Skip to contentSkip to conversation

netlabel: Implement CALIPSO config functions for SMACK.

RFC PATCH In review Huw Davies 1 participant 1 message Feb 17, 2016

Subsystems (4)
Networking Network drivers SELinux security module Labeled networking (NetLabel)
lore
Share & tools
lore

Huw Davies

author
#0 lore raw

RFC PATCH v3 19/19 netlabel: Implement CALIPSO config functions for SMACK.

SMACK uses similar functions to control CIPSO, these are the equivalent functions for CALIPSO and follow exactly the same semantics.

int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
struct netlbl_audit *audit_info)
Adds a CALIPSO doi.

void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
Removes a CALIPSO doi.

int netlbl_cfg_calipso_map_add(u32 doi, const char *domain,
const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info)
Creates a mapping between a domain and a CALIPSO doi. If addr and mask are non-NULL this creates an address-selector type mapping.

This also extends netlbl_cfg_map_del() to remove IPv6 address-selector mappings.

Signed-off-by Huw Davies <[email protected]>
---
 include/net/netlabel.h             |  26 +++++++
 net/netlabel/netlabel_domainhash.c |  66 ++++++++++++++++++
 net/netlabel/netlabel_domainhash.h |   8 +++
 net/netlabel/netlabel_kapi.c       | 138 +++++++++++++++++++++++++++++++++++++
 4 files changed, 238 insertions(+)
include/net/netlabel.h +26 -0
index a306bc7..efe9806 100644
@@ -445,6 +445,14 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 			       const struct in_addr *addr,
 			       const struct in_addr *mask,
 			       struct netlbl_audit *audit_info);
+int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
+			   struct netlbl_audit *audit_info);
+void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
+int netlbl_cfg_calipso_map_add(u32 doi,
+			       const char *domain,
+			       const struct in6_addr *addr,
+			       const struct in6_addr *mask,
+			       struct netlbl_audit *audit_info);
 /*
  * LSM security attribute operations
  */

@@ -561,6 +569,24 @@ static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
 {
 	return -ENOSYS;
 }
+static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
+					 struct netlbl_audit *audit_info)
+{
+	return -ENOSYS;
+}
+static inline void netlbl_cfg_calipso_del(u32 doi,
+					  struct netlbl_audit *audit_info)
+{
+	return;
+}
+static inline int netlbl_cfg_calipso_map_add(u32 doi,
+					     const char *domain,
+					     const struct in6_addr *addr,
+					     const struct in6_addr *mask,
+					     struct netlbl_audit *audit_info)
+{
+	return -ENOSYS;
+}
 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
 				     u32 offset)
 {
net/netlabel/netlabel_domainhash.c +66 -0

72 lines not on this page · raw message

net/netlabel/netlabel_domainhash.h +8 -0
index b7ddb6e..1f92477 100644
@@ -93,6 +93,10 @@ int netlbl_domhsh_remove_af4(const char *domain,
 			     const struct in_addr *addr,
 			     const struct in_addr *mask,
 			     struct netlbl_audit *audit_info);
+int netlbl_domhsh_remove_af6(const char *domain,
+			     const struct in6_addr *addr,
+			     const struct in6_addr *mask,
+			     struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove(const char *domain, u16 family,
 			 struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove_default(u16 family, struct netlbl_audit *audit_info);

@@ -102,6 +106,10 @@ struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
 #if IS_ENABLED(CONFIG_IPV6)
 struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
 						   const struct in6_addr *addr);
+int netlbl_domhsh_remove_af6(const char *domain,
+			     const struct in6_addr *addr,
+			     const struct in6_addr *mask,
+			     struct netlbl_audit *audit_info);
 #endif /* IPv6 */
 
 int netlbl_domhsh_walk(u32 *skip_bkt,
net/netlabel/netlabel_kapi.c +138 -0

150 lines not on this page · raw message

Signature · 1 line
2.7.0