10 Oct, 2008
10 commits
-
Add the necessary NetLabel support for the new CIPSO mapping,
CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
This patch accomplishes three minor tasks: add a new tag type for local
labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
replace some of the CIPSO "magic numbers" with constants from the header
file. The first change allows CIPSO to support full LSM labels/contexts,
not just MLS attributes. The second change brings the mapping names inline
with what userspace is using, compatibility is preserved since we don't
actually change the value. The last change is to aid readability and help
prevent mistakes.Signed-off-by: Paul Moore
-
Previous work enabled the use of address based NetLabel selectors, which while
highly useful, brought the potential for additional per-packet overhead when
used. This patch attempts to solve that by applying NetLabel socket labels
when sockets are connect()'d. This should alleviate the per-packet NetLabel
labeling for all connected sockets (yes, it even works for connected DGRAM
sockets).Signed-off-by: Paul Moore
Reviewed-by: James Morris -
This patch builds upon the new NetLabel address selector functionality by
providing the NetLabel KAPI and CIPSO engine support needed to enable the
new packet-based labeling. The only new addition to the NetLabel KAPI at
this point is shown below:* int netlbl_skbuff_setattr(skb, family, secattr)
... and is designed to be called from a Netfilter hook after the packet's
IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.This patch also provides the necessary SELinux hooks to support this new
functionality. Smack support is not currently included due to uncertainty
regarding the permissions needed to expand the Smack network access controls.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
This patch extends the NetLabel traffic labeling capabilities to individual
packets based not only on the LSM domain but the by the destination address
as well. The changes here only affect the core NetLabel infrastructre,
changes to the NetLabel KAPI and individial protocol engines are also
required but are split out into a different patch to ease review.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
Create an ordered IP address linked list mechanism similar to the core
kernel's linked list construct. The idea behind this list functionality
is to create an extensibile linked list ordered by IP address mask to
ease the matching of network addresses. The linked list is ordered with
larger address masks at the front of the list and shorter address masks
at the end to facilitate overriding network entries with individual host
or subnet entries.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
NetLabel has always had a list of backpointers in the CIPSO DOI definition
structure which pointed to the NetLabel LSM domain mapping structures which
referenced the CIPSO DOI struct. The rationale for this was that when an
administrator removed a CIPSO DOI from the system all of the associated
NetLabel LSM domain mappings should be removed as well; a list of
backpointers made this a simple operation.Unfortunately, while the backpointers did make the removal easier they were
a bit of a mess from an implementation point of view which was making
further development difficult. Since the removal of a CIPSO DOI is a
realtively rare event it seems to make sense to remove this backpointer
list as the optimization was hurting us more then it was helping. However,
we still need to be able to track when a CIPSO DOI definition is being used
so replace the backpointer list with a reference count. In order to
preserve the current functionality of removing the associated LSM domain
mappings when a CIPSO DOI is removed we walk the LSM domain mapping table,
removing the relevant entries.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
At some point I think I messed up and dropped the calls to netlbl_skbuff_err()
which are necessary for CIPSO to send error notifications to remote systems.
This patch re-introduces the error handling calls into the SELinux code.Signed-off-by: Paul Moore
Acked-by: James Morris -
After some discussions with the Smack folks, well just Casey, I now have a
better idea of what Smack wants out of NetLabel in the future so I think it
is now safe to do some API "pruning". If another LSM comes along that
needs this functionality we can always add it back in, but I don't see any
LSMs on the horizon which might make use of these functions.Thanks to Rami Rosen who suggested removing netlbl_cfg_cipsov4_del() back
in February 2008.Signed-off-by: Paul Moore
Reviewed-by: James Morris -
Fix a few sparse warnings. One dealt with a RCU lock being held on error,
another dealt with an improper type caused by a signed/unsigned mixup while
the rest appeared to be caused by using rcu_dereference() in a
list_for_each_entry_rcu() call. The latter probably isn't a big deal, but
I derive a certain pleasure from knowing that the net/netlabel is nice and
clean.Thanks to James Morris for pointing out the issues and demonstrating how
to run sparse.Signed-off-by: Paul Moore
20 Jul, 2008
1 commit
-
Without CONFIG_NET_NS, namespace is always &init_net.
Compiler will be able to omit namespace comparisons with this patch.Signed-off-by: YOSHIFUJI Hideaki
Signed-off-by: David S. Miller
18 Jul, 2008
1 commit
-
Conflicts:
Documentation/powerpc/booting-without-of.txt
drivers/atm/Makefile
drivers/net/fs_enet/fs_enet-main.c
drivers/pci/pci-acpi.c
net/8021q/vlan.c
net/iucv/iucv.c
16 Jul, 2008
1 commit
15 Jul, 2008
1 commit
-
Currently, we are trying to place the information from the kernel to
1, 2, 3 and 4 pages sequentially. These pages are allocated via slab.
Though, from the slab point of view steps 3 and 4 are equivalent on
most architectures. So, lets skip 3 pages attempt.By the way, should we switch from .doit to .dumpit interface here?
The amount of data seems quite big for me.Signed-off-by: Denis V. Lunev
Acked-by: Paul Moore
Signed-off-by: David S. Miller
11 Jul, 2008
2 commits
-
Conflicts:
include/linux/rculist.h
kernel/rcupreempt.cSigned-off-by: Ingo Molnar
-
So, no need to kfree_skb here on the error path. In this case we can
simply return.Signed-off-by: Denis V. Lunev
Acked-by: Paul Moore
Signed-off-by: David S. Miller
28 Jun, 2008
1 commit
-
There is a missing "!" in a conditional statement which is causing entries to
be skipped when dumping the default IPv6 static label entries. This can be
demonstrated by running the following:# netlabelctl unlbl add default address:::1 \
label:system_u:object_r:unlabeled_t:s0
# netlabelctl -p unlbl list... you will notice that the entry for the IPv6 localhost address is not
displayed but does exist (works correctly, causes collisions when attempting
to add duplicate entries, etc.).Signed-off-by: Paul Moore
Signed-off-by: David S. Miller
19 May, 2008
1 commit
-
Move rcu-protected lists from list.h into a new header file rculist.h.
This is done because list are a very used primitive structure all over the
kernel and it's currently impossible to include other header files in this
list.h without creating some circular dependencies.For example, list.h implements rcu-protected list and uses rcu_dereference()
without including rcupdate.h. It actually compiles because users of
rcu_dereference() are macros. Others RCU functions could be used too but
aren't probably because of this.Therefore this patch creates rculist.h which includes rcupdates without to
many changes/troubles.Signed-off-by: Franck Bui-Huu
Acked-by: Paul E. McKenney
Acked-by: Josh Triplett
Signed-off-by: Andrew Morton
Signed-off-by: Ingo Molnar
28 Apr, 2008
1 commit
-
Previously I added sessionid output to all audit messages where it was
available but we still didn't know the sessionid of the sender of
netlink messages. This patch adds that information to netlink messages
so we can audit who sent netlink messages.Signed-off-by: Eric Paris
Signed-off-by: Al Viro
18 Apr, 2008
1 commit
-
dev_get_by_index() may return NULL if nothing is found. In
net/netlabel/netlabel_unlabeled.c::netlbl_unlabel_staticlist_gen() the
function is called, but the return value is never checked. If it returns
NULL then we'll deref a NULL pointer on the very next line.
I checked the callers, and I don't think this can actually happen today,
but code changes over time and in the future it might happen and it does
no harm to be defensive and check for the failure, so that if/when it
happens we'll fail gracefully instead of crashing.Signed-off-by: Jesper Juhl
Acked-by: Paul Moore
Signed-off-by: David S. Miller
26 Mar, 2008
1 commit
-
Introduce per-net_device inlines: dev_net(), dev_net_set().
Without CONFIG_NET_NS, no namespace other than &init_net exists.
Let's explicitly define them to help compiler optimizations.Signed-off-by: YOSHIFUJI Hideaki
18 Feb, 2008
2 commits
-
Everything that is called from netlbl_init() can be marked with
__init. This moves 620 bytes from .text section to .text.init one.Signed-off-by: Pavel Emelyanov
Acked-by: Paul Moore
Signed-off-by: David S. Miller -
Turning them to array and registration in a loop saves
80 lines of code and ~300 bytes from text section.Signed-off-by: Pavel Emelyanov
Acked-by: Paul Moore
Signed-off-by: David S. Miller
13 Feb, 2008
4 commits
-
This one is called from under this config only, so move
it in the same place.Signed-off-by: Pavel Emelyanov
Signed-off-by: David S. Miller -
Some code declares variables on the stack, but uses them
under #ifdef CONFIG_IPV6, so thay become unused when ipv6
is off. Fortunately, they are used in a switch's case
branches, so the fix is rather simple.Is it OK from coding style POV to add braces inside "cases",
or should I better avoid such style and rework the patch?Signed-off-by: Pavel Emelyanov
Signed-off-by: David S. Miller -
The audit_log_start() will expand into an empty do { } while (0)
construction and the audit_ctx becomes unused.The solution: push current->audit_context into audit_log_start()
directly, since it is not required in any other place in the
calling function.Signed-off-by: Pavel Emelyanov
Signed-off-by: David S. Miller -
Currently, if the call to netlbl_domhsh_search succeeds the
return result will still be NULL.Fix that, by returning the found entry (if any).
Signed-off-by: Pavel Emelyanov
Acked-by: Paul Moore
Signed-off-by: David S. Miller
06 Feb, 2008
1 commit
-
Add a new set of configuration functions to the NetLabel/LSM API so that
LSMs can perform their own configuration of the NetLabel subsystem without
relying on assistance from userspace.Signed-off-by: Paul Moore
Signed-off-by: Casey Schaufler
Reviewed-by: James Morris
Cc: Chris Wright
Cc: Stephen Smalley
Cc: Casey Schaufler
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
30 Jan, 2008
7 commits
-
This patch adds auditing support to the NetLabel static labeling mechanism.
Signed-off-by: Paul Moore
Signed-off-by: James Morris -
Most trusted OSs, with the exception of Linux, have the ability to specify
static security labels for unlabeled networks. This patch adds this ability to
the NetLabel packet labeling framework.If the NetLabel subsystem is called to determine the security attributes of an
incoming packet it first checks to see if any recognized NetLabel packet
labeling protocols are in-use on the packet. If none can be found then the
unlabled connection table is queried and based on the packets incoming
interface and address it is matched with a security label as configured by the
administrator using the netlabel_tools package. The matching security label is
returned to the caller just as if the packet was explicitly labeled using a
labeling protocol.Signed-off-by: Paul Moore
Signed-off-by: James Morris -
In order to do any sort of IP header inspection of incoming packets we need to
know which address family, AF_INET/AF_INET6/etc., it belongs to and since the
sk_buff structure does not store this information we need to pass along the
address family separate from the packet itself.Signed-off-by: Paul Moore
Signed-off-by: James Morris -
This patch adds support to the NetLabel LSM secattr struct for a secid token
and a type field, paving the way for full LSM/SELinux context support and
"static" or "fallback" labels. In addition, this patch adds a fair amount
of documentation to the core NetLabel structures used as part of the
NetLabel kernel API.Signed-off-by: Paul Moore
Signed-off-by: James Morris -
Currently we use two separate spinlocks to protect both the hash/mapping table
and the default entry. This could be considered a bit foolish because it adds
complexity without offering any real performance advantage. This patch
removes the dedicated default spinlock and protects the default entry with the
hash/mapping table spinlock.Signed-off-by: Paul Moore
Signed-off-by: James Morris -
The NetLabel/LSM domain hash table search function used an argument to specify
if the default entry should be returned if an exact match couldn't be found in
the hash table. This is a bit against the kernel's style so make two separate
functions to represent the separate behaviors.Signed-off-by: Paul Moore
Signed-off-by: James Morris -
This patch removes some unneeded RCU read locks as we can treat the reads as
"safe" even without RCU. It also converts the NetLabel configuration refcount
from a spinlock protected u32 into atomic_t to be more consistent with the rest
of the kernel.Signed-off-by: Paul Moore
Signed-off-by: James Morris
21 Dec, 2007
1 commit
-
Signed-off-by: Joe Perches
Signed-off-by: David S. Miller
26 Oct, 2007
1 commit
-
This fixes some awkward, and perhaps even problematic, RCU lock usage in the
NetLabel code as well as some other related trivial cleanups found when
looking through the RCU locking. Most of the changes involve removing the
redundant RCU read locks wrapping spinlocks in the case of a RCU writer.Signed-off-by: Paul Moore
Signed-off-by: David S. Miller
11 Oct, 2007
1 commit
-
This change allows the generic attribute interface to be used within
the netfilter subsystem where this flag was initially introduced.The byte-order flag is yet unused, it's intended use is to
allow automatic byte order convertions for all atomic types.Signed-off-by: Thomas Graf
Signed-off-by: David S. Miller
08 Aug, 2007
1 commit
-
The LSM domain mapping head table pointer was not being referenced via the RCU
safe dereferencing function, rcu_dereference(). This patch adds those missing
calls to the NetLabel code.This has been tested using recent linux-2.6 git kernels with no visible
regressions.Signed-off-by: Paul Moore
Signed-off-by: David S. Miller
02 Aug, 2007
1 commit
-
The security_secid_to_secctx() function returns memory that must be freed
by a call to security_release_secctx() which was not always happening. This
patch fixes two of these problems (all that I could find in the kernel source
at present).Signed-off-by: Paul Moore
Acked-by: Stephen Smalley
Signed-off-by: James Morris