Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eda61d32 authored by Paul Moore's avatar Paul Moore Committed by Linus Torvalds
Browse files

NetLabel: introduce a new kernel configuration API for NetLabel 



Add a new set of configuration functions to the NetLabel/LSM API so that
LSMs can perform their own configuration of the NetLabel subsystem without
relying on assistance from userspace.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarJames Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 97829955

include/net/netlabel.h

+41 −6
Original line number Diff line number Diff line
@@ -36,6 +36,8 @@ 
#include <net/netlink.h>

#include <asm/atomic.h>



struct cipso_v4_doi;



/*

 * NetLabel - A management interface for maintaining network packet label

 *            mapping tables for explicit packet labling protocols.
@@ -103,12 +105,6 @@ struct netlbl_audit { 
	uid_t loginuid;

};



/* Domain mapping definition struct */

struct netlbl_dom_map;



/* Domain mapping operations */

int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);



/*

 * LSM security attributes

 */
@@ -343,6 +339,19 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) 
}



#ifdef CONFIG_NETLABEL

/*

 * LSM configuration operations

 */

int netlbl_cfg_map_del(const char *domain, struct netlbl_audit *audit_info);

int netlbl_cfg_unlbl_add_map(const char *domain,

			     struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,

			   struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,

			       const char *domain,

			       struct netlbl_audit *audit_info);

int netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);



/*

 * LSM security attribute operations

 */
@@ -378,6 +387,32 @@ void netlbl_cache_invalidate(void); 
int netlbl_cache_add(const struct sk_buff *skb,

		     const struct netlbl_lsm_secattr *secattr);

#else

static inline int netlbl_cfg_map_del(const char *domain,

				     struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_unlbl_add_map(const char *domain,

					   struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,

					 struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,

					     const char *domain,

					     struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_cfg_cipsov4_del(u32 doi,

					 struct netlbl_audit *audit_info)

{

	return -ENOSYS;

}

static inline int netlbl_secattr_catmap_walk(

	                              struct netlbl_lsm_secattr_catmap *catmap,

				      u32 offset)

net/ipv4/cipso_ipv4.c

+2 −2
Original line number Diff line number Diff line
@@ -547,7 +547,7 @@ int cipso_v4_doi_remove(u32 doi, 
		rcu_read_lock();

		list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list)

			if (dom_iter->valid)

				netlbl_domhsh_remove(dom_iter->domain,

				netlbl_cfg_map_del(dom_iter->domain,

						   audit_info);

		rcu_read_unlock();

		cipso_v4_cache_invalidate();

net/netlabel/netlabel_cipso_v4.c

+1 −1
Original line number Diff line number Diff line
@@ -90,7 +90,7 @@ static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1 
 * safely.

 *

 */

static void netlbl_cipsov4_doi_free(struct rcu_head *entry)

void netlbl_cipsov4_doi_free(struct rcu_head *entry)

{

	struct cipso_v4_doi *ptr;

net/netlabel/netlabel_cipso_v4.h

+3 −0
Original line number Diff line number Diff line
@@ -163,4 +163,7 @@ enum { 
/* NetLabel protocol functions */

int netlbl_cipsov4_genl_init(void);



/* Free the memory associated with a CIPSOv4 DOI definition */

void netlbl_cipsov4_doi_free(struct rcu_head *entry);



#endif

net/netlabel/netlabel_domainhash.h

+1 −0
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry, 
		      struct netlbl_audit *audit_info);

int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,

			      struct netlbl_audit *audit_info);

int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);

int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);

struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);

int netlbl_domhsh_walk(u32 *skip_bkt,