1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Network interface table. 4 * 5 * Network interfaces (devices) do not have a security field, so we 6 * maintain a table associating each interface with a SID. 7 * 8 * Author: James Morris <jmorris@redhat.com> 9 * 10 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 11 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. 12 * Paul Moore <paul@paul-moore.com> 13 */ 14 #include <linux/init.h> 15 #include <linux/types.h> 16 #include <linux/slab.h> 17 #include <linux/stddef.h> 18 #include <linux/kernel.h> 19 #include <linux/list.h> 20 #include <linux/notifier.h> 21 #include <linux/netdevice.h> 22 #include <linux/rcupdate.h> 23 #include <net/net_namespace.h> 24 25 #include "security.h" 26 #include "objsec.h" 27 #include "netif.h" 28 29 #define SEL_NETIF_HASH_SIZE 64 30 #define SEL_NETIF_HASH_MAX 1024 31 32 struct sel_netif { 33 struct list_head list; 34 struct netif_security_struct nsec; 35 struct rcu_head rcu_head; 36 }; 37 38 static u32 sel_netif_total; 39 static LIST_HEAD(sel_netif_list); 40 static DEFINE_SPINLOCK(sel_netif_lock); 41 static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE]; 42 43 /** 44 * sel_netif_hashfn - Hashing function for the interface table 45 * @ns: the network namespace 46 * @ifindex: the network interface 47 * 48 * Description: 49 * This is the hashing function for the network interface table, it returns the 50 * bucket number for the given interface. 51 * 52 */ 53 static inline u32 sel_netif_hashfn(const struct net *ns, int ifindex) 54 { 55 return (((uintptr_t)ns + ifindex) & (SEL_NETIF_HASH_SIZE - 1)); 56 } 57 58 /** 59 * sel_netif_find - Search for an interface record 60 * @ns: the network namespace 61 * @ifindex: the network interface 62 * 63 * Description: 64 * Search the network interface table and return the record matching @ifindex. 65 * If an entry can not be found in the table return NULL. 66 * 67 */ 68 static inline struct sel_netif *sel_netif_find(const struct net *ns, 69 int ifindex) 70 { 71 int idx = sel_netif_hashfn(ns, ifindex); 72 struct sel_netif *netif; 73 74 list_for_each_entry_rcu(netif, &sel_netif_hash[idx], list) 75 if (net_eq(netif->nsec.ns, ns) && 76 netif->nsec.ifindex == ifindex) 77 return netif; 78 79 return NULL; 80 } 81 82 /** 83 * sel_netif_insert - Insert a new interface into the table 84 * @netif: the new interface record 85 * 86 * Description: 87 * Add a new interface record to the network interface hash table. Returns 88 * zero on success, negative values on failure. 89 * 90 */ 91 static int sel_netif_insert(struct sel_netif *netif) 92 { 93 int idx; 94 95 if (sel_netif_total >= SEL_NETIF_HASH_MAX) 96 return -ENOSPC; 97 98 idx = sel_netif_hashfn(netif->nsec.ns, netif->nsec.ifindex); 99 list_add_rcu(&netif->list, &sel_netif_hash[idx]); 100 sel_netif_total++; 101 102 return 0; 103 } 104 105 /** 106 * sel_netif_destroy - Remove an interface record from the table 107 * @netif: the existing interface record 108 * 109 * Description: 110 * Remove an existing interface record from the network interface table. 111 * 112 */ 113 static void sel_netif_destroy(struct sel_netif *netif) 114 { 115 list_del_rcu(&netif->list); 116 sel_netif_total--; 117 kfree_rcu(netif, rcu_head); 118 } 119 120 /** 121 * sel_netif_sid_slow - Lookup the SID of a network interface using the policy 122 * @ns: the network namespace 123 * @ifindex: the network interface 124 * @sid: interface SID 125 * 126 * Description: 127 * This function determines the SID of a network interface by quering the 128 * security policy. The result is added to the network interface table to 129 * speedup future queries. Returns zero on success, negative values on 130 * failure. 131 * 132 */ 133 static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) 134 { 135 int ret; 136 struct sel_netif *netif; 137 struct sel_netif *new = NULL; 138 struct net_device *dev; 139 140 /* NOTE: we always use init's network namespace since we don't 141 * currently support containers */ 142 143 dev = dev_get_by_index(ns, ifindex); 144 if (unlikely(dev == NULL)) { 145 pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n", 146 __func__, ifindex); 147 return -ENOENT; 148 } 149 150 spin_lock_bh(&sel_netif_lock); 151 netif = sel_netif_find(ns, ifindex); 152 if (netif != NULL) { 153 *sid = netif->nsec.sid; 154 ret = 0; 155 goto out; 156 } 157 new = kzalloc(sizeof(*new), GFP_ATOMIC); 158 if (new == NULL) { 159 ret = -ENOMEM; 160 goto out; 161 } 162 ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid); 163 if (ret != 0) 164 goto out; 165 new->nsec.ns = ns; 166 new->nsec.ifindex = ifindex; 167 ret = sel_netif_insert(new); 168 if (ret != 0) 169 goto out; 170 *sid = new->nsec.sid; 171 172 out: 173 spin_unlock_bh(&sel_netif_lock); 174 dev_put(dev); 175 if (unlikely(ret)) { 176 pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n", 177 __func__, ifindex); 178 kfree(new); 179 } 180 return ret; 181 } 182 183 /** 184 * sel_netif_sid - Lookup the SID of a network interface 185 * @ns: the network namespace 186 * @ifindex: the network interface 187 * @sid: interface SID 188 * 189 * Description: 190 * This function determines the SID of a network interface using the fastest 191 * method possible. First the interface table is queried, but if an entry 192 * can't be found then the policy is queried and the result is added to the 193 * table to speedup future queries. Returns zero on success, negative values 194 * on failure. 195 * 196 */ 197 int sel_netif_sid(struct net *ns, int ifindex, u32 *sid) 198 { 199 struct sel_netif *netif; 200 201 rcu_read_lock(); 202 netif = sel_netif_find(ns, ifindex); 203 if (likely(netif != NULL)) { 204 *sid = netif->nsec.sid; 205 rcu_read_unlock(); 206 return 0; 207 } 208 rcu_read_unlock(); 209 210 return sel_netif_sid_slow(ns, ifindex, sid); 211 } 212 213 /** 214 * sel_netif_kill - Remove an entry from the network interface table 215 * @ns: the network namespace 216 * @ifindex: the network interface 217 * 218 * Description: 219 * This function removes the entry matching @ifindex from the network interface 220 * table if it exists. 221 * 222 */ 223 static void sel_netif_kill(const struct net *ns, int ifindex) 224 { 225 struct sel_netif *netif; 226 227 rcu_read_lock(); 228 spin_lock_bh(&sel_netif_lock); 229 netif = sel_netif_find(ns, ifindex); 230 if (netif) 231 sel_netif_destroy(netif); 232 spin_unlock_bh(&sel_netif_lock); 233 rcu_read_unlock(); 234 } 235 236 /** 237 * sel_netif_flush - Flush the entire network interface table 238 * 239 * Description: 240 * Remove all entries from the network interface table. 241 * 242 */ 243 void sel_netif_flush(void) 244 { 245 int idx; 246 struct sel_netif *netif; 247 248 spin_lock_bh(&sel_netif_lock); 249 for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++) 250 list_for_each_entry(netif, &sel_netif_hash[idx], list) 251 sel_netif_destroy(netif); 252 spin_unlock_bh(&sel_netif_lock); 253 } 254 255 static int sel_netif_netdev_notifier_handler(struct notifier_block *this, 256 unsigned long event, void *ptr) 257 { 258 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 259 260 if (event == NETDEV_DOWN) 261 sel_netif_kill(dev_net(dev), dev->ifindex); 262 263 return NOTIFY_DONE; 264 } 265 266 static struct notifier_block sel_netif_netdev_notifier = { 267 .notifier_call = sel_netif_netdev_notifier_handler, 268 }; 269 270 static __init int sel_netif_init(void) 271 { 272 int i; 273 274 if (!selinux_enabled) 275 return 0; 276 277 for (i = 0; i < SEL_NETIF_HASH_SIZE; i++) 278 INIT_LIST_HEAD(&sel_netif_hash[i]); 279 280 register_netdevice_notifier(&sel_netif_netdev_notifier); 281 282 return 0; 283 } 284 285 __initcall(sel_netif_init); 286 287