2014-12-13 01:08:40 +00:00
|
|
|
/*
|
|
|
|
* Simplified MAC Kernel (smack) security module
|
|
|
|
*
|
|
|
|
* This file contains the Smack netfilter implementation
|
|
|
|
*
|
|
|
|
* Author:
|
|
|
|
* Casey Schaufler <casey@schaufler-ca.com>
|
|
|
|
*
|
|
|
|
* Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
|
|
|
|
* Copyright (C) 2014 Intel Corporation.
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2,
|
|
|
|
* as published by the Free Software Foundation.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/netfilter_ipv4.h>
|
|
|
|
#include <linux/netfilter_ipv6.h>
|
|
|
|
#include <linux/netdevice.h>
|
2015-11-08 18:54:08 +00:00
|
|
|
#include <net/inet_sock.h>
|
2017-04-21 09:49:08 +00:00
|
|
|
#include <net/net_namespace.h>
|
2014-12-13 01:08:40 +00:00
|
|
|
#include "smack.h"
|
|
|
|
|
2016-08-08 17:08:25 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-12-13 01:08:40 +00:00
|
|
|
|
2015-09-18 19:33:06 +00:00
|
|
|
static unsigned int smack_ipv6_output(void *priv,
|
2014-12-13 01:08:40 +00:00
|
|
|
struct sk_buff *skb,
|
2015-04-04 00:32:56 +00:00
|
|
|
const struct nf_hook_state *state)
|
2014-12-13 01:08:40 +00:00
|
|
|
{
|
2015-11-08 18:54:08 +00:00
|
|
|
struct sock *sk = skb_to_full_sk(skb);
|
2014-12-13 01:08:40 +00:00
|
|
|
struct socket_smack *ssp;
|
|
|
|
struct smack_known *skp;
|
|
|
|
|
2015-11-08 18:54:08 +00:00
|
|
|
if (sk && sk->sk_security) {
|
|
|
|
ssp = sk->sk_security;
|
2014-12-13 01:08:40 +00:00
|
|
|
skp = ssp->smk_out;
|
|
|
|
skb->secmark = skp->smk_secid;
|
|
|
|
}
|
|
|
|
|
|
|
|
return NF_ACCEPT;
|
|
|
|
}
|
|
|
|
#endif /* IPV6 */
|
|
|
|
|
2015-09-18 19:33:06 +00:00
|
|
|
static unsigned int smack_ipv4_output(void *priv,
|
2014-12-13 01:08:40 +00:00
|
|
|
struct sk_buff *skb,
|
2015-04-04 00:32:56 +00:00
|
|
|
const struct nf_hook_state *state)
|
2014-12-13 01:08:40 +00:00
|
|
|
{
|
2015-11-08 18:54:08 +00:00
|
|
|
struct sock *sk = skb_to_full_sk(skb);
|
2014-12-13 01:08:40 +00:00
|
|
|
struct socket_smack *ssp;
|
|
|
|
struct smack_known *skp;
|
|
|
|
|
2015-11-08 18:54:08 +00:00
|
|
|
if (sk && sk->sk_security) {
|
|
|
|
ssp = sk->sk_security;
|
2014-12-13 01:08:40 +00:00
|
|
|
skp = ssp->smk_out;
|
|
|
|
skb->secmark = skp->smk_secid;
|
|
|
|
}
|
|
|
|
|
|
|
|
return NF_ACCEPT;
|
|
|
|
}
|
|
|
|
|
2017-07-26 09:40:52 +00:00
|
|
|
static const struct nf_hook_ops smack_nf_ops[] = {
|
2014-12-13 01:08:40 +00:00
|
|
|
{
|
|
|
|
.hook = smack_ipv4_output,
|
|
|
|
.pf = NFPROTO_IPV4,
|
|
|
|
.hooknum = NF_INET_LOCAL_OUT,
|
|
|
|
.priority = NF_IP_PRI_SELINUX_FIRST,
|
|
|
|
},
|
2016-08-08 17:08:25 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-12-13 01:08:40 +00:00
|
|
|
{
|
|
|
|
.hook = smack_ipv6_output,
|
|
|
|
.pf = NFPROTO_IPV6,
|
|
|
|
.hooknum = NF_INET_LOCAL_OUT,
|
|
|
|
.priority = NF_IP6_PRI_SELINUX_FIRST,
|
|
|
|
},
|
|
|
|
#endif /* IPV6 */
|
|
|
|
};
|
|
|
|
|
2017-04-21 09:49:08 +00:00
|
|
|
static int __net_init smack_nf_register(struct net *net)
|
|
|
|
{
|
|
|
|
return nf_register_net_hooks(net, smack_nf_ops,
|
|
|
|
ARRAY_SIZE(smack_nf_ops));
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __net_exit smack_nf_unregister(struct net *net)
|
2014-12-13 01:08:40 +00:00
|
|
|
{
|
2017-04-21 09:49:08 +00:00
|
|
|
nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
|
|
|
|
}
|
2014-12-13 01:08:40 +00:00
|
|
|
|
2017-04-21 09:49:08 +00:00
|
|
|
static struct pernet_operations smack_net_ops = {
|
|
|
|
.init = smack_nf_register,
|
|
|
|
.exit = smack_nf_unregister,
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __init smack_nf_ip_init(void)
|
|
|
|
{
|
2014-12-13 01:08:40 +00:00
|
|
|
if (smack_enabled == 0)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
|
2017-04-21 09:49:08 +00:00
|
|
|
return register_pernet_subsys(&smack_net_ops);
|
2014-12-13 01:08:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
__initcall(smack_nf_ip_init);
|