On Wed, Nov 28, 2018 at 1:44 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> added new RTM_* definitions without properly updating SELinux, this
> patch adds the necessary SELinux support.
>
> While there was a BUILD_BUG_ON() in the SELinux code to protect from
> exactly this case, it was bypassed in the broken commit. In order to
> hopefully prevent this from happening in the future, add additional
> comments which provide some instructions on how to resolve the
> BUILD_BUG_ON() failures.
>
> Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
> Cc: <stable@xxxxxxxxxxxxxxx> # 4.19
> Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx>
> ---
> security/selinux/nlmsgtab.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
I'm building a test kernel right now, assuming all goes well I'm going
to send this up to Linus for v4.20.
> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 74b951f55608..9cec81209617 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
> { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_NEWCACHEREPORT, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> + { RTM_NEWCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> + { RTM_DELCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> + { RTM_GETCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> };
>
> static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
> @@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
>
> switch (sclass) {
> case SECCLASS_NETLINK_ROUTE_SOCKET:
> - /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
> + /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
> + * If the BUILD_BUG_ON() below fails you must update the
> + * structures at the top of this file with the new mappings
> + * before updating the BUILD_BUG_ON() macro!
> + */
> BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
> err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
> sizeof(nlmsg_route_perms));
> @@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
> break;
>
> case SECCLASS_NETLINK_XFRM_SOCKET:
> + /* If the BUILD_BUG_ON() below fails you must update the
> + * structures at the top of this file with the new mappings
> + * before updating the BUILD_BUG_ON() macro!
> + */
> BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
> err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
> sizeof(nlmsg_xfrm_perms));
>
--
paul moore
www.paul-moore.com
