From patchwork Fri Jul 29 13:53:32 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9252589 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EE34C6075F for ; Fri, 29 Jul 2016 15:12:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DE9CC2833B for ; Fri, 29 Jul 2016 15:12:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D341C28342; Fri, 29 Jul 2016 15:12:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EF2642833B for ; Fri, 29 Jul 2016 15:12:10 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.28,440,1464652800"; d="scan'208";a="16070673" IronPort-PHdr: =?us-ascii?q?9a23=3AEJHnlRMD35IhC0vgS8Ul6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0KfvzrarrMEGX3/hxlliBBdydsKMczbSH+P+xEUU7or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6anHS+4HYoFwnlMkIt?= =?us-ascii?q?f6KuS9aU0ZX8iLH60qaQSj0AvCC6b7J2IUf+hiTqne5Sv7FfLL0swADCuHpCdr?= =?us-ascii?q?ce72ppIVWOg0S0vZ/or9Ze6SAYh9YNv44FCP27LOwESulTDC4nKH8d/8r2rlzY?= =?us-ascii?q?Sg/J4WETFi0OmwdMKxDM8RW/W5D2qCa8ve14nGGBMdbeUaE/WTPk6bxiDhDvlm?= =?us-ascii?q?NPOiYw6mDMotR5lqNAuBaorBE5xJTbJMmZMPdycKTHcfsASGZBV9oXXCtERsun?= =?us-ascii?q?YoIJSeoMM/pJh4j7u1YK6xC5AE3kBOrrjCVPnXLwxrE92OcJHgTP3QhmFNUL41?= =?us-ascii?q?rOq9CgGK4UGcKo1qbFyy6LO/9f3zbw7Irgdx0lpfiKWqI2es3Unxp8XzjZh0md?= =?us-ascii?q?/NS2dwie0f4A5i3Ct+c=3D?= X-IPAS-Result: =?us-ascii?q?A2H7BABZcZtX/wHyM5BdGwEBAYMngVK6fSCHMEwBAQEBAQE?= =?us-ascii?q?CAlongjIEAxCCFAIEAQIkExQgCwMDCQEBFwghCAgDAS0VEQcHCwUWAgSIEAS8Q?= =?us-ascii?q?QELASSPCREBhXcFjweKLIkUhWyBaYgADIVJhmSFTYN4VIN9a4Y2gTUBAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 29 Jul 2016 15:11:58 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u6TFBwrC012684; Fri, 29 Jul 2016 11:11:58 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u6TDsI0H152225 for ; Fri, 29 Jul 2016 09:54:18 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u6TDsBFE003339 for ; Fri, 29 Jul 2016 09:54:18 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1DaAQBQX5tXfYGlL8FdHQGEebZ4hAyGHQKBeAEBAQEBARMBARYrL4RdAgEDJ1IQGAgxVwcSG4gavEABAQgnlRIFjweKLIkUhWyBaYgMhUmGZIVNg3iEUTkyh2sBAQE X-IPAS-Result: A1DaAQBQX5tXfYGlL8FdHQGEebZ4hAyGHQKBeAEBAQEBARMBARYrL4RdAgEDJ1IQGAgxVwcSG4gavEABAQgnlRIFjweKLIkUhWyBaYgMhUmGZIVNg3iEUTkyh2sBAQE X-IronPort-AV: E=Sophos;i="5.28,439,1464667200"; d="scan'208";a="5610104" Received: from emsm-gh1-uea10.corp.nsa.gov (HELO emsm-gh1-uea10.nsa.gov) ([10.208.41.36]) by goalie.tycho.ncsc.mil with ESMTP; 29 Jul 2016 09:54:17 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3Ar5746RFWkkWUGOgurTORDJ1GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ74r8mwAkXT6L1XgUPTWs2DsrQf2rKQ7fGrBzBIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TWM5DIfUi/yKRBy?= =?us-ascii?q?brysXNWD14Lphqvsp9X6WEZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuwwZgf8q9tZBXKPmZOx4COUAVHV1e1wyscbrrxjY?= =?us-ascii?q?UiOU4WYHF34RllxPGQeBpAnzQ5PZqiLnsq943y6AMIv9SrVwES+u9I93WRToj2?= =?us-ascii?q?EBLDd//2bJzoR9lKtBoQmJvxVlwpXMZIieObx5ZKyZNd8eSGZPWdxdfzZMDoO1?= =?us-ascii?q?c80ECO9Fdf1Vpo+7p1YAsQqWBA+wCeepwThNwjf21Kl8yeM6HAfdwAsrHPoBtX?= =?us-ascii?q?3VqJP+M6JBf/qyyfzkxDOLTe5M1jr788CcfhknoPyIX5p1fM7VwE8oB0XOiVDG?= =?us-ascii?q?+t+tBC+cyulY6zvT1OFnT+/6zjd/8ww=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0EaAwDjXptXfYGlL8FdHQGEebZ4hAyGH?= =?us-ascii?q?QKBeAEBAQEBAQICDwEBFisvgjIEARIBghMCAQMnUhAYCDFXBxIbiBq8PgEBCCe?= =?us-ascii?q?VEgWPB4osiRSFbIFpiAyFSYZkhU2DeIRROTKHawEBAQ?= X-IPAS-Result: =?us-ascii?q?A0EaAwDjXptXfYGlL8FdHQGEebZ4hAyGHQKBeAEBAQEBAQI?= =?us-ascii?q?CDwEBFisvgjIEARIBghMCAQMnUhAYCDFXBxIbiBq8PgEBCCeVEgWPB4osiRSFb?= =?us-ascii?q?IFpiAyFSYZkhU2DeIRROTKHawEBAQ?= X-IronPort-AV: E=Sophos;i="5.28,439,1464652800"; d="scan'208";a="16065418" Received: from mail-il-dmz.mellanox.com (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea10.nsa.gov with ESMTP; 29 Jul 2016 13:54:15 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 29 Jul 2016 16:54:12 +0300 Received: from x-vnc01.mtx.labs.mlnx (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id u6TDrgit021752; Fri, 29 Jul 2016 16:54:10 +0300 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Subject: [PATCH v3 5/9] selinux: Create policydb version for Infiniband support Date: Fri, 29 Jul 2016 16:53:32 +0300 Message-Id: <1469800416-125043-6-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1469800416-125043-1-git-send-email-danielj@mellanox.com> References: <1469800416-125043-1-git-send-email-danielj@mellanox.com> X-Mailman-Approved-At: Fri, 29 Jul 2016 11:02:35 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: linux-rdma@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Support for Infiniband requires the addition of two new object contexts, one for infiniband PKeys and another IB Ports. Added handlers to read and write the new ocontext types when reading or writing a binary policy representation. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen --- v2: - Shorten ib_end_port to ib_port. Paul Moore - Added bounds checking to port number. Paul Moore - Eliminated {} in OCON_PKEY case statement. Yuval Shaia v3: - ib_port -> ib_endport. Paul Moore security/selinux/include/security.h | 3 +- security/selinux/ss/policydb.c | 130 +++++++++++++++++++++++++++++++----- security/selinux/ss/policydb.h | 27 +++++--- 3 files changed, 136 insertions(+), 24 deletions(-) diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 38feb55..a7e6ed2 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -36,13 +36,14 @@ #define POLICYDB_VERSION_DEFAULT_TYPE 28 #define POLICYDB_VERSION_CONSTRAINT_NAMES 29 #define POLICYDB_VERSION_XPERMS_IOCTL 30 +#define POLICYDB_VERSION_INFINIBAND 31 /* Range of policy versions we understand*/ #define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX #define POLICYDB_VERSION_MAX CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE #else -#define POLICYDB_VERSION_MAX POLICYDB_VERSION_XPERMS_IOCTL +#define POLICYDB_VERSION_MAX POLICYDB_VERSION_INFINIBAND #endif /* Mask for just the mount related flags */ diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 992a315..6056c2c 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -17,6 +17,11 @@ * * Added support for the policy capability bitmap * + * Update: Mellanox Techonologies + * + * Added Infiniband support + * + * Copyright (C) 2016 Mellanox Techonologies * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc. * Copyright (C) 2003 - 2004 Tresys Technology, LLC @@ -76,81 +81,86 @@ static struct policydb_compat_info policydb_compat[] = { { .version = POLICYDB_VERSION_BASE, .sym_num = SYM_NUM - 3, - .ocon_num = OCON_NUM - 1, + .ocon_num = OCON_NUM - 3, }, { .version = POLICYDB_VERSION_BOOL, .sym_num = SYM_NUM - 2, - .ocon_num = OCON_NUM - 1, + .ocon_num = OCON_NUM - 3, }, { .version = POLICYDB_VERSION_IPV6, .sym_num = SYM_NUM - 2, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_NLCLASS, .sym_num = SYM_NUM - 2, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_MLS, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_AVTAB, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_RANGETRANS, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_POLCAP, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_PERMISSIVE, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_BOUNDARY, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_FILENAME_TRANS, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_ROLETRANS, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_NEW_OBJECT_DEFAULTS, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_DEFAULT_TYPE, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_CONSTRAINT_NAMES, .sym_num = SYM_NUM, - .ocon_num = OCON_NUM, + .ocon_num = OCON_NUM - 2, }, { .version = POLICYDB_VERSION_XPERMS_IOCTL, .sym_num = SYM_NUM, + .ocon_num = OCON_NUM - 2, + }, + { + .version = POLICYDB_VERSION_INFINIBAND, + .sym_num = SYM_NUM, .ocon_num = OCON_NUM, }, }; @@ -2219,6 +2229,61 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info, goto out; break; } + case OCON_PKEY: { + rc = next_entry(nodebuf, fp, sizeof(u32) * 6); + if (rc) + goto out; + + c->u.pkey.subnet_prefix = be64_to_cpu(*((__be64 *)nodebuf)); + /* The subnet prefix is stored as an IPv6 + * address in the policy. + * + * Check that the lower 2 DWORDS are 0. + */ + if (nodebuf[2] || nodebuf[3]) { + rc = -EINVAL; + goto out; + } + + if (nodebuf[4] > 0xffff || + nodebuf[5] > 0xffff) { + rc = -EINVAL; + goto out; + } + + c->u.pkey.low_pkey = le32_to_cpu(nodebuf[4]); + c->u.pkey.high_pkey = le32_to_cpu(nodebuf[5]); + + rc = context_read_and_validate(&c->context[0], + p, + fp); + if (rc) + goto out; + break; + } + case OCON_IB_ENDPORT: + rc = next_entry(buf, fp, sizeof(u32) * 2); + if (rc) + goto out; + len = le32_to_cpu(buf[0]); + + rc = str_read(&c->u.ib_endport.dev_name, GFP_KERNEL, fp, len); + if (rc) + goto out; + + if (buf[1] > 0xff || buf[1] == 0) { + rc = -EINVAL; + goto out; + } + + c->u.ib_endport.port_num = le32_to_cpu(buf[1]); + + rc = context_read_and_validate(&c->context[0], + p, + fp); + if (rc) + goto out; + break; } } } @@ -3147,6 +3212,41 @@ static int ocontext_write(struct policydb *p, struct policydb_compat_info *info, if (rc) return rc; break; + case OCON_PKEY: + *((__be64 *)nodebuf) = cpu_to_be64(c->u.pkey.subnet_prefix); + + /* + * The low order 2 bits were confirmed to be 0 + * when the policy was loaded. Write them out + * as zero + */ + nodebuf[2] = 0; + nodebuf[3] = 0; + + nodebuf[4] = cpu_to_le32(c->u.pkey.low_pkey); + nodebuf[5] = cpu_to_le32(c->u.pkey.high_pkey); + + rc = put_entry(nodebuf, sizeof(u32), 6, fp); + if (rc) + return rc; + rc = context_write(p, &c->context[0], fp); + if (rc) + return rc; + break; + case OCON_IB_ENDPORT: + len = strlen(c->u.ib_endport.dev_name); + buf[0] = cpu_to_le32(len); + buf[1] = cpu_to_le32(c->u.ib_endport.port_num); + rc = put_entry(buf, sizeof(u32), 2, fp); + if (rc) + return rc; + rc = put_entry(c->u.ib_endport.dev_name, 1, len, fp); + if (rc) + return rc; + rc = context_write(p, &c->context[0], fp); + if (rc) + return rc; + break; } } } diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index 725d594..edb329d 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -187,6 +187,15 @@ struct ocontext { u32 addr[4]; u32 mask[4]; } node6; /* IPv6 node information */ + struct { + u64 subnet_prefix; + u16 low_pkey; + u16 high_pkey; + } pkey; + struct { + char *dev_name; + u8 port_num; + } ib_endport; } u; union { u32 sclass; /* security class for genfs */ @@ -215,14 +224,16 @@ struct genfs { #define SYM_NUM 8 /* object context array indices */ -#define OCON_ISID 0 /* initial SIDs */ -#define OCON_FS 1 /* unlabeled file systems */ -#define OCON_PORT 2 /* TCP and UDP port numbers */ -#define OCON_NETIF 3 /* network interfaces */ -#define OCON_NODE 4 /* nodes */ -#define OCON_FSUSE 5 /* fs_use */ -#define OCON_NODE6 6 /* IPv6 nodes */ -#define OCON_NUM 7 +#define OCON_ISID 0 /* initial SIDs */ +#define OCON_FS 1 /* unlabeled file systems */ +#define OCON_PORT 2 /* TCP and UDP port numbers */ +#define OCON_NETIF 3 /* network interfaces */ +#define OCON_NODE 4 /* nodes */ +#define OCON_FSUSE 5 /* fs_use */ +#define OCON_NODE6 6 /* IPv6 nodes */ +#define OCON_PKEY 7 /* Infiniband PKeys */ +#define OCON_IB_ENDPORT 8 /* Infiniband end ports */ +#define OCON_NUM 9 /* The policy database */ struct policydb {