Commit 729b39ec authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull selinux updates from Paul Moore:

 - Thanks to help from the MPTCP folks, it looks like we have finally
   sorted out a proper solution to the MPTCP socket labeling issue, see
   the new security_mptcp_add_subflow() LSM hook.

 - Fix the labeled NFS handling such that a labeled NFS share mounted
   prior to the initial SELinux policy load is properly labeled once a
   policy is loaded; more information in the commit description.

 - Two patches to security/selinux/Makefile, the first took the cleanups
   in v6.4 a bit further and the second removed the grouped targets
   support as that functionality doesn't appear to be properly supported
   prior to make v4.3.

 - Deprecate the "fs" object context type in SELinux policies. The fs
   object context type was an old vestige that was introduced back in
   v2.6.12-rc2 but never really used.

 - A number of small changes that remove dead code, clean up some
   awkward bits, and generally improve the quality of the code. See the
   individual commit descriptions for more information.

* tag 'selinux-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: avoid bool as identifier name
  selinux: fix Makefile for versions of make < v4.3
  selinux: make labeled NFS work when mounted before policy load
  selinux: cleanup exit_sel_fs() declaration
  selinux: deprecated fs ocon
  selinux: make header files self-including
  selinux: keep context struct members in sync
  selinux: Implement mptcp_add_subflow hook
  security, lsm: Introduce security_mptcp_add_subflow()
  selinux: small cleanups in selinux_audit_rule_init()
  selinux: declare read-only data arrays const
  selinux: retain const qualifier on string literal in avtab_hash_eval()
  selinux: drop return at end of void function avc_insert()
  selinux: avc: drop unused function avc_disable()
  selinux: adjust typos in comments
  selinux: do not leave dangling pointer behind
  selinux: more Makefile tweaks
parents cae72026 447a5688

include/linux/lsm_hook_defs.h

+1 −0
Original line number Diff line number Diff line
@@ -343,6 +343,7 @@ LSM_HOOK(void, LSM_RET_VOID, sctp_sk_clone, struct sctp_association *asoc, 
	 struct sock *sk, struct sock *newsk)

LSM_HOOK(int, 0, sctp_assoc_established, struct sctp_association *asoc,

	 struct sk_buff *skb)

LSM_HOOK(int, 0, mptcp_add_subflow, struct sock *sk, struct sock *ssk)

#endif /* CONFIG_SECURITY_NETWORK */



#ifdef CONFIG_SECURITY_INFINIBAND

include/linux/security.h

+6 −0
Original line number Diff line number Diff line
@@ -1465,6 +1465,7 @@ void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk, 
			    struct sock *newsk);

int security_sctp_assoc_established(struct sctp_association *asoc,

				    struct sk_buff *skb);

int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);



#else	/* CONFIG_SECURITY_NETWORK */

static inline int security_unix_stream_connect(struct sock *sock,
@@ -1692,6 +1693,11 @@ static inline int security_sctp_assoc_established(struct sctp_association *asoc, 
{

	return 0;

}



static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)

{

	return 0;

}

#endif	/* CONFIG_SECURITY_NETWORK */



#ifdef CONFIG_SECURITY_INFINIBAND

net/mptcp/subflow.c

+6 −0
Original line number Diff line number Diff line
@@ -1668,6 +1668,10 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, 


	lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);



	err = security_mptcp_add_subflow(sk, sf->sk);

	if (err)

		goto release_ssk;



	/* the newly created socket has to be in the same cgroup as its parent */

	mptcp_attach_cgroup(sk, sf->sk);
@@ -1680,6 +1684,8 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, 
	get_net_track(net, &sf->sk->ns_tracker, GFP_KERNEL);

	sock_inuse_add(net, 1);

	err = tcp_set_ulp(sf->sk, "mptcp");



release_ssk:

	release_sock(sf->sk);



	if (err) {

security/security.c

+17 −0
Original line number Diff line number Diff line
@@ -4667,6 +4667,23 @@ int security_sctp_assoc_established(struct sctp_association *asoc, 
}

EXPORT_SYMBOL(security_sctp_assoc_established);



/**

 * security_mptcp_add_subflow() - Inherit the LSM label from the MPTCP socket

 * @sk: the owning MPTCP socket

 * @ssk: the new subflow

 *

 * Update the labeling for the given MPTCP subflow, to match the one of the

 * owning MPTCP socket. This hook has to be called after the socket creation and

 * initialization via the security_socket_create() and

 * security_socket_post_create() LSM hooks.

 *

 * Return: Returns 0 on success or a negative error code on failure.

 */

int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)

{

	return call_int_hook(mptcp_add_subflow, 0, sk, ssk);

}



#endif	/* CONFIG_SECURITY_NETWORK */



#ifdef CONFIG_SECURITY_INFINIBAND

security/selinux/Makefile

+18 −12
Original line number Diff line number Diff line
@@ -3,32 +3,38 @@ 
# Makefile for building the SELinux module as part of the kernel tree.

#



# NOTE: There are a number of improvements that can be made to this Makefile

# once the kernel requires make v4.3 or greater; the most important feature

# lacking in older versions of make is support for grouped targets.  These

# improvements are noted inline in the Makefile below ...



obj-$(CONFIG_SECURITY_SELINUX) := selinux.o



ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include



selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \

	     netnode.o netport.o status.o \

	     ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \

	     ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/context.o



selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o



selinux-$(CONFIG_NETLABEL) += netlabel.o



selinux-$(CONFIG_SECURITY_INFINIBAND) += ibpkey.o



selinux-$(CONFIG_IMA) += ima.o



ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include

genhdrs := flask.h av_permissions.h



# see the note above, replace the dependency rule with the one below:

#  $(addprefix $(obj)/,$(selinux-y)): $(addprefix $(obj)/,$(genhdrs))

$(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h



quiet_cmd_flask = GEN     $(obj)/flask.h $(obj)/av_permissions.h

      cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h

quiet_cmd_genhdrs = GEN     $(addprefix $(obj)/,$(genhdrs))

      cmd_genhdrs = $< $(addprefix $(obj)/,$(genhdrs))



targets += flask.h av_permissions.h

# once make >= 4.3 is required, we can use grouped targets in the rule below,

# which basically involves adding both headers and a '&' before the colon, see

# the example below:

#   $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/...

# see the note above, replace the $targets and 'flask.h' rule with the lines

# below:

#  targets += $(genhdrs)

#  $(addprefix $(obj)/,$(genhdrs)) &: scripts/selinux/...

targets += flask.h

$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE

	$(call if_changed,flask)
 
	$(call if_changed,genhdrs)