public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

selinux: support wildcard network interface names

Browse source 
Add support for wildcard matching of network interface names.  This is
useful for auto-generated interfaces, for example podman creates network
interfaces for containers with the naming scheme podman0, podman1,
podman2, ...

To maintain backward compatibility guard this feature with a new policy
capability 'netif_wildcard'.

Netifcon definitions are compared against in the order given by the
policy, so userspace tools should sort them in a reasonable order.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Christian Göttsche 2025-03-02 16:40:45 +01:00 • committed by Paul Moore
parent 6ae0042f4d
commit 8af43b61c1
4 changed files with 22 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
security/selinux/include/policycap.h
View file

@ -15,6 +15,7 @@ enum {
POLICYDB_CAP_IOCTL_SKIP_CLOEXEC, POLICYDB_CAP_IOCTL_SKIP_CLOEXEC,
POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT,
POLICYDB_CAP_NETLINK_XPERM, POLICYDB_CAP_NETLINK_XPERM,
POLICYDB_CAP_NETIF_WILDCARD,
__POLICYDB_CAP_MAX __POLICYDB_CAP_MAX
}; };
#define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1) #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)

1
security/selinux/include/policycap_names.h
View file

@ -18,6 +18,7 @@ const char *const selinux_policycap_names[__POLICYDB_CAP_MAX] = {
"ioctl_skip_cloexec", "ioctl_skip_cloexec",
"userspace_initial_context", "userspace_initial_context",
"netlink_xperm", "netlink_xperm",
"netif_wildcard",
}; };
/* clang-format on */ /* clang-format on */

8
security/selinux/include/security.h
View file

@ -202,6 +202,12 @@ static inline bool selinux_policycap_netlink_xperm(void)
selinux_state.policycap[POLICYDB_CAP_NETLINK_XPERM]); selinux_state.policycap[POLICYDB_CAP_NETLINK_XPERM]);
} }
static inline bool selinux_policycap_netif_wildcard(void)
{
return READ_ONCE(
selinux_state.policycap[POLICYDB_CAP_NETIF_WILDCARD]);
}
struct selinux_policy_convert_data; struct selinux_policy_convert_data;
struct selinux_load_state { struct selinux_load_state {
@ -301,7 +307,7 @@ int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid); int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid);
int security_netif_sid(char *name, u32 *if_sid); int security_netif_sid(const char *name, u32 *if_sid);
int security_node_sid(u16 domain, void *addr, u32 addrlen, u32 *out_sid); int security_node_sid(u16 domain, void *addr, u32 addrlen, u32 *out_sid);

16
security/selinux/ss/services.c
View file

@ -46,6 +46,7 @@
#include <linux/in.h> #include <linux/in.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/audit.h> #include <linux/audit.h>
#include <linux/parser.h>
#include <linux/vmalloc.h> #include <linux/vmalloc.h>
#include <linux/lsm_hooks.h> #include <linux/lsm_hooks.h>
#include <net/netlabel.h> #include <net/netlabel.h>
@ -2572,19 +2573,22 @@ out:
* @name: interface name * @name: interface name
* @if_sid: interface SID * @if_sid: interface SID
*/ */
int security_netif_sid(char *name, u32 *if_sid) int security_netif_sid(const char *name, u32 *if_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *sidtab;
int rc; int rc;
struct ocontext *c; struct ocontext *c;
bool wildcard_support;
if (!selinux_initialized()) { if (!selinux_initialized()) {
*if_sid = SECINITSID_NETIF; *if_sid = SECINITSID_NETIF;
return 0; return 0;
} }
wildcard_support = selinux_policycap_netif_wildcard();
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
@ -2594,8 +2598,14 @@ retry:
c = policydb->ocontexts[OCON_NETIF]; c = policydb->ocontexts[OCON_NETIF];
while (c) { while (c) {
if (strcmp(name, c->u.name) == 0) if (wildcard_support) {
break; if (match_wildcard(c->u.name, name))
break;
} else {
if (strcmp(c->u.name, name) == 0)
break;
}
c = c->next; c = c->next;
} }