1 /* 2 * NetLabel Unlabeled Support 3 * 4 * This file defines functions for dealing with unlabeled packets for the 5 * NetLabel system. The NetLabel system manages static and dynamic label 6 * mappings for network protocols such as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #include <linux/types.h> 32 #include <linux/rcupdate.h> 33 #include <linux/list.h> 34 #include <linux/spinlock.h> 35 #include <linux/socket.h> 36 #include <linux/string.h> 37 #include <linux/skbuff.h> 38 #include <linux/audit.h> 39 #include <net/sock.h> 40 #include <net/netlink.h> 41 #include <net/genetlink.h> 42 43 #include <net/netlabel.h> 44 #include <asm/bug.h> 45 46 #include "netlabel_user.h" 47 #include "netlabel_domainhash.h" 48 #include "netlabel_unlabeled.h" 49 50 /* Accept unlabeled packets flag */ 51 static DEFINE_SPINLOCK(netlabel_unlabel_acceptflg_lock); 52 static u8 netlabel_unlabel_acceptflg = 0; 53 54 /* NetLabel Generic NETLINK CIPSOv4 family */ 55 static struct genl_family netlbl_unlabel_gnl_family = { 56 .id = GENL_ID_GENERATE, 57 .hdrsize = 0, 58 .name = NETLBL_NLTYPE_UNLABELED_NAME, 59 .version = NETLBL_PROTO_VERSION, 60 .maxattr = NLBL_UNLABEL_A_MAX, 61 }; 62 63 /* NetLabel Netlink attribute policy */ 64 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { 65 [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, 66 }; 67 68 /* 69 * Helper Functions 70 */ 71 72 /** 73 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag 74 * @value: desired value 75 * @audit_info: NetLabel audit information 76 * 77 * Description: 78 * Set the value of the unlabeled accept flag to @value. 79 * 80 */ 81 static void netlbl_unlabel_acceptflg_set(u8 value, 82 struct netlbl_audit *audit_info) 83 { 84 struct audit_buffer *audit_buf; 85 u8 old_val; 86 87 spin_lock(&netlabel_unlabel_acceptflg_lock); 88 old_val = netlabel_unlabel_acceptflg; 89 netlabel_unlabel_acceptflg = value; 90 spin_unlock(&netlabel_unlabel_acceptflg_lock); 91 92 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW, 93 audit_info); 94 if (audit_buf != NULL) { 95 audit_log_format(audit_buf, 96 " unlbl_accept=%u old=%u", value, old_val); 97 audit_log_end(audit_buf); 98 } 99 } 100 101 /* 102 * NetLabel Command Handlers 103 */ 104 105 /** 106 * netlbl_unlabel_accept - Handle an ACCEPT message 107 * @skb: the NETLINK buffer 108 * @info: the Generic NETLINK info block 109 * 110 * Description: 111 * Process a user generated ACCEPT message and set the accept flag accordingly. 112 * Returns zero on success, negative values on failure. 113 * 114 */ 115 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) 116 { 117 u8 value; 118 struct netlbl_audit audit_info; 119 120 if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { 121 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); 122 if (value == 1 || value == 0) { 123 netlbl_netlink_auditinfo(skb, &audit_info); 124 netlbl_unlabel_acceptflg_set(value, &audit_info); 125 return 0; 126 } 127 } 128 129 return -EINVAL; 130 } 131 132 /** 133 * netlbl_unlabel_list - Handle a LIST message 134 * @skb: the NETLINK buffer 135 * @info: the Generic NETLINK info block 136 * 137 * Description: 138 * Process a user generated LIST message and respond with the current status. 139 * Returns zero on success, negative values on failure. 140 * 141 */ 142 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) 143 { 144 int ret_val = -EINVAL; 145 struct sk_buff *ans_skb; 146 void *data; 147 148 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 149 if (ans_skb == NULL) 150 goto list_failure; 151 data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family, 152 0, NLBL_UNLABEL_C_LIST); 153 if (data == NULL) { 154 ret_val = -ENOMEM; 155 goto list_failure; 156 } 157 158 rcu_read_lock(); 159 ret_val = nla_put_u8(ans_skb, 160 NLBL_UNLABEL_A_ACPTFLG, 161 netlabel_unlabel_acceptflg); 162 rcu_read_unlock(); 163 if (ret_val != 0) 164 goto list_failure; 165 166 genlmsg_end(ans_skb, data); 167 168 ret_val = genlmsg_reply(ans_skb, info); 169 if (ret_val != 0) 170 goto list_failure; 171 return 0; 172 173 list_failure: 174 kfree_skb(ans_skb); 175 return ret_val; 176 } 177 178 179 /* 180 * NetLabel Generic NETLINK Command Definitions 181 */ 182 183 static struct genl_ops netlbl_unlabel_genl_c_accept = { 184 .cmd = NLBL_UNLABEL_C_ACCEPT, 185 .flags = GENL_ADMIN_PERM, 186 .policy = netlbl_unlabel_genl_policy, 187 .doit = netlbl_unlabel_accept, 188 .dumpit = NULL, 189 }; 190 191 static struct genl_ops netlbl_unlabel_genl_c_list = { 192 .cmd = NLBL_UNLABEL_C_LIST, 193 .flags = 0, 194 .policy = netlbl_unlabel_genl_policy, 195 .doit = netlbl_unlabel_list, 196 .dumpit = NULL, 197 }; 198 199 200 /* 201 * NetLabel Generic NETLINK Protocol Functions 202 */ 203 204 /** 205 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component 206 * 207 * Description: 208 * Register the unlabeled packet NetLabel component with the Generic NETLINK 209 * mechanism. Returns zero on success, negative values on failure. 210 * 211 */ 212 int netlbl_unlabel_genl_init(void) 213 { 214 int ret_val; 215 216 ret_val = genl_register_family(&netlbl_unlabel_gnl_family); 217 if (ret_val != 0) 218 return ret_val; 219 220 ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, 221 &netlbl_unlabel_genl_c_accept); 222 if (ret_val != 0) 223 return ret_val; 224 225 ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, 226 &netlbl_unlabel_genl_c_list); 227 if (ret_val != 0) 228 return ret_val; 229 230 return 0; 231 } 232 233 /* 234 * NetLabel KAPI Hooks 235 */ 236 237 /** 238 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet 239 * @secattr: the security attributes 240 * 241 * Description: 242 * Determine the security attributes, if any, for an unlabled packet and return 243 * them in @secattr. Returns zero on success and negative values on failure. 244 * 245 */ 246 int netlbl_unlabel_getattr(struct netlbl_lsm_secattr *secattr) 247 { 248 int ret_val; 249 250 rcu_read_lock(); 251 if (netlabel_unlabel_acceptflg == 1) { 252 netlbl_secattr_init(secattr); 253 ret_val = 0; 254 } else 255 ret_val = -ENOMSG; 256 rcu_read_unlock(); 257 258 return ret_val; 259 } 260 261 /** 262 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets 263 * 264 * Description: 265 * Set the default NetLabel configuration to allow incoming unlabeled packets 266 * and to send unlabeled network traffic by default. 267 * 268 */ 269 int netlbl_unlabel_defconf(void) 270 { 271 int ret_val; 272 struct netlbl_dom_map *entry; 273 struct netlbl_audit audit_info; 274 275 /* Only the kernel is allowed to call this function and the only time 276 * it is called is at bootup before the audit subsystem is reporting 277 * messages so don't worry to much about these values. */ 278 security_task_getsecid(current, &audit_info.secid); 279 audit_info.loginuid = 0; 280 281 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 282 if (entry == NULL) 283 return -ENOMEM; 284 entry->type = NETLBL_NLTYPE_UNLABELED; 285 ret_val = netlbl_domhsh_add_default(entry, &audit_info); 286 if (ret_val != 0) 287 return ret_val; 288 289 netlbl_unlabel_acceptflg_set(1, &audit_info); 290 291 return 0; 292 } 293