From patchwork Wed Apr 19 17:44:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthieu Baerts X-Patchwork-Id: 85516 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp563798vqo; Wed, 19 Apr 2023 10:49:44 -0700 (PDT) X-Google-Smtp-Source: AKy350Zn/VDR9pm1p5Z9vtbzayAK+kR8t6kfhCsMLlXML5ZuAztWDERgWn0In3UJfg/YhmO4VItD X-Received: by 2002:a05:6a20:431e:b0:f0:3724:a9b0 with SMTP id h30-20020a056a20431e00b000f03724a9b0mr4827800pzk.3.1681926583793; Wed, 19 Apr 2023 10:49:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681926583; cv=none; d=google.com; s=arc-20160816; b=P4dYZfPL8TOFlLGEWCtJTIvDYCmVzM3HIJ4UDmb2YpoVVcjf6mqJJbTcWFnpITz2wo Yp+qyMZ7erAcyORLrUK4wcMloDIiKsyWR0Bvg6Xke4uf6VLsGROxCx+nkaiwtb/LFDXJ qkzrKKMx2YkJxhD/NUF28mFrL8b2TY5UPUeBW01Xe0QtBTX6hC2dkk2/NLUhtYK7KD0g ti0CHC8p20PtxAHbcpgHHg9UnGNkmaRInO5Cx0Ntu1OATC3n7r4m1sB3Loj/ygtBZnhj h0lz6pjvyuubEMXtWUcwFOQwo2Fys84y+gRz+DXsmEStolQXV71dFeayzfttVIdzGj1O DoZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:in-reply-to:references:message-id :content-transfer-encoding:mime-version:subject:date:from :dkim-signature; bh=9RbIwTqRb0BDbnwq8YaxJ333m+AcgTDfn8Ja+ySsZ+Q=; b=dcxHyEQEFVA0dKsB7bI+qDUHg3D+gtmWZ0821t00QfXpLIUDCEogwGb6RPqrgRIPKD bi9iaSzGJez8OSQw4rfKUPgZYEllx7ixG3AWkot+c66XMwuCy/2+G4wgAtdE0am9hLBB oRYrrTTAxoSV2Hdbao88aQJ67cjxn9976Xn3Qm265UcOpo28IGKL5mrobaLmWDZijejQ 5mhmIF30PIvuXtt0uqgqmplIY1ZBvkOdCdWDmLb36lWGezbcRqdK72Z6zh1NRk1lf/Ms PwZWgy2tTDFWCcUnOmfiGgcTJEBnXQCxB72f8E3GFuw00sy4k015LAvzWeTo4KIRznSE o2aw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@tessares.net header.s=google header.b=suVtm7Mg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=tessares.net Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v37-20020a631525000000b005130f15c5b1si4727169pgl.363.2023.04.19.10.49.06; Wed, 19 Apr 2023 10:49:43 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@tessares.net header.s=google header.b=suVtm7Mg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=tessares.net Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233272AbjDSRoo (ORCPT + 99 others); Wed, 19 Apr 2023 13:44:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232727AbjDSRok (ORCPT ); Wed, 19 Apr 2023 13:44:40 -0400 Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 36D677685 for ; Wed, 19 Apr 2023 10:44:33 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id ffacd0b85a97d-2fde2879eabso1290830f8f.1 for ; Wed, 19 Apr 2023 10:44:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tessares.net; s=google; t=1681926271; x=1684518271; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=9RbIwTqRb0BDbnwq8YaxJ333m+AcgTDfn8Ja+ySsZ+Q=; b=suVtm7MgYycUt3Fu5QA/59FP2JJaRuXf2BK9rn6LghytcioCuAsQFkuUW9VBzDJbEd lNI0Qv3RB4pAw72J+1UNm/9PtDOpay6XEXbcjO0t/hdiGOY4LHikTS2caNfv4zW00JK7 V48Rv2ApL6wcDb7haKa/uYEB0k97ppGi8Byu/9zB4YtCCTtLQngt+B3A6YyYKCtioRD2 SLnR6hpmQ76QmjZYHgOPabUWd0X1NONEGJVtXp0EJPTQmD75iwIzXchHwcdNXwEYv24X 1vvl+p8QK3Avo70JGjdVK/NzUx8OCDQqG+bxKYw0m3vXawWCSzfQofZ3unIeIyXgTykW M+pQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681926271; x=1684518271; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9RbIwTqRb0BDbnwq8YaxJ333m+AcgTDfn8Ja+ySsZ+Q=; b=RxMpPCj09JZ1DuKmwur5XRGus83OECL0AzrZEsJpiSQ07wR+KnDOFSXy61qccBVUjM 7bSCxnIYP6rsmyxRy1S50Qg+nvgK6mca2RDPMgi1IvafH4XA3cY9BlEWGXAGu6vwPSTi SKrDFjbQeeBf9ODr/oibR2PeKfIsYK7Mqfki5MnZ5sQglDjVV9wSPi99w9ccGWeFdhtE /Aq4sHEhkKVxLl3FCEXp0lqF6abD7Kz9IzZcKvunMZSTlWcayiBMZ5x44wdLwYqx6nG1 rVsFYcbrp5bzLAzWM6V541LEqwYoWLlItbcPFpNEQS0XG9jDn04tJe37Edv1xGXSKYau sn5A== X-Gm-Message-State: AAQBX9dTXG03KXBQvywMcS+VHriW2ST21wNiKZVZ+dl31Lu8cqNm7Qtf KBV1/VeWUv/h3J5INzw7iOYGIA== X-Received: by 2002:adf:e688:0:b0:2fb:f93f:b96 with SMTP id r8-20020adfe688000000b002fbf93f0b96mr5159967wrm.31.1681926271574; Wed, 19 Apr 2023 10:44:31 -0700 (PDT) Received: from vdi08.nix.tessares.net (static.219.156.76.144.clients.your-server.de. [144.76.156.219]) by smtp.gmail.com with ESMTPSA id o18-20020a5d4092000000b002fe87e0706bsm3027879wrp.97.2023.04.19.10.44.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Apr 2023 10:44:31 -0700 (PDT) From: Matthieu Baerts Date: Wed, 19 Apr 2023 19:44:04 +0200 Subject: [PATCH LSM 1/2] security, lsm: Introduce security_mptcp_add_subflow() MIME-Version: 1.0 Message-Id: <20230419-upstream-lsm-next-20230419-mptcp-sublows-user-ctx-v1-1-9d4064cb0075@tessares.net> References: <20230419-upstream-lsm-next-20230419-mptcp-sublows-user-ctx-v1-0-9d4064cb0075@tessares.net> In-Reply-To: <20230419-upstream-lsm-next-20230419-mptcp-sublows-user-ctx-v1-0-9d4064cb0075@tessares.net> To: Paul Moore , James Morris , "Serge E. Hallyn" , Stephen Smalley , Eric Paris Cc: Paolo Abeni , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Ondrej Mosnacek , mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, Matthieu Baerts X-Mailer: b4 0.12.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4147; i=matthieu.baerts@tessares.net; h=from:subject:message-id; bh=ImEO6jhjyTkNStj63VHfS9Fa8J/JaMOk/HAY9HrkSs8=; b=owEBbQKS/ZANAwAIAfa3gk9CaaBzAcsmYgBkQCh9B3Q/tK29huTRfn80vFL4Qelr+A0+fhoMw 1w1X6DnbVGJAjMEAAEIAB0WIQToy4X3aHcFem4n93r2t4JPQmmgcwUCZEAofQAKCRD2t4JPQmmg c1ToD/4op14xnZbmNIFBWh1PT+MnRYeBRoLHSUX4MyRze6NzRUnFd3wdNDqBEq9+dorFoeg6ydC mpLldYd+FDZq1ngzAkg0ZvgVgFEA+WcpqjYk4iegbkQY+4xKW0cu8NY336bbR1ecvQ1m9k+OpvU sV72MtDizAw11irqLp0leoPgd1xuUyu/Adm9GZ8gcFv9RNWw61nNm5rmYM1TaLZesBySHyqLKEX XbC050oI2AOrlMroQx5OU0O/aIuyUWclATrS2q7EcgbD/paYmiXvSK4mn/AiFLBkBJsuo+t/kGD gQKiyZNqWSh+/jQ5KS4m1QsQAqUuRqbEbFjZZPZvEfK114xuKCwVdUNllin3QEm32JHTYWFeN4H A86k2I5H4pIcMIHBxMvRcIOo4jpoTyohVgvNWgetgcwH1KC4YtaN6s8iwNSXe9dVBcMyAiA9wjV ceY6wH1Mrsrbt/p/YrJec0hxpUuCH8oFZRHMaVV98N36SSLcfLUr6PpsFLIOww6531pJb52/fId DH1AE7jeDQ4EHkqiTZ1Gjs37/IkS1pFBGs9mTGjlloCcrAU0HpKvFSDDZfuog7F1lhrgkgwG6pQ UXhls5pgeB86jNIgGEPlK+hubj6LRu72BGpgTk6BCaTsa/3fCOiepTPi/iTzwfUl5tghbPZZwJb bmTxgWmL+QlF3Ug== X-Developer-Key: i=matthieu.baerts@tessares.net; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763627849318690848?= X-GMAIL-MSGID: =?utf-8?q?1763627849318690848?= From: Paolo Abeni MPTCP can create subflows in kernel context, and later indirectly expose them to user-space, via the owning mptcp socket. As discussed in the reported link, the above causes unexpected failures for server, MPTCP-enabled applications. Let's introduce a new LSM hook to allow the security module to relabel the subflow according to the owing process. Note that the new hook requires both the mptcp socket and the new subflow. This could allow future extensions, e.g. explicitly validating the mptcp <-> subflow linkage. Link: https://lore.kernel.org/mptcp/CAHC9VhTNh-YwiyTds=P1e3rixEDqbRTFj22bpya=+qJqfcaMfg@mail.gmail.com/ Signed-off-by: Paolo Abeni Acked-by: Matthieu Baerts Signed-off-by: Matthieu Baerts --- include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 6 ++++++ net/mptcp/subflow.c | 6 ++++++ security/security.c | 15 +++++++++++++++ 4 files changed, 28 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 6bb55e61e8e8..7308a1a7599b 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -343,6 +343,7 @@ LSM_HOOK(void, LSM_RET_VOID, sctp_sk_clone, struct sctp_association *asoc, struct sock *sk, struct sock *newsk) LSM_HOOK(int, 0, sctp_assoc_established, struct sctp_association *asoc, struct sk_buff *skb) +LSM_HOOK(int, 0, mptcp_add_subflow, struct sock *sk, struct sock *ssk) #endif /* CONFIG_SECURITY_NETWORK */ #ifdef CONFIG_SECURITY_INFINIBAND diff --git a/include/linux/security.h b/include/linux/security.h index cd23221ce9e6..80a0b37a9f26 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1465,6 +1465,7 @@ void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk, struct sock *newsk); int security_sctp_assoc_established(struct sctp_association *asoc, struct sk_buff *skb); +int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk); #else /* CONFIG_SECURITY_NETWORK */ static inline int security_unix_stream_connect(struct sock *sock, @@ -1692,6 +1693,11 @@ static inline int security_sctp_assoc_established(struct sctp_association *asoc, { return 0; } + +static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk) +{ + return 0; +} #endif /* CONFIG_SECURITY_NETWORK */ #ifdef CONFIG_SECURITY_INFINIBAND diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 4ae1a7304cf0..d361749cabff 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1692,6 +1692,10 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING); + err = security_mptcp_add_subflow(sk, sf->sk); + if (err) + goto release_ssk; + /* the newly created socket has to be in the same cgroup as its parent */ mptcp_attach_cgroup(sk, sf->sk); @@ -1704,6 +1708,8 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, get_net_track(net, &sf->sk->ns_tracker, GFP_KERNEL); sock_inuse_add(net, 1); err = tcp_set_ulp(sf->sk, "mptcp"); + +release_ssk: release_sock(sf->sk); if (err) { diff --git a/security/security.c b/security/security.c index f4170efcddda..24cf2644a4b9 100644 --- a/security/security.c +++ b/security/security.c @@ -4667,6 +4667,21 @@ int security_sctp_assoc_established(struct sctp_association *asoc, } EXPORT_SYMBOL(security_sctp_assoc_established); +/** + * security_mptcp_add_subflow() - Inherit the LSM label from the MPTCP socket + * @sk: the owning MPTCP socket + * @ssk: the new subflow + * + * Update the labeling for the given MPTCP subflow, to match the one of the + * owning MPTCP socket. + * + * Return: Returns 0 on success or a negative error code on failure. + */ +int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk) +{ + return call_int_hook(mptcp_add_subflow, 0, sk, ssk); +} + #endif /* CONFIG_SECURITY_NETWORK */ #ifdef CONFIG_SECURITY_INFINIBAND