Hi,
Accessfs is a new file system to control access to system resources.
For further information see the help text.
Changes:
- ported to LSM
- support capabilities
- merged ipv4/ipv6 into ip
This part (1/2) adds a hook to LSM to enable control based on the port
number.
The patch is attached below. It is also available at:
<http://home.t-online.de/home/olaf.dietsche/linux/accessfs-2.5.34-0.5-1_2.patch.gz>
It applies to 2.5.3[5-8] as well.
I did minimal testing using uml 0.58-2.5.34.
Regards, Olaf.
diff -urN v2.5.34/include/linux/security.h v2.5.34-accessfs/include/linux/security.h
--- v2.5.34/include/linux/security.h Sun Sep 1 00:04:51 2002
+++ v2.5.34-accessfs/include/linux/security.h Tue Sep 24 13:25:50 2002
@@ -642,6 +642,13 @@
* @args contains the call arguments (user space pointer).
* The module should return -ENOSYS if it does not implement any new
* system calls.
+ * @ip_prot_sock:
+ * Check, whether this is a protected port.
+ * Security modules may use this hook to implement fine grained control
+ * based on the port number.
+ * @port contains the requested port
+ * The module should return true if port is a protected port (e.g. < 1024),
+ * false otherwise.
*
* @register_security:
* allow module stacking.
@@ -785,6 +792,7 @@
unsigned long arg5);
void (*task_kmod_set_label) (void);
void (*task_reparent_to_init) (struct task_struct * p);
+ int (*ip_prot_sock) (int port);
/* allow module stacking */
int (*register_security) (const char *name,
diff -urN v2.5.34/net/ipv4/af_inet.c v2.5.34-accessfs/net/ipv4/af_inet.c
--- v2.5.34/net/ipv4/af_inet.c Tue Sep 24 11:52:15 2002
+++ v2.5.34-accessfs/net/ipv4/af_inet.c Tue Sep 24 13:21:29 2002
@@ -531,7 +531,7 @@
snum = ntohs(addr->sin_port);
err = -EACCES;
- if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
+ if (security_ops->ip_prot_sock(snum) && !capable(CAP_NET_BIND_SERVICE))
goto out;
/* We keep a pair of addresses. rcv_saddr is the one
diff -urN v2.5.34/net/ipv6/af_inet6.c v2.5.34-accessfs/net/ipv6/af_inet6.c
--- v2.5.34/net/ipv6/af_inet6.c Tue Sep 24 11:52:15 2002
+++ v2.5.34-accessfs/net/ipv6/af_inet6.c Tue Sep 24 13:21:56 2002
@@ -313,7 +313,7 @@
}
snum = ntohs(addr->sin6_port);
- if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
+ if (security_ops->ip_prot_sock(snum) && !capable(CAP_NET_BIND_SERVICE))
return -EACCES;
lock_sock(sk);
diff -urN v2.5.34/security/capability.c v2.5.34-accessfs/security/capability.c
--- v2.5.34/security/capability.c Sun Sep 1 00:04:55 2002
+++ v2.5.34-accessfs/security/capability.c Tue Sep 24 13:20:08 2002
@@ -18,6 +18,7 @@
#include <linux/smp_lock.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
+#include <net/sock.h>
/* flag to keep track of how we were registered */
static int secondary;
@@ -679,6 +680,11 @@
return;
}
+static int cap_ip_prot_sock (int port)
+{
+ return port && port < PROT_SOCK;
+}
+
static int cap_register (const char *name, struct security_operations *ops)
{
return -EINVAL;
@@ -781,6 +787,8 @@
.task_prctl = cap_task_prctl,
.task_kmod_set_label = cap_task_kmod_set_label,
.task_reparent_to_init = cap_task_reparent_to_init,
+
+ .ip_prot_sock = cap_ip_prot_sock,
.register_security = cap_register,
.unregister_security = cap_unregister,
diff -urN v2.5.34/security/dummy.c v2.5.34-accessfs/security/dummy.c
--- v2.5.34/security/dummy.c Sun Sep 1 00:04:52 2002
+++ v2.5.34-accessfs/security/dummy.c Tue Sep 24 13:19:21 2002
@@ -18,6 +18,7 @@
#include <linux/security.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
+#include <net/sock.h>
static int dummy_ptrace (struct task_struct *parent, struct task_struct *child)
{
@@ -493,6 +494,11 @@
return;
}
+static int dummy_ip_prot_sock (int port)
+{
+ return port && port < PROT_SOCK;
+}
+
static int dummy_register (const char *name, struct security_operations *ops)
{
return -EINVAL;
@@ -595,6 +601,8 @@
.task_prctl = dummy_task_prctl,
.task_kmod_set_label = dummy_task_kmod_set_label,
.task_reparent_to_init = dummy_task_reparent_to_init,
+
+ .ip_prot_sock = dummy_ip_prot_sock,
.register_security = dummy_register,
.unregister_security = dummy_unregister,
On Tue, Sep 24, 2002 at 05:39:43PM +0200, Olaf Dietsche wrote:
> Hi,
>
> Accessfs is a new file system to control access to system resources.
> For further information see the help text.
>
> Changes:
> - ported to LSM
> - support capabilities
> - merged ipv4/ipv6 into ip
>
> This part (1/2) adds a hook to LSM to enable control based on the port
> number.
I like this, it looks quite nice.
You might want to provide a patch against the development LSM tree
(available at lsm.immunix.org) as that tree already has a lot of ip_*
hooks that have not been submitted to the networking group yet. If you
do this, I would be glad to add this patch to the LSM tree, which will
keep you from having to do the forward port for all new kernel versions
that come out, if you want. A number of other security related projects
are already in this tree (SELinux, DTE, LIDS, and others.)
thanks,
greg k-h