420 ASSOCIATION__SETCONTEXT, NULL); 421 422 return rc; 423 } 424 425 /* 426 * LSM hook that controls access to unlabelled packets. If 427 * a xfrm_state is authorizable (defined by macro) then it was 428 * already authorized by the IPSec process. If not, then 429 * we need to check for unlabelled access since this may not have 430 * gone thru the IPSec process. 431 */ 432 int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb, 433 struct avc_audit_data *ad) 434 { 435 int i, rc = 0; 436 struct sec_path *sp; 437 u32 sel_sid = SECINITSID_UNLABELED; 438 439 sp = skb->sp; 440 441 if (sp) { 442 for (i = 0; i < sp->len; i++) { 443 struct xfrm_state *x = sp->xvec[i]; 444 445 if (x && selinux_authorizable_xfrm(x)) { 446 struct xfrm_sec_ctx *ctx = x->security; 447 sel_sid = ctx->ctx_sid; 448 break; 449 } 450 } 451 } 452 453 /* 454 * This check even when there's no association involved is 455 * intended, according to Trent Jaeger, to make sure a 456 * process can't engage in non-ipsec communication unless 457 * explicitly allowed by policy. 458 */ 459 460 rc = avc_has_perm(isec_sid, sel_sid, SECCLASS_ASSOCIATION, 461 ASSOCIATION__RECVFROM, ad); 462 463 return rc; 464 } 465 466 /* 467 * POSTROUTE_LAST hook's XFRM processing: 468 * If we have no security association, then we need to determine 469 * whether the socket is allowed to send to an unlabelled destination. 470 * If we do have a authorizable security association, then it has already been 471 * checked in the selinux_xfrm_state_pol_flow_match hook above. 472 */ 473 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb, 474 struct avc_audit_data *ad, u8 proto) 475 { 476 struct dst_entry *dst; 477 int rc = 0; 478 479 dst = skb->dst; 480 481 if (dst) { 482 struct dst_entry *dst_test; 483 484 for (dst_test = dst; dst_test != 0; 485 dst_test = dst_test->child) { 486 struct xfrm_state *x = dst_test->xfrm; 487 488 if (x && selinux_authorizable_xfrm(x)) 489 goto out; 490 } 491 } 492 493 switch (proto) { 494 case IPPROTO_AH: 495 case IPPROTO_ESP: 496 case IPPROTO_COMP: 497 /* 498 * We should have already seen this packet once before 499 * it underwent xfrm(s). No need to subject it to the 500 * unlabeled check. 501 */ 502 goto out; 503 default: 504 break; 505 } 506 507 /* 508 * This check even when there's no association involved is 509 * intended, according to Trent Jaeger, to make sure a 510 * process can't engage in non-ipsec communication unless 511 * explicitly allowed by policy. 512 */ 513 514 rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION, 515 ASSOCIATION__SENDTO, ad); 516 out: 517 return rc; 518 } 519