Re: [PATCH] selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN

[Paul Moore <paul@paul-moore.com>]

On Wed, Nov 28, 2018 at 1:44 PM Paul Moore <paul@paul-moore.com> wrote:
> Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> added new RTM_* definitions without properly updating SELinux, this
> patch adds the necessary SELinux support.
>
> While there was a BUILD_BUG_ON() in the SELinux code to protect from
> exactly this case, it was bypassed in the broken commit.  In order to
> hopefully prevent this from happening in the future, add additional
> comments which provide some instructions on how to resolve the
> BUILD_BUG_ON() failures.
>
> Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> Cc: <stable@vger.kernel.org> # 4.19
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  security/selinux/nlmsgtab.c |   13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)

I'm building a test kernel right now, assuming all goes well I'm going
to send this up to Linus for v4.20.

> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 74b951f55608..9cec81209617 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
>         { RTM_NEWSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ },
>         { RTM_GETSTATS,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
>         { RTM_NEWCACHEREPORT,   NETLINK_ROUTE_SOCKET__NLMSG_READ },
> +       { RTM_NEWCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> +       { RTM_DELCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> +       { RTM_GETCHAIN,         NETLINK_ROUTE_SOCKET__NLMSG_READ  },
>  };
>
>  static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
> @@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>
>         switch (sclass) {
>         case SECCLASS_NETLINK_ROUTE_SOCKET:
> -               /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
> +               /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
> +                * If the BUILD_BUG_ON() below fails you must update the
> +                * structures at the top of this file with the new mappings
> +                * before updating the BUILD_BUG_ON() macro!
> +                */
>                 BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
>                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
>                                  sizeof(nlmsg_route_perms));
> @@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>                 break;
>
>         case SECCLASS_NETLINK_XFRM_SOCKET:
> +               /* If the BUILD_BUG_ON() below fails you must update the
> +                * structures at the top of this file with the new mappings
> +                * before updating the BUILD_BUG_ON() macro!
> +                */
>                 BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
>                 err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
>                                  sizeof(nlmsg_xfrm_perms));
>

-- 
paul moore
www.paul-moore.com