netdev - [RFC PATCH v1 0/3] Fix a problem with incoming TCP connections and NetLabel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Mar 2009 12:22:50 -0400
From:	Paul Moore <paul.moore@...com>
To:	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov,
	netdev@...r.kernel.org
Subject: [RFC PATCH v1 0/3] Fix a problem with incoming TCP connections and
	NetLabel

The patches below have more information on the problem but the issue is that
we are not correctly labeling incoming TCP connection sockets at present.  Due
to a variety of things all coming together we've gotten a bit lucky in that
the majority of labeled TCP connections are labeled correctly now but this
won't hold for long as some of the new features added recently will break this
"happy coincidence" for some configurations.

For the folks on netdev, you probably only care about the relocation of the
security_inet_conn_request() hooks but this is such a minor move I doubt there
will be much objection.  Still, I would appreciate any feedback/comments.

For the folks on the SELinux and LSM lists please take a look and let me know
if the basic approach seems reasonable.  Keep in mind I still need to make a
few more passes through the code to clean it up and make sure I haven't done
anything stupid.  I've done basic testing under both SELinux and Smack using
2.6.29-rc7 and everything looks okay so far so feel free to play with it but
more testing is still needed.

---

Paul Moore (3):
      netlabel: Label incoming TCP connections correctly in Smack
      netlabel: Label incoming TCP connections correctly in SELinux
      lsm: Relocate the IPv4 security_inet_conn_request() hooks

 include/net/cipso_ipv4.h            |   17 +++
 include/net/netlabel.h              |   17 +++
 net/ipv4/cipso_ipv4.c               |  130 ++++++++++++++++++++++--
 net/ipv4/syncookies.c               |    9 +-
 net/ipv4/tcp_ipv4.c                 |    7 +
 net/netlabel/netlabel_kapi.c        |  124 +++++++++++++++++++++--
 security/selinux/hooks.c            |   54 +++-------
 security/selinux/include/netlabel.h |   26 ++---
 security/selinux/netlabel.c         |  187 ++++++++++-------------------------
 security/smack/smack_lsm.c          |   53 +++++++---
 10 files changed, 393 insertions(+), 231 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html