1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Netlink message type permission tables, for user generated messages.
4  *
5  * Author: James Morris <jmorris@redhat.com>
6  *
7  * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
8  */
9 #include <linux/types.h>
10 #include <linux/kernel.h>
11 #include <linux/netlink.h>
12 #include <linux/rtnetlink.h>
13 #include <linux/if.h>
14 #include <linux/inet_diag.h>
15 #include <linux/xfrm.h>
16 #include <linux/audit.h>
17 #include <linux/sock_diag.h>
18 
19 #include "flask.h"
20 #include "av_permissions.h"
21 #include "security.h"
22 
23 struct nlmsg_perm {
24 	u16	nlmsg_type;
25 	u32	perm;
26 };
27 
28 static const struct nlmsg_perm nlmsg_route_perms[] =
29 {
30 	{ RTM_NEWLINK,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
31 	{ RTM_DELLINK,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
32 	{ RTM_GETLINK,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
33 	{ RTM_SETLINK,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
34 	{ RTM_NEWADDR,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
35 	{ RTM_DELADDR,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
36 	{ RTM_GETADDR,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
37 	{ RTM_NEWROUTE,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
38 	{ RTM_DELROUTE,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
39 	{ RTM_GETROUTE,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
40 	{ RTM_NEWNEIGH,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
41 	{ RTM_DELNEIGH,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
42 	{ RTM_GETNEIGH,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
43 	{ RTM_NEWRULE,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
44 	{ RTM_DELRULE,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
45 	{ RTM_GETRULE,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
46 	{ RTM_NEWQDISC,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
47 	{ RTM_DELQDISC,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
48 	{ RTM_GETQDISC,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
49 	{ RTM_NEWTCLASS,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
50 	{ RTM_DELTCLASS,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
51 	{ RTM_GETTCLASS,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
52 	{ RTM_NEWTFILTER,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
53 	{ RTM_DELTFILTER,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
54 	{ RTM_GETTFILTER,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
55 	{ RTM_NEWACTION,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
56 	{ RTM_DELACTION,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
57 	{ RTM_GETACTION,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
58 	{ RTM_NEWPREFIX,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
59 	{ RTM_GETMULTICAST,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
60 	{ RTM_GETANYCAST,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
61 	{ RTM_GETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
62 	{ RTM_SETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
63 	{ RTM_NEWADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
64 	{ RTM_DELADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
65 	{ RTM_GETADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
66 	{ RTM_GETDCB,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
67 	{ RTM_SETDCB,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
68 	{ RTM_NEWNETCONF,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
69 	{ RTM_DELNETCONF,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
70 	{ RTM_GETNETCONF,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
71 	{ RTM_NEWMDB,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
72 	{ RTM_DELMDB,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE  },
73 	{ RTM_GETMDB,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
74 	{ RTM_NEWNSID,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
75 	{ RTM_DELNSID,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
76 	{ RTM_GETNSID,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
77 	{ RTM_NEWSTATS,		NETLINK_ROUTE_SOCKET__NLMSG_READ },
78 	{ RTM_GETSTATS,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
79 	{ RTM_NEWCACHEREPORT,	NETLINK_ROUTE_SOCKET__NLMSG_READ },
80 	{ RTM_NEWCHAIN,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
81 	{ RTM_DELCHAIN,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
82 	{ RTM_GETCHAIN,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
83 	{ RTM_NEWNEXTHOP,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
84 	{ RTM_DELNEXTHOP,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
85 	{ RTM_GETNEXTHOP,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
86 	{ RTM_NEWLINKPROP,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
87 	{ RTM_DELLINKPROP,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
88 	{ RTM_NEWVLAN,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
89 	{ RTM_DELVLAN,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
90 	{ RTM_GETVLAN,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
91 	{ RTM_NEWNEXTHOPBUCKET,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
92 	{ RTM_DELNEXTHOPBUCKET,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
93 	{ RTM_GETNEXTHOPBUCKET,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
94 };
95 
96 static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
97 {
98 	{ TCPDIAG_GETSOCK,	NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
99 	{ DCCPDIAG_GETSOCK,	NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
100 	{ SOCK_DIAG_BY_FAMILY,	NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
101 	{ SOCK_DESTROY,		NETLINK_TCPDIAG_SOCKET__NLMSG_WRITE },
102 };
103 
104 static const struct nlmsg_perm nlmsg_xfrm_perms[] =
105 {
106 	{ XFRM_MSG_NEWSA,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
107 	{ XFRM_MSG_DELSA,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
108 	{ XFRM_MSG_GETSA,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
109 	{ XFRM_MSG_NEWPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
110 	{ XFRM_MSG_DELPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
111 	{ XFRM_MSG_GETPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
112 	{ XFRM_MSG_ALLOCSPI,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
113 	{ XFRM_MSG_ACQUIRE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
114 	{ XFRM_MSG_EXPIRE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
115 	{ XFRM_MSG_UPDPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
116 	{ XFRM_MSG_UPDSA,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
117 	{ XFRM_MSG_POLEXPIRE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
118 	{ XFRM_MSG_FLUSHSA,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
119 	{ XFRM_MSG_FLUSHPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
120 	{ XFRM_MSG_NEWAE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
121 	{ XFRM_MSG_GETAE,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
122 	{ XFRM_MSG_REPORT,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
123 	{ XFRM_MSG_MIGRATE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
124 	{ XFRM_MSG_NEWSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
125 	{ XFRM_MSG_GETSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
126 	{ XFRM_MSG_NEWSPDINFO,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
127 	{ XFRM_MSG_GETSPDINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
128 	{ XFRM_MSG_MAPPING,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
129 	{ XFRM_MSG_SETDEFAULT,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
130 	{ XFRM_MSG_GETDEFAULT,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
131 };
132 
133 static const struct nlmsg_perm nlmsg_audit_perms[] =
134 {
135 	{ AUDIT_GET,		NETLINK_AUDIT_SOCKET__NLMSG_READ     },
136 	{ AUDIT_SET,		NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
137 	{ AUDIT_LIST,		NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
138 	{ AUDIT_ADD,		NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
139 	{ AUDIT_DEL,		NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
140 	{ AUDIT_LIST_RULES,	NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
141 	{ AUDIT_ADD_RULE,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
142 	{ AUDIT_DEL_RULE,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
143 	{ AUDIT_USER,		NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
144 	{ AUDIT_SIGNAL_INFO,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },
145 	{ AUDIT_TRIM,		NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
146 	{ AUDIT_MAKE_EQUIV,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
147 	{ AUDIT_TTY_GET,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },
148 	{ AUDIT_TTY_SET,	NETLINK_AUDIT_SOCKET__NLMSG_TTY_AUDIT	},
149 	{ AUDIT_GET_FEATURE,	NETLINK_AUDIT_SOCKET__NLMSG_READ     },
150 	{ AUDIT_SET_FEATURE,	NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
151 };
152 
153 
nlmsg_perm(u16 nlmsg_type,u32 * perm,const struct nlmsg_perm * tab,size_t tabsize)154 static int nlmsg_perm(u16 nlmsg_type, u32 *perm, const struct nlmsg_perm *tab, size_t tabsize)
155 {
156 	int i, err = -EINVAL;
157 
158 	for (i = 0; i < tabsize/sizeof(struct nlmsg_perm); i++)
159 		if (nlmsg_type == tab[i].nlmsg_type) {
160 			*perm = tab[i].perm;
161 			err = 0;
162 			break;
163 		}
164 
165 	return err;
166 }
167 
selinux_nlmsg_lookup(u16 sclass,u16 nlmsg_type,u32 * perm)168 int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
169 {
170 	int err = 0;
171 
172 	switch (sclass) {
173 	case SECCLASS_NETLINK_ROUTE_SOCKET:
174 		/* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
175 		 * If the BUILD_BUG_ON() below fails you must update the
176 		 * structures at the top of this file with the new mappings
177 		 * before updating the BUILD_BUG_ON() macro!
178 		 */
179 		BUILD_BUG_ON(RTM_MAX != (RTM_NEWNEXTHOPBUCKET + 3));
180 		err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
181 				 sizeof(nlmsg_route_perms));
182 		break;
183 
184 	case SECCLASS_NETLINK_TCPDIAG_SOCKET:
185 		err = nlmsg_perm(nlmsg_type, perm, nlmsg_tcpdiag_perms,
186 				 sizeof(nlmsg_tcpdiag_perms));
187 		break;
188 
189 	case SECCLASS_NETLINK_XFRM_SOCKET:
190 		/* If the BUILD_BUG_ON() below fails you must update the
191 		 * structures at the top of this file with the new mappings
192 		 * before updating the BUILD_BUG_ON() macro!
193 		 */
194 		BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_GETDEFAULT);
195 		err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
196 				 sizeof(nlmsg_xfrm_perms));
197 		break;
198 
199 	case SECCLASS_NETLINK_AUDIT_SOCKET:
200 		if ((nlmsg_type >= AUDIT_FIRST_USER_MSG &&
201 		     nlmsg_type <= AUDIT_LAST_USER_MSG) ||
202 		    (nlmsg_type >= AUDIT_FIRST_USER_MSG2 &&
203 		     nlmsg_type <= AUDIT_LAST_USER_MSG2)) {
204 			*perm = NETLINK_AUDIT_SOCKET__NLMSG_RELAY;
205 		} else {
206 			err = nlmsg_perm(nlmsg_type, perm, nlmsg_audit_perms,
207 					 sizeof(nlmsg_audit_perms));
208 		}
209 		break;
210 
211 	/* No messaging from userspace, or class unknown/unhandled */
212 	default:
213 		err = -ENOENT;
214 		break;
215 	}
216 
217 	return err;
218 }
219