Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8802f616 authored by Paul Moore's avatar Paul Moore Committed by David S. Miller
Browse files

[NetLabel]: documentation 



Documentation for the NetLabel system, this includes a basic overview
of how NetLabel works, how LSM developers can integrate it into their
favorite LSM, as well as documentation on the CIPSO related sysctl
variables.  Also, due to the difficulty of finding expired IETF
drafts, I am including the IETF CIPSO draft that is the basis of the
NetLabel CIPSO implementation.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a51c64f1

CREDITS

+7 −0
Original line number Diff line number Diff line
@@ -2384,6 +2384,13 @@ N: Thomas Molina 
E: tmolina@cablespeed.com

D: bug fixes, documentation, minor hackery



N: Paul Moore

E: paul.moore@hp.com

D: NetLabel author

S: Hewlett-Packard

S: 110 Spit Brook Road

S: Nashua, NH 03062



N: James Morris

E: jmorris@namei.org

W: http://namei.org/

Documentation/00-INDEX

+2 −0
Original line number Diff line number Diff line
@@ -184,6 +184,8 @@ mtrr.txt 
	- how to use PPro Memory Type Range Registers to increase performance.

nbd.txt

	- info on a TCP implementation of a network block device.

netlabel/

	- directory with information on the NetLabel subsystem.

networking/

	- directory with info on various aspects of networking with Linux.

nfsroot.txt

Documentation/netlabel/00-INDEX

0 → 100644
+10 −0
Original line number Diff line number Diff line 
00-INDEX

	- this file.

cipso_ipv4.txt

	- documentation on the IPv4 CIPSO protocol engine.

draft-ietf-cipso-ipsecurity-01.txt

	- IETF draft of the CIPSO protocol, dated 16 July 1992.

introduction.txt

	- NetLabel introduction, READ THIS FIRST.

lsm_interface.txt

	- documentation on the NetLabel kernel security module API.

Documentation/netlabel/cipso_ipv4.txt

0 → 100644
+48 −0
Original line number Diff line number Diff line 
NetLabel CIPSO/IPv4 Protocol Engine

==============================================================================

Paul Moore, paul.moore@hp.com



May 17, 2006



 * Overview



The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial IP

Security Option (CIPSO) draft from July 16, 1992.  A copy of this draft can be

found in this directory, consult '00-INDEX' for the filename.  While the IETF

draft never made it to an RFC standard it has become a de-facto standard for

labeled networking and is used in many trusted operating systems.



 * Outbound Packet Processing



The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by

adding the CIPSO label to the socket.  This causes all packets leaving the

system through the socket to have the CIPSO IP option applied.  The socket's

CIPSO label can be changed at any point in time, however, it is recommended

that it is set upon the socket's creation.  The LSM can set the socket's CIPSO

label by using the NetLabel security module API; if the NetLabel "domain" is

configured to use CIPSO for packet labeling then a CIPSO IP option will be

generated and attached to the socket.



 * Inbound Packet Processing



The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the

IP layer without any special handling required by the LSM.  However, in order

to decode and translate the CIPSO label on the packet the LSM must use the

NetLabel security module API to extract the security attributes of the packet.

This is typically done at the socket layer using the 'socket_sock_rcv_skb()'

LSM hook.



 * Label Translation



The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security

attributes such as sensitivity level and category to values which are

appropriate for the host.  These mappings are defined as part of a CIPSO

Domain Of Interpretation (DOI) definition and are configured through the

NetLabel user space communication layer.  Each DOI definition can have a

different security attribute mapping table.



 * Label Translation Cache



The NetLabel system provides a framework for caching security attribute

mappings from the network labels to the corresponding LSM identifiers.  The

CIPSO/IPv4 protocol engine supports this caching mechanism.