Skip to content

Commit d7cce01

Browse files
hdmdaviespcmoore
hdmdavies
authored and
pcmoore
committed
netlabel: Add support for removing a CALIPSO DOI.
Remove a specified DOI through the NLBL_CALIPSO_C_REMOVE command. It requires the attribute: NLBL_CALIPSO_A_DOI. Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent dc7de73 commit d7cce01

File tree

4 files changed

+150
-0
lines changed

4 files changed

+150
-0
lines changed

‎include/net/netlabel.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,7 @@ struct netlbl_calipso_ops {
237237
int (*doi_add)(struct calipso_doi *doi_def,
238238
struct netlbl_audit *audit_info);
239239
void (*doi_free)(struct calipso_doi *doi_def);
240+
int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info);
240241
struct calipso_doi *(*doi_getdef)(u32 doi);
241242
void (*doi_putdef)(struct calipso_doi *doi_def);
242243
int (*doi_walk)(u32 *skip_cnt,

‎net/ipv6/calipso.c

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,53 @@ static void calipso_doi_free_rcu(struct rcu_head *entry)
162162
calipso_doi_free(doi_def);
163163
}
164164

165+
/**
166+
* calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
167+
* @doi: the DOI value
168+
* @audit_secid: the LSM secid to use in the audit message
169+
*
170+
* Description:
171+
* Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
172+
* be called to release their own LSM domain mappings as well as our own
173+
* domain list. Returns zero on success and negative values on failure.
174+
*
175+
*/
176+
static int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
177+
{
178+
int ret_val;
179+
struct calipso_doi *doi_def;
180+
struct audit_buffer *audit_buf;
181+
182+
spin_lock(&calipso_doi_list_lock);
183+
doi_def = calipso_doi_search(doi);
184+
if (!doi_def) {
185+
spin_unlock(&calipso_doi_list_lock);
186+
ret_val = -ENOENT;
187+
goto doi_remove_return;
188+
}
189+
if (!atomic_dec_and_test(&doi_def->refcount)) {
190+
spin_unlock(&calipso_doi_list_lock);
191+
ret_val = -EBUSY;
192+
goto doi_remove_return;
193+
}
194+
list_del_rcu(&doi_def->list);
195+
spin_unlock(&calipso_doi_list_lock);
196+
197+
call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
198+
ret_val = 0;
199+
200+
doi_remove_return:
201+
audit_buf = netlbl_audit_start(AUDIT_MAC_CALIPSO_DEL, audit_info);
202+
if (audit_buf) {
203+
audit_log_format(audit_buf,
204+
" calipso_doi=%u res=%u",
205+
doi, ret_val == 0 ? 1 : 0);
206+
audit_log_end(audit_buf);
207+
}
208+
209+
return ret_val;
210+
}
211+
165212
/**
166213
* calipso_doi_getdef - Returns a reference to a valid DOI definition
167214
* @doi: the DOI value
@@ -253,6 +300,7 @@ static int calipso_doi_walk(u32 *skip_cnt,
253300
static const struct netlbl_calipso_ops ops = {
254301
.doi_add = calipso_doi_add,
255302
.doi_free = calipso_doi_free,
303+
.doi_remove = calipso_doi_remove,
256304
.doi_getdef = calipso_doi_getdef,
257305
.doi_putdef = calipso_doi_putdef,
258306
.doi_walk = calipso_doi_walk,

‎net/netlabel/netlabel_calipso.c

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ struct netlbl_calipso_doiwalk_arg {
5353
u32 seq;
5454
};
5555

56+
/* Argument struct for netlbl_domhsh_walk() */
57+
struct netlbl_domhsh_walk_arg {
58+
struct netlbl_audit *audit_info;
59+
u32 doi;
60+
};
61+
5662
/* NetLabel Generic NETLINK CALIPSO family */
5763
static struct genl_family netlbl_calipso_gnl_family = {
5864
.id = GENL_ID_GENERATE,
@@ -257,6 +263,64 @@ static int netlbl_calipso_listall(struct sk_buff *skb,
257263
return skb->len;
258264
}
259265

266+
/**
267+
* netlbl_calipso_remove_cb - netlbl_calipso_remove() callback for REMOVE
268+
* @entry: LSM domain mapping entry
269+
* @arg: the netlbl_domhsh_walk_arg structure
270+
*
271+
* Description:
272+
* This function is intended for use by netlbl_calipso_remove() as the callback
273+
* for the netlbl_domhsh_walk() function; it removes LSM domain map entries
274+
* which are associated with the CALIPSO DOI specified in @arg. Returns zero on
275+
* success, negative values on failure.
276+
*
277+
*/
278+
static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
279+
{
280+
struct netlbl_domhsh_walk_arg *cb_arg = arg;
281+
282+
if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
283+
entry->def.calipso->doi == cb_arg->doi)
284+
return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
285+
286+
return 0;
287+
}
288+
289+
/**
290+
* netlbl_calipso_remove - Handle a REMOVE message
291+
* @skb: the NETLINK buffer
292+
* @info: the Generic NETLINK info block
293+
*
294+
* Description:
295+
* Process a user generated REMOVE message and respond accordingly. Returns
296+
* zero on success, negative values on failure.
297+
*
298+
*/
299+
static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
300+
{
301+
int ret_val = -EINVAL;
302+
struct netlbl_domhsh_walk_arg cb_arg;
303+
struct netlbl_audit audit_info;
304+
u32 skip_bkt = 0;
305+
u32 skip_chain = 0;
306+
307+
if (!info->attrs[NLBL_CALIPSO_A_DOI])
308+
return -EINVAL;
309+
310+
netlbl_netlink_auditinfo(skb, &audit_info);
311+
cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
312+
cb_arg.audit_info = &audit_info;
313+
ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
314+
netlbl_calipso_remove_cb, &cb_arg);
315+
if (ret_val == 0 || ret_val == -ENOENT) {
316+
ret_val = calipso_doi_remove(cb_arg.doi, &audit_info);
317+
if (ret_val == 0)
318+
atomic_dec(&netlabel_mgmt_protocount);
319+
}
320+
321+
return ret_val;
322+
}
323+
260324
/* NetLabel Generic NETLINK Command Definitions
261325
*/
262326

@@ -269,6 +333,13 @@ static const struct genl_ops netlbl_calipso_ops[] = {
269333
.dumpit = NULL,
270334
},
271335
{
336+
.cmd = NLBL_CALIPSO_C_REMOVE,
337+
.flags = GENL_ADMIN_PERM,
338+
.policy = calipso_genl_policy,
339+
.doit = netlbl_calipso_remove,
340+
.dumpit = NULL,
341+
},
342+
{
272343
.cmd = NLBL_CALIPSO_C_LIST,
273344
.flags = 0,
274345
.policy = calipso_genl_policy,
@@ -362,6 +433,27 @@ void calipso_doi_free(struct calipso_doi *doi_def)
362433
ops->doi_free(doi_def);
363434
}
364435

436+
/**
437+
* calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
438+
* @doi: the DOI value
439+
* @audit_secid: the LSM secid to use in the audit message
440+
*
441+
* Description:
442+
* Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
443+
* be called to release their own LSM domain mappings as well as our own
444+
* domain list. Returns zero on success and negative values on failure.
445+
*
446+
*/
447+
int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
448+
{
449+
int ret_val = -ENOMSG;
450+
const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
451+
452+
if (ops)
453+
ret_val = ops->doi_remove(doi, audit_info);
454+
return ret_val;
455+
}
456+
365457
/**
366458
* calipso_doi_getdef - Returns a reference to a valid DOI definition
367459
* @doi: the DOI value

‎net/netlabel/netlabel_calipso.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,14 @@
4646
*
4747
* If using CALIPSO_MAP_PASS no additional attributes are required.
4848
*
49+
* o REMOVE:
50+
* Sent by an application to remove a specific DOI mapping table from the
51+
* CALIPSO system.
52+
*
53+
* Required attributes:
54+
*
55+
* NLBL_CALIPSO_A_DOI
56+
*
4957
* o LIST:
5058
* Sent by an application to list the details of a DOI definition. On
5159
* success the kernel should send a response using the following format.
@@ -114,6 +122,7 @@ static inline int netlbl_calipso_genl_init(void)
114122
int calipso_doi_add(struct calipso_doi *doi_def,
115123
struct netlbl_audit *audit_info);
116124
void calipso_doi_free(struct calipso_doi *doi_def);
125+
int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
117126
struct calipso_doi *calipso_doi_getdef(u32 doi);
118127
void calipso_doi_putdef(struct calipso_doi *doi_def);
119128
int calipso_doi_walk(u32 *skip_cnt,

0 commit comments

Comments
 (0)