Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[IPSEC]: Add xfrm policy change auditing to pfkey_spdget

Browse source 
pfkey_spdget neither had an LSM security hook nor auditing for the
removal of xfrm_policy structs.  The security hook was added when it was
moved into xfrm_policy_byid instead of the callers to that function by
my earlier patch and this patch adds the auditing hooks as well.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Venkat Yekkirala <vyekkirala@trustedcs.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Paris 2007-03-07 16:01:45 -08:00 committed by David S. Miller
parent ef41aaa0b7
commit 215a2dd3b4
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
net/key/af_key.c
View file

@ -2537,7 +2537,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
{ {
unsigned int dir; unsigned int dir;
int err; int err = 0, delete;
struct sadb_x_policy *pol; struct sadb_x_policy *pol;
struct xfrm_policy *xp; struct xfrm_policy *xp;
struct km_event c; struct km_event c;
@ -2549,16 +2549,20 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
if (dir >= XFRM_POLICY_MAX) if (dir >= XFRM_POLICY_MAX)
return -EINVAL; return -EINVAL;
delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id, xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
hdr->sadb_msg_type == SADB_X_SPDDELETE2, &err); delete, &err);
if (xp == NULL) if (xp == NULL)
return -ENOENT; return -ENOENT;
err = 0; if (delete) {
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
c.seq = hdr->sadb_msg_seq; if (err)
c.pid = hdr->sadb_msg_pid; goto out;
if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) { c.seq = hdr->sadb_msg_seq;
c.pid = hdr->sadb_msg_pid;
c.data.byid = 1; c.data.byid = 1;
c.event = XFRM_MSG_DELPOLICY; c.event = XFRM_MSG_DELPOLICY;
km_policy_notify(xp, dir, &c); km_policy_notify(xp, dir, &c);
@ -2566,6 +2570,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
err = key_pol_get_resp(sk, xp, hdr, dir); err = key_pol_get_resp(sk, xp, hdr, dir);
} }
out:
xfrm_pol_put(xp); xfrm_pol_put(xp);
return err; return err;
} }