Merge branch 'master' of git://git.infradead.org/users/pcmoore/lblnet-2.6_next into next (5c8c40be) · Commits · e / devices / android_kernel_sony_msm8994

Documentation/feature-removal-schedule.txt

+12 −0

Original line number	Diff line number	Diff line
		@@ -324,3 +324,15 @@ When: 2.6.29 (ideally) or 2.6.30 (more likely)
		Why: Deprecated by the new (standard) device driver binding model. Use
		i2c_driver->probe() and ->remove() instead.
		Who: Jean Delvare <khali@linux-fr.org>

		---------------------------

		What: SELinux "compat_net" functionality
		When: 2.6.30 at the earliest
		Why: In 2.6.18 the Secmark concept was introduced to replace the "compat_net"
		network access control functionality of SELinux. Secmark offers both
		better performance and greater flexibility than the "compat_net"
		mechanism. Now that the major Linux distributions have moved to
		Secmark, it is time to deprecate the older mechanism and start the
		process of removing the old code.
		Who: Paul Moore <paul.moore@hp.com>

include/net/cipso_ipv4.h

+4 −2

Original line number	Diff line number	Diff line
		@@ -131,7 +131,8 @@ extern int cipso_v4_rbm_strictvalid;
		*/

		#ifdef CONFIG_NETLABEL
		int cipso_v4_doi_add(struct cipso_v4_doi *doi_def);
		int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
		struct netlbl_audit *audit_info);
		void cipso_v4_doi_free(struct cipso_v4_doi *doi_def);
		int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info);
		struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
		@@ -140,7 +141,8 @@ int cipso_v4_doi_walk(u32 *skip_cnt,
		int (callback) (struct cipso_v4_doi doi_def, void *arg),
		void *cb_arg);
		#else
		static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
		static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}

include/net/netlabel.h

+80 −6

Original line number	Diff line number	Diff line
		@@ -33,6 +33,8 @@
		#include <linux/types.h>
		#include <linux/net.h>
		#include <linux/skbuff.h>
		#include <linux/in.h>
		#include <linux/in6.h>
		#include <net/netlink.h>
		#include <asm/atomic.h>

		@@ -353,13 +355,37 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
		/*
		* LSM configuration operations
		*/
		int netlbl_cfg_map_del(const char domain, struct netlbl_audit audit_info);
		int netlbl_cfg_unlbl_add_map(const char *domain,
		int netlbl_cfg_map_del(const char *domain,
		u16 family,
		const void *addr,
		const void *mask,
		struct netlbl_audit *audit_info);
		int netlbl_cfg_unlbl_map_add(const char *domain,
		u16 family,
		const void *addr,
		const void *mask,
		struct netlbl_audit *audit_info);
		int netlbl_cfg_unlbl_static_add(struct net *net,
		const char *dev_name,
		const void *addr,
		const void *mask,
		u16 family,
		u32 secid,
		struct netlbl_audit *audit_info);
		int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,
		int netlbl_cfg_unlbl_static_del(struct net *net,
		const char *dev_name,
		const void *addr,
		const void *mask,
		u16 family,
		struct netlbl_audit *audit_info);
		int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
		struct netlbl_audit *audit_info);
		void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);
		int netlbl_cfg_cipsov4_map_add(u32 doi,
		const char *domain,
		const struct in_addr *addr,
		const struct in_addr *mask,
		struct netlbl_audit *audit_info);

		/*
		* LSM security attribute operations
		*/
		@@ -401,19 +427,62 @@ void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway);
		void netlbl_cache_invalidate(void);
		int netlbl_cache_add(const struct sk_buff *skb,
		const struct netlbl_lsm_secattr *secattr);

		/*
		* Protocol engine operations
		*/
		struct audit_buffer *netlbl_audit_start(int type,
		struct netlbl_audit *audit_info);
		#else
		static inline int netlbl_cfg_map_del(const char *domain,
		u16 family,
		const void *addr,
		const void *mask,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}
		static inline int netlbl_cfg_unlbl_map_add(const char *domain,
		u16 family,
		void *addr,
		void *mask,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}
		static inline int netlbl_cfg_unlbl_static_add(struct net *net,
		const char *dev_name,
		const void *addr,
		const void *mask,
		u16 family,
		u32 secid,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}
		static inline int netlbl_cfg_unlbl_static_del(struct net *net,
		const char *dev_name,
		const void *addr,
		const void *mask,
		u16 family,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}
		static inline int netlbl_cfg_unlbl_add_map(const char *domain,
		static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		}
		static inline int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,
		static inline void netlbl_cfg_cipsov4_del(u32 doi,
		struct netlbl_audit *audit_info)
		{
		return;
		}
		static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
		const char *domain,
		const struct in_addr *addr,
		const struct in_addr *mask,
		struct netlbl_audit *audit_info)
		{
		return -ENOSYS;
		@@ -495,6 +564,11 @@ static inline int netlbl_cache_add(const struct sk_buff *skb,
		{
		return 0;
		}
		static inline struct audit_buffer *netlbl_audit_start(int type,
		struct netlbl_audit *audit_info)
		{
		return NULL;
		}
		#endif /* CONFIG_NETLABEL */

		#endif /* _NETLABEL_H */

net/ipv4/cipso_ipv4.c

+65 −21

Original line number	Diff line number	Diff line
		@@ -38,6 +38,7 @@
		#include <linux/spinlock.h>
		#include <linux/string.h>
		#include <linux/jhash.h>
		#include <linux/audit.h>
		#include <net/ip.h>
		#include <net/icmp.h>
		#include <net/tcp.h>
		@@ -449,6 +450,7 @@ static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
		/**
		* cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
		* @doi_def: the DOI structure
		* @audit_info: NetLabel audit information
		*
		* Description:
		* The caller defines a new DOI for use by the CIPSO engine and calls this
		@@ -458,50 +460,78 @@ static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
		* zero on success and non-zero on failure.
		*
		*/
		int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
		int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
		struct netlbl_audit *audit_info)
		{
		int ret_val = -EINVAL;
		u32 iter;
		u32 doi;
		u32 doi_type;
		struct audit_buffer *audit_buf;

		doi = doi_def->doi;
		doi_type = doi_def->type;

		if (doi_def == NULL \|\| doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
		return -EINVAL;
		goto doi_add_return;
		for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
		switch (doi_def->tags[iter]) {
		case CIPSO_V4_TAG_RBITMAP:
		break;
		case CIPSO_V4_TAG_RANGE:
		if (doi_def->type != CIPSO_V4_MAP_PASS)
		return -EINVAL;
		break;
		case CIPSO_V4_TAG_INVALID:
		if (iter == 0)
		return -EINVAL;
		break;
		case CIPSO_V4_TAG_ENUM:
		if (doi_def->type != CIPSO_V4_MAP_PASS)
		return -EINVAL;
		goto doi_add_return;
		break;
		case CIPSO_V4_TAG_LOCAL:
		if (doi_def->type != CIPSO_V4_MAP_LOCAL)
		return -EINVAL;
		goto doi_add_return;
		break;
		case CIPSO_V4_TAG_INVALID:
		if (iter == 0)
		goto doi_add_return;
		break;
		default:
		return -EINVAL;
		goto doi_add_return;
		}
		}

		atomic_set(&doi_def->refcount, 1);

		spin_lock(&cipso_v4_doi_list_lock);
		if (cipso_v4_doi_search(doi_def->doi) != NULL)
		goto doi_add_failure;
		if (cipso_v4_doi_search(doi_def->doi) != NULL) {
		spin_unlock(&cipso_v4_doi_list_lock);
		ret_val = -EEXIST;
		goto doi_add_return;
		}
		list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
		spin_unlock(&cipso_v4_doi_list_lock);
		ret_val = 0;

		return 0;
		doi_add_return:
		audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
		if (audit_buf != NULL) {
		const char *type_str;
		switch (doi_type) {
		case CIPSO_V4_MAP_TRANS:
		type_str = "trans";
		break;
		case CIPSO_V4_MAP_PASS:
		type_str = "pass";
		break;
		case CIPSO_V4_MAP_LOCAL:
		type_str = "local";
		break;
		default:
		type_str = "(unknown)";
		}
		audit_log_format(audit_buf,
		" cipso_doi=%u cipso_type=%s res=%u",
		doi, type_str, ret_val == 0 ? 1 : 0);
		audit_log_end(audit_buf);
		}

		doi_add_failure:
		spin_unlock(&cipso_v4_doi_list_lock);
		return -EEXIST;
		return ret_val;
		}

		/**
		@@ -559,25 +589,39 @@ static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
		*/
		int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
		{
		int ret_val;
		struct cipso_v4_doi *doi_def;
		struct audit_buffer *audit_buf;

		spin_lock(&cipso_v4_doi_list_lock);
		doi_def = cipso_v4_doi_search(doi);
		if (doi_def == NULL) {
		spin_unlock(&cipso_v4_doi_list_lock);
		return -ENOENT;
		ret_val = -ENOENT;
		goto doi_remove_return;
		}
		if (!atomic_dec_and_test(&doi_def->refcount)) {
		spin_unlock(&cipso_v4_doi_list_lock);
		return -EBUSY;
		ret_val = -EBUSY;
		goto doi_remove_return;
		}
		list_del_rcu(&doi_def->list);
		spin_unlock(&cipso_v4_doi_list_lock);

		cipso_v4_cache_invalidate();
		call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
		ret_val = 0;

		return 0;
		doi_remove_return:
		audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
		if (audit_buf != NULL) {
		audit_log_format(audit_buf,
		" cipso_doi=%u res=%u",
		doi, ret_val == 0 ? 1 : 0);
		audit_log_end(audit_buf);
		}

		return ret_val;
		}

		/**

net/netlabel/netlabel_cipso_v4.c

+18 −43

Original line number	Diff line number	Diff line
		@@ -130,6 +130,7 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
		/**
		* netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
		* @info: the Generic NETLINK info block
		* @audit_info: NetLabel audit information
		*
		* Description:
		* Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
		@@ -137,7 +138,8 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
		* non-zero on error.
		*
		*/
		static int netlbl_cipsov4_add_std(struct genl_info *info)
		static int netlbl_cipsov4_add_std(struct genl_info *info,
		struct netlbl_audit *audit_info)
		{
		int ret_val = -EINVAL;
		struct cipso_v4_doi *doi_def = NULL;
		@@ -316,7 +318,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info)
		}
		}

		ret_val = cipso_v4_doi_add(doi_def);
		ret_val = cipso_v4_doi_add(doi_def, audit_info);
		if (ret_val != 0)
		goto add_std_failure;
		return 0;
		@@ -330,6 +332,7 @@ add_std_failure:
		/**
		* netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
		* @info: the Generic NETLINK info block
		* @audit_info: NetLabel audit information
		*
		* Description:
		* Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
		@@ -337,7 +340,8 @@ add_std_failure:
		* error.
		*
		*/
		static int netlbl_cipsov4_add_pass(struct genl_info *info)
		static int netlbl_cipsov4_add_pass(struct genl_info *info,
		struct netlbl_audit *audit_info)
		{
		int ret_val;
		struct cipso_v4_doi *doi_def = NULL;
		@@ -354,7 +358,7 @@ static int netlbl_cipsov4_add_pass(struct genl_info *info)
		if (ret_val != 0)
		goto add_pass_failure;

		ret_val = cipso_v4_doi_add(doi_def);
		ret_val = cipso_v4_doi_add(doi_def, audit_info);
		if (ret_val != 0)
		goto add_pass_failure;
		return 0;
		@@ -367,6 +371,7 @@ add_pass_failure:
		/**
		* netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
		* @info: the Generic NETLINK info block
		* @audit_info: NetLabel audit information
		*
		* Description:
		* Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
		@@ -374,7 +379,8 @@ add_pass_failure:
		* non-zero on error.
		*
		*/
		static int netlbl_cipsov4_add_local(struct genl_info *info)
		static int netlbl_cipsov4_add_local(struct genl_info *info,
		struct netlbl_audit *audit_info)
		{
		int ret_val;
		struct cipso_v4_doi *doi_def = NULL;
		@@ -391,7 +397,7 @@ static int netlbl_cipsov4_add_local(struct genl_info *info)
		if (ret_val != 0)
		goto add_local_failure;

		ret_val = cipso_v4_doi_add(doi_def);
		ret_val = cipso_v4_doi_add(doi_def, audit_info);
		if (ret_val != 0)
		goto add_local_failure;
		return 0;
		@@ -415,48 +421,31 @@ static int netlbl_cipsov4_add(struct sk_buff skb, struct genl_info info)

		{
		int ret_val = -EINVAL;
		u32 type;
		u32 doi;
		const char *type_str = "(unknown)";
		struct audit_buffer *audit_buf;
		struct netlbl_audit audit_info;

		if (!info->attrs[NLBL_CIPSOV4_A_DOI] \|\|
		!info->attrs[NLBL_CIPSOV4_A_MTYPE])
		return -EINVAL;

		doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
		netlbl_netlink_auditinfo(skb, &audit_info);

		type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
		switch (type) {
		switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
		case CIPSO_V4_MAP_TRANS:
		type_str = "trans";
		ret_val = netlbl_cipsov4_add_std(info);
		ret_val = netlbl_cipsov4_add_std(info, &audit_info);
		break;
		case CIPSO_V4_MAP_PASS:
		type_str = "pass";
		ret_val = netlbl_cipsov4_add_pass(info);
		ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
		break;
		case CIPSO_V4_MAP_LOCAL:
		type_str = "local";
		ret_val = netlbl_cipsov4_add_local(info);
		ret_val = netlbl_cipsov4_add_local(info, &audit_info);
		break;
		}
		if (ret_val == 0)
		atomic_inc(&netlabel_mgmt_protocount);

		audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
		&audit_info);
		if (audit_buf != NULL) {
		audit_log_format(audit_buf,
		" cipso_doi=%u cipso_type=%s res=%u",
		doi,
		type_str,
		ret_val == 0 ? 1 : 0);
		audit_log_end(audit_buf);
		}

		return ret_val;
		}

		@@ -725,9 +714,7 @@ static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map entry, void arg)
		static int netlbl_cipsov4_remove(struct sk_buff skb, struct genl_info info)
		{
		int ret_val = -EINVAL;
		u32 doi = 0;
		struct netlbl_domhsh_walk_arg cb_arg;
		struct audit_buffer *audit_buf;
		struct netlbl_audit audit_info;
		u32 skip_bkt = 0;
		u32 skip_chain = 0;
		@@ -735,29 +722,17 @@ static int netlbl_cipsov4_remove(struct sk_buff skb, struct genl_info info)
		if (!info->attrs[NLBL_CIPSOV4_A_DOI])
		return -EINVAL;

		doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
		netlbl_netlink_auditinfo(skb, &audit_info);

		cb_arg.doi = doi;
		cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
		cb_arg.audit_info = &audit_info;
		ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
		netlbl_cipsov4_remove_cb, &cb_arg);
		if (ret_val == 0 \|\| ret_val == -ENOENT) {
		ret_val = cipso_v4_doi_remove(doi, &audit_info);
		ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
		if (ret_val == 0)
		atomic_dec(&netlabel_mgmt_protocount);
		}

		audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
		&audit_info);
		if (audit_buf != NULL) {
		audit_log_format(audit_buf,
		" cipso_doi=%u res=%u",
		doi,
		ret_val == 0 ? 1 : 0);
		audit_log_end(audit_buf);
		}

		return ret_val;
		}