Blame view
include/net/netlabel.h
20.7 KB
11a03f78f [NetLabel]: core ... |
1 2 3 4 5 6 |
/* * NetLabel System * * The NetLabel system manages static and dynamic label mappings for network * protocols such as CIPSO and RIPSO. * |
82c21bfab doc: Update the e... |
7 |
* Author: Paul Moore <paul@paul-moore.com> |
11a03f78f [NetLabel]: core ... |
8 9 10 11 |
* */ /* |
63c416887 netlabel: Add net... |
12 |
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 |
11a03f78f [NetLabel]: core ... |
13 14 15 16 17 18 19 20 21 22 23 24 |
* * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See * the GNU General Public License for more details. * * You should have received a copy of the GNU General Public License |
a6227e26d include/net/: Fix... |
25 |
* along with this program; if not, see <http://www.gnu.org/licenses/>. |
11a03f78f [NetLabel]: core ... |
26 27 28 29 30 31 32 |
* */ #ifndef _NETLABEL_H #define _NETLABEL_H #include <linux/types.h> |
5a0e3ad6a include cleanup: ... |
33 |
#include <linux/slab.h> |
7a0e1d602 [NetLabel]: add s... |
34 |
#include <linux/net.h> |
11a03f78f [NetLabel]: core ... |
35 |
#include <linux/skbuff.h> |
6c2e8ac09 netlabel: Update ... |
36 37 |
#include <linux/in.h> #include <linux/in6.h> |
11a03f78f [NetLabel]: core ... |
38 |
#include <net/netlink.h> |
389fb800a netlabel: Label i... |
39 |
#include <net/request_sock.h> |
b4217b828 net: convert netl... |
40 |
#include <linux/refcount.h> |
11a03f78f [NetLabel]: core ... |
41 |
|
eda61d32e NetLabel: introdu... |
42 |
struct cipso_v4_doi; |
cb72d3821 netlabel: Initial... |
43 |
struct calipso_doi; |
eda61d32e NetLabel: introdu... |
44 |
|
11a03f78f [NetLabel]: core ... |
45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
/* * NetLabel - A management interface for maintaining network packet label * mapping tables for explicit packet labling protocols. * * Network protocols such as CIPSO and RIPSO require a label translation layer * to convert the label on the packet into something meaningful on the host * machine. In the current Linux implementation these mapping tables live * inside the kernel; NetLabel provides a mechanism for user space applications * to manage these mapping tables. * * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to * send messages between kernel and user space. The general format of a * NetLabel message is shown below: * * +-----------------+-------------------+--------- --- -- - * | struct nlmsghdr | struct genlmsghdr | payload * +-----------------+-------------------+--------- --- -- - * * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. * The payload is dependent on the subsystem specified in the * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c |
fcd482806 [NetLabel]: rewor... |
67 68 |
* file. All of the fields in the NetLabel payload are NETLINK attributes, see * the include/net/netlink.h file for more information on NETLINK attributes. |
11a03f78f [NetLabel]: core ... |
69 70 71 72 73 74 |
* */ /* * NetLabel NETLINK protocol */ |
8cc44579d NetLabel: Introdu... |
75 76 77 |
/* NetLabel NETLINK protocol version * 1: initial version * 2: added static labels for unlabeled connections |
d91d40799 netlabel: Add con... |
78 79 |
* 3: network selectors added to the NetLabel/LSM domain mapping and the * CIPSO_V4_MAP_LOCAL CIPSO mapping was added |
8cc44579d NetLabel: Introdu... |
80 |
*/ |
63c416887 netlabel: Add net... |
81 |
#define NETLBL_PROTO_VERSION 3 |
11a03f78f [NetLabel]: core ... |
82 83 84 85 86 87 88 89 90 91 92 93 94 |
/* NetLabel NETLINK types/families */ #define NETLBL_NLTYPE_NONE 0 #define NETLBL_NLTYPE_MGMT 1 #define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT" #define NETLBL_NLTYPE_RIPSO 2 #define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO" #define NETLBL_NLTYPE_CIPSOV4 3 #define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4" #define NETLBL_NLTYPE_CIPSOV6 4 #define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6" #define NETLBL_NLTYPE_UNLABELED 5 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" |
63c416887 netlabel: Add net... |
95 96 |
#define NETLBL_NLTYPE_ADDRSELECT 6 #define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL" |
cb72d3821 netlabel: Initial... |
97 98 |
#define NETLBL_NLTYPE_CALIPSO 7 #define NETLBL_NLTYPE_CALIPSO_NAME "NLBL_CALIPSO" |
11a03f78f [NetLabel]: core ... |
99 |
|
11a03f78f [NetLabel]: core ... |
100 101 102 103 104 105 106 107 108 109 |
/* * NetLabel - Kernel API for accessing the network packet label mappings. * * The following functions are provided for use by other kernel modules, * specifically kernel LSM modules, to provide a consistent, transparent API * for dealing with explicit packet labeling protocols such as CIPSO and * RIPSO. The functions defined here are implemented in the * net/netlabel/netlabel_kapi.c file. * */ |
95d4e6be2 [NetLabel]: audit... |
110 111 112 |
/* NetLabel audit information */ struct netlbl_audit { u32 secid; |
e1760bd5f userns: Convert t... |
113 |
kuid_t loginuid; |
4440e8548 audit: convert al... |
114 |
unsigned int sessionid; |
95d4e6be2 [NetLabel]: audit... |
115 |
}; |
16efd4543 NetLabel: Add sec... |
116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 |
/* * LSM security attributes */ /** * struct netlbl_lsm_cache - NetLabel LSM security attribute cache * @refcount: atomic reference counter * @free: LSM supplied function to free the cache data * @data: LSM supplied cache data * * Description: * This structure is provided for LSMs which wish to make use of the NetLabel * caching mechanism to store LSM specific data/attributes in the NetLabel * cache. If the LSM has to perform a lot of translation from the NetLabel * security attributes into it's own internal representation then the cache * mechanism can provide a way to eliminate some or all of that translation * overhead on a cache hit. * */ |
11a03f78f [NetLabel]: core ... |
135 |
struct netlbl_lsm_cache { |
b4217b828 net: convert netl... |
136 |
refcount_t refcount; |
11a03f78f [NetLabel]: core ... |
137 138 139 |
void (*free) (const void *data); void *data; }; |
16efd4543 NetLabel: Add sec... |
140 141 |
/** |
4fbe63d1c netlabel: shorter... |
142 |
* struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap |
16efd4543 NetLabel: Add sec... |
143 144 145 146 147 148 149 150 151 152 |
* @startbit: the value of the lowest order bit in the bitmap * @bitmap: the category bitmap * @next: pointer to the next bitmap "node" or NULL * * Description: * This structure is used to represent category bitmaps. Due to the large * number of categories supported by most labeling protocols it is not * practical to transfer a full bitmap internally so NetLabel adopts a sparse * bitmap structure modeled after SELinux's ebitmap structure. * The catmap bitmap field MUST be a power of two in length and large |
027527603 NetLabel: convert... |
153 154 155 |
* enough to hold at least 240 bits. Special care (i.e. check the code!) * should be used when changing these values as the LSM implementation * probably has functions which rely on the sizes of these types to speed |
16efd4543 NetLabel: Add sec... |
156 157 158 |
* processing. * */ |
027527603 NetLabel: convert... |
159 160 161 162 163 164 |
#define NETLBL_CATMAP_MAPTYPE u64 #define NETLBL_CATMAP_MAPCNT 4 #define NETLBL_CATMAP_MAPSIZE (sizeof(NETLBL_CATMAP_MAPTYPE) * 8) #define NETLBL_CATMAP_SIZE (NETLBL_CATMAP_MAPSIZE * \ NETLBL_CATMAP_MAPCNT) #define NETLBL_CATMAP_BIT (NETLBL_CATMAP_MAPTYPE)0x01 |
4fbe63d1c netlabel: shorter... |
165 |
struct netlbl_lsm_catmap { |
027527603 NetLabel: convert... |
166 167 |
u32 startbit; NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT]; |
4fbe63d1c netlabel: shorter... |
168 |
struct netlbl_lsm_catmap *next; |
027527603 NetLabel: convert... |
169 |
}; |
16efd4543 NetLabel: Add sec... |
170 171 172 |
/** * struct netlbl_lsm_secattr - NetLabel LSM security attributes |
00447872a NetLabel: Allow p... |
173 |
* @flags: indicate structure attributes, see NETLBL_SECATTR_* |
16efd4543 NetLabel: Add sec... |
174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 |
* @type: indicate the NLTYPE of the attributes * @domain: the NetLabel LSM domain * @cache: NetLabel LSM specific cache * @attr.mls: MLS sensitivity label * @attr.mls.cat: MLS category bitmap * @attr.mls.lvl: MLS sensitivity level * @attr.secid: LSM specific secid token * * Description: * This structure is used to pass security attributes between NetLabel and the * LSM modules. The flags field is used to specify which fields within the * struct are valid and valid values can be created by bitwise OR'ing the * NETLBL_SECATTR_* defines. The domain field is typically set by the LSM to * specify domain specific configuration settings and is not usually used by * NetLabel itself when returning security attributes to the LSM. * */ |
00447872a NetLabel: Allow p... |
191 192 193 |
struct netlbl_lsm_secattr { u32 flags; /* bitmap values for 'flags' */ |
701a90bad NetLabel: make ne... |
194 195 |
#define NETLBL_SECATTR_NONE 0x00000000 #define NETLBL_SECATTR_DOMAIN 0x00000001 |
00447872a NetLabel: Allow p... |
196 197 |
#define NETLBL_SECATTR_DOMAIN_CPY (NETLBL_SECATTR_DOMAIN | \ NETLBL_SECATTR_FREE_DOMAIN) |
701a90bad NetLabel: make ne... |
198 199 200 |
#define NETLBL_SECATTR_CACHE 0x00000002 #define NETLBL_SECATTR_MLS_LVL 0x00000004 #define NETLBL_SECATTR_MLS_CAT 0x00000008 |
16efd4543 NetLabel: Add sec... |
201 |
#define NETLBL_SECATTR_SECID 0x00000010 |
00447872a NetLabel: Allow p... |
202 203 |
/* bitmap meta-values for 'flags' */ #define NETLBL_SECATTR_FREE_DOMAIN 0x01000000 |
9534f71ca SELinux: restore ... |
204 |
#define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ |
16efd4543 NetLabel: Add sec... |
205 206 |
NETLBL_SECATTR_MLS_CAT | \ NETLBL_SECATTR_SECID) |
16efd4543 NetLabel: Add sec... |
207 |
u32 type; |
11a03f78f [NetLabel]: core ... |
208 |
char *domain; |
ffb733c65 NetLabel: fix a c... |
209 |
struct netlbl_lsm_cache *cache; |
8d75899d0 netlabel: Changes... |
210 |
struct { |
16efd4543 NetLabel: Add sec... |
211 |
struct { |
4fbe63d1c netlabel: shorter... |
212 |
struct netlbl_lsm_catmap *cat; |
16efd4543 NetLabel: Add sec... |
213 214 215 216 |
u32 lvl; } mls; u32 secid; } attr; |
11a03f78f [NetLabel]: core ... |
217 |
}; |
cb72d3821 netlabel: Initial... |
218 219 220 221 |
/** * struct netlbl_calipso_ops - NetLabel CALIPSO operations * @doi_add: add a CALIPSO DOI * @doi_free: free a CALIPSO DOI |
a5e34490c netlabel: Add sup... |
222 223 |
* @doi_getdef: returns a reference to a DOI * @doi_putdef: releases a reference of a DOI |
e1ce69df7 netlabel: Add sup... |
224 |
* @doi_walk: enumerate the DOI list |
ceba1832b calipso: Set the ... |
225 226 227 |
* @sock_getattr: retrieve the socket's attr * @sock_setattr: set the socket's attr * @sock_delattr: remove the socket's attr |
e1adea927 calipso: Allow re... |
228 229 |
* @req_setattr: set the req socket's attr * @req_delattr: remove the req socket's attr |
2917f57b6 calipso: Allow th... |
230 231 232 233 |
* @opt_getattr: retrieve attr from memory block * @skbuff_optptr: find option in packet * @skbuff_setattr: set the skbuff's attr * @skbuff_delattr: remove the skbuff's attr |
4fee5242b calipso: Add a la... |
234 235 |
* @cache_invalidate: invalidate cache * @cache_add: add cache entry |
cb72d3821 netlabel: Initial... |
236 237 238 239 240 241 242 243 244 245 246 |
* * Description: * This structure is filled out by the CALIPSO engine and passed * to the NetLabel core via a call to netlbl_calipso_ops_register(). * It enables the CALIPSO engine (and hence IPv6) to be compiled * as a module. */ struct netlbl_calipso_ops { int (*doi_add)(struct calipso_doi *doi_def, struct netlbl_audit *audit_info); void (*doi_free)(struct calipso_doi *doi_def); |
d7cce0150 netlabel: Add sup... |
247 |
int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info); |
a5e34490c netlabel: Add sup... |
248 249 |
struct calipso_doi *(*doi_getdef)(u32 doi); void (*doi_putdef)(struct calipso_doi *doi_def); |
e1ce69df7 netlabel: Add sup... |
250 251 252 |
int (*doi_walk)(u32 *skip_cnt, int (*callback)(struct calipso_doi *doi_def, void *arg), void *cb_arg); |
ceba1832b calipso: Set the ... |
253 254 255 256 257 258 |
int (*sock_getattr)(struct sock *sk, struct netlbl_lsm_secattr *secattr); int (*sock_setattr)(struct sock *sk, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); void (*sock_delattr)(struct sock *sk); |
e1adea927 calipso: Allow re... |
259 260 261 262 |
int (*req_setattr)(struct request_sock *req, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); void (*req_delattr)(struct request_sock *req); |
2917f57b6 calipso: Allow th... |
263 264 265 266 267 268 269 |
int (*opt_getattr)(const unsigned char *calipso, struct netlbl_lsm_secattr *secattr); unsigned char *(*skbuff_optptr)(const struct sk_buff *skb); int (*skbuff_setattr)(struct sk_buff *skb, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); int (*skbuff_delattr)(struct sk_buff *skb); |
4fee5242b calipso: Add a la... |
270 271 272 |
void (*cache_invalidate)(void); int (*cache_add)(const unsigned char *calipso_ptr, const struct netlbl_lsm_secattr *secattr); |
cb72d3821 netlabel: Initial... |
273 |
}; |
11a03f78f [NetLabel]: core ... |
274 |
/* |
23bcdc1ad SELinux: enable d... |
275 |
* LSM security attribute operations (inline) |
11a03f78f [NetLabel]: core ... |
276 |
*/ |
11a03f78f [NetLabel]: core ... |
277 |
/** |
ffb733c65 NetLabel: fix a c... |
278 279 280 281 282 283 284 285 |
* netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache * @flags: the memory allocation flags * * Description: * Allocate and initialize a netlbl_lsm_cache structure. Returns a pointer * on success, NULL on failure. * */ |
645408d1f [PATCH] gfp_t in ... |
286 |
static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags) |
ffb733c65 NetLabel: fix a c... |
287 288 289 290 291 |
{ struct netlbl_lsm_cache *cache; cache = kzalloc(sizeof(*cache), flags); if (cache) |
b4217b828 net: convert netl... |
292 |
refcount_set(&cache->refcount, 1); |
ffb733c65 NetLabel: fix a c... |
293 294 295 296 297 298 299 300 301 302 303 304 305 |
return cache; } /** * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct * @cache: the struct to free * * Description: * Frees @secattr including all of the internal buffers. * */ static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache) { |
b4217b828 net: convert netl... |
306 |
if (!refcount_dec_and_test(&cache->refcount)) |
ffb733c65 NetLabel: fix a c... |
307 308 309 310 311 312 313 314 |
return; if (cache->free) cache->free(cache->data); kfree(cache); } /** |
4fbe63d1c netlabel: shorter... |
315 |
* netlbl_catmap_alloc - Allocate a LSM secattr catmap |
027527603 NetLabel: convert... |
316 317 318 319 320 321 322 |
* @flags: memory allocation flags * * Description: * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL * on failure. * */ |
4fbe63d1c netlabel: shorter... |
323 |
static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc(gfp_t flags) |
027527603 NetLabel: convert... |
324 |
{ |
4fbe63d1c netlabel: shorter... |
325 |
return kzalloc(sizeof(struct netlbl_lsm_catmap), flags); |
027527603 NetLabel: convert... |
326 327 328 |
} /** |
4fbe63d1c netlabel: shorter... |
329 |
* netlbl_catmap_free - Free a LSM secattr catmap |
027527603 NetLabel: convert... |
330 331 332 333 334 335 |
* @catmap: the category bitmap * * Description: * Free a LSM secattr catmap. * */ |
4fbe63d1c netlabel: shorter... |
336 |
static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap) |
027527603 NetLabel: convert... |
337 |
{ |
4fbe63d1c netlabel: shorter... |
338 |
struct netlbl_lsm_catmap *iter; |
027527603 NetLabel: convert... |
339 |
|
4b8feff25 netlabel: fix the... |
340 |
while (catmap) { |
027527603 NetLabel: convert... |
341 342 343 |
iter = catmap; catmap = catmap->next; kfree(iter); |
4b8feff25 netlabel: fix the... |
344 |
} |
027527603 NetLabel: convert... |
345 346 347 |
} /** |
11a03f78f [NetLabel]: core ... |
348 349 350 351 |
* netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct * @secattr: the struct to initialize * * Description: |
c6fa82a9d NetLabel: change ... |
352 |
* Initialize an already allocated netlbl_lsm_secattr struct. |
11a03f78f [NetLabel]: core ... |
353 354 |
* */ |
c6fa82a9d NetLabel: change ... |
355 |
static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr) |
11a03f78f [NetLabel]: core ... |
356 |
{ |
16efd4543 NetLabel: Add sec... |
357 |
memset(secattr, 0, sizeof(*secattr)); |
11a03f78f [NetLabel]: core ... |
358 359 360 361 362 |
} /** * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct * @secattr: the struct to clear |
11a03f78f [NetLabel]: core ... |
363 364 365 |
* * Description: * Destroys the @secattr struct, including freeing all of the internal buffers. |
ffb733c65 NetLabel: fix a c... |
366 |
* The struct must be reset with a call to netlbl_secattr_init() before reuse. |
11a03f78f [NetLabel]: core ... |
367 368 |
* */ |
ffb733c65 NetLabel: fix a c... |
369 |
static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr) |
11a03f78f [NetLabel]: core ... |
370 |
{ |
00447872a NetLabel: Allow p... |
371 372 |
if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN) kfree(secattr->domain); |
16efd4543 NetLabel: Add sec... |
373 374 375 |
if (secattr->flags & NETLBL_SECATTR_CACHE) netlbl_secattr_cache_free(secattr->cache); if (secattr->flags & NETLBL_SECATTR_MLS_CAT) |
4fbe63d1c netlabel: shorter... |
376 |
netlbl_catmap_free(secattr->attr.mls.cat); |
11a03f78f [NetLabel]: core ... |
377 378 379 380 381 382 383 384 385 386 387 |
} /** * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct * @flags: the memory allocation flags * * Description: * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid * pointer on success, or NULL on failure. * */ |
1f758d935 NetLabel: use gfp... |
388 |
static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(gfp_t flags) |
11a03f78f [NetLabel]: core ... |
389 390 391 392 393 394 395 |
{ return kzalloc(sizeof(struct netlbl_lsm_secattr), flags); } /** * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct * @secattr: the struct to free |
11a03f78f [NetLabel]: core ... |
396 397 |
* * Description: |
ffb733c65 NetLabel: fix a c... |
398 |
* Frees @secattr including all of the internal buffers. |
11a03f78f [NetLabel]: core ... |
399 400 |
* */ |
ffb733c65 NetLabel: fix a c... |
401 |
static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) |
11a03f78f [NetLabel]: core ... |
402 |
{ |
ffb733c65 NetLabel: fix a c... |
403 |
netlbl_secattr_destroy(secattr); |
11a03f78f [NetLabel]: core ... |
404 405 |
kfree(secattr); } |
027527603 NetLabel: convert... |
406 |
#ifdef CONFIG_NETLABEL |
23bcdc1ad SELinux: enable d... |
407 |
/* |
eda61d32e NetLabel: introdu... |
408 409 |
* LSM configuration operations */ |
6c2e8ac09 netlabel: Update ... |
410 411 412 413 414 415 416 417 418 |
int netlbl_cfg_map_del(const char *domain, u16 family, const void *addr, const void *mask, struct netlbl_audit *audit_info); int netlbl_cfg_unlbl_map_add(const char *domain, u16 family, const void *addr, const void *mask, |
eda61d32e NetLabel: introdu... |
419 |
struct netlbl_audit *audit_info); |
6c2e8ac09 netlabel: Update ... |
420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 |
int netlbl_cfg_unlbl_static_add(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, u32 secid, struct netlbl_audit *audit_info); int netlbl_cfg_unlbl_static_del(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, struct netlbl_audit *audit_info); int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, struct netlbl_audit *audit_info); void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info); int netlbl_cfg_cipsov4_map_add(u32 doi, |
eda61d32e NetLabel: introdu... |
437 |
const char *domain, |
6c2e8ac09 netlabel: Update ... |
438 439 |
const struct in_addr *addr, const struct in_addr *mask, |
eda61d32e NetLabel: introdu... |
440 |
struct netlbl_audit *audit_info); |
3f09354ac netlabel: Impleme... |
441 442 443 444 445 446 447 448 |
int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info); void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info); int netlbl_cfg_calipso_map_add(u32 doi, const char *domain, const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info); |
eda61d32e NetLabel: introdu... |
449 |
/* |
23bcdc1ad SELinux: enable d... |
450 451 |
* LSM security attribute operations */ |
4fbe63d1c netlabel: shorter... |
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 |
int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset); int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset); int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, u32 *offset, unsigned long *bitmap); int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, u32 bit, gfp_t flags); int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, u32 start, u32 end, gfp_t flags); int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, u32 offset, unsigned long bitmap, gfp_t flags); |
23bcdc1ad SELinux: enable d... |
468 |
|
3faa8f982 netlabel: Move bi... |
469 470 471 472 473 |
/* Bitmap functions */ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, u32 offset, u8 state); void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state); |
23bcdc1ad SELinux: enable d... |
474 |
/* |
16efd4543 NetLabel: Add sec... |
475 |
* LSM protocol operations (NetLabel LSM/kernel API) |
23bcdc1ad SELinux: enable d... |
476 477 478 |
*/ int netlbl_enabled(void); int netlbl_sock_setattr(struct sock *sk, |
389fb800a netlabel: Label i... |
479 |
u16 family, |
23bcdc1ad SELinux: enable d... |
480 |
const struct netlbl_lsm_secattr *secattr); |
014ab19a6 selinux: Set sock... |
481 |
void netlbl_sock_delattr(struct sock *sk); |
23bcdc1ad SELinux: enable d... |
482 483 |
int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); |
014ab19a6 selinux: Set sock... |
484 485 486 |
int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr); |
389fb800a netlabel: Label i... |
487 488 |
int netlbl_req_setattr(struct request_sock *req, const struct netlbl_lsm_secattr *secattr); |
07feee8f8 netlabel: Cleanup... |
489 |
void netlbl_req_delattr(struct request_sock *req); |
948bf85c1 netlabel: Add fun... |
490 491 492 |
int netlbl_skbuff_setattr(struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr); |
23bcdc1ad SELinux: enable d... |
493 |
int netlbl_skbuff_getattr(const struct sk_buff *skb, |
75e22910c NetLabel: Add IP ... |
494 |
u16 family, |
23bcdc1ad SELinux: enable d... |
495 |
struct netlbl_lsm_secattr *secattr); |
a04e71f63 netlabel: Pass a ... |
496 |
void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway); |
23bcdc1ad SELinux: enable d... |
497 498 499 500 501 |
/* * LSM label mapping cache operations */ void netlbl_cache_invalidate(void); |
4fee5242b calipso: Add a la... |
502 |
int netlbl_cache_add(const struct sk_buff *skb, u16 family, |
23bcdc1ad SELinux: enable d... |
503 |
const struct netlbl_lsm_secattr *secattr); |
6c2e8ac09 netlabel: Update ... |
504 505 506 507 508 509 |
/* * Protocol engine operations */ struct audit_buffer *netlbl_audit_start(int type, struct netlbl_audit *audit_info); |
027527603 NetLabel: convert... |
510 |
#else |
eda61d32e NetLabel: introdu... |
511 |
static inline int netlbl_cfg_map_del(const char *domain, |
6c2e8ac09 netlabel: Update ... |
512 513 514 |
u16 family, const void *addr, const void *mask, |
eda61d32e NetLabel: introdu... |
515 516 517 518 |
struct netlbl_audit *audit_info) { return -ENOSYS; } |
6c2e8ac09 netlabel: Update ... |
519 520 521 522 |
static inline int netlbl_cfg_unlbl_map_add(const char *domain, u16 family, void *addr, void *mask, |
eda61d32e NetLabel: introdu... |
523 524 525 526 |
struct netlbl_audit *audit_info) { return -ENOSYS; } |
6c2e8ac09 netlabel: Update ... |
527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 |
static inline int netlbl_cfg_unlbl_static_add(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, u32 secid, struct netlbl_audit *audit_info) { return -ENOSYS; } static inline int netlbl_cfg_unlbl_static_del(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, struct netlbl_audit *audit_info) { return -ENOSYS; } static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, struct netlbl_audit *audit_info) { return -ENOSYS; } static inline void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info) { return; } static inline int netlbl_cfg_cipsov4_map_add(u32 doi, |
eda61d32e NetLabel: introdu... |
557 |
const char *domain, |
6c2e8ac09 netlabel: Update ... |
558 559 |
const struct in_addr *addr, const struct in_addr *mask, |
eda61d32e NetLabel: introdu... |
560 561 562 563 |
struct netlbl_audit *audit_info) { return -ENOSYS; } |
3f09354ac netlabel: Impleme... |
564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 |
static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info) { return -ENOSYS; } static inline void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info) { return; } static inline int netlbl_cfg_calipso_map_add(u32 doi, const char *domain, const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info) { return -ENOSYS; } |
4fbe63d1c netlabel: shorter... |
582 583 |
static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset) |
027527603 NetLabel: convert... |
584 585 586 |
{ return -ENOENT; } |
4fbe63d1c netlabel: shorter... |
587 588 |
static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset) |
027527603 NetLabel: convert... |
589 590 591 |
{ return -ENOENT; } |
4fbe63d1c netlabel: shorter... |
592 593 594 |
static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, u32 *offset, unsigned long *bitmap) |
4b8feff25 netlabel: fix the... |
595 596 597 |
{ return 0; } |
4fbe63d1c netlabel: shorter... |
598 599 600 |
static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, u32 bit, gfp_t flags) |
027527603 NetLabel: convert... |
601 602 603 |
{ return 0; } |
4fbe63d1c netlabel: shorter... |
604 605 606 607 |
static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, u32 start, u32 end, gfp_t flags) |
027527603 NetLabel: convert... |
608 609 610 |
{ return 0; } |
bc7e6edbb netlabel: fix the... |
611 612 613 614 |
static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, u32 offset, unsigned long bitmap, gfp_t flags) |
4b8feff25 netlabel: fix the... |
615 616 617 |
{ return 0; } |
23bcdc1ad SELinux: enable d... |
618 619 620 621 |
static inline int netlbl_enabled(void) { return 0; } |
ba6ff9f2b [NetLabel]: conso... |
622 |
static inline int netlbl_sock_setattr(struct sock *sk, |
389fb800a netlabel: Label i... |
623 624 |
u16 family, const struct netlbl_lsm_secattr *secattr) |
11a03f78f [NetLabel]: core ... |
625 626 627 |
{ return -ENOSYS; } |
014ab19a6 selinux: Set sock... |
628 629 630 |
static inline void netlbl_sock_delattr(struct sock *sk) { } |
14a72f53f [NetLabel]: corre... |
631 632 633 634 635 |
static inline int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) { return -ENOSYS; } |
014ab19a6 selinux: Set sock... |
636 637 638 639 640 641 |
static inline int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr) { return -ENOSYS; } |
389fb800a netlabel: Label i... |
642 643 644 645 646 |
static inline int netlbl_req_setattr(struct request_sock *req, const struct netlbl_lsm_secattr *secattr) { return -ENOSYS; } |
07feee8f8 netlabel: Cleanup... |
647 648 649 650 |
static inline void netlbl_req_delattr(struct request_sock *req) { return; } |
948bf85c1 netlabel: Add fun... |
651 652 653 654 655 656 |
static inline int netlbl_skbuff_setattr(struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr) { return -ENOSYS; } |
11a03f78f [NetLabel]: core ... |
657 |
static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, |
75e22910c NetLabel: Add IP ... |
658 |
u16 family, |
11a03f78f [NetLabel]: core ... |
659 660 661 662 |
struct netlbl_lsm_secattr *secattr) { return -ENOSYS; } |
dfaebe982 selinux: Fix miss... |
663 664 665 |
static inline void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway) |
11a03f78f [NetLabel]: core ... |
666 667 668 |
{ return; } |
11a03f78f [NetLabel]: core ... |
669 670 671 672 |
static inline void netlbl_cache_invalidate(void) { return; } |
4fee5242b calipso: Add a la... |
673 |
static inline int netlbl_cache_add(const struct sk_buff *skb, u16 family, |
11a03f78f [NetLabel]: core ... |
674 675 676 677 |
const struct netlbl_lsm_secattr *secattr) { return 0; } |
6c2e8ac09 netlabel: Update ... |
678 679 680 681 682 |
static inline struct audit_buffer *netlbl_audit_start(int type, struct netlbl_audit *audit_info) { return NULL; } |
11a03f78f [NetLabel]: core ... |
683 |
#endif /* CONFIG_NETLABEL */ |
cb72d3821 netlabel: Initial... |
684 685 |
const struct netlbl_calipso_ops * netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops); |
11a03f78f [NetLabel]: core ... |
686 |
#endif /* _NETLABEL_H */ |