LinuxJournal/0040775000076400007640000000000007511114161013401 5ustar lmcmzaklmcmzakLinuxJournal/dsi/0040775000076400007640000000000007511320201014152 5ustar lmcmzaklmcmzakLinuxJournal/dsi/lsm/0040755000000000000000000000000007511323452013566 5ustar rootrootLinuxJournal/dsi/lsm/Makefile0100644000000000000000000000236207511202060015215 0ustar rootrootCC=gcc LINUX=/usr/src/linux MODCFLAGS := -g -Wall -DMODULE -D__KERNEL__ -DLINUX -O2 -I$(LINUX)/include -fomit-frame-pointer -fno-strict-aliasing -march=i686 -mpreferred-stack-boundary=2 #MODCFLAGS := -D__KERNEL__ -I$(LINUX)/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fomit-frame-pointer -fno-strict-aliasing -fno-common -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include $(LINUX)/include/linux/modversions.h all: lsm.o lsm.o: startup.o dsi.o dsi_task.o dsi_cache.o dsi_inode.o dsi_net.o ld -m elf_i386 -r -o lsm.o startup.o dsi.o dsi_task.o dsi_cache.o dsi_inode.o dsi_net.o startup.o: startup.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c startup.c dsi.o: dsi.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c dsi.c dsi_task.o: dsi_task.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c dsi_task.c dsi_cache.o: dsi_cache.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c dsi_cache.c dsi_inode.o: dsi_inode.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c dsi_inode.c dsi_net.o: dsi_net.c /usr/src/linux/include/linux/version.h dsi.h $(CC) $(MODCFLAGS) -c dsi_net.c clean: rm -f *.o core LinuxJournal/dsi/lsm/dsi.c0100644000000000000000000010451007511205623014506 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi.c * * This file contains the DSM hooks to the kernel. * The set of function was defined by the LSM interface. * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include #include "dsi.h" #include "dsi_ip_options.h" int dsi_node_id = 0; int dsi_alarm = 0; static int dsi_sethostname (char *hostname) { return 0; } static int dsi_setdomainname (char *domainname) { return 0; } static int dsi_reboot (unsigned int cmd) { return 0; } static int dsi_ioperm (unsigned long from, unsigned long num, int turn_on) { return 0; } static int dsi_iopl (unsigned int old, unsigned int level) { return 0; } static int dsi_ptrace (struct task_struct *parent, struct task_struct *child) { return 0; } static int dsi_capget (struct task_struct *target, kernel_cap_t * effective, kernel_cap_t * inheritable, kernel_cap_t * permitted) { return 0; } static int dsi_capset_check (struct task_struct *target, kernel_cap_t * effective, kernel_cap_t * inheritable, kernel_cap_t * permitted) { return 0; } static void dsi_capset_set (struct task_struct *target, kernel_cap_t * effective, kernel_cap_t * inheritable, kernel_cap_t * permitted) { return; } static int dsi_acct (struct file *file) { return 0; } static int dsi_capable (struct task_struct *tsk, int cap) { if (cap_is_fs_cap (cap) ? tsk->fsuid == 0 : tsk->euid == 0) /* capability granted */ return 0; /* capability denied */ return -EPERM; } static int dsi_sysctl (ctl_table * table, int op) { return 0; } static int dsi_sys_security (unsigned int id, unsigned int call, unsigned long *args) { struct task_struct *p; unsigned int task_pid; int task_sid; task_security_t *tsec; int ssid;//,sid; int tsid; int tclass; void *cache_node; int permission; int rc; DSI_PRINT("DSI sys_security : id=%x,call=%x,args=%x\n",id,call,(int)args); if(id != DSI_MAGIC) return -ENOSYS; rc = 0; switch(call) { case DSI_SET_NODE_ID: dsi_node_id = args[0]; break; case DSI_SET_TASK_SECURITY: printk("set security\n"); task_pid = args[0]; task_sid = args[1]; for_each_task(p) { if(p->pid == task_pid){ printk("task found pid = %x\n",task_pid); tsec = (task_security_t *)(p->security); if(tsec) { tsec->sid = task_sid; printk("sid = %x\n",tsec->sid); } break; } } break; case DSI_SET_POLICY: ssid = args[0]; tsid = args[1]; tclass = args[2]; permission = args[3]; cache_node = dsi_cache_update(ssid,tsid,tclass,permission); if(!cache_node) { printk("Can't update cache\n"); rc = -ENOSYS; } break; case DSI_ALARM_CHECK: rc = dsi_alarm; dsi_alarm = 0; break; default: rc = -ENOSYS; break; } return rc; } static int dsi_swapon (struct swap_info_struct *swap) { return 0; } static int dsi_swapoff (struct swap_info_struct *swap) { return 0; } static int dsi_nfsservctl (int cmd, struct nfsctl_arg *arg) { return 0; } static int dsi_quotactl (int cmds, int type, int id, struct super_block *sb) { return 0; } static int dsi_quota_on (struct file *f) { return 0; } static int dsi_bdflush (int func, long data) { return 0; } static int dsi_syslog (int type) { return 0; } static int dsi_netlink_send (struct sk_buff *skb) { if (current->euid == 0) cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN); else NETLINK_CB (skb).eff_cap = 0; return 0; } static int dsi_netlink_recv (struct sk_buff *skb) { if (!cap_raised (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN)) return -EPERM; return 0; } static int dsi_binprm_alloc_security (struct linux_binprm *bprm) { task_security_t *tsec; char elf_hdr[EI_NIDENT] = {0}; kernel_read(bprm->file,0,elf_hdr,EI_NIDENT); /* First of all, some simple consistency checks */ if (memcmp(elf_hdr, ELFMAG, SELFMAG) == 0) { /* Validate that we have a SID */ if (elf_hdr[DSI_ELF_SID_POS]) { tsec = (task_security_t *)current->security; if (tsec) { tsec->sid = elf_hdr[DSI_ELF_SID_POS]; DSI_PRINT("Found a sid : tsec->sid %d\n",tsec->sid); } } } return 0; } static void dsi_binprm_free_security (struct linux_binprm *bprm) { return; } static void dsi_binprm_compute_creds (struct linux_binprm *bprm) { return; } static int dsi_binprm_set_security (struct linux_binprm *bprm) { return 0; } static int dsi_sb_alloc_security (struct super_block *sb) { return 0; } static void dsi_sb_free_security (struct super_block *sb) { return; } static int dsi_sb_statfs (struct super_block *sb) { return 0; } static int dsi_mount (char *dev_name, struct nameidata *nd, char *type, unsigned long flags, void *data) { return 0; } static int dsi_check_sb (struct vfsmount *mnt, struct nameidata *nd) { return 0; } static int dsi_umount (struct vfsmount *mnt, int flags) { return 0; } static void dsi_umount_close (struct vfsmount *mnt) { return; } static void dsi_umount_busy (struct vfsmount *mnt) { return; } static void dsi_post_remount (struct vfsmount *mnt, unsigned long flags, void *data) { return; } static void dsi_post_mountroot (void) { return; } static void dsi_post_addmount (struct vfsmount *mnt, struct nameidata *nd) { return; } static int dsi_inode_alloc_security (struct inode *inode) { internal_inode_alloc_security(inode); return 0; } static void dsi_inode_free_security (struct inode *inode) { internal_inode_free_security(inode); return; } static int dsi_inode_create (struct inode *inode, struct dentry *dentry, int mask) { return 0; } static void dsi_inode_post_create (struct inode *inode, struct dentry *dentry, int mask) { return; } static int dsi_inode_link (struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry) { return 0; } static void dsi_inode_post_link (struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry) { return; } static int dsi_inode_unlink (struct inode *inode, struct dentry *dentry) { return 0; } static int dsi_inode_symlink (struct inode *inode, struct dentry *dentry, const char *name) { return 0; } static void dsi_inode_post_symlink (struct inode *inode, struct dentry *dentry, const char *name) { return; } static int dsi_inode_mkdir (struct inode *inode, struct dentry *dentry, int mask) { return 0; } static void dsi_inode_post_mkdir (struct inode *inode, struct dentry *dentry, int mask) { return; } static int dsi_inode_rmdir (struct inode *inode, struct dentry *dentry) { return 0; } static int dsi_inode_mknod (struct inode *inode, struct dentry *dentry, int major, dev_t minor) { return 0; } static void dsi_inode_post_mknod (struct inode *inode, struct dentry *dentry, int major, dev_t minor) { return; } static int dsi_inode_rename (struct inode *old_inode, struct dentry *old_dentry, struct inode *new_inode, struct dentry *new_dentry) { return 0; } static void dsi_inode_post_rename (struct inode *old_inode, struct dentry *old_dentry, struct inode *new_inode, struct dentry *new_dentry) { return; } static int dsi_inode_readlink (struct dentry *dentry) { return 0; } static int dsi_inode_follow_link (struct dentry *dentry, struct nameidata *nameidata) { return 0; } static int dsi_inode_permission (struct inode *inode, int mask) { /*DSI_PRINT("dsi_node_permission inode=%x,mask=%x\n",(int)inode,mask);*/ return 0; } static int dsi_inode_revalidate (struct dentry *inode) { return 0; } static int dsi_inode_setattr (struct dentry *dentry, struct iattr *iattr) { return 0; } static int dsi_inode_stat (struct inode *inode) { return 0; } static void dsi_post_lookup (struct inode *ino, struct dentry *d) { return; } static void dsi_delete (struct inode *ino) { return; } static int dsi_file_permission (struct file *file, int mask) { return 0; } static int dsi_file_alloc_security (struct file *file) { return 0; } static void dsi_file_free_security (struct file *file) { return; } static int dsi_file_llseek (struct file *file) { return 0; } static int dsi_file_ioctl (struct file *file, unsigned int command, unsigned long arg) { return 0; } static int dsi_file_mmap (struct file *file, unsigned long prot, unsigned long flags) { return 0; } static int dsi_file_mprotect (struct vm_area_struct *vma, unsigned long prot) { return 0; } static int dsi_file_lock (struct file *file, unsigned int cmd) { return 0; } static int dsi_file_fcntl (struct file *file, unsigned int cmd, unsigned long arg) { return 0; } static int dsi_file_set_fowner (struct file *file) { return 0; } static int dsi_file_send_sigiotask (struct task_struct *tsk, struct fown_struct *fown, int fd, int reason) { return 0; } static int dsi_file_receive (struct file *file) { return 0; } static int dsi_task_create (unsigned long clone_flags) { DSI_PRINT("dsi_task_create flags=%x\n",clone_flags); return(dsi_check_task(current, current, PROCESS_FORK)); } static int dsi_task_alloc_security (struct task_struct *p) { int rc; task_security_t *tsec1, *tsec2; DSI_PRINT("dsi_task_alloc_security : task=%x\n",(int)p); rc = internal_task_alloc_security(p); if(rc) { printk("dsi_tak_alloc_security - PROBLEM\n"); return(rc); } tsec1 = current->security; tsec2 = p->security; if((tsec1 == NULL) || (tsec2 == NULL)) { printk("dsi_task_alloc_security - NO SECURITY STRUCTURE\n"); return (-1); } tsec2->osid = tsec1->osid; tsec2->sid = tsec1->sid; return 0; } static void dsi_task_free_security (struct task_struct *p) { DSI_PRINT("dsi_task_free_security : task=%x\n",(int)p); internal_task_free_security(p); return; } static int dsi_task_setuid (uid_t id0, uid_t id1, uid_t id2, int flags) { return 0; } static int dsi_task_post_setuid (uid_t id0, uid_t id1, uid_t id2, int flags) { return 0; } static int dsi_task_setgid (gid_t id0, gid_t id1, gid_t id2, int flags) { return 0; } static int dsi_task_setpgid (struct task_struct *p, pid_t pgid) { return 0; } static int dsi_task_getpgid (struct task_struct *p) { return 0; } static int dsi_task_getsid (struct task_struct *p) { return 0; } static int dsi_task_setgroups (int gidsetsize, gid_t * grouplist) { return 0; } static int dsi_task_setnice (struct task_struct *p, int nice) { return 0; } static int dsi_task_setrlimit (unsigned int resource, struct rlimit *new_rlim) { return 0; } static int dsi_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp) { return 0; } static int dsi_task_getscheduler (struct task_struct *p) { return 0; } static int dsi_task_wait (struct task_struct *p) { return 0; } static int dsi_task_kill (struct task_struct *p, struct siginfo *info, int sig) { return 0; } static int dsi_task_prctl (int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5) { return 0; } static void dsi_task_kmod_set_label (void) { return; } int dsi_ip_options_get(struct ip_options **optp, unsigned char *data, int optlen) { struct ip_options *opt=NULL; opt = kmalloc(sizeof(struct ip_options)+((optlen+3)&~3), DSI_SAFE_ALLOC); if (!opt) return -ENOMEM; memset(opt, 0, sizeof(struct ip_options)); if (optlen) { memcpy(opt->__data, data, optlen); } while (optlen & 3) opt->__data[optlen++] = IPOPT_END; opt->optlen = optlen; opt->is_data = 1; opt->is_setbyuser = 1; *optp = opt; return 0; } /* * If not a bypass label, always include serial and ssid. The msid and * dsid tags are only included if they have been explicitly specified via * the extended socket API. */ static inline __u8 dsi_calculate_optlen() { return (NSID_BASE_LEN + NSID_SSID_LEN + NSID_NODEID_LEN); } /* * Fill optptr buffer with IP options. Note that optlen is not 32-bit * aligned here. */ static inline void dsi_options_fill(inode_security_t *isec, unsigned char *optptr, __u8 optlen) { __u8 i; optptr[0] = IPOPT_CIPSO; optptr[1] = optlen; *(__u32 *)&optptr[2] = __constant_htonl(NSID_DOI); i = NSID_BASE_LEN; optptr[i] = NSID_SSID; optptr[i+1] = NSID_SSID_LEN; if ( isec == NULL ) { *(__u32 *)&optptr[i+2] = htonl(DEFAULT_SID); /*DSI_ERROR("No SID associated with sk_buff, assigning default SID\n");*/ } else *(__u32 *)&optptr[i+2] = htonl(isec->sid); i += NSID_SSID_LEN; optptr[i] = NSID_NODEID; optptr[i+1] = NSID_NODEID_LEN; *(__u32 *)&optptr[i+2] = htonl(dsi_node_id); i += NSID_NODEID_LEN; /* out_tag: */ optptr[6] = NSID_FREEFORM; optptr[7] = i - NSID_BASE_LEN + 2; return; } static inline int dsi_parse_u32_param( __u8 paramtype, __u8 optlen, int i, const char *optptr, unsigned char **pp_ptr, __u32 *param) { __u8 paramlen; if ( (paramtype != NSID_SSID) && (paramtype != NSID_NODEID) ) { printk("Wrong paramtype\n"); *pp_ptr = (char *)(optptr + i); return -EINVAL; } paramlen = optptr[i + 1]; if (paramlen != NSID_U32_LEN || paramlen > optlen - i) { printk("Wrong paramlen\n"); *pp_ptr = (char*)(optptr + i + 1); return -EINVAL; } *param = ntohl(*(__u32 *)(optptr + i + 2)); return paramlen; } /* * Decode IP options on incoming packets into labels. * * Note: we're guaranteed to have a minimum of 2 bytes at optptr, with * optptr[1] being a valid length of data to access. */ static inline int dsi_ip_decode_options(struct sk_buff *skb, const char *optptr, unsigned char **pp_ptr) { __u8 opttype = optptr[0]; __u8 optlen = optptr[1]; __u8 i, tagtype, taglen; __u32 doi; struct iphdr *iph; sk_buff_security_t *ssec; __u32 rsid = 0; /* Remote SID */ __u32 nodeid = 0; /* Remote node ID */ if (!skb) { printk("dsi_ip_deocde_options No skb\n"); return 0; } iph = skb->nh.iph; ssec = skb->lsm_security; if(!ssec) { printk("dsi_ip_decode_options security bufffer is NULL\n"); } /* This is the only type of security option which we accept */ if (opttype != IPOPT_CIPSO) { printk("Not CIPSO option\n"); *pp_ptr = (char*)optptr; return -EPERM; } if (optlen < NSID_MIN_LEN) { printk("Bad length\n"); *pp_ptr = (char*)optptr; return -EINVAL; } doi = *(__u32 *)&optptr[2]; if (doi != __constant_htonl(NSID_DOI)) { printk("Bad DOI\n"); *pp_ptr = (char*)(optptr + 3); return -EINVAL; } tagtype = optptr[6]; if (tagtype != NSID_FREEFORM) { printk("Not freeform tag\n"); *pp_ptr = (char*)(optptr + 7); return -EINVAL; } taglen = optptr[7]; if (taglen != (optlen - 6)) { printk("Bad internal freeform length\n"); *pp_ptr = (char*)(optptr + 8); return -EINVAL; } for (i = NSID_BASE_LEN; i < optlen; ) { __u8 paramtype = optptr[i]; int rc = 0; switch (paramtype) { case NSID_SSID: rc = dsi_parse_u32_param(paramtype, optlen, i, optptr, pp_ptr, &rsid); break; case NSID_NODEID: rc = dsi_parse_u32_param(paramtype, optlen, i, optptr, pp_ptr, &nodeid); break; default: *pp_ptr = (char *)(optptr + i + 1); return -EINVAL; } if (rc < 0) { printk("dsi : Bad options\n"); return rc; } i += rc; } if (i != optlen) { printk("Invalid option size\n"); *pp_ptr = (char*)(optptr + 2); return -EINVAL; } if (!skb && !capable(CAP_NET_RAW)) { printk("Invalid capabilities\n"); *pp_ptr = (char*)optptr; return -EPERM; } /* DSI: Now perform SID and Node ID mapping to a single NSID (Network SID) */ if(ssec) ssec->sid = rsid + 16 * nodeid; /* This is a bogus function for now */ else printk("lsm_security is NULL\n"); return 0; } /* * This is critical for TCP to operate with our CIPSO options. The effective * MSS is the maximum size of segments which are transmitted, and it must * take the size of the options into account */ static inline void dsi_adjust_effective_mss(struct sock *sk) { struct tcp_opt *tp = &sk->tp_pinfo.af_tcp; if (tp->ext_header_len < NSID_ALIGN(NSID_MAX_TCP_LEN)) { tp->ext_header_len = NSID_ALIGN(NSID_MAX_TCP_LEN); tcp_sync_mss(sk, tp->pmtu_cookie); } return; } static unsigned int dsi_ip_preroute_first (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_preroute_last (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_input_first (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_input_last (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_forward_first (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_forward_last (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_output_first (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_output_last (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_postroute_first (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static unsigned int dsi_ip_postroute_last (unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn) (struct sk_buff *)) { return NF_ACCEPT; } static void dsi_ip_fragment (struct sk_buff *newskb, const struct sk_buff *oldskb) { return; } static int dsi_ip_defragment (struct sk_buff *skb) { return NF_ACCEPT; } static void dsi_ip_decapsulate (struct sk_buff *skb) { return; } static void dsi_ip_encapsulate (struct sk_buff *skb) { return; } static void dsi_netdev_unregister (struct net_device *dev) { return; } static int dsi_socket_create (int family, int type, int protocol) { task_security_t *tsec; int rc=0; tsec = current->security; if(tsec) rc = dsi_check_permission(tsec->sid, tsec->sid, DSI_CLASS_SOCKET, SOCKET_CREATE); else rc = 0;/*-ENOSYS;*/ if(rc) { printk("Can't create a socket\n"); dsi_alarm |= ALARM_SOCKET_CREATE; } return(rc); } static void dsi_socket_post_create (struct socket *sock, int family, int type, int protocol) { inode_security_t *isec = NULL; task_security_t *tsec = NULL; /* set the security id to inode related to socket */ DSI_PRINT("dsi_socket_post_create(%x) inode = %x\n",(int)sock,(int)sock->inode); if(sock->inode) isec = sock->inode->i_security; if(!isec){ internal_inode_alloc_security(sock->inode); isec = sock->inode->i_security; } if(isec) { isec->sid = DSI_SID_NORMAL; tsec = current->security; if(tsec) { isec->task_sid = tsec->sid; isec->sid = tsec->sid; } isec->class = DSI_CLASS_SOCKET; isec->magic = DSI_MAGIC; } return; } static int dsi_socket_bind (struct socket *sock, struct sockaddr *address, int addrlen) { return 0; } static int dsi_socket_connect (struct socket *sock, struct sockaddr *address, int addrlen) { task_security_t *tsec; inode_security_t *isec; int rc=0; tsec = current->security; if (sock->inode) { isec = sock->inode->i_security; if(isec->class == 0) { isec = 0; } } else isec = 0; if (tsec && isec) { rc = dsi_check_permission(tsec->sid, isec->sid, isec->class, SOCKET_CONNECT); } else { rc = 0; /*-ENOSYS*/; } if (rc) { dsi_alarm = ALARM_SOCKET_CONNENT; DSI_ERROR("dsi_socket_connect - No Permission\n"); } return rc; } static int dsi_socket_listen (struct socket *sock, int backlog) { return 0; } static int dsi_socket_accept (struct socket *sock, struct socket *newsock) { inode_security_t *isec = NULL; inode_security_t *isecnew = NULL; /* set the security id to inode related to socket */ DSI_PRINT("dsi_socket_post_create\n"); if(newsock->inode) isecnew = newsock->inode->i_security; if(!isecnew){ internal_inode_alloc_security(newsock->inode); isecnew = newsock->inode->i_security; } if(isecnew) { isecnew->sid = DSI_SID_NORMAL; isec = sock->inode->i_security; if(isec) { isecnew->task_sid = isec->task_sid; isecnew->sid = isec->sid; } isecnew->class = DSI_CLASS_SOCKET; isecnew->magic = DSI_MAGIC; } return 0; } static int dsi_socket_sendmsg (struct socket *sock, struct msghdr *msg, int size) { task_security_t *tsec; inode_security_t *isec; int rc=0; __u8 optlen; struct sock *sk; struct ip_options * opt = NULL; unsigned char optptr[optlen = dsi_calculate_optlen()]; tsec = current->security; if(sock->inode){ isec = sock->inode->i_security; if(isec && ( (isec->magic != DSI_MAGIC) || (isec->class == 0) )) { isec = 0; } } else isec = 0; if (tsec && isec) { rc = dsi_check_permission(tsec->sid, isec->sid, isec->class, SOCKET_SEND); } else { rc = 0;//-ENOSYS; } if (rc) { dsi_alarm = ALARM_SOCKET_SEND; DSI_ERROR("dsi_socket_sendmsg(%x) - No Permission\n",(int)sock); if (isec) printk("ssid=%d,tsid=%d,class=%d,magic=%x\n",tsec->sid,isec->sid, isec->class,(int)isec->magic); } else { /* No error so add the security information to the outgoing packet*/ sk = sock->sk; /* add option only for the ip (AF_INET) family and none local message */ if ((sk->family == AF_INET) && (RTN_LOCAL != inet_addr_type(sk->daddr)) ) { opt = sk->protinfo.af_inet.opt; if (!opt || (*opt->__data != IPOPT_CIPSO) ) { opt = NULL; dsi_options_fill(isec, optptr, optlen); dsi_ip_options_get(&opt,optptr,optlen); opt = xchg(&sk->protinfo.af_inet.opt, opt); if (opt) { kfree(opt); } } } } return rc; } static int dsi_socket_recvmsg (struct socket *sock, struct msghdr *msg, int size, int flags) { return 0; } static int dsi_socket_getsockname (struct socket *sock) { return 0; } static int dsi_socket_getpeername (struct socket *sock) { return 0; } static int dsi_socket_setsockopt (struct socket *sock, int level, int optname) { return 0; } static int dsi_socket_getsockopt (struct socket *sock, int level, int optname) { return 0; } static int dsi_socket_shutdown (struct socket *sock, int how) { return 0; } static int dsi_sock_rcv_skb (struct sock *sk, struct sk_buff *skb) { inode_security_t *isec; sk_buff_security_t *ssec; int sid,nid; int rc; if((sk == NULL) || (skb == NULL)) { printk("dsi_sock_rcv_skb sk=%x,skb=%x\n",(int)sk,(int)skb); return(0); } if (TCP_TIME_WAIT == sk->state) { /* the sk point to a tcp_tw_bucket that doesn't contain sk->socket */ return 0; } isec = 0; if (sk->socket) { if (sk->socket->inode) { isec = sk->socket->inode->i_security; } } if (!isec) { printk("dsi_socket_rcv_skb - security is not ATTACHED\n"); } else { sid = isec->sid; } ssec = skb->lsm_security; nid = 0; if(!ssec) { printk("dsi_sock_rcv_skb is NULL\n"); } else { nid = ssec->sid; } if (isec && ssec) { rc = dsi_check_permission(isec->sid, ssec->sid, DSI_CLASS_NETWORK, NETWORK_RECEIVE); } else { rc = 0;//-ENOSYS; } if (rc) { dsi_alarm = ALARM_NETWORK_RECEIVE; DSI_ERROR("dsi_sock_rcv_skb(%x) - No Permission\n",(int)sk); } return(rc); } static int dsi_socket_unix_stream_connect (struct socket *sock, struct socket *other) { return 0; } static int dsi_socket_unix_may_send (struct socket *sock, struct socket *other) { return 0; } static int dsi_module_create_module (const char *name_user, size_t size) { return 0; } static int dsi_module_init_module (struct module *mod_user) { /*DSI_PRINT("dsi_module_init\n");*/ return 0; } static int dsi_module_delete_module (const struct module *mod) { /*DSI_PRINT("dsi_module_delete\n");*/ return 0; } static int dsi_ipc_permission (struct kern_ipc_perm *ipcp, short flag) { return 0; } static int dsi_ipc_getinfo (int id, int cmd) { return 0; } static int dsi_msg_msg_alloc_security (struct msg_msg *msg) { return 0; } static void dsi_msg_msg_free_security (struct msg_msg *msg) { return; } static int dsi_msg_queue_alloc_security (struct msg_queue *msq) { return 0; } static void dsi_msg_queue_free_security (struct msg_queue *msq) { return; } static int dsi_msg_queue_associate (struct msg_queue *msq, int msqid, int msqflg) { return 0; } static int dsi_msg_queue_msgctl (struct msg_queue *msq, int msqid, int cmd) { return 0; } static int dsi_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg, int msqid, int msgflg) { return 0; } static int dsi_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg, struct task_struct *target, long type, int mode) { return 0; } static int dsi_shm_alloc_security (struct shmid_kernel *shp) { return 0; } static void dsi_shm_free_security (struct shmid_kernel *shp) { return; } static int dsi_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg) { return 0; } static int dsi_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd) { return 0; } static int dsi_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr, int shmflg) { return 0; } static int dsi_sem_alloc_security (struct sem_array *sma) { return 0; } static void dsi_sem_free_security (struct sem_array *sma) { return; } static int dsi_sem_associate (struct sem_array *sma, int semid, int semflg) { return 0; } static int dsi_sem_semctl (struct sem_array *sma, int semid, int cmd) { return 0; } static int dsi_sem_semop (struct sem_array *sma, int semid, struct sembuf *sops, unsigned nsops, int alter) { return 0; } static int dsi_skb_alloc_security (struct sk_buff *skb) { int rc; rc = internal_sk_buff_alloc_security(skb); return rc; } static int dsi_skb_clone (struct sk_buff *newskb, const struct sk_buff *oldskb) { return 0; } static void dsi_skb_copy (struct sk_buff *newskb, const struct sk_buff *oldskb) { return; } static void dsi_skb_set_owner_w (struct sk_buff *skb, struct sock *sk) { sk_buff_security_t *ssec; inode_security_t *isec; if (!sk->socket) { DSI_PRINT("dsi_skb_set_owner_w NO SOCKET\n"); return; } if (!sk->socket->inode) { DSI_PRINT("dsi_skb_set_owner_w NO INODE\n"); return; } isec = sk->socket->inode->i_security; ssec = skb->lsm_security; if (!isec) { internal_inode_alloc_security(sk->socket->inode); isec = sk->socket->inode->i_security; } if (!ssec) { internal_sk_buff_alloc_security(skb); ssec = skb->lsm_security; } if ((ssec == 0) || (isec == 0)) { DSI_PRINT("dsi_skb_set_owner ssec=%x,isec=%x\n",(int)ssec,(int)isec); return; } ssec->sid = isec->sid; return; } static void dsi_skb_free_security (struct sk_buff *skb) { internal_sk_buff_free_security(skb); return; } static int dsi_register (const char *name, struct security_operations *ops) { return -EINVAL; } static int dsi_unregister (const char *name, struct security_operations *ops) { return -EINVAL; } static struct binprm_security_ops dsi_binprm_ops = { alloc_security: dsi_binprm_alloc_security, free_security: dsi_binprm_free_security, compute_creds: dsi_binprm_compute_creds, set_security: dsi_binprm_set_security, }; static struct super_block_security_ops dsi_sb_ops = { alloc_security: dsi_sb_alloc_security, free_security: dsi_sb_free_security, statfs: dsi_sb_statfs, mount: dsi_mount, check_sb: dsi_check_sb, umount: dsi_umount, umount_close: dsi_umount_close, umount_busy: dsi_umount_busy, post_remount: dsi_post_remount, post_mountroot: dsi_post_mountroot, post_addmount: dsi_post_addmount, }; static struct inode_security_ops dsi_inode_ops = { alloc_security: dsi_inode_alloc_security, free_security: dsi_inode_free_security, create: dsi_inode_create, post_create: dsi_inode_post_create, link: dsi_inode_link, post_link: dsi_inode_post_link, unlink: dsi_inode_unlink, symlink: dsi_inode_symlink, post_symlink: dsi_inode_post_symlink, mkdir: dsi_inode_mkdir, post_mkdir: dsi_inode_post_mkdir, rmdir: dsi_inode_rmdir, mknod: dsi_inode_mknod, post_mknod: dsi_inode_post_mknod, rename: dsi_inode_rename, post_rename: dsi_inode_post_rename, readlink: dsi_inode_readlink, follow_link: dsi_inode_follow_link, permission: dsi_inode_permission, revalidate: dsi_inode_revalidate, setattr: dsi_inode_setattr, stat: dsi_inode_stat, post_lookup: dsi_post_lookup, delete: dsi_delete, }; static struct file_security_ops dsi_file_ops = { permission: dsi_file_permission, alloc_security: dsi_file_alloc_security, free_security: dsi_file_free_security, llseek: dsi_file_llseek, ioctl: dsi_file_ioctl, mmap: dsi_file_mmap, mprotect: dsi_file_mprotect, lock: dsi_file_lock, fcntl: dsi_file_fcntl, set_fowner: dsi_file_set_fowner, send_sigiotask: dsi_file_send_sigiotask, receive: dsi_file_receive, }; static struct task_security_ops dsi_task_ops = { create: dsi_task_create, alloc_security: dsi_task_alloc_security, free_security: dsi_task_free_security, setuid: dsi_task_setuid, post_setuid: dsi_task_post_setuid, setgid: dsi_task_setgid, setpgid: dsi_task_setpgid, getpgid: dsi_task_getpgid, getsid: dsi_task_getsid, setgroups: dsi_task_setgroups, setnice: dsi_task_setnice, setrlimit: dsi_task_setrlimit, setscheduler: dsi_task_setscheduler, getscheduler: dsi_task_getscheduler, wait: dsi_task_wait, kill: dsi_task_kill, prctl: dsi_task_prctl, kmod_set_label: dsi_task_kmod_set_label, }; static struct socket_security_ops dsi_socket_ops = { create: dsi_socket_create, post_create: dsi_socket_post_create, bind: dsi_socket_bind, connect: dsi_socket_connect, listen: dsi_socket_listen, accept: dsi_socket_accept, sendmsg: dsi_socket_sendmsg, recvmsg: dsi_socket_recvmsg, getsockname: dsi_socket_getsockname, getpeername: dsi_socket_getpeername, getsockopt: dsi_socket_getsockopt, setsockopt: dsi_socket_setsockopt, shutdown: dsi_socket_shutdown, sock_rcv_skb: dsi_sock_rcv_skb, unix_stream_connect: dsi_socket_unix_stream_connect, unix_may_send: dsi_socket_unix_may_send, }; static struct skb_security_ops dsi_skb_ops = { alloc_security: dsi_skb_alloc_security, clone: dsi_skb_clone, copy: dsi_skb_copy, set_owner_w: dsi_skb_set_owner_w, free_security: dsi_skb_free_security, }; static struct ip_security_ops dsi_ip_ops = { preroute_first: dsi_ip_preroute_first, preroute_last: dsi_ip_preroute_last, input_first: dsi_ip_input_first, input_last: dsi_ip_input_last, forward_first: dsi_ip_forward_first, forward_last: dsi_ip_forward_last, output_first: dsi_ip_output_first, output_last: dsi_ip_output_last, postroute_first: dsi_ip_postroute_first, postroute_last: dsi_ip_postroute_last, fragment: dsi_ip_fragment, defragment: dsi_ip_defragment, encapsulate: dsi_ip_encapsulate, decapsulate: dsi_ip_decapsulate, decode_options: dsi_ip_decode_options, }; static struct netdev_security_ops dsi_netdev_ops = { unregister: dsi_netdev_unregister, }; static struct module_security_ops dsi_module_ops = { create_module: dsi_module_create_module, init_module: dsi_module_init_module, delete_module: dsi_module_delete_module, }; static struct ipc_security_ops dsi_ipc_ops = { permission: dsi_ipc_permission, getinfo: dsi_ipc_getinfo, }; static struct msg_msg_security_ops dsi_msg_msg_ops = { alloc_security: dsi_msg_msg_alloc_security, free_security: dsi_msg_msg_free_security, }; static struct msg_queue_security_ops dsi_msg_queue_ops = { alloc_security: dsi_msg_queue_alloc_security, free_security: dsi_msg_queue_free_security, associate: dsi_msg_queue_associate, msgctl: dsi_msg_queue_msgctl, msgsnd: dsi_msg_queue_msgsnd, msgrcv: dsi_msg_queue_msgrcv, }; static struct shm_security_ops dsi_shm_ops = { alloc_security: dsi_shm_alloc_security, free_security: dsi_shm_free_security, associate: dsi_shm_associate, shmctl: dsi_shm_shmctl, shmat: dsi_shm_shmat, }; static struct sem_security_ops dsi_sem_ops = { alloc_security: dsi_sem_alloc_security, free_security: dsi_sem_free_security, associate: dsi_sem_associate, semctl: dsi_sem_semctl, semop: dsi_sem_semop, }; struct security_operations dsi_security_ops = { sethostname: dsi_sethostname, setdomainname: dsi_setdomainname, reboot: dsi_reboot, ioperm: dsi_ioperm, iopl: dsi_iopl, ptrace: dsi_ptrace, capget: dsi_capget, capset_check: dsi_capset_check, capset_set: dsi_capset_set, acct: dsi_acct, capable: dsi_capable, sysctl: dsi_sysctl, sys_security: dsi_sys_security, swapon: dsi_swapon, swapoff: dsi_swapoff, nfsservctl: dsi_nfsservctl, quotactl: dsi_quotactl, quota_on: dsi_quota_on, bdflush: dsi_bdflush, syslog: dsi_syslog, netlink_send: dsi_netlink_send, netlink_recv: dsi_netlink_recv, bprm_ops: &dsi_binprm_ops, sb_ops: &dsi_sb_ops, inode_ops: &dsi_inode_ops, file_ops: &dsi_file_ops, task_ops: &dsi_task_ops, socket_ops: &dsi_socket_ops, skb_ops: &dsi_skb_ops, ip_ops: &dsi_ip_ops, ipc_ops: &dsi_ipc_ops, netdev_ops: &dsi_netdev_ops, module_ops: &dsi_module_ops, msg_msg_ops: &dsi_msg_msg_ops, msg_queue_ops: &dsi_msg_queue_ops, shm_ops: &dsi_shm_ops, sem_ops: &dsi_sem_ops, register_security: dsi_register, unregister_security: dsi_unregister, }; LinuxJournal/dsi/lsm/dsi.h0100644000000000000000000000672107511210413014511 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi.h * * The main header file for DSM * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #ifndef __DSI_H #define __DSI_H #ifdef MODULE /* This prevents user programs that include dsi.h to inherit kernel stuff */ #include #include #endif #define DSI_MODULE_NAME "DSI-LSM MODULE" /* Security syhstem calls */ #define DSI_SET_NODE_ID 1 #define DSI_SET_TASK_SECURITY 2 #define DSI_SET_POLICY 3 #define DSI_ALARM_CHECK 4 #define DSI_SET_IMAGE_SID 5 #define DSI_SET_PSIDS 5 #define DSI_SID_LOW 1 #define DSI_SID_NORMAL 2 #define DSI_SID_HIGH 3 /* for now we define only 3 classes */ #define DSI_CLASS_PROCESS 1 #define DSI_CLASS_SOCKET 2 #define DSI_CLASS_NETWORK 3 /* permission bits for process class */ #define PROCESS_FORK 0x00000001 /* permission bits for socket class */ #define SOCKET_CREATE 0x00000001 #define SOCKET_CONNECT 0x00000002 #define SOCKET_SEND 0x00000004 /* permission bits for network */ #define NETWORK_RECEIVE 0x00000001 /* allarms types */ #define ALARM_PROCESS_CREATE 0x00000001 #define ALARM_SOCKET_CREATE 0x00000002 #define ALARM_SOCKET_CONNENT 0x00000004 #define ALARM_SOCKET_SEND 0x00000008 #define ALARM_NETWORK_RECEIVE 0x00000010 #define DSI_MAGIC 0x7754ffa5 #ifdef MODULE /* This prevents user programs that include dsi.h to inherit kernel stuff */ /*#define DSI_DEBUG*/ #ifdef DSI_DEBUG #define DSI_PRINT(fmt, arg...) printk(DSI_MODULE_NAME" - " fmt,##arg); #else #define DSI_PRINT(fmt, arg...) #endif #define DSI_WARNING(fmt, arg...) printk(DSI_MODULE_NAME"-WARNING-" fmt,##arg); #define DSI_ERROR(fmt, arg...) printk(DSI_MODULE_NAME"-ERROR-" fmt,##arg); #define DSI_SAFE_ALLOC (in_interrupt () ? GFP_ATOMIC : GFP_KERNEL) #define DSI_ELF_SID_POS 7 typedef struct { int sid; int osid; int magic; void *task; } task_security_t; typedef struct /*inode_security_struct*/ { unsigned long magic; /* magic number for this module */ struct inode *inode; /* back pointer to inode object */ int task_sid; /* SID of creating task */ int sid; /* SID of this object */ int class; /* security class of this object */ } inode_security_t; typedef struct { unsigned long magic; /* magic number for this module */ struct sk_buff *skb; /* back pointer */ atomic_t use; /* reference count */ int sid; /* Source SID */ } sk_buff_security_t; int dsi_label_tasks(); int internal_task_alloc_security(struct task_struct *p); void internal_task_free_security(struct task_struct *p); int dsi_check_task( struct task_struct *tsk1, struct task_struct *tsk2, int permission); int internal_inode_alloc_security (struct inode *inode); void internal_inode_free_security (struct inode *inode); int internal_sk_buff_alloc_security (struct sk_buff *skb); void internal_sk_buff_free_security (struct sk_buff *skb); #include "dsi_cache.h" #endif /* MODULE */ #endif LinuxJournal/dsi/lsm/dsi_cache.c0100644000000000000000000001765207511206220015635 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_cache.c * * This file contains the DSM cache implementation * * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include "dsi_cache.h" #include "dsi.h" static dsi_cache_t dsi_cache; static dsi_cache_node_t *dsi_free_node_list = NULL; /* * Initialize the cache. */ int dsi_cache_init(void) { dsi_cache_node_t *new; int i; int err = 0; for (i = 0; i < DSI_CACHE_SLOTS; i++) dsi_cache.slots[i] = 0; dsi_cache.nhit = 0; dsi_cache.activeNodes = 0; for (i = 0; i < DSI_CACHE_MAX_NODES; i++) { new = (dsi_cache_node_t *) kmalloc(sizeof(dsi_cache_node_t), GFP_KERNEL); if (!new) { DSI_ERROR("avc: only able to allocate %d entries\n", i); err = -ENOMEM; break; } memset(new, 0, sizeof(dsi_cache_node_t)); new->next = dsi_free_node_list; dsi_free_node_list = new; } if (!err) { printk("DSI: allocated %d bytes during initialization.\n", i * sizeof(dsi_cache_node_t)); } return err; } /* * Free the cache */ void dsi_cache_free(void) { dsi_cache_node_t *cur, *tmp; int i, activeNode=0; /* free node list */ while(dsi_free_node_list) { cur = dsi_free_node_list; dsi_free_node_list = dsi_free_node_list->next; kfree(cur); } for (i = 0; i < DSI_CACHE_SLOTS; i++) { cur = dsi_cache.slots[i]; while(cur) { tmp = cur; cur = cur->next; kfree(tmp); activeNode++; } dsi_cache.slots[i] = 0; } if (dsi_cache.activeNodes != activeNode) { DSI_WARNING("Active node count(%d) different from predicted(%d)\n", activeNode,dsi_cache.activeNodes ); } } /* * Get a new node from the list * and load SIDs pair, class and permission. */ inline dsi_cache_node_t *dsi_load_node(int ssid, int tsid, int tclass, unsigned int permission) { dsi_cache_node_t *new; int hvalue; new = NULL; hvalue = DSI_HASH(ssid, tsid, tclass); if (dsi_free_node_list) { new = dsi_free_node_list; dsi_free_node_list = dsi_free_node_list->next; dsi_cache.activeNodes++; } else { DSI_ERROR("No free elements to the free list\n"); } if(!new) return(NULL); new->node.ssid = ssid; new->node.tsid = tsid; new->node.class = tclass; new->node.permission = permission; new->next = dsi_cache.slots[hvalue]; dsi_cache.slots[hvalue] = new; DSI_PRINT("dsi_load_node node = %x\n",(int)new); return new; } #define DSI_HARDCODED_POLICY /* * This function is use to load the hardcoded policy * and is used to populate the cache if the external policy * is not available. * We use it for testing * */ int dsi_load_policy() { int err=0; #ifdef DSI_HARDCODED_POLICY DSI_PRINT("dsi_load_policy\n"); /* process class */ dsi_load_node(DSI_SID_LOW,DSI_SID_LOW,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_NORMAL,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_HIGH,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_LOW,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_NORMAL,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_HIGH,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_LOW,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_NORMAL,DSI_CLASS_PROCESS,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_HIGH,DSI_CLASS_PROCESS,0xffffffff); /* socket class */ dsi_load_node(DSI_SID_LOW,DSI_SID_LOW,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_NORMAL,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_HIGH,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_LOW,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_NORMAL,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_HIGH,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_LOW,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_NORMAL,DSI_CLASS_SOCKET,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_HIGH,DSI_CLASS_SOCKET,0xffffffff); /* network class */ dsi_load_node(DSI_SID_LOW,DSI_SID_LOW,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_NORMAL,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_LOW,DSI_SID_HIGH,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_LOW,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_NORMAL,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_NORMAL,DSI_SID_HIGH,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_LOW,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_NORMAL,DSI_CLASS_NETWORK,0xffffffff); dsi_load_node(DSI_SID_HIGH,DSI_SID_HIGH,DSI_CLASS_NETWORK,0xffffffff); #endif return err; } /* * Search for a node that has the specified * SID pair and class. */ inline dsi_cache_node_t *dsi_search_node( int ssid, int tsid, int tclass) { dsi_cache_node_t *cur; int hvalue; int tprobes = 1; hvalue = DSI_HASH(ssid, tsid, tclass); cur = dsi_cache.slots[hvalue]; while (cur != NULL && (ssid != cur->node.ssid || tclass != cur->node.class || tsid != cur->node.tsid)) { tprobes++; cur = cur->next; } if (cur == NULL) { /* cache miss */ printk("cache miss ssid=%x, tsid=%x, class=%x,hvalue=%x\n",ssid,tsid,tclass,hvalue); return NULL; } /* cache hit */ return cur; } /* * Look up an AVC entry that is valid for the * `requested' permissions between the SID pair * (`ssid', `tsid'), interpreting the permissions * based on `tclass'. If a valid AVC entry exists, * then this function updates `aeref' to refer to the * entry and returns 0. Otherwise, this function * returns -ENOENT. */ int dsi_check_permission( int ssid, /* IN */ int tsid, /* IN */ int tclass, /* IN */ int requested) { int rc = 0;//-ENOENT; dsi_cache_node_t *node; node = dsi_search_node(ssid, tsid, tclass); if (node) { if (node->node.permission & requested ) { return 0; } else { rc = -ENOENT; } } if (rc) { printk("NO permission node =%x,requested=%x\n",(int)node,requested); if(node) { printk("node permission=%x\n",node->node.permission); printk("node ssid=%x\n",node->node.ssid); printk("node tsid=%x\n",node->node.tsid); printk("node class=%x\n",node->node.class); } } return rc; } dsi_cache_node_t *dsi_cache_update(int ssid, int tsid, int tclass, unsigned int permission) { dsi_cache_node_t *node; node = dsi_search_node(ssid, tsid, tclass); if(node) { node->node.ssid = ssid; node->node.tsid = tsid; node->node.class = tclass; node->node.permission = permission; } else{ node = dsi_load_node( ssid, tsid, tclass, permission); } return (node); } LinuxJournal/dsi/lsm/dsi_cache.h0100644000000000000000000000361007511210464015634 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_cache.h * * This file contains the header file cache functions * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * */ #ifndef __DSI_CACHE_H #define __DSI_CACHE_H typedef struct dsi_cache_entry { int ssid; int tsid; int class; unsigned int permission; } dsi_cache_entry_t; typedef struct dsi_cache_node { dsi_cache_entry_t node; struct dsi_cache_node *next; } dsi_cache_node_t; #define DSI_CACHE_SLOTS 512 #define DSI_CACHE_MAX_NODES 410 typedef struct { dsi_cache_node_t *slots[DSI_CACHE_SLOTS]; int nhit; int activeNodes; } dsi_cache_t; #define DSI_HASH(ssid,tsid,class) \ ((ssid ^ (tsid<<2) ^ (class<<4)) & (DSI_CACHE_SLOTS - 1)) /* functions prototypes */ int dsi_cache_init(void); void dsi_cache_free(void); dsi_cache_node_t *dsi_load_node(int ssid, int tsid, int tclass, unsigned int permission); inline dsi_cache_node_t *dsi_search_node( int ssid, int tsid, int tclass); int dsi_check_permission( int ssid, /* IN */ int tsid, /* IN */ int tclass, /* IN */ int requested); int dsi_load_policy(); typedef struct dsi_cache_task { int sid; struct dsi_cache_task *next; char name[1]; } dsi_cache_task_t; typedef struct dsi_cache_nid { int nodeId; int ssid; int netId; } dsi_cache_nid_t; dsi_cache_node_t *dsi_cache_update(int ssid, int tsid, int tclass, unsigned int permission); int dsi_cache_nid_load(int nodeId, int ssid, int netId); #endif LinuxJournal/dsi/lsm/dsi_inode.c0100644000000000000000000000477707511206572015706 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_inode.c * * This file contains the DSM inode security implementation * * * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include "dsi.h" /* * Allocation security memory for inode * */ inline void *get_inode_memory(struct inode *inode) { void *ret; ret = kmalloc(sizeof(inode_security_t),DSI_SAFE_ALLOC); return(ret); } /* * Free inode security memory * */ inline void free_inode_memory(inode_security_t *tsec) { kfree(tsec); } int internal_inode_alloc_security (struct inode *inode) { task_security_t *tsec = current->security; inode_security_t *isec; int rc = 0; DSI_PRINT("internal_iknode_alloc_security inode=%x\n",(int)inode); isec = inode->i_security; if (isec && tsec->magic == DSI_MAGIC) goto out; isec = (inode_security_t *)get_inode_memory(inode); if (!isec) { rc = -ENOMEM; goto out; } memset(isec, 0, sizeof(inode_security_t)); isec->magic = DSI_MAGIC; isec->inode = inode; isec->sid = DSI_SID_NORMAL; if(tsec) isec->task_sid = tsec->sid; inode->i_security = isec; out: return rc; } void internal_inode_free_security (struct inode *inode) { inode_security_t *isec = inode->i_security; DSI_PRINT("dsi_inode_free_security inode=%x\n",(int)inode); if (!isec || isec->magic != DSI_MAGIC) return; inode->i_security = NULL; free_inode_memory(isec); return; } int dsi_check_inode( struct task_struct *tsk1, struct task_struct *tsk2, int permission) { int rc; task_security_t *tsec1, *tsec2; tsec1 = tsk1->security; tsec2 = tsk2->security; rc = dsi_check_permission(tsec1->sid, tsec2->sid, DSI_CLASS_SOCKET, permission); DSI_PRINT("dsi_check_inode=%d\n",rc); return(rc); } LinuxJournal/dsi/lsm/dsi_ip_options.h0100644000000000000000000000551307511205515016761 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_ip_options.h * * This is the header file for IP options. * The options are used to add the security information to the IP packet * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ /* * Network SID API * * Copyright (C) 2002 Ericsson, Inc * * This file contains functions to modify IP options. * The set of function are called by hooks defined by the LSM interface. */ #ifndef _DSI_IP_OPTIONS_H_ #define _DSI_IP_OPTIONS_H_ #define DEFAULT_SID 0x12341234 /* NSID_U32_LEN */ #define SAFE_ALLOC (in_interrupt () ? GFP_ATOMIC : GFP_KERNEL) #define SELOPT_ALIGN(val) ((val + 3) & ~3) #define NSID_NODEID 6 #define NSID_NODEID_LEN NSID_U32_LEN #define NSID_DOI 0x10001000 /* Made up */ #define NSID_FREEFORM 7 /* FIPS-188, type 7 tag */ #define NSID_BASE_LEN 8 /* type+len+doi+tagtype+taglen*/ #define NSID_NULL_LEN 2 /* Length of null parameter */ #define NSID_U32_LEN 6 /* Length of 32-bit parameter */ #define NSID_BYPASS 1 /* Bypass label */ #define NSID_BYPASS_LEN NSID_NULL_LEN /* Bypass label length */ #define NSID_SERIAL 2 /* Policy serial label */ #define NSID_SERIAL_LEN NSID_U32_LEN /* Policy serial length */ #define NSID_SSID 3 /* Source SID label */ #define NSID_SSID_LEN NSID_U32_LEN /* Source SID length */ #define NSID_MSID 4 /* Message SID label */ #define NSID_MSID_LEN NSID_U32_LEN /* Message SID length */ #define NSID_DSID 5 /* Destination SID label */ #define NSID_DSID_LEN NSID_U32_LEN /* Destination SID length */ #define SCMP_PORT 40000 /* IANA unassigned */ #ifdef __KERNEL__ #define DEBUG_LABELING #define NSID_ALIGN(val) ((val + 3) & ~3) #define NSID_MIN_LEN NSID_BASE_LEN + NSID_BYPASS_LEN #define NSID_STD_LEN (NSID_BASE_LEN \ + NSID_SERIAL_LEN + NSID_SSID_LEN) #define NSID_MAX_TCP_LEN (NSID_BASE_LEN + NSID_SERIAL_LEN \ + NSID_SSID_LEN + NSID_DSID_LEN) #define ip_warn(iph, fmt, args...) \ \ do { printk(KERN_WARNING __FUNCTION__ ": " fmt, ##args); \ printk(" [%u.%u.%u.%u->%u.%u.%u.%u]\n", \ NIPQUAD(iph->saddr), NIPQUAD(iph->daddr)); \ } while (0); #ifdef DEBUG_LABELING #define SDBG(x) do { x; } while (0); #else #define SDBG(x) do { } while (0); #endif /* DEBUG_LABELING */ #endif /* __KERNEL__ */ #endif /* _DSI_IP_OPTIONS__H_ */ LinuxJournal/dsi/lsm/dsi_net.c0100644000000000000000000000413507511207017015355 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_net.c * * This file contains the DSM network implementation * * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include "dsi.h" extern int dsi_alarm; /* * allocate sk_buff security structure * */ inline void * get_sk_buff_memory(struct sk_buff *skb) { void * ret; ret = kmalloc(sizeof(sk_buff_security_t),DSI_SAFE_ALLOC); return(ret); } /* * free sk_buff security structure * */ inline void free_sk_buff_memory(sk_buff_security_t *tsec) { kfree(tsec); } int internal_sk_buff_alloc_security (struct sk_buff *skb) { sk_buff_security_t *sksec; int rc = 0; DSI_PRINT("internal_sk_buff_alloc_security task=%x\n",(int)skb); sksec = skb->lsm_security; if (sksec && sksec->magic == DSI_MAGIC) goto out; sksec = (sk_buff_security_t *)get_sk_buff_memory(skb); if (!sksec) { rc = -ENOMEM; goto out; } memset(sksec, 0, sizeof(sk_buff_security_t)); sksec->magic = DSI_MAGIC; sksec->skb = skb; sksec->sid = DSI_SID_NORMAL; skb->lsm_security = sksec; out: return rc; } void internal_sk_buff_free_security (struct sk_buff *skb) { sk_buff_security_t *ssec = skb->lsm_security; DSI_PRINT("internal_sk_buff_free_security task=%x\n",(int)skb); if (!ssec || ssec->magic != DSI_MAGIC) return; skb->lsm_security = NULL; free_sk_buff_memory(ssec); return; } LinuxJournal/dsi/lsm/dsi_task.c0100644000000000000000000000735407511210000015521 0ustar rootroot/* * Distributed Security Module (DSM) * * dsi_task.c * * This file contains the DSM task security implementation * * * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include #include "dsi.h" #define END_OF_TASK_STRUCT extern int dsi_alarm; /* * Allocate the task security structure. * We can control how the security structure is allocated * by defining or undefining END_OF_TASK_STRUCT. * If END_OF_TASK_STRUCT is defined then we don't * allocate the memory but the security structure is * alocated on top of the memory used for task_struct. * If the security structure is big, then probably, * there must be the memory allocation because the kernel * stack can overwrite the security area. * */ inline int get_task_memory(struct task_struct *p) { int ret; #ifdef END_OF_TASK_STRUCT ret = (int)p + sizeof(struct task_struct); #else ret = kmalloc(sizeof(task_security_t),DSI_SAFE_ALLOC); #endif return(ret); } inline void free_task_memory(task_security_t *tsec) { #ifndef END_OF_TASK_STRUCT kfree(tsec); #endif } int internal_task_alloc_security (struct task_struct *p) { task_security_t *tsec; int rc = 0; char elf_hdr[EI_NIDENT] = {0}; DSI_PRINT("internal_task_alloc_security task=%x\n",(int)p); tsec = p->security; if (tsec && tsec->magic == DSI_MAGIC) goto out; tsec = (task_security_t *)get_task_memory(p); if (!tsec) { rc = -ENOMEM; goto out; } memset(tsec, 0, sizeof(task_security_t)); tsec->magic = DSI_MAGIC; tsec->task = p; tsec->osid = tsec->sid = DSI_SID_NORMAL; if (p->mm && p->mm->mmap) { kernel_read(p->mm->mmap->vm_file,0,elf_hdr,EI_NIDENT); /* First of all, some simple consistency checks */ if (memcmp(elf_hdr, ELFMAG, SELFMAG) == 0) { /* Validate that we have a SID */ if (elf_hdr[DSI_ELF_SID_POS]) { tsec->sid = elf_hdr[DSI_ELF_SID_POS];/***need to modify osid ***/ DSI_PRINT("SID modified in internal alloc task %p %d\n",p,tsec->sid); } } } p->security = tsec; out: return rc; } void internal_task_free_security (struct task_struct *p) { task_security_t *tsec = p->security; DSI_PRINT("dsi_task_free_security task=%x\n",(int)p); if (!tsec || tsec->magic != DSI_MAGIC) return; p->security = NULL; free_task_memory(tsec); return; } /* * When module is loaded, we scan the task list and attach * the security structure to them. * */ int dsi_label_tasks() { struct task_struct *p; int rc=0; for_each_task(p) { rc = internal_task_alloc_security (p); if(rc) break; } if(!rc) { p = &init_task; rc = internal_task_alloc_security (p); } return(rc); } int dsi_check_task( struct task_struct *tsk1, struct task_struct *tsk2, int permission) { int rc; task_security_t *tsec1, *tsec2; tsec1 = tsk1->security; tsec2 = tsk2->security; rc = dsi_check_permission(tsec1->sid, tsec2->sid, DSI_CLASS_PROCESS, permission); if(rc) dsi_alarm |= ALARM_PROCESS_CREATE; return(rc); } LinuxJournal/dsi/lsm/load0100755000000000000000000000002407511114364014424 0ustar rootroot/sbin/insmod lsm.o LinuxJournal/dsi/lsm/startup.c0100644000000000000000000000236707511202410015427 0ustar rootroot/* * Distributed Security Module (DSM) Initialization function * * Copyright (C) 2002 Ericsson, Inc * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include "dsi.h" extern struct security_operations dsi_security_ops; int init_module() { int err=0; DSI_PRINT("Initializing DSM\n"); if ((err = dsi_label_tasks())) { DSI_ERROR("Can't attach labels to tasks\n"); return err; } if ((err = dsi_cache_init())) { DSI_PRINT("Can't initialize the cache\n"); dsi_cache_free(); return err; } if ((err = dsi_load_policy())) { DSI_PRINT("Can't load policy\n"); dsi_cache_free(); return err; } if ((err = register_security(&dsi_security_ops))) { DSI_ERROR("Wrong security parameter\n"); dsi_cache_free(); return err; } return(0); } void cleanup_module() { DSI_PRINT("Deinitializing module\n"); dsi_cache_free(); unregister_security(&dsi_security_ops); } LinuxJournal/dsi/lsm/unload0100755000000000000000000000002107511114364014764 0ustar rootroot/sbin/rmmod lsm LinuxJournal/dsi/user/0040755000000000000000000000000007511320255013747 5ustar rootrootLinuxJournal/dsi/user/tools/0040755000000000000000000000000007511320071015103 5ustar rootrootLinuxJournal/dsi/user/tools/CheckAlarm.c0100644000000000000000000001154307511115033017242 0ustar rootroot /* Set the Node ID of DSI cluster architecture */ #include #include #include #include #include #include "dsi.h" #ifdef GTK_GUI #include #endif #define MAX_MSG_CHARS 50 _syscall3(int, security, unsigned int, id, unsigned int, call, unsigned int *, args); #ifdef GTK_GUI typedef struct { GtkWidget *view; GtkTextBuffer *text; } mystruct; /* Every GTK timeout, function is called to check if any alarms are present */ gint update_client( mystruct *data ) { int ret; unsigned int id = DSI_MAGIC; unsigned int call = DSI_ALARM_CHECK; GtkTextIter iter; gchar entry_text[MAX_MSG_CHARS]; char *date; time_t calendar = time(NULL); struct tm *system_time = localtime(&calendar); date = asctime(system_time); ret = security( id, call, NULL); if ( ret > 0 ) { sprintf(entry_text, "Alarm trapped at %s", date); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); if ( ret & 0x10 ) { sprintf(entry_text, "Unable to receive on socket\n"); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); } if ( ret & 0x8 ) { sprintf(entry_text, "Unable to send data to socket\n"); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); } if ( ret & 0x4 ) { sprintf(entry_text, "Unable to connect to socket\n"); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); } if ( ret & 0x2 ) { sprintf(entry_text, "Unable to create socket\n"); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); } if ( ret & 0x1 ) { sprintf(entry_text, "Unable to fork task\n"); gtk_text_buffer_insert_at_cursor( data->text, entry_text, -1 ); } gtk_text_buffer_insert_at_cursor( data->text, "\n", -1 ); gtk_text_buffer_get_end_iter( data->text, &iter); gtk_text_view_scroll_to_iter( GTK_TEXT_VIEW( data->view ), &iter, 0, FALSE, 0, 0); } return 1; } /* GTK interface */ void gtk_gui( int argc, char *argv[] ) { static mystruct data; static GtkWidget *window, *vbox, *scrolled_window, *client_view, *button; static GtkTextBuffer *client_text = NULL; static gint timeout = 0; gtk_init (&argc, &argv); /* create a new window */ window = gtk_window_new (GTK_WINDOW_TOPLEVEL); gtk_widget_set_size_request (GTK_WIDGET (window), 300, 220); gtk_window_set_title (GTK_WINDOW (window), "Alarm monitor"); g_signal_connect (G_OBJECT (window), "destroy", G_CALLBACK (gtk_main_quit), NULL); g_signal_connect_swapped (G_OBJECT (window), "delete_event", G_CALLBACK (gtk_widget_destroy), window); /* Main text vertic layout window */ vbox = gtk_vbox_new (FALSE, 0); gtk_widget_show (vbox); gtk_container_add (GTK_CONTAINER (window), vbox); /* Client text window */ scrolled_window = gtk_scrolled_window_new (NULL, NULL); gtk_container_set_border_width (GTK_CONTAINER (scrolled_window), 10); gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (scrolled_window), GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC); client_view = gtk_text_view_new(); gtk_text_view_set_editable( GTK_TEXT_VIEW( client_view ), FALSE ); gtk_text_view_set_wrap_mode( GTK_TEXT_VIEW( client_view ), TRUE ); gtk_text_view_set_cursor_visible( GTK_TEXT_VIEW( client_view ), FALSE ); client_text = gtk_text_view_get_buffer (GTK_TEXT_VIEW (client_view)); gtk_container_add( GTK_CONTAINER(scrolled_window), client_view ); gtk_box_pack_start (GTK_BOX (vbox), scrolled_window, TRUE, TRUE, 2); gtk_widget_show (client_view); gtk_widget_show (scrolled_window); /* 'Close' button */ button = gtk_button_new_with_label ("Close"); g_signal_connect (G_OBJECT (button), "clicked", G_CALLBACK (gtk_main_quit), NULL); gtk_box_pack_start (GTK_BOX (vbox), button, FALSE, FALSE, 0); gtk_widget_show (button); /* Main loop */ data.view = client_view; data.text = client_text; timeout = gtk_timeout_add(1000, (GtkFunction)update_client, &data); gtk_widget_show (window); gtk_main(); gtk_timeout_remove( timeout ); } #endif /* GTK_GUI */ /* Main */ int main( int argc, char *argv[] ) { #ifdef GTK_GUI gtk_gui(argc, argv); #else int ret; unsigned int id = DSI_MAGIC; unsigned int call = DSI_ALARM_CHECK; char *date; time_t calendar = time(NULL); struct tm *system_time = localtime(&calendar); while (1) { ret = security( id, call, NULL); if ( ret > 0 ) { calendar = time(NULL); system_time = localtime(&calendar); date = asctime(system_time); printf("Alarm trapped at %s", date); if ( ret & 0x10 ) printf("Unable to receive on socket\n"); if ( ret & 0x8 ) printf("Unable to send data to socket\n"); if ( ret & 0x4 ) printf("Unable to connect to socket\n"); if ( ret & 0x2 ) printf("Unable to create socket\n"); if ( ret & 0x1 ) printf("Unable to fork task\n"); printf("\n"); } sleep(1); } #endif /* GTK_GUI */ return 0; } LinuxJournal/dsi/user/tools/Makefile0100644000000000000000000000074407511115033016545 0ustar rootrootCC=gcc LINUX=/usr/src/linux MODCFLAGS := -Wall -I$(LINUX)/include -I../lsm #GTKFLAGS := `pkg-config --cflags --libs gtk+-2.0` -DGTK_GUI GTKFLAGS := all: SetNodeID UpdatePolicy CheckAlarm SetNodeID: SetNodeID.c $(CC) $(MODCFLAGS) -o SetNodeID SetNodeID.c UpdatePolicy: UpdatePolicy.c $(CC) $(MODCFLAGS) -o UpdatePolicy UpdatePolicy.c CheckAlarm: CheckAlarm.c $(CC) $(MODCFLAGS) $(GTKFLAGS) -o CheckAlarm CheckAlarm.c clean: rm -f *.o SetNodeID UpdatePolicy CheckAlarm core LinuxJournal/dsi/user/tools/SetNodeID.c0100644000000000000000000000110307511115033017015 0ustar rootroot/* Set the Node ID of DSI cluster architecture */ #include #include #include #include "dsi.h" _syscall3(int, security, unsigned int, id, unsigned int, call, unsigned int *, args); int main(int argc, char **argv) { int ret; unsigned int id = DSI_MAGIC; unsigned int call = DSI_SET_NODE_ID; int snid; unsigned int args[2]; if ( argc != 2 ) { printf("Usage: SetNodeID snid\n"); return 2; } snid = atoi(argv[1]); args[0] = snid; ret = security( id, call, (unsigned int *)args); printf("ret=%d\n",ret); return 0; } LinuxJournal/dsi/user/tools/UpdatePolicy.c0100644000000000000000000000204507511115033017647 0ustar rootroot#include #include #include #include "dsi.h" _syscall3(int, security, unsigned int, id, unsigned int, call, unsigned int *, args); int main(int argc, char **argv) { int ret; unsigned int id = DSI_MAGIC; unsigned int call = DSI_SET_POLICY; unsigned int args[4] ; unsigned int rc = 1; int ssid, tsid, tclass, permission; FILE *policy = fopen(argv[1], "r"); if ( argc != 2 ) { printf("Usage: UpdatePolicy policy_filename\n"); return 2; } if ( policy == NULL ) { printf("Error opening file %s\n", argv[1]); return 1; } rc = fscanf(policy, "%d %d %d %x", &ssid, &tsid, &tclass, &permission); while ( (rc != 0) && (rc != EOF) ) { args[0] = ssid; args[1] = tsid; args[2] = tclass; args[3] = permission; printf("%d %d %d %x\n", ssid, tsid, tclass, permission); ret = security( id, call, (unsigned int *)args); printf("ret=%d\n",ret); rc = fscanf(policy, "%d %d %d %x", &ssid, &tsid, &tclass, &permission); } if ( rc == 0 ) printf("Invalid input in policy\n"); return 0; } LinuxJournal/dsi/user/tools/dsi.h0100644000000000000000000000551307511115033016034 0ustar rootroot#ifndef __DSI_H #define __DSI_H #ifdef MODULE /* This prevents user programs that include dsi.h to inherit kernel stuff */ #include #include #endif #define DSI_MODULE_NAME "DSI-LSM MODULE" #define DSI_SET_NODE_ID 1 #define DSI_SET_TASK_SECURITY 2 #define DSI_SET_POLICY 3 #define DSI_ALARM_CHECK 4 #define DSI_SET_IMAGE_SID 5 #define DSI_SET_PSIDS 5 #define DSI_SID_LOW 1 #define DSI_SID_NORMAL 2 #define DSI_SID_HIGH 3 #define DSI_CLASS_PROCESS 1 #define DSI_CLASS_SOCKET 2 #define DSI_CLASS_NETWORK 3 #define PROCESS_FORK 0x00000001 #define SOCKET_CREATE 0x00000001 #define SOCKET_CONNECT 0x00000002 #define SOCKET_SEND 0x00000004 #define NETWORK_RECEIVE 0x00000001 #define ALARM_PROCESS_CREATE 0x00000001 #define ALARM_SOCKET_CREATE 0x00000002 #define ALARM_SOCKET_CONNENT 0x00000004 #define ALARM_SOCKET_SEND 0x00000008 #define ALARM_NETWORK_RECEIVE 0x00000010 #define DSI_MAGIC 0x7754ffa5 #ifdef MODULE /* This prevents user programs that include dsi.h to inherit kernel stuff */ /*#define DSI_DEBUG*/ #ifdef DSI_DEBUG #define DSI_PRINT(fmt, arg...) printk(DSI_MODULE_NAME" - " fmt,##arg); #else #define DSI_PRINT(fmt, arg...) #endif #define DSI_WARNING(fmt, arg...) printk(DSI_MODULE_NAME"-WARNING-" fmt,##arg); #define DSI_ERROR(fmt, arg...) printk(DSI_MODULE_NAME"-ERROR-" fmt,##arg); #define DSI_SAFE_ALLOC (in_interrupt () ? GFP_ATOMIC : GFP_KERNEL) #define DSI_ELF_SID_POS 7 typedef struct { int sid; int osid; int magic; void *task; } task_security_t; typedef struct /*inode_security_struct*/ { unsigned long magic; /* magic number for this module */ struct inode *inode; /* back pointer to inode object */ int task_sid; /* SID of creating task */ int sid; /* SID of this object */ int class; /* security class of this object */ } inode_security_t; typedef struct { unsigned long magic; /* magic number for this module */ struct sk_buff *skb; /* back pointer */ atomic_t use; /* reference count */ int sid; /* Source SID */ } sk_buff_security_t; int dsi_label_tasks(); int internal_task_alloc_security(struct task_struct *p); void internal_task_free_security(struct task_struct *p); int dsi_check_task( struct task_struct *tsk1, struct task_struct *tsk2, int permission); int internal_inode_alloc_security (struct inode *inode); void internal_inode_free_security (struct inode *inode); int internal_sk_buff_alloc_security (struct sk_buff *skb); void internal_sk_buff_free_security (struct sk_buff *skb); #include "dsi_cache.h" #endif /* MODULE */ #endif LinuxJournal/dsi/user/tools/policy_test0100644000000000000000000000014207511115033017356 0ustar rootroot1 1 1 0x01 1 1 2 0x07 1 1 3 0x01 2 2 1 0x01 2 2 2 0x07 2 2 3 0x01 3 3 1 0x01 3 3 2 0x07 3 3 3 0x01LinuxJournal/dsi/user/client/0040755000000000000000000000000007511320114015217 5ustar rootrootLinuxJournal/dsi/user/client/Makefile0100644000000000000000000000014607511115022016655 0ustar rootrootall: HTTPClient HTTPClient: test.c gcc -Wall -o HTTPClient test.c clean: rm -f HTTPClient core LinuxJournal/dsi/user/client/test.c0100644000000000000000000000130407511115022016335 0ustar rootroot#include #include #include #include #include #include #include #include int main() { int sock; int connid; struct sockaddr_in ad; sock = socket(PF_INET, SOCK_DGRAM,0); printf("socket = %d\n",sock); memset(&ad,0,sizeof(ad)); ad.sin_family = AF_INET; ad.sin_port = htons(8000); ad.sin_addr.s_addr = inet_addr("142.133.113.28"); //ad.sin_addr.s_addr = inet_addr("127.0.0.1"); printf("addr = %x\n", ad.sin_addr.s_addr); connid = connect(sock,(struct sockaddr*)&ad,sizeof(ad)); printf("connect = %d\n",connid); while(1) { send(sock,"Hello Server",12,0); sleep(1); } return 0; } LinuxJournal/dsi/user/server/0040755000000000000000000000000007511320103015245 5ustar rootrootLinuxJournal/dsi/user/server/Makefile0100644000000000000000000000014307511115124016705 0ustar rootrootall: HTTPServer HTTPServer: serv.c gcc -Wall -o HTTPServer serv.c clean: rm -f HTTPServer coreLinuxJournal/dsi/user/server/serv.c0100644000000000000000000000131107511115011016361 0ustar rootroot#include #include #include #include #include #include int main() { int sock; int err; struct sockaddr_in ad; char buff[20]; printf("Listen side\n"); sock = socket(PF_INET, SOCK_DGRAM,0); printf("listen socket = %d\n",sock); memset(&ad,0,sizeof(ad)); ad.sin_family = AF_INET; ad.sin_port = htons(8000); //ad.sin_addr.s_addr = inet_addr("127.0.0.1"); ad.sin_addr.s_addr = inet_addr("142.133.113.67"); err = bind(sock,(struct sockaddr *)&ad,sizeof(ad)); printf("bind = %d\n",err); while(1) { err = recv(sock,buff,12,MSG_WAITALL); if(err <= 0) break; buff[12] = 0; printf("%s\n",buff); } return 0; } LinuxJournal/dsi/user/test/0040755000000000000000000000000007511320054014723 5ustar rootrootLinuxJournal/dsi/user/test/Makefile0100644000000000000000000000044707511317154016374 0ustar rootrootall: fork dgram dgramresp servresp fork: fork.c gcc -Wall -o fork fork.c dgram: dgram.c gcc -Wall -o dgram dgram.c dgramresp: dgramresp.c gcc -Wall -o dgramresp dgramresp.c servresp: servresp.c gcc -Wall -o servresp servresp.c clean: rm -f core fork dgram dgramresp servrespLinuxJournal/dsi/user/test/dgram.c0100644000000000000000000000103007511317154016157 0ustar rootroot#include #include #include #include #include #include #include int main() { int sock; int connid; int i; struct sockaddr_in ad; sock = socket(PF_INET, SOCK_DGRAM,0); memset(&ad,0,sizeof(ad)); ad.sin_family = PF_INET; ad.sin_port = htons(8000); ad.sin_addr.s_addr = inet_addr("142.133.113.21"); connid = connect(sock,(struct sockaddr *)&ad,sizeof(ad)); for(i=0;i<500000;i++) { send(sock,"Hello Server",12,0); } return 0; } LinuxJournal/dsi/user/test/dgramresp.c0100644000000000000000000000201507511317154017055 0ustar rootroot#include #include #include #include #include #include #include int main() { int sock,sockresp; int connid; int err; int i; char buff[20]; struct sockaddr_in ad, adresp; sock = socket(PF_INET, SOCK_DGRAM,0); sockresp = socket(PF_INET, SOCK_DGRAM,0); memset(&ad,0,sizeof(ad)); ad.sin_family = PF_INET; ad.sin_port = htons(8000); ad.sin_addr.s_addr = inet_addr("142.133.113.28"); connid = connect(sock,(struct sockaddr *)&ad,sizeof(ad)); memset(&adresp,0,sizeof(adresp)); adresp.sin_family = PF_INET; adresp.sin_port = htons(8001); adresp.sin_addr.s_addr = inet_addr("142.133.113.67"); err = bind(sockresp,(struct sockaddr *)&adresp,sizeof(adresp)); for(i=0;i<100000;i++) { err = send(sock,"Hello Server",12,0); if(err != 12) { printf("send error = %d\n",err); break; } err = recv(sockresp,buff,2,0x100); if(err <= 0){ printf("recv err = %d\n",err); break; } buff[1] = 0; } return(0); } LinuxJournal/dsi/user/test/fork.c0100644000000000000000000000051307511317154016033 0ustar rootroot#include #include #include #include #include int main() { pid_t child_pid; int child_status; int i; printf("Start fork test\n"); for(i=0;i<100000;i++) { child_pid = fork(); if(child_pid != 0) { wait(&child_status); } else { exit(0); } } return(0); } LinuxJournal/dsi/user/test/servresp.c0100644000000000000000000000166207511317154016751 0ustar rootroot#include #include #include #include #include #include int main() { int sock,sockresp; int err; struct sockaddr_in ad,adresp; char buff[20]; printf("Listen side\n"); sock = socket(PF_INET, SOCK_DGRAM,0); printf("listen socket = %d\n",sock); memset(&ad,0,sizeof(ad)); ad.sin_family = AF_INET; ad.sin_port = htons(8000); ad.sin_addr.s_addr = inet_addr("142.133.113.28"); err = bind(sock,(struct sockaddr *)&ad,sizeof(ad)); printf("bind = %d\n",err); memset(&adresp,0,sizeof(adresp)); adresp.sin_port = htons(8001); adresp.sin_family = PF_INET; adresp.sin_addr.s_addr = inet_addr("142.133.113.67"); sockresp = socket(PF_INET,SOCK_DGRAM,0); printf("socket resp = %d\n",sockresp); while(1) { err = recv(sock,buff,12,MSG_WAITALL); if(err <= 0) break; sendto(sockresp,"y",2,0,(struct sockaddr *)&adresp,sizeof(adresp)); } return 0; } LinuxJournal/dsi/user/README0100644000000000000000000000405107511320255014624 0ustar rootrootThe directory contains : 1) client - a client program to demonstrate (together with server) the possibility of controlling processes by DSM module. 2) server - a server program to demonstrate (together with client) the possibility of controlling processes by DSM module. 3) tools - various tools to control the DSM module (load policy, check alarms, set the node ID). 4) test - test programs to measure the performance of the system Using DSM module to control the local and remote access ------------------------------------------------------- 1) su 2) Load module : /sbin/insmod lsm.o 3) Establish a communication between client and server processes. If everything is OK, you should see the message : "Hallo Server" on the server's shell. 4) Go to tools directory and start the "CheckAlarm" process. 5) Go to tools directory and start manipulating the policy file. a) Local Access Control : On the client side - change the policy for the socket class (class number 2), exp. 0x07 -> 0x04 - load the new policy, exp. ./UpdatePolicy policy_test - the client process should stop sending - change the policy for the socket class (class number 2), exp. 0x04 -> 0x07 - the client process should resume sending b) Remote Access Control : On the server side - change the policy for the network class (class number 3), exp. 0x01 -> 0x00 - load the new policy, exp. ./UpdatePolicy policy_test - the server process should stop receiving - change the policy for the network class (class number 3), exp. 0x00 -> 0x01 - the server process should resume receiving Measure the performance ----------------------- There are 3 different programs to measure the performance. Those test are descived in the OLS paper and the article. a) fork - measure the performance of the fork system call exp. time fork b) dgram - measure the performance of the local access exp. time dgram c) dgramresp and servresp - measure the performance of the remote access (client - server). exp. time dgramresp LinuxJournal/dsi/README0100644000000000000000000000040407511320201013633 0ustar rootrootThe directory contains : 1) lsm - kernel part - DSM module 2) user - user part - user programs to demonstrate the possibilities of the DSM module. - tools to congtrol the DSM module - user programs to measure the performace