[PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[Paul Moore]

This patch builds on a previous SELinux/netfilter patch by Florian
Westphal and makes better use of the nf_hook_state variable passed
into the SELinux/netfilter hooks as well as a number of other small
cleanups in the related code.

Signed-off-by: Paul Moore <paul@paul-moore.com>
---
 security/selinux/hooks.c |   53 +++++++++++++++++++++-------------------------
 1 file changed, 24 insertions(+), 29 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4210831d5ade..4c9ff2e9af31 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5692,38 +5692,37 @@ static int selinux_tun_dev_open(void *security)
 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
 				       const struct nf_hook_state *state)
 {
-	const struct net_device *indev = state->in;
-	u16 family = state->pf;
-	int err;
+	int ifindex;
+	u16 family;
 	char *addrp;
 	u32 peer_sid;
 	struct common_audit_data ad;
 	struct lsm_network_audit net = {0,};
-	u8 secmark_active;
-	u8 netlbl_active;
-	u8 peerlbl_active;
+	int secmark_active, peerlbl_active;
 
 	if (!selinux_policycap_netpeer())
 		return NF_ACCEPT;
 
 	secmark_active = selinux_secmark_enabled();
-	netlbl_active = netlbl_enabled();
 	peerlbl_active = selinux_peerlbl_enabled();
 	if (!secmark_active && !peerlbl_active)
 		return NF_ACCEPT;
 
+	family = state->pf;
 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
 		return NF_DROP;
 
+	ifindex = state->in->ifindex;
 	ad.type = LSM_AUDIT_DATA_NET;
 	ad.u.net = &net;
-	ad.u.net->netif = indev->ifindex;
+	ad.u.net->netif = ifindex;
 	ad.u.net->family = family;
 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
 		return NF_DROP;
 
 	if (peerlbl_active) {
-		err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
+		int err;
+		err = selinux_inet_sys_rcv_skb(state->net, ifindex,
 					       addrp, family, peer_sid, &ad);
 		if (err) {
 			selinux_netlbl_err(skb, family, err, 1);
@@ -5737,7 +5736,7 @@ static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
 			return NF_DROP;
 
-	if (netlbl_active)
+	if (netlbl_enabled())
 		/* we do this in the FORWARD path and not the POST_ROUTING
 		 * path because we want to make sure we apply the necessary
 		 * labeling before IPsec is applied so we can leverage AH
@@ -5751,7 +5750,6 @@ static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
 				      const struct nf_hook_state *state)
 {
-	u16 family = state->pf;
 	struct sock *sk;
 	u32 sid;
 
@@ -5785,7 +5783,7 @@ static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
 		sid = sksec->sid;
 	} else
 		sid = SECINITSID_KERNEL;
-	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
+	if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
 		return NF_DROP;
 
 	return NF_ACCEPT;
@@ -5793,25 +5791,22 @@ static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
 
 
 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
-						int ifindex,
-						u16 family)
+					const struct nf_hook_state *state)
 {
-	struct sock *sk = skb_to_full_sk(skb);
 	struct sk_security_struct *sksec;
 	struct common_audit_data ad;
 	struct lsm_network_audit net = {0,};
-	char *addrp;
 	u8 proto;
 
-	if (sk == NULL)
+	if (state->sk == NULL)
 		return NF_ACCEPT;
-	sksec = sk->sk_security;
+	sksec = state->sk->sk_security;
 
 	ad.type = LSM_AUDIT_DATA_NET;
 	ad.u.net = &net;
-	ad.u.net->netif = ifindex;
-	ad.u.net->family = family;
-	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
+	ad.u.net->netif = state->out->ifindex;
+	ad.u.net->family = state->pf;
+	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
 		return NF_DROP;
 
 	if (selinux_secmark_enabled())
@@ -5830,31 +5825,29 @@ static unsigned int selinux_ip_postroute(void *priv,
 					 struct sk_buff *skb,
 					 const struct nf_hook_state *state)
 {
-	const struct net_device *outdev = state->out;
-	u16 family = state->pf;
+	u16 family;
 	u32 secmark_perm;
 	u32 peer_sid;
-	int ifindex = outdev->ifindex;
+	int ifindex;
 	struct sock *sk;
 	struct common_audit_data ad;
 	struct lsm_network_audit net = {0,};
 	char *addrp;
-	u8 secmark_active;
-	u8 peerlbl_active;
+	int secmark_active, peerlbl_active;
 
 	/* If any sort of compatibility mode is enabled then handoff processing
 	 * to the selinux_ip_postroute_compat() function to deal with the
 	 * special handling.  We do this in an attempt to keep this function
 	 * as fast and as clean as possible. */
 	if (!selinux_policycap_netpeer())
-		return selinux_ip_postroute_compat(skb, ifindex, family);
+		return selinux_ip_postroute_compat(skb, state);
 
 	secmark_active = selinux_secmark_enabled();
 	peerlbl_active = selinux_peerlbl_enabled();
 	if (!secmark_active && !peerlbl_active)
 		return NF_ACCEPT;
 
-	sk = skb_to_full_sk(skb);
+	sk = state->sk;
 
 #ifdef CONFIG_XFRM
 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
@@ -5873,6 +5866,7 @@ static unsigned int selinux_ip_postroute(void *priv,
 		return NF_ACCEPT;
 #endif
 
+	family = state->pf;
 	if (sk == NULL) {
 		/* Without an associated socket the packet is either coming
 		 * from the kernel or it is being forwarded; check the packet
@@ -5933,6 +5927,7 @@ static unsigned int selinux_ip_postroute(void *priv,
 		secmark_perm = PACKET__SEND;
 	}
 
+	ifindex = state->out->ifindex;
 	ad.type = LSM_AUDIT_DATA_NET;
 	ad.u.net = &net;
 	ad.u.net->netif = ifindex;
@@ -5950,7 +5945,7 @@ static unsigned int selinux_ip_postroute(void *priv,
 		u32 if_sid;
 		u32 node_sid;
 
-		if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
+		if (sel_netif_sid(state->net, ifindex, &if_sid))
 			return NF_DROP;
 		if (avc_has_perm(&selinux_state,
 				 peer_sid, if_sid,

Re: [PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[Paul Moore]

On Mon, Oct 11, 2021 at 7:06 PM Paul Moore <paul@paul-moore.com> wrote:
>
> This patch builds on a previous SELinux/netfilter patch by Florian
> Westphal and makes better use of the nf_hook_state variable passed
> into the SELinux/netfilter hooks as well as a number of other small
> cleanups in the related code.
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  security/selinux/hooks.c |   53 +++++++++++++++++++++-------------------------
>  1 file changed, 24 insertions(+), 29 deletions(-)

FYI, I just merged this into selinux/next.

-- 
paul moore
www.paul-moore.com

Re: [PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[Stephen Smalley]

On Tue, Oct 12, 2021 at 11:02 AM Paul Moore <paul@paul-moore.com> wrote:
>
> On Mon, Oct 11, 2021 at 7:06 PM Paul Moore <paul@paul-moore.com> wrote:
> >
> > This patch builds on a previous SELinux/netfilter patch by Florian
> > Westphal and makes better use of the nf_hook_state variable passed
> > into the SELinux/netfilter hooks as well as a number of other small
> > cleanups in the related code.
> >
> > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > ---
> >  security/selinux/hooks.c |   53 +++++++++++++++++++++-------------------------
> >  1 file changed, 24 insertions(+), 29 deletions(-)
>
> FYI, I just merged this into selinux/next.

Don't know if it was this one or the previous one yet but
selinux-testsuite locks up my box hard during selinux-testsuite on
inet_socket test.
Completely unresponsive, no output.

Re: [PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[Paul Moore]

On Tue, Oct 12, 2021 at 1:52 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, Oct 12, 2021 at 11:02 AM Paul Moore <paul@paul-moore.com> wrote:
> >
> > On Mon, Oct 11, 2021 at 7:06 PM Paul Moore <paul@paul-moore.com> wrote:
> > >
> > > This patch builds on a previous SELinux/netfilter patch by Florian
> > > Westphal and makes better use of the nf_hook_state variable passed
> > > into the SELinux/netfilter hooks as well as a number of other small
> > > cleanups in the related code.
> > >
> > > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > > ---
> > >  security/selinux/hooks.c |   53 +++++++++++++++++++++-------------------------
> > >  1 file changed, 24 insertions(+), 29 deletions(-)
> >
> > FYI, I just merged this into selinux/next.
>
> Don't know if it was this one or the previous one yet but
> selinux-testsuite locks up my box hard during selinux-testsuite on
> inet_socket test.
> Completely unresponsive, no output.

That's fun.  I could have sworn this ran through my automated test,
but let me double check ...

-- 
paul moore
www.paul-moore.com

Re: [PATCH] selinux: make better use of the nf_hook_state passed to the NF hooks

[Paul Moore]

On Tue, Oct 12, 2021 at 1:57 PM Paul Moore <paul@paul-moore.com> wrote:
> On Tue, Oct 12, 2021 at 1:52 PM Stephen Smalley
> <stephen.smalley.work@gmail.com> wrote:
> >
> > On Tue, Oct 12, 2021 at 11:02 AM Paul Moore <paul@paul-moore.com> wrote:
> > >
> > > On Mon, Oct 11, 2021 at 7:06 PM Paul Moore <paul@paul-moore.com> wrote:
> > > >
> > > > This patch builds on a previous SELinux/netfilter patch by Florian
> > > > Westphal and makes better use of the nf_hook_state variable passed
> > > > into the SELinux/netfilter hooks as well as a number of other small
> > > > cleanups in the related code.
> > > >
> > > > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > > > ---
> > > >  security/selinux/hooks.c |   53 +++++++++++++++++++++-------------------------
> > > >  1 file changed, 24 insertions(+), 29 deletions(-)
> > >
> > > FYI, I just merged this into selinux/next.
> >
> > Don't know if it was this one or the previous one yet but
> > selinux-testsuite locks up my box hard during selinux-testsuite on
> > inet_socket test.
> > Completely unresponsive, no output.
>
> That's fun.  I could have sworn this ran through my automated test,
> but let me double check ...

Well that's embarrassing ... yes, something is wrong with this patch,
I'll pop it off selinux/next now and repost when I've had a chance to
revisit this.

-- 
paul moore
www.paul-moore.com