[RFC,0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP)

Message

Richard Haines Sept. 24, 2020, 8:50 a.m. UTC

These patches came about after looking at 5G open source in particular
the updated 5G GTP driver at [1]. As this driver is still under
development, testing the LSM/SELinux hooks on the current stable
version in kernel selinux-next [2] seems best. As [1] uses the same base
code as the current 3G version (except that it handles different packet
types) they should port over.

To test the GTP driver there is an RFC patch for the selinux-testsuite
that will be posted.

To enable the selinux-testsuite GTP tests, the libgtpnl [3] library and
tools needed to be modified to:
Return ERRNO on error to detect EACCES, Add gtp_match_tunnel function,
Allow gtp-link to specify port numbers for multiple instances to
run in the same namespace (not sure if this happens in real life).

A patch for libgtpnl is supplied in the selinux-testsuite patch as well
as setup/test instructions (libgtpnl is not packaged by Fedora)

These patches were tested on Fedora 32 with kernel [2] using the
'targeted' policy. They have not been tested on a any type of 3G setup.

[1] https://github.com/PrinzOwO/gtp5g
[2] https://github.com/SELinuxProject/selinux-kernel
[3] git://git.osmocom.org/libgtpnl.git

Richard Haines (3):
  security: Add GPRS Tunneling Protocol (GTP) security hooks
  gtp: Add LSM hooks to GPRS Tunneling Protocol (GTP)
  selinux: Add SELinux GTP support

 Documentation/security/GTP.rst      | 98 +++++++++++++++++++++++++++++
 Documentation/security/index.rst    |  1 +
 drivers/net/gtp.c                   | 49 ++++++++++++++-
 include/linux/lsm_hook_defs.h       |  3 +
 include/linux/lsm_hooks.h           | 16 +++++
 include/linux/security.h            | 19 ++++++
 security/security.c                 | 18 ++++++
 security/selinux/hooks.c            | 64 +++++++++++++++++++
 security/selinux/include/classmap.h |  2 +
 security/selinux/include/objsec.h   |  4 ++
 10 files changed, 273 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/security/GTP.rst