calipso: Set the calipso socket label to match the secattr.
Subsystems (5)
RFC PATCH v3 10/19 calipso: Set the calipso socket label to match the secattr.
CALIPSO is a hop-by-hop IPv6 option. A lot of this patch is based on the equivalent CISPO code. The main difference is due to manipulating the options in the hop-by-hop header.
Signed-off-by Huw Davies <[email protected]>
--- include/net/ipv6.h | 2 + include/net/netlabel.h | 9 + include/uapi/linux/in6.h | 1 + net/ipv6/calipso.c | 595 ++++++++++++++++++++++++++++++++++++++++ net/ipv6/ipv6_sockglue.c | 1 - net/netlabel/Kconfig | 1 + net/netlabel/netlabel_calipso.c | 64 +++++ net/netlabel/netlabel_calipso.h | 5 + net/netlabel/netlabel_kapi.c | 64 ++++- security/selinux/netlabel.c | 2 +- 10 files changed, 733 insertions(+), 11 deletions(-)
include/net/ipv6.h +2 -0
@@ -315,6 +315,8 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,bool ipv6_opt_accepted (const struct sock *sk,const struct sk_buff *skb,const struct inet6_skb_parm *opt); +struct ipv6_txoptions *ipv6_update_options (struct sock *sk, +struct ipv6_txoptions *opt);static inline bool ipv6_accept_ra (struct inet6_dev *idev) {
include/net/netlabel.h +9 -0
@@ -226,6 +226,9 @@ struct netlbl_lsm_secattr {* @doi_getdef: returns a reference to a DOI * @doi_putdef: releases a reference of a DOI * @doi_walk: enumerate the DOI list +* @sock_getattr: retrieve the socket's attr +* @sock_setattr: set the socket's attr +* @sock_delattr: remove the socket's attr * * Description: * This structure is filled out by the CALIPSO engine and passed
@@ -243,6 +246,12 @@ struct netlbl_calipso_ops {int (*doi_walk)(u32 *skip_cnt,int (*callback)(struct calipso_doi *doi_def,void *arg),void *cb_arg); +int (*sock_getattr)(struct sock *sk, +struct netlbl_lsm_secattr *secattr); +int (*sock_setattr)(struct sock *sk, +const struct calipso_doi *doi_def, +const struct netlbl_lsm_secattr *secattr); +void (*sock_delattr)(struct sock *sk); };/*
include/uapi/linux/in6.h +1 -0
@@ -143,6 +143,7 @@ struct in6_flowlabel_req {#define IPV6_TLV_PAD1 0#define IPV6_TLV_PADN 1#define IPV6_TLV_ROUTERALERT 5 +#define IPV6_TLV_CALIPSO 7/* RFC 5570 */ #define IPV6_TLV_JUMBO 194#define IPV6_TLV_HAO 201/* home address option */
net/ipv6/calipso.c +595 -0
613 lines not on this page · raw message
net/ipv6/ipv6_sockglue.c +0 -1
@@ -98,7 +98,6 @@ int ip6_ra_control(struct sock *sk, int sel)return 0 ; } -static struct ipv6_txoptions *ipv6_update_options (struct sock *sk,struct ipv6_txoptions *opt) {
net/netlabel/Kconfig +1 -0
@@ -5,6 +5,7 @@ config NETLABEL bool "NetLabel subsystem support" depends on SECURITY + select CRC_CCITT if IPV6 default n ---help--- NetLabel provides support for explicit network packet labeling
net/netlabel/netlabel_calipso.c +64 -0
67 lines not on this page · raw message
net/netlabel/netlabel_calipso.h +5 -0
@@ -128,5 +128,10 @@ void calipso_doi_putdef(struct calipso_doi *doi_def);int calipso_doi_walk (u32 *skip_cnt,int (*callback)(struct calipso_doi *doi_def,void *arg),void *cb_arg); +int calipso_sock_getattr (struct sock *sk,struct netlbl_lsm_secattr *secattr); +int calipso_sock_setattr (struct sock *sk, +const struct calipso_doi *doi_def, +const struct netlbl_lsm_secattr *secattr); +void calipso_sock_delattr (struct sock *sk);#endif
net/netlabel/netlabel_kapi.c +55 -9
124 lines not on this page · raw message
security/selinux/netlabel.c +1 -1
@@ -333,7 +333,7 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)struct sk_security_struct *sksec = sk->sk_security;struct netlbl_lsm_secattr *secattr; -if (family !=PF_INET ) +if (family !=PF_INET && family !=PF_INET6 )return 0 ; secattr =selinux_netlbl_sock_genattr (sk);
Signature · 1 line
2.7.0