1 /* 2 * NSA Security-Enhanced Linux (SELinux) security module 3 * 4 * This file contains the SELinux XFRM hook function implementations. 5 * 6 * Authors: Serge Hallyn <sergeh@us.ibm.com> 7 * Trent Jaeger <jaegert@us.ibm.com> 8 * 9 * Updated: Venkat Yekkirala <vyekkirala@TrustedCS.com> 10 * 11 * Granular IPSec Associations for use in MLS environments. 12 * 13 * Copyright (C) 2005 International Business Machines Corporation 14 * Copyright (C) 2006 Trusted Computer Solutions, Inc. 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License version 2, 18 * as published by the Free Software Foundation. 19 */ 20 21 /* 22 * USAGE: 23 * NOTES: 24 * 1. Make sure to enable the following options in your kernel config: 25 * CONFIG_SECURITY=y 26 * CONFIG_SECURITY_NETWORK=y 27 * CONFIG_SECURITY_NETWORK_XFRM=y 28 * CONFIG_SECURITY_SELINUX=m/y 29 * ISSUES: 30 * 1. Caching packets, so they are not dropped during negotiation 31 * 2. Emulating a reasonable SO_PEERSEC across machines 32 * 3. Testing addition of sk_policy's with security context via setsockopt 33 */ 34 #include <linux/module.h> 35 #include <linux/kernel.h> 36 #include <linux/init.h> 37 #include <linux/security.h> 38 #include <linux/types.h> 39 #include <linux/netfilter.h> 40 #include <linux/netfilter_ipv4.h> 41 #include <linux/netfilter_ipv6.h> 42 #include <linux/ip.h> 43 #include <linux/tcp.h> 44 #include <linux/skbuff.h> 45 #include <linux/xfrm.h> 46 #include <net/xfrm.h> 47 #include <net/checksum.h> 48 #include <net/udp.h> 49 #include <asm/semaphore.h> 50 51 #include "avc.h" 52 #include "objsec.h" 53 #include "xfrm.h" 54 55 56 /* 57 * Returns true if an LSM/SELinux context 58 */ 59 static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx) 60 { 61 return (ctx && 62 (ctx->ctx_doi == XFRM_SC_DOI_LSM) && 63 (ctx->ctx_alg == XFRM_SC_ALG_SELINUX)); 64 } 65 66 /* 67 * Returns true if the xfrm contains a security blob for SELinux 68 */ 69 static inline int selinux_authorizable_xfrm(struct xfrm_state *x) 70 { 71 return selinux_authorizable_ctx(x->security); 72 } 73 74 /* 75 * LSM hook implementation that authorizes that a flow can use 76 * a xfrm policy rule. 77 */ 78 int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir) 79 { 80 int rc; 81 u32 sel_sid; 82 struct xfrm_sec_ctx *ctx; 83 84 /* Context sid is either set to label or ANY_ASSOC */ 85 if ((ctx = xp->security)) { 86 if (!selinux_authorizable_ctx(ctx)) 87 return -EINVAL; 88 89 sel_sid = ctx->ctx_sid; 90 } 91 else 92 /* 93 * All flows should be treated as polmatch'ing an 94 * otherwise applicable "non-labeled" policy. This 95 * would prevent inadvertent "leaks". 96 */ 97 return 0; 98 99 rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION, 100 ASSOCIATION__POLMATCH, 101 NULL); 102 103 if (rc == -EACCES) 104 rc = -ESRCH; 105 106 return rc; 107 } 108 109 /* 110 * LSM hook implementation that authorizes that a state matches 111 * the given policy, flow combo. 112 */ 113 114 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp, 115 struct flowi *fl) 116 { 117 u32 state_sid; 118 int rc; 119 120 if (!xp->security) 121 if (x->security) 122 /* unlabeled policy and labeled SA can't match */ 123 return 0; 124 else 125 /* unlabeled policy and unlabeled SA match all flows */ 126 return 1; 127 else 128 if (!x->security) 129 /* unlabeled SA and labeled policy can't match */ 130 return 0; 131 else 132 if (!selinux_authorizable_xfrm(x)) 133 /* Not a SELinux-labeled SA */ 134 return 0; 135 136 state_sid = x->security->ctx_sid; 137 138 if (fl->secid != state_sid) 139 return 0; 140 141 rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION, 142 ASSOCIATION__SENDTO, 143 NULL)? 0:1; 144 145 /* 146 * We don't need a separate SA Vs. policy polmatch check 147 * since the SA is now of the same label as the flow and 148 * a flow Vs. policy polmatch check had already happened 149 * in selinux_xfrm_policy_lookup() above. 150 */ 151 152 return rc; 153 } 154 155 /* 156 * LSM hook implementation that checks and/or returns the xfrm sid for the 157 * incoming packet. 158 */ 159 160 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall) 161 { 162 struct sec_path *sp; 163 164 *sid = SECSID_NULL; 165 166 if (skb == NULL) 167 return 0; 168 169 sp = skb->sp; 170 if (sp) { 171 int i, sid_set = 0; 172 173 for (i = sp->len-1; i >= 0; i--) { 174 struct xfrm_state *x = sp->xvec[i]; 175 if (selinux_authorizable_xfrm(x)) { 176 struct xfrm_sec_ctx *ctx = x->security; 177 178 if (!sid_set) { 179 *sid = ctx->ctx_sid; 180 sid_set = 1; 181 182 if (!ckall) 183 break; 184 } 185 else if (*sid != ctx->ctx_sid) 186 return -EINVAL; 187 } 188 } 189 } 190 191 return 0; 192 } 193 194 /* 195 * Security blob allocation for xfrm_policy and xfrm_state 196 * CTX does not have a meaningful value on input 197 */ 198 static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp, 199 struct xfrm_user_sec_ctx *uctx, u32 sid) 200 { 201 int rc = 0; 202 struct task_security_struct *tsec = current->security; 203 struct xfrm_sec_ctx *ctx = NULL; 204 char *ctx_str = NULL; 205 u32 str_len; 206 207 BUG_ON(uctx && sid); 208 209 if (!uctx) 210 goto not_from_user; 211 212 if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX) 213 return -EINVAL; 214 215 if (uctx->ctx_len >= PAGE_SIZE) 216 return -ENOMEM; 217 218 *ctxp = ctx = kmalloc(sizeof(*ctx) + 219 uctx->ctx_len, 220 GFP_KERNEL); 221 222 if (!ctx) 223 return -ENOMEM; 224 225 ctx->ctx_doi = uctx->ctx_doi; 226 ctx->ctx_len = uctx->ctx_len; 227 ctx->ctx_alg = uctx->ctx_alg; 228 229 memcpy(ctx->ctx_str, 230 uctx+1, 231 ctx->ctx_len); 232 rc = security_context_to_sid(ctx->ctx_str, 233 ctx->ctx_len, 234 &ctx->ctx_sid); 235 236 if (rc) 237 goto out; 238 239 /* 240 * Does the subject have permission to set security context? 241 */ 242 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 243 SECCLASS_ASSOCIATION, 244 ASSOCIATION__SETCONTEXT, NULL); 245 if (rc) 246 goto out; 247 248 return rc; 249 250 not_from_user: 251 rc = security_sid_to_context(sid, &ctx_str, &str_len); 252 if (rc) 253 goto out; 254 255 *ctxp = ctx = kmalloc(sizeof(*ctx) + 256 str_len, 257 GFP_ATOMIC); 258 259 if (!ctx) { 260 rc = -ENOMEM; 261 goto out; 262 } 263 264 ctx->ctx_doi = XFRM_SC_DOI_LSM; 265 ctx->ctx_alg = XFRM_SC_ALG_SELINUX; 266 ctx->ctx_sid = sid; 267 ctx->ctx_len = str_len; 268 memcpy(ctx->ctx_str, 269 ctx_str, 270 str_len); 271 272 goto out2; 273 274 out: 275 *ctxp = NULL; 276 kfree(ctx); 277 out2: 278 kfree(ctx_str); 279 return rc; 280 } 281 282 /* 283 * LSM hook implementation that allocs and transfers uctx spec to 284 * xfrm_policy. 285 */ 286 int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, 287 struct xfrm_user_sec_ctx *uctx) 288 { 289 int err; 290 291 BUG_ON(!xp); 292 BUG_ON(!uctx); 293 294 err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, 0); 295 return err; 296 } 297 298 299 /* 300 * LSM hook implementation that copies security data structure from old to 301 * new for policy cloning. 302 */ 303 int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new) 304 { 305 struct xfrm_sec_ctx *old_ctx, *new_ctx; 306 307 old_ctx = old->security; 308 309 if (old_ctx) { 310 new_ctx = new->security = kmalloc(sizeof(*new_ctx) + 311 old_ctx->ctx_len, 312 GFP_KERNEL); 313 314 if (!new_ctx) 315 return -ENOMEM; 316 317 memcpy(new_ctx, old_ctx, sizeof(*new_ctx)); 318 memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len); 319 } 320 return 0; 321 } 322 323 /* 324 * LSM hook implementation that frees xfrm_policy security information. 325 */ 326 void selinux_xfrm_policy_free(struct xfrm_policy *xp) 327 { 328 struct xfrm_sec_ctx *ctx = xp->security; 329 if (ctx) 330 kfree(ctx); 331 } 332 333 /* 334 * LSM hook implementation that authorizes deletion of labeled policies. 335 */ 336 int selinux_xfrm_policy_delete(struct xfrm_policy *xp) 337 { 338 struct task_security_struct *tsec = current->security; 339 struct xfrm_sec_ctx *ctx = xp->security; 340 int rc = 0; 341 342 if (ctx) 343 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 344 SECCLASS_ASSOCIATION, 345 ASSOCIATION__SETCONTEXT, NULL); 346 347 return rc; 348 } 349 350 /* 351 * LSM hook implementation that allocs and transfers sec_ctx spec to 352 * xfrm_state. 353 */ 354 int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx, 355 u32 secid) 356 { 357 int err; 358 359 BUG_ON(!x); 360 361 err = selinux_xfrm_sec_ctx_alloc(&x->security, uctx, secid); 362 return err; 363 } 364 365 /* 366 * LSM hook implementation that frees xfrm_state security information. 367 */ 368 void selinux_xfrm_state_free(struct xfrm_state *x) 369 { 370 struct xfrm_sec_ctx *ctx = x->security; 371 if (ctx) 372 kfree(ctx); 373 } 374 375 /* 376 * LSM hook implementation that authorizes deletion of labeled SAs. 377 */ 378 int selinux_xfrm_state_delete(struct xfrm_state *x) 379 { 380 struct task_security_struct *tsec = current->security; 381 struct xfrm_sec_ctx *ctx = x->security; 382 int rc = 0; 383 384 if (ctx) 385 rc = avc_has_perm(tsec->sid, ctx->ctx_sid, 386 SECCLASS_ASSOCIATION, 387 ASSOCIATION__SETCONTEXT, NULL); 388 389 return rc; 390 } 391 392 /* 393 * LSM hook that controls access to unlabelled packets. If 394 * a xfrm_state is authorizable (defined by macro) then it was 395 * already authorized by the IPSec process. If not, then 396 * we need to check for unlabelled access since this may not have 397 * gone thru the IPSec process. 398 */ 399 int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb, 400 struct avc_audit_data *ad) 401 { 402 int i, rc = 0; 403 struct sec_path *sp; 404 u32 sel_sid = SECINITSID_UNLABELED; 405 406 sp = skb->sp; 407 408 if (sp) { 409 for (i = 0; i < sp->len; i++) { 410 struct xfrm_state *x = sp->xvec[i]; 411 412 if (x && selinux_authorizable_xfrm(x)) { 413 struct xfrm_sec_ctx *ctx = x->security; 414 sel_sid = ctx->ctx_sid; 415 break; 416 } 417 } 418 } 419 420 /* 421 * This check even when there's no association involved is 422 * intended, according to Trent Jaeger, to make sure a 423 * process can't engage in non-ipsec communication unless 424 * explicitly allowed by policy. 425 */ 426 427 rc = avc_has_perm(isec_sid, sel_sid, SECCLASS_ASSOCIATION, 428 ASSOCIATION__RECVFROM, ad); 429 430 return rc; 431 } 432 433 /* 434 * POSTROUTE_LAST hook's XFRM processing: 435 * If we have no security association, then we need to determine 436 * whether the socket is allowed to send to an unlabelled destination. 437 * If we do have a authorizable security association, then it has already been 438 * checked in the selinux_xfrm_state_pol_flow_match hook above. 439 */ 440 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb, 441 struct avc_audit_data *ad, u8 proto) 442 { 443 struct dst_entry *dst; 444 int rc = 0; 445 446 dst = skb->dst; 447 448 if (dst) { 449 struct dst_entry *dst_test; 450 451 for (dst_test = dst; dst_test != 0; 452 dst_test = dst_test->child) { 453 struct xfrm_state *x = dst_test->xfrm; 454 455 if (x && selinux_authorizable_xfrm(x)) 456 goto out; 457 } 458 } 459 460 switch (proto) { 461 case IPPROTO_AH: 462 case IPPROTO_ESP: 463 case IPPROTO_COMP: 464 /* 465 * We should have already seen this packet once before 466 * it underwent xfrm(s). No need to subject it to the 467 * unlabeled check. 468 */ 469 goto out; 470 default: 471 break; 472 } 473 474 /* 475 * This check even when there's no association involved is 476 * intended, according to Trent Jaeger, to make sure a 477 * process can't engage in non-ipsec communication unless 478 * explicitly allowed by policy. 479 */ 480 481 rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION, 482 ASSOCIATION__SENDTO, ad); 483 out: 484 return rc; 485 } 486