1 /* 2 * Network interface table. 3 * 4 * Network interfaces (devices) do not have a security field, so we 5 * maintain a table associating each interface with a SID. 6 * 7 * Author: James Morris <jmorris@redhat.com> 8 * 9 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 10 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. 11 * Paul Moore <paul@paul-moore.com> 12 * 13 * This program is free software; you can redistribute it and/or modify 14 * it under the terms of the GNU General Public License version 2, 15 * as published by the Free Software Foundation. 16 */ 17 #include <linux/init.h> 18 #include <linux/types.h> 19 #include <linux/slab.h> 20 #include <linux/stddef.h> 21 #include <linux/kernel.h> 22 #include <linux/list.h> 23 #include <linux/notifier.h> 24 #include <linux/netdevice.h> 25 #include <linux/rcupdate.h> 26 #include <net/net_namespace.h> 27 28 #include "security.h" 29 #include "objsec.h" 30 #include "netif.h" 31 32 #define SEL_NETIF_HASH_SIZE 64 33 #define SEL_NETIF_HASH_MAX 1024 34 35 struct sel_netif { 36 struct list_head list; 37 struct netif_security_struct nsec; 38 struct rcu_head rcu_head; 39 }; 40 41 static u32 sel_netif_total; 42 static LIST_HEAD(sel_netif_list); 43 static DEFINE_SPINLOCK(sel_netif_lock); 44 static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE]; 45 46 /** 47 * sel_netif_hashfn - Hashing function for the interface table 48 * @ns: the network namespace 49 * @ifindex: the network interface 50 * 51 * Description: 52 * This is the hashing function for the network interface table, it returns the 53 * bucket number for the given interface. 54 * 55 */ 56 static inline u32 sel_netif_hashfn(const struct net *ns, int ifindex) 57 { 58 return (((uintptr_t)ns + ifindex) & (SEL_NETIF_HASH_SIZE - 1)); 59 } 60 61 /** 62 * sel_netif_find - Search for an interface record 63 * @ns: the network namespace 64 * @ifindex: the network interface 65 * 66 * Description: 67 * Search the network interface table and return the record matching @ifindex. 68 * If an entry can not be found in the table return NULL. 69 * 70 */ 71 static inline struct sel_netif *sel_netif_find(const struct net *ns, 72 int ifindex) 73 { 74 int idx = sel_netif_hashfn(ns, ifindex); 75 struct sel_netif *netif; 76 77 list_for_each_entry_rcu(netif, &sel_netif_hash[idx], list) 78 if (net_eq(netif->nsec.ns, ns) && 79 netif->nsec.ifindex == ifindex) 80 return netif; 81 82 return NULL; 83 } 84 85 /** 86 * sel_netif_insert - Insert a new interface into the table 87 * @netif: the new interface record 88 * 89 * Description: 90 * Add a new interface record to the network interface hash table. Returns 91 * zero on success, negative values on failure. 92 * 93 */ 94 static int sel_netif_insert(struct sel_netif *netif) 95 { 96 int idx; 97 98 if (sel_netif_total >= SEL_NETIF_HASH_MAX) 99 return -ENOSPC; 100 101 idx = sel_netif_hashfn(netif->nsec.ns, netif->nsec.ifindex); 102 list_add_rcu(&netif->list, &sel_netif_hash[idx]); 103 sel_netif_total++; 104 105 return 0; 106 } 107 108 /** 109 * sel_netif_destroy - Remove an interface record from the table 110 * @netif: the existing interface record 111 * 112 * Description: 113 * Remove an existing interface record from the network interface table. 114 * 115 */ 116 static void sel_netif_destroy(struct sel_netif *netif) 117 { 118 list_del_rcu(&netif->list); 119 sel_netif_total--; 120 kfree_rcu(netif, rcu_head); 121 } 122 123 /** 124 * sel_netif_sid_slow - Lookup the SID of a network interface using the policy 125 * @ns: the network namespace 126 * @ifindex: the network interface 127 * @sid: interface SID 128 * 129 * Description: 130 * This function determines the SID of a network interface by quering the 131 * security policy. The result is added to the network interface table to 132 * speedup future queries. Returns zero on success, negative values on 133 * failure. 134 * 135 */ 136 static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) 137 { 138 int ret; 139 struct sel_netif *netif; 140 struct sel_netif *new = NULL; 141 struct net_device *dev; 142 143 /* NOTE: we always use init's network namespace since we don't 144 * currently support containers */ 145 146 dev = dev_get_by_index(ns, ifindex); 147 if (unlikely(dev == NULL)) { 148 pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n", 149 __func__, ifindex); 150 return -ENOENT; 151 } 152 153 spin_lock_bh(&sel_netif_lock); 154 netif = sel_netif_find(ns, ifindex); 155 if (netif != NULL) { 156 *sid = netif->nsec.sid; 157 ret = 0; 158 goto out; 159 } 160 new = kzalloc(sizeof(*new), GFP_ATOMIC); 161 if (new == NULL) { 162 ret = -ENOMEM; 163 goto out; 164 } 165 ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid); 166 if (ret != 0) 167 goto out; 168 new->nsec.ns = ns; 169 new->nsec.ifindex = ifindex; 170 ret = sel_netif_insert(new); 171 if (ret != 0) 172 goto out; 173 *sid = new->nsec.sid; 174 175 out: 176 spin_unlock_bh(&sel_netif_lock); 177 dev_put(dev); 178 if (unlikely(ret)) { 179 pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n", 180 __func__, ifindex); 181 kfree(new); 182 } 183 return ret; 184 } 185 186 /** 187 * sel_netif_sid - Lookup the SID of a network interface 188 * @ns: the network namespace 189 * @ifindex: the network interface 190 * @sid: interface SID 191 * 192 * Description: 193 * This function determines the SID of a network interface using the fastest 194 * method possible. First the interface table is queried, but if an entry 195 * can't be found then the policy is queried and the result is added to the 196 * table to speedup future queries. Returns zero on success, negative values 197 * on failure. 198 * 199 */ 200 int sel_netif_sid(struct net *ns, int ifindex, u32 *sid) 201 { 202 struct sel_netif *netif; 203 204 rcu_read_lock(); 205 netif = sel_netif_find(ns, ifindex); 206 if (likely(netif != NULL)) { 207 *sid = netif->nsec.sid; 208 rcu_read_unlock(); 209 return 0; 210 } 211 rcu_read_unlock(); 212 213 return sel_netif_sid_slow(ns, ifindex, sid); 214 } 215 216 /** 217 * sel_netif_kill - Remove an entry from the network interface table 218 * @ns: the network namespace 219 * @ifindex: the network interface 220 * 221 * Description: 222 * This function removes the entry matching @ifindex from the network interface 223 * table if it exists. 224 * 225 */ 226 static void sel_netif_kill(const struct net *ns, int ifindex) 227 { 228 struct sel_netif *netif; 229 230 rcu_read_lock(); 231 spin_lock_bh(&sel_netif_lock); 232 netif = sel_netif_find(ns, ifindex); 233 if (netif) 234 sel_netif_destroy(netif); 235 spin_unlock_bh(&sel_netif_lock); 236 rcu_read_unlock(); 237 } 238 239 /** 240 * sel_netif_flush - Flush the entire network interface table 241 * 242 * Description: 243 * Remove all entries from the network interface table. 244 * 245 */ 246 void sel_netif_flush(void) 247 { 248 int idx; 249 struct sel_netif *netif; 250 251 spin_lock_bh(&sel_netif_lock); 252 for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++) 253 list_for_each_entry(netif, &sel_netif_hash[idx], list) 254 sel_netif_destroy(netif); 255 spin_unlock_bh(&sel_netif_lock); 256 } 257 258 static int sel_netif_netdev_notifier_handler(struct notifier_block *this, 259 unsigned long event, void *ptr) 260 { 261 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 262 263 if (event == NETDEV_DOWN) 264 sel_netif_kill(dev_net(dev), dev->ifindex); 265 266 return NOTIFY_DONE; 267 } 268 269 static struct notifier_block sel_netif_netdev_notifier = { 270 .notifier_call = sel_netif_netdev_notifier_handler, 271 }; 272 273 static __init int sel_netif_init(void) 274 { 275 int i; 276 277 if (!selinux_enabled) 278 return 0; 279 280 for (i = 0; i < SEL_NETIF_HASH_SIZE; i++) 281 INIT_LIST_HEAD(&sel_netif_hash[i]); 282 283 register_netdevice_notifier(&sel_netif_netdev_notifier); 284 285 return 0; 286 } 287 288 __initcall(sel_netif_init); 289 290