[PATCH] selinux: Print 'sclass' as string when unrecognized netlink message occurs

[PATCH] selinux: Print 'sclass' as string when unrecognized netlink message occurs

[Marek Milkovic]

This prints the 'sclass' field as string instead of index in unrecognized netlink message.
The textual representation makes it easier to distinguish the right class.

Signed-off-by: Marek Milkovic <mmilkovi@redhat.com>
---
 security/selinux/hooks.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 87a9156..d75f525 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4712,8 +4712,8 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
 		if (err == -EINVAL) {
 			printk(KERN_WARNING
 			       "SELinux: unrecognized netlink message:"
-			       " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
-			       sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
+			       " protocol=%hu nlmsg_type=%hu sclass=%s\n",
+			       sk->sk_protocol, nlh->nlmsg_type, secclass_map[sksec->sclass - 1].name);
 			if (!selinux_enforcing || security_get_allow_unknown())
 				err = 0;
 		}
-- 
2.1.0

Re: [PATCH] selinux: Print 'sclass' as string when unrecognized netlink message occurs

[Stephen Smalley]

On 04/02/2015 11:58 AM, Marek Milkovic wrote:
> This prints the 'sclass' field as string instead of index in unrecognized netlink message.
> The textual representation makes it easier to distinguish the right class.
> 
> Signed-off-by: Marek Milkovic <mmilkovi@redhat.com>

Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>

> ---
>  security/selinux/hooks.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 87a9156..d75f525 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -4712,8 +4712,8 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
>  		if (err == -EINVAL) {
>  			printk(KERN_WARNING
>  			       "SELinux: unrecognized netlink message:"
> -			       " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
> -			       sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
> +			       " protocol=%hu nlmsg_type=%hu sclass=%s\n",
> +			       sk->sk_protocol, nlh->nlmsg_type, secclass_map[sksec->sclass - 1].name);
>  			if (!selinux_enforcing || security_get_allow_unknown())
>  				err = 0;
>  		}
> 

Re: [PATCH] selinux: Print 'sclass' as string when unrecognized netlink message occurs

[Paul Moore]

On Thu, Apr 2, 2015 at 11:58 AM, Marek Milkovic <mmilkovi@redhat.com> wrote:
> This prints the 'sclass' field as string instead of index in unrecognized netlink message.
> The textual representation makes it easier to distinguish the right class.
>
> Signed-off-by: Marek Milkovic <mmilkovi@redhat.com>
> ---
>  security/selinux/hooks.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Thanks Marek, this looks good.  I'm adding this to the next queue for
after the merge window.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 87a9156..d75f525 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -4712,8 +4712,8 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
>                 if (err == -EINVAL) {
>                         printk(KERN_WARNING
>                                "SELinux: unrecognized netlink message:"
> -                              " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
> -                              sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
> +                              " protocol=%hu nlmsg_type=%hu sclass=%s\n",
> +                              sk->sk_protocol, nlh->nlmsg_type, secclass_map[sksec->sclass - 1].name);
>                         if (!selinux_enforcing || security_get_allow_unknown())
>                                 err = 0;
>                 }
> --
> 2.1.0
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.



-- 
paul moore
www.paul-moore.com

Re: [PATCH] selinux: Print 'sclass' as string when unrecognized netlink message occurs

[Paul Moore]

On Tuesday, April 07, 2015 07:28:07 AM Paul Moore wrote:
> On Thu, Apr 2, 2015 at 11:58 AM, Marek Milkovic <mmilkovi@redhat.com> wrote:
> > This prints the 'sclass' field as string instead of index in unrecognized
> > netlink message. The textual representation makes it easier to
> > distinguish the right class.
> > 
> > Signed-off-by: Marek Milkovic <mmilkovi@redhat.com>
> > ---
> > 
> >  security/selinux/hooks.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Thanks Marek, this looks good.  I'm adding this to the next queue for
> after the merge window.

Merged into next with a minor reformat to fit the code into an 80-char wide 
terminal.

> > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> > index 87a9156..d75f525 100644
> > --- a/security/selinux/hooks.c
> > +++ b/security/selinux/hooks.c
> > @@ -4712,8 +4712,8 @@ static int selinux_nlmsg_perm(struct sock *sk,
> > struct sk_buff *skb)> 
> >                 if (err == -EINVAL) {
> >                 
> >                         printk(KERN_WARNING
> >                         
> >                                "SELinux: unrecognized netlink message:"
> > 
> > -                              " protocol=%hu nlmsg_type=%hu
> > sclass=%hu\n",
> > -                              sk->sk_protocol, nlh->nlmsg_type,
> > sksec->sclass); +                              " protocol=%hu
> > nlmsg_type=%hu sclass=%s\n", +                             
> > sk->sk_protocol, nlh->nlmsg_type, secclass_map[sksec->sclass - 1].name);> 
> >                         if (!selinux_enforcing ||
> >                         security_get_allow_unknown())
> >                         
> >                                 err = 0;
> >                 
> >                 }
> > 
> > --
> > 2.1.0
> > 
> > _______________________________________________
> > Selinux mailing list
> > Selinux@tycho.nsa.gov
> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> > To get help, send an email containing "help" to
> > Selinux-request@tycho.nsa.gov.

-- 
paul moore
www.paul-moore.com