A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

[MLSXFRM]: Add security sid to sock

Browse source 
This adds security for IP sockets at the sock level. Security at the
sock level is needed to enforce the SELinux security policy for
security associations even when a sock is orphaned (such as in the TCP
LAST_ACK state).

This will also be used to enforce SELinux controls over data arriving
at or leaving a child socket while it's still waiting to be accepted.

Signed-off-by: Venkat Yekkirala <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Venkat Yekkirala 2006-08-04 23:08:56 -07:00 • committed by David S. Miller
commit 892c141e62
6 changed files with 53 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

5
security/dummy.c
View file

@ -805,6 +805,10 @@ static inline void dummy_sk_free_security (struct sock *sk)
{
}
static inline void dummy_sk_clone_security (const struct sock *sk, struct sock *newsk)
{
}
static unsigned int dummy_sk_getsid(struct sock *sk, struct flowi *fl, u8 dir)
{
return 0;
@ -1060,6 +1064,7 @@ void security_fixup_ops (struct security_operations *ops)
set_to_dummy_if_null(ops, socket_getpeersec_dgram);
set_to_dummy_if_null(ops, sk_alloc_security);
set_to_dummy_if_null(ops, sk_free_security);
set_to_dummy_if_null(ops, sk_clone_security);
set_to_dummy_if_null(ops, sk_getsid);
#endif /* CONFIG_SECURITY_NETWORK */
#ifdef CONFIG_SECURITY_NETWORK_XFRM

38
security/selinux/hooks.c
View file

@ -269,15 +269,13 @@ static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
{
struct sk_security_struct *ssec;
if (family != PF_UNIX)
return 0;
ssec = kzalloc(sizeof(*ssec), priority);
if (!ssec)
return -ENOMEM;
ssec->sk = sk;
ssec->peer_sid = SECINITSID_UNLABELED;
ssec->sid = SECINITSID_UNLABELED;
sk->sk_security = ssec;
return 0;
@ -287,9 +285,6 @@ static void sk_free_security(struct sock *sk)
{
struct sk_security_struct *ssec = sk->sk_security;
if (sk->sk_family != PF_UNIX)
return;
sk->sk_security = NULL;
kfree(ssec);
}
@ -3068,6 +3063,7 @@ static void selinux_socket_post_create(struct socket *sock, int family,
{
struct inode_security_struct *isec;
struct task_security_struct *tsec;
struct sk_security_struct *sksec;
u32 newsid;
isec = SOCK_INODE(sock)->i_security;
@ -3078,6 +3074,11 @@ static void selinux_socket_post_create(struct socket *sock, int family,
isec->sid = kern ? SECINITSID_KERNEL : newsid;
isec->initialized = 1;
if (sock->sk) {
sksec = sock->sk->sk_security;
sksec->sid = isec->sid;
}
return;
}
@ -3551,22 +3552,24 @@ static void selinux_sk_free_security(struct sock *sk)
sk_free_security(sk);
}
static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
{
struct sk_security_struct *ssec = sk->sk_security;
struct sk_security_struct *newssec = newsk->sk_security;
newssec->sid = ssec->sid;
newssec->peer_sid = ssec->peer_sid;
}
static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
{
struct inode_security_struct *isec;
u32 sock_sid = SECINITSID_ANY_SOCKET;
if (!sk)
return selinux_no_sk_sid(fl);
else {
struct sk_security_struct *sksec = sk->sk_security;
read_lock_bh(&sk->sk_callback_lock);
isec = get_sock_isec(sk);
if (isec)
sock_sid = isec->sid;
read_unlock_bh(&sk->sk_callback_lock);
return sock_sid;
return sksec->sid;
}
}
static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
@ -4618,6 +4621,7 @@ static struct security_operations selinux_ops = {
.socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
.sk_alloc_security = selinux_sk_alloc_security,
.sk_free_security = selinux_sk_free_security,
.sk_clone_security = selinux_sk_clone_security,
.sk_getsid = selinux_sk_getsid_security,
#ifdef CONFIG_SECURITY_NETWORK_XFRM

1
security/selinux/include/objsec.h
View file

@ -99,6 +99,7 @@ struct netif_security_struct {
struct sk_security_struct {
struct sock *sk; /* back pointer to sk object */
u32 sid; /* SID of this object */
u32 peer_sid; /* SID of peer */
};