Network Buffer Hook Functions

LSM provides a set of hooks for maintaining and propagating security information for network buffer structures (struct sk_buff). A security field was added to this structure, and the hooks provide methods for allocating, cloning, copying, and freeing this security field. The basic lifecycle hook functions are:

These basic hooks are not discussed further. In addition to these basic hooks, two other hooks are provided: selinux_skb_set_owner_w and selinux_skb_recv_datagram. The remainder of this section describes the network buffer security structure and the implementation for these two hooks.

Network Buffer Security Structure

The skb_security_struct structure contains security information for network buffers. This structure is defined as:

struct skb_security_struct {
        unsigned long magic;            /* magic number for this module */
        struct sk_buff *skb;            /* back pointer */
        struct list_head list;          /* list of skb_security_struct */
        __u8 opts;                      /* Bitmap of current options */
        __u8 mapped;                    /* Bitmap of mapped SIDs */
        __u8 invalid;                   /* Security state invalidated */
        atomic_t use;                   /* reference count */
        __u32 serial;                   /* Policy ID used to label datagram */
        security_id_t ssid;             /* Source SID */
        security_id_t msid;             /* Message SID  */
        security_id_t dsid;             /* Destination SID */
        void *data;                     /* Implementation specific data */
};      

Table 38. skb_security_struct

FieldDescription
magicModule id for the SELinux module.
skbPointer to the SKB this structure belongs to.
listPointer used to maintain the list of allocated SKB security structures.
optsBitmap of flags indicating current packet labeling options.
mappedBitmap of flags indicating currently mapped remote SIDs.
invalidFlag indicating that the security state of the SKB is invalid.
useReference count for the security structure.
serialThe policy serial number.
ssidThe SID of the source socket.
msidThe SID of the message; sockets that maintain message boundaries may label each message.
dsidThe desired SID of the destination socket.
dataOpaque pointer to data that may be associated with the SKB. Not currently used.

See the Section called Network Packet Labeling, the Section called IPv4 Networking Hook Functions, and the Section called selinux_socket_sock_rcv_skb (Transport Layer Hook) for a discussion of how these fields are used by the labeled networking support, the IP hooks, and the sock_rcv_skb hook.

selinux_skb_set_owner_w

This hook sets the SID fields in a network buffer for an outgoing packet when the buffer is associated with a particular sending socket. The SID fields can then be used for permission checks and other processing related to the buffer. If labeled networking is used for the outgoing packet, then the SID fields are copied into the IP option by the selopt_ip_label_output function.

If the sending socket has no associated user socket, and the socket is a TCP socket, then the network buffer source and message SIDs are set to the kernel socket SID. Otherwise, no further determination is possible and the network buffer is left unlabeled.

If the sending socket has an associated user socket, but there is no inode security structure, then the network buffer' source and message SIDs are assigned either the TCP reset socket SID or the ICMP socket SID based on its family and protocol, and this hook returns. This logic handles kernel created sockets, since they are not caught by the LSM hooks.

Where there exists a inode for the socket, the source socket SID and message SID for the network buffer are set by default to the SID of the sending socket. However, the extended socket calls may change the SIDs used for the network buffer. See the Section called extsocket_skb_set_owner_w for a discussion of the optional extended socket call processing.

selinux_skb_recv_datagram

This hook calls the extsocket_skb_recv_datagram function to perform the processing necessary for the extended socket calls.