RFE: add LSM/SELinux access controls for AF_PACKET sockets

[pcmoore]

Add more general IPv4 and IPv6 per-packet access controls, including support for traffic over SOCK_RAW sockets.

[stephensmalley]

Aren't the existing per-packet controls via sock_rcv_skb and the SELinux netfilter hooks already covering raw IP socket traffic?

[pcmoore]

Some general comments from a brief investigation I did several years ago:

Just as a FYI: there may actually be two issues here, AF_INET{6}/SOCK_RAW
sockets, and AF_PACKET/SOCK_RAW sockets.

One possible solution for AF_INET/SOCK_RAW, and other protocols not caught by socket
filters, would be to move the selinux_inet_sys_rcv_skb()/ingress filtering into a
NF_INET_LOCAL_IN hook (all the IP processing/parsing we care about is finished at that
point) while keeping the peer object class checks in the socket filter hook.  This should
also work for AF_INET6/SOCK_RAW.

For AF_PACKET sockets, the AF_PACKET code implements its own socket filter
wrapper, af_packet.c:run_filter(), which does not call security_sock_rcv_skb() like the
normal sk_filter() function used by everything else, e.g. TCP/UDP.  The AF_PACKET
code, af_packet.c, registers a protocol handler directly with the network device, and
receives packets directly from the interface.  The IP stack is not involved (as you
would expect).

There might be some interesting policy implications here as we would end up seeing
more/new traffic that we haven't seen previously in the SELinux hooks.

[pcmoore]

Quick update: it appears that AF_INET/SOCK_RAW (and likely other protocols) end up calling sk_filter() via sock_queue_rcv_skb() so we may be in better shape than originally thought.

[stephensmalley]

Should we close this since AF_INET SOCK_RAW is covered, or edit it to instead refer to the lack of controls on AF_PACKET traffic?