Eric Lee / smarc-fsl-linux-kernel

28 Jun, 2016

2 commits

  • dc7de73f1   netlabel: Add support for creating a CALIPSO protocol domain mapping. ... Browse Code »

    This extends the NLBL_MGMT_C_ADD and NLBL_MGMT_C_ADDDEF commands
    to accept CALIPSO protocol DOIs.

    Signed-off-by: Huw Davies
    Signed-off-by: Paul Moore

    Huw Davies
     
  • 8f18e675c   netlabel: Add an address family to domain hash entries. ... Browse Code »

    The reason is to allow different labelling protocols for
    different address families with the same domain.

    This requires the addition of an address family attribute
    in the netlink communication protocol. It is used in several
    messages:

    NLBL_MGMT_C_ADD and NLBL_MGMT_C_ADDDEF take it as an optional
    attribute for the unlabelled protocol. It may be one of AF_INET,
    AF_INET6 or AF_UNSPEC (to specify both address families). If it
    is missing, it defaults to AF_UNSPEC.

    NLBL_MGMT_C_LISTALL and NLBL_MGMT_C_LISTDEF return it as part of
    the enumeration of each item. Addtionally, it may be sent to
    LISTDEF to specify which address family to return.

    Signed-off-by: Huw Davies
    Signed-off-by: Paul Moore

    Huw Davies
     

07 Dec, 2013

1 commit

  • d484ff154   netlabel: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: Paul Moore
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Jeff Kirsher
     

02 Aug, 2011

1 commit

27 Jul, 2011

1 commit

  • 60063497a   atomic: use <linux/atomic.h> ... Browse Code »

    This allows us to move duplicated code in
    (atomic_inc_not_zero() for now) to

    Signed-off-by: Arun Sharma
    Reviewed-by: Eric Dumazet
    Cc: Ingo Molnar
    Cc: David Miller
    Cc: Eric Dumazet
    Acked-by: Mike Frysinger
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arun Sharma
     

20 Dec, 2010

1 commit

10 Oct, 2008

1 commit

  • 63c416887   netlabel: Add network address selectors to the NetLabel/LSM domain mapping ... Browse Code »

    This patch extends the NetLabel traffic labeling capabilities to individual
    packets based not only on the LSM domain but the by the destination address
    as well. The changes here only affect the core NetLabel infrastructre,
    changes to the NetLabel KAPI and individial protocol engines are also
    required but are split out into a different patch to ease review.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     

30 Jan, 2008

1 commit

  • c783f1ce5   NetLabel: Remove unneeded RCU read locks ... Browse Code »

    This patch removes some unneeded RCU read locks as we can treat the reads as
    "safe" even without RCU. It also converts the NetLabel configuration refcount
    from a spinlock protected u32 into atomic_t to be more consistent with the rest
    of the kernel.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     

19 Jul, 2007

1 commit

  • 23bcdc1ad   SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement ... Browse Code »

    Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the
    current runtime status of NetLabel based on the existing configuration. LSMs
    that make use of NetLabel, i.e. SELinux, can use this new function to determine
    if they should perform NetLabel access checks. This patch changes the
    NetLabel/SELinux glue code such that SELinux only enforces NetLabel related
    access checks when netlbl_enabled() returns true.

    At present NetLabel is considered to be enabled when there is at least one
    labeled protocol configuration present. The result is that by default NetLabel
    is considered to be disabled, however, as soon as an administrator configured
    a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing
    NetLabel related access controls - including unlabeled packet controls.

    This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL"
    blocks into a single block to ease future review as recommended by Linus.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     

26 Sep, 2006

1 commit

23 Sep, 2006

1 commit

  • d15c345fe   [NetLabel]: core NetLabel subsystem ... Browse Code »

    Add a new kernel subsystem, NetLabel, to provide explicit packet
    labeling services (CIPSO, RIPSO, etc.) to LSM developers. NetLabel is
    designed to work in conjunction with a LSM to intercept and decode
    security labels on incoming network packets as well as ensure that
    outgoing network packets are labeled according to the security
    mechanism employed by the LSM. The NetLabel subsystem is configured
    through a Generic NETLINK interface described in the header files
    included in this patch.

    Signed-off-by: Paul Moore
    Signed-off-by: David S. Miller

    Paul Moore