linux/security/selinux
Paul Moore 5dbbaf2de8 tun: fix LSM/SELinux labeling of tun/tap devices
This patch corrects some problems with LSM/SELinux that were introduced
with the multiqueue patchset.  The problem stems from the fact that the
multiqueue work changed the relationship between the tun device and its
associated socket; before the socket persisted for the life of the
device, however after the multiqueue changes the socket only persisted
for the life of the userspace connection (fd open).  For non-persistent
devices this is not an issue, but for persistent devices this can cause
the tun device to lose its SELinux label.

We correct this problem by adding an opaque LSM security blob to the
tun device struct which allows us to have the LSM security state, e.g.
SELinux labeling information, persist for the lifetime of the tun
device.  In the process we tweak the LSM hooks to work with this new
approach to TUN device/socket labeling and introduce a new LSM hook,
security_tun_dev_attach_queue(), to approve requests to attach to a
TUN queue via TUNSETQUEUE.

The SELinux code has been adjusted to match the new LSM hooks, the
other LSMs do not make use of the LSM TUN controls.  This patch makes
use of the recently added "tun_socket:attach_queue" permission to
restrict access to the TUNSETQUEUE operation.  On older SELinux
policies which do not define the "tun_socket:attach_queue" permission
the access control decision for TUNSETQUEUE will be handled according
to the SELinux policy's unknown permission setting.

Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: Eric Paris <eparis@parisplace.org>
Tested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-14 18:16:59 -05:00
..
include tun: fix LSM/SELinux labeling of tun/tap devices 2013-01-14 18:16:59 -05:00
ss userns: Convert selinux to use kuid and kgid where appropriate 2012-09-21 03:13:22 -07:00
.gitignore SELinux: add .gitignore files for dynamic classes 2009-10-24 09:42:27 +08:00
Kconfig selinux: Deprecate and schedule the removal of the the compat_net functionality 2008-12-31 12:54:11 -05:00
Makefile selinux: change to new flag variable 2010-10-21 10:12:40 +11:00
avc.c selinux: tag avc cache alloc as non-critical 2012-07-31 18:42:47 -07:00
exports.c selinux: sparse fix: include selinux.h in exports.c 2011-09-09 16:56:32 -07:00
hooks.c tun: fix LSM/SELinux labeling of tun/tap devices 2013-01-14 18:16:59 -05:00
netif.c SELinux: avc: remove the useless fields in avc_add_callback 2012-04-09 12:23:44 -04:00
netlabel.c doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
netlink.c netlink: hide struct module parameter in netlink_kernel_create 2012-09-08 18:46:30 -04:00
netnode.c selinux: fix sel_netnode_insert() suspicious rcu dereference 2012-11-21 21:55:32 +11:00
netport.c SELinux: avc: remove the useless fields in avc_add_callback 2012-04-09 12:23:44 -04:00
nlmsgtab.c bridge: update selinux perm table for RTM_NEWMDB and RTM_DELMDB 2012-12-15 17:14:38 -08:00
selinuxfs.c mm: kill vma flag VM_RESERVED and mm->reserved_vm counter 2012-10-09 16:22:19 +09:00
xfrm.c atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00