From: Richard Haines <richard_c_haines@btinternet.com>
To: selinux@vger.kernel.org, linux-security-module@vger.kernel.org,
osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org
Cc: stephen.smalley.work@gmail.com, paul@paul-moore.com,
pablo@netfilter.org, laforge@gnumonks.org, jmorris@namei.org,
Richard Haines <richard_c_haines@btinternet.com>
Subject: [PATCH 0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP)
Date: Wed, 30 Sep 2020 10:49:31 +0100 [thread overview]
Message-ID: <20200930094934.32144-1-richard_c_haines@btinternet.com> (raw)
These patches came about after looking at 5G open source in particular
the updated 5G GTP driver at [1]. As this driver is still under
development, added the LSM/SELinux hooks to the current stable GTP
version in kernel selinux-next [2]. Similar hooks have also been
implemented in [1] as it uses the same base code as the current 3G
version (except that it handles different packet types).
To test the 3G GTP driver there is an RFC patch for the selinux-testsuite
at [3].
To enable the selinux-testsuite GTP tests, the libgtpnl [4] library and
tools needed to be modified to:
Return ERRNO on error to detect EACCES, Add gtp_match_tunnel function,
Allow gtp-link to specify port numbers for multiple instances to
run in the same namespace.
A patch for libgtpnl is supplied in the selinux-testsuite patch as well
as setup/test instructions (libgtpnl is not packaged by Fedora)
These patches were tested on Fedora 32 with kernel [2] using the
'targeted' policy. Also ran the Linux Kernel GTP-U basic tests [5].
[1] https://github.com/PrinzOwO/gtp5g
[2] https://github.com/SELinuxProject/selinux-kernel
[3] https://lore.kernel.org/selinux/20200924085314.6120-1-richard_c_haines@btinternet.com/
[4] git://git.osmocom.org/libgtpnl.git
[5] https://osmocom.org/projects/linux-kernel-gtp-u/wiki/Basic_Testing
Changes from RFC patches:
1) Rework the LSM hook names and contents as suggested by Casey Schaufler.
This resulted in moving the gtp_dev struct from gtp.c to include/net/gtp.h
so that it is visible to the LSM modules for storing the security blob.
2) Remove pr_debug's from gtp.c security_* calls.
3) Minor GTP.rst updates.
4) Added netdev to distribution list.
Richard Haines (3):
security: Add GPRS Tunneling Protocol (GTP) security hooks
gtp: Add LSM hooks to GPRS Tunneling Protocol (GTP)
selinux: Add SELinux GTP support
Documentation/security/GTP.rst | 100 ++++++++++++++++++++++++++++
Documentation/security/index.rst | 1 +
drivers/net/gtp.c | 50 +++++++++-----
include/linux/lsm_hook_defs.h | 3 +
include/linux/lsm_hooks.h | 13 ++++
include/linux/security.h | 22 ++++++
include/net/gtp.h | 21 ++++++
security/security.c | 18 +++++
security/selinux/hooks.c | 66 ++++++++++++++++++
security/selinux/include/classmap.h | 2 +
security/selinux/include/objsec.h | 4 ++
11 files changed, 284 insertions(+), 16 deletions(-)
create mode 100644 Documentation/security/GTP.rst
--
2.26.2
next reply other threads:[~2020-10-15 22:28 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 9:49 Richard Haines [this message]
2020-09-30 9:49 ` [PATCH 1/3] security: Add GPRS Tunneling Protocol (GTP) security hooks Richard Haines
2020-09-30 9:49 ` [PATCH 2/3] gtp: Add LSM hooks to GPRS Tunneling Protocol (GTP) Richard Haines
2020-09-30 9:49 ` [PATCH 3/3] selinux: Add SELinux GTP support Richard Haines
2020-09-30 11:01 ` Harald Welte
2020-09-30 12:25 ` Richard Haines
2020-09-30 13:38 ` Harald Welte
2020-10-12 2:09 ` Paul Moore
2020-10-12 9:38 ` Harald Welte
2020-10-13 13:55 ` Paul Moore
2020-10-13 16:38 ` Richard Haines
2020-10-13 20:42 ` Harald Welte
2020-09-30 10:17 ` [PATCH 0/3] Add LSM/SELinux support for GPRS Tunneling Protocol (GTP) Pablo Neira Ayuso
2020-09-30 12:20 ` Richard Haines
2020-09-30 12:30 ` Pablo Neira Ayuso
2020-09-30 15:56 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200930094934.32144-1-richard_c_haines@btinternet.com \
--to=richard_c_haines@btinternet.com \
--cc=jmorris@namei.org \
--cc=laforge@gnumonks.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=osmocom-net-gprs@lists.osmocom.org \
--cc=pablo@netfilter.org \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).