selinux: add netlink nlmsg_type audit message

Add a new audit message type to capture nlmsg-related information. This
is similar to LSM_AUDIT_DATA_IOCTL_OP which was added for the other
SELinux extended permission (ioctl).

Adding a new type is preferred to adding to the existing
lsm_network_audit structure which contains irrelevant information for
the netlink sockets (i.e., dport, sport).

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
[PM: change "nlnk-msgtype" to "nl-msgtype" as discussed]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h
index 97a8b21eb03339166c96e94743148e9e96fb2bc4..69d2b7bc00ed39c8756f7f9a3034100ab76088a4 100644 (file)
--- a/include/linux/lsm_audit.h
+++ b/include/linux/lsm_audit.h
@@ -77,6 +77,7 @@ struct common_audit_data {
 #define LSM_AUDIT_DATA_LOCKDOWN 15
 #define LSM_AUDIT_DATA_NOTIFICATION 16
 #define LSM_AUDIT_DATA_ANONINODE       17
+#define LSM_AUDIT_DATA_NLMSGTYPE       18
        union   {
                struct path path;
                struct dentry *dentry;
@@ -98,6 +99,7 @@ struct common_audit_data {
                struct lsm_ibendport_audit *ibendport;
                int reason;
                const char *anonclass;
+               u16 nlmsg_type;
        } u;
        /* this union contains LSM specific data */
        union {

diff --git a/security/lsm_audit.c b/security/lsm_audit.c
index 9a8352972086cf6cc7492c7717b1f9ab6ec0b20e..b2f565c0990a4ef7e8afb79039a59bbce40808b3 100644 (file)
--- a/security/lsm_audit.c
+++ b/security/lsm_audit.c
@@ -425,6 +425,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
        case LSM_AUDIT_DATA_ANONINODE:
                audit_log_format(ab, " anonclass=%s", a->u.anonclass);
                break;
+       case LSM_AUDIT_DATA_NLMSGTYPE:
+               audit_log_format(ab, " nl-msgtype=%hu", a->u.nlmsg_type);
+               break;
        } /* switch (a->type) */
 }
 

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5e5f3398f39d0c5fb05fb5d68615dc907c263a4a..617f54abb640297b99b90fb4f13acabdf3daf874 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5939,14 +5939,14 @@ static int nlmsg_sock_has_extended_perms(struct sock *sk, u32 perms, u16 nlmsg_t
 {
        struct sk_security_struct *sksec = sk->sk_security;
        struct common_audit_data ad;
-       struct lsm_network_audit net;
        u8 driver;
        u8 xperm;
 
        if (sock_skip_has_perm(sksec->sid))
                return 0;
 
-       ad_net_init_from_sk(&ad, &net, sk);
+       ad.type = LSM_AUDIT_DATA_NLMSGTYPE;
+       ad.u.nlmsg_type = nlmsg_type;
 
        driver = nlmsg_type >> 8;
        xperm = nlmsg_type & 0xff;