Casey Schaufler
bc04c8e3f4
BugLink: http://bugs.launchpad.net/bugs/2028253 Allow LSMs to request exclusive access to the netlabel facility. Provide mechanism for LSMs to determine if they have access to netlabel. Update the current users of netlabel, SELinux and Smack, to use and respect the exclusive use of netlabel. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> (cherry picked from commit ae3fd34fef7a12601d5abf3471b269b86080104d https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next) Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
143 lines
3.6 KiB
C
143 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* SELinux interface to the NetLabel subsystem
|
|
*
|
|
* Author: Paul Moore <paul@paul-moore.com>
|
|
*/
|
|
|
|
/*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*/
|
|
|
|
#ifndef _SELINUX_NETLABEL_H_
|
|
#define _SELINUX_NETLABEL_H_
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/net.h>
|
|
#include <linux/skbuff.h>
|
|
#include <net/sock.h>
|
|
#include <net/request_sock.h>
|
|
#include <net/sctp/structs.h>
|
|
|
|
#include "avc.h"
|
|
#include "objsec.h"
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void selinux_netlbl_cache_invalidate(void);
|
|
|
|
void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error,
|
|
int gateway);
|
|
|
|
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec);
|
|
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec);
|
|
|
|
int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u16 family, u32 *type,
|
|
u32 *sid);
|
|
int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, u16 family, u32 sid);
|
|
int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
|
|
struct sk_buff *skb);
|
|
int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family);
|
|
void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family);
|
|
void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk);
|
|
int selinux_netlbl_socket_post_create(struct sock *sk, u16 family);
|
|
int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
|
|
struct sk_buff *skb, u16 family,
|
|
struct common_audit_data *ad);
|
|
int selinux_netlbl_socket_setsockopt(struct socket *sock, int level,
|
|
int optname);
|
|
int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr);
|
|
int selinux_netlbl_socket_connect_locked(struct sock *sk,
|
|
struct sockaddr *addr);
|
|
|
|
#else
|
|
static inline void selinux_netlbl_cache_invalidate(void)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline void selinux_netlbl_err(struct sk_buff *skb, u16 family,
|
|
int error, int gateway)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline void
|
|
selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline void
|
|
selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u16 family,
|
|
u32 *type, u32 *sid)
|
|
{
|
|
*type = NETLBL_NLTYPE_NONE;
|
|
*sid = SECSID_NULL;
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, u16 family,
|
|
u32 sid)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int
|
|
selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
|
|
struct sk_buff *skb)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_inet_conn_request(struct request_sock *req,
|
|
u16 family)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)
|
|
{
|
|
return;
|
|
}
|
|
static inline void selinux_netlbl_sctp_sk_clone(struct sock *sk,
|
|
struct sock *newsk)
|
|
{
|
|
return;
|
|
}
|
|
static inline int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
|
|
struct sk_buff *skb, u16 family,
|
|
struct common_audit_data *ad)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_socket_setsockopt(struct socket *sock,
|
|
int level, int optname)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_socket_connect(struct sock *sk,
|
|
struct sockaddr *addr)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline int selinux_netlbl_socket_connect_locked(struct sock *sk,
|
|
struct sockaddr *addr)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_NETLABEL */
|
|
|
|
static inline bool selinux_netlbl_enabled(void)
|
|
{
|
|
return selinux_blob_sizes.lbs_netlabel && netlbl_enabled();
|
|
}
|
|
|
|
#endif
|