netdev - Re: [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhSbqnN-brs0ssbCeAcUWGhUyRYR=FBYB1yB9uuR7_UeOQ@mail.gmail.com>
Date:   Wed, 28 Nov 2018 13:47:25 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     selinux@...r.kernel.org
Cc:     netdev@...r.kernel.org, jiri@...lanox.com
Subject: Re: [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN

On Wed, Nov 28, 2018 at 1:44 PM Paul Moore <paul@...l-moore.com> wrote:
> Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> added new RTM_* definitions without properly updating SELinux, this
> patch adds the necessary SELinux support.
>
> While there was a BUILD_BUG_ON() in the SELinux code to protect from
> exactly this case, it was bypassed in the broken commit.  In order to
> hopefully prevent this from happening in the future, add additional
> comments which provide some instructions on how to resolve the
> BUILD_BUG_ON() failures.
>
> Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> Cc: <stable@...r.kernel.org> # 4.19
> Signed-off-by: Paul Moore <paul@...l-moore.com>
> ---
>  security/selinux/nlmsgtab.c |   13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)

I'm building a test kernel right now, assuming all goes well I'm going
to send this up to Linus for v4.20.

> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 74b951f55608..9cec81209617 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
>         { RTM_NEWSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ },
>         { RTM_GETSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
>         { RTM_NEWCACHEREPORT,   NETLINK_ROUTE_SOCKET__NLMSG_READ },
> +       { RTM_NEWCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> +       { RTM_DELCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> +       { RTM_GETCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
>  };
>
>  static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
> @@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>
>         switch (sclass) {
>         case SECCLASS_NETLINK_ROUTE_SOCKET:
> -               /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
> +               /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
> +                * If the BUILD_BUG_ON() below fails you must update the
> +                * structures at the top of this file with the new mappings
> +                * before updating the BUILD_BUG_ON() macro!
> +                */
>                 BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
>                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
>                                  sizeof(nlmsg_route_perms));
> @@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>                 break;
>
>         case SECCLASS_NETLINK_XFRM_SOCKET:
> +               /* If the BUILD_BUG_ON() below fails you must update the
> +                * structures at the top of this file with the new mappings
> +                * before updating the BUILD_BUG_ON() macro!
> +                */
>                 BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
>                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
>                                  sizeof(nlmsg_xfrm_perms));
>

-- 
paul moore
www.paul-moore.com