From nobody Thu Apr 25 04:25:54 2024 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AD481FB6 for ; Tue, 17 Jan 2023 07:37:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1673941044; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0EO/JH4gKngksQOeggNkg/wN952j8ab5v0INEKnLio0=; b=N9aco8VIgqgdfXj2wxpT4UajNVK8QinhzTNo79RGGqwe+CnrOVTAVmoHWex4H06etyXYVw XtoW/gnEuV5wUcude+WUM88Ne4Ac38u5ndZ3ia8W/jUBg7zphvz4Yc9/kRnTSWZyRFH692 FF4SCiWAOgqUd0TpMqUtzOPkIzjHe78= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-19-1-qUnE6fMX6khaE84q-4Hw-1; Tue, 17 Jan 2023 02:37:22 -0500 X-MC-Unique: 1-qUnE6fMX6khaE84q-4Hw-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 691793C0ED43 for ; Tue, 17 Jan 2023 07:37:22 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.39.192.87]) by smtp.corp.redhat.com (Postfix) with ESMTP id EA5CF40C2064 for ; Tue, 17 Jan 2023 07:37:21 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Subject: [PATCH mptcp-next v2 13/13] selinux: Implement mptcp_add_subflow hook Date: Tue, 17 Jan 2023 08:36:33 +0100 Message-Id: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" Newly added subflows should inherit the LSM label from the associated msk socket regarless current context. This patch implements the above copying sid and class from the msk context, deleting the existing subflow label, if any, and then re-creating a new one. The new helper reuses the selinux_netlbl_sk_security_free() function, and the latter can end-up being called multiple times with the same argument; we additionally need to make it idempotent. Signed-off-by: Paolo Abeni --- v1 -> v2: - cleanup selinux_netlbl_sk_security_free() (Paul) - inherit label from msk (Paul) v1 -> v2: - fix build issue with !CONFIG_NETLABEL --- security/selinux/hooks.c | 16 ++++++++++++++++ security/selinux/netlabel.c | 8 ++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3c5be76a9199..1e0ca10a6c02 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5476,6 +5476,21 @@ static void selinux_sctp_sk_clone(struct sctp_associ= ation *asoc, struct sock *sk selinux_netlbl_sctp_sk_clone(sk, newsk); } =20 +static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk) +{ + struct sk_security_struct *ssksec =3D ssk->sk_security; + struct sk_security_struct *sksec =3D sk->sk_security; + + ssksec->sclass =3D sksec->sclass; + ssksec->sid =3D sksec->sid; + + /* replace the existing subflow label deleting the existing one + * and re-recrating a new label using the current context + */ + selinux_netlbl_sk_security_free(ssksec); + return selinux_netlbl_socket_post_create(ssk, ssk->sk_family); +} + static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff= *skb, struct request_sock *req) { @@ -7216,6 +7231,7 @@ static struct security_hook_list selinux_hooks[] __ls= m_ro_after_init =3D { LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone), LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect), LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established), + LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow), LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request), LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone), LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established), diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 1321f15799e2..33187e38def7 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -155,8 +155,12 @@ void selinux_netlbl_err(struct sk_buff *skb, u16 famil= y, int error, int gateway) */ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec) { - if (sksec->nlbl_secattr !=3D NULL) - netlbl_secattr_free(sksec->nlbl_secattr); + if (!sksec->nlbl_secattr) + return; + + netlbl_secattr_free(sksec->nlbl_secattr); + sksec->nlbl_secattr =3D NULL; + sksec->nlbl_state =3D NLBL_UNSET; } =20 /** --=20 2.39.0