linux-toradex.git/include/linux/selinux.h, branch v3.0.3

secmark: make secmark object handling generic

2010-10-20T23:12:48+00:00

Right now secmark has lots of direct selinux calls.  Use all LSM calls and
remove all SELinux specific knowledge.  The only SELinux specific knowledge
we leave is the mode.  The only point is to make sure that other LSMs at
least test this generic code before they assume it works.  (They may also
have to make changes if they do not represent labels as strings)

Signed-off-by: Eric Paris 
Acked-by: Paul Moore 
Acked-by: Patrick McHardy 
Signed-off-by: James Morris

SELinux: inline selinux_is_enabled in !CONFIG_SECURITY_SELINUX

2009-09-15T01:37:33+00:00

Without this patch building a kernel emits millions of warning like:

include/linux/selinux.h:92: warning: ?selinux_is_enabled? defined but not used

When it is build without CONFIG_SECURITY_SELINUX.  This is harmless, but
the function should be inlined, so it gets compiled out.

Reported-by: Linus Torvalds 
Signed-off-by: Eric Paris 
Signed-off-by: James Morris

Creds: creds->security can be NULL is selinux is disabled

2009-09-14T02:34:07+00:00

__validate_process_creds should check if selinux is actually enabled before
running tests on the selinux portion of the credentials struct.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

SELinux: use new audit hooks, remove redundant exports

2008-04-18T23:53:46+00:00

Setup the new Audit LSM hooks for SELinux.
Remove the now redundant exported SELinux Audit interface.

Audit: Export 'audit_krule' and 'audit_field' to the public
since their internals are needed by the implementation of the
new LSM hook 'audit_rule_known'.

Signed-off-by: Casey Schaufler 
Signed-off-by: Ahmed S. Darwish 
Acked-by: James Morris

SELinux: remove redundant exports

2008-04-18T23:52:36+00:00

Remove the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)

They can be substitued with the following generic equivalents
respectively:
new LSM hook, inode_getsecid(inode, secid)
new LSM hook, ipc_getsecid*(ipcp, secid)
LSM hook, task_getsecid(tsk, secid)
LSM hook, sid_to_secctx(sid, ctx, len)

Signed-off-by: Casey Schaufler 
Signed-off-by: Ahmed S. Darwish 
Acked-by: James Morris 
Reviewed-by: Paul Moore

SELinux: Enable dynamic enable/disable of the network access checks

2008-01-29T21:17:26+00:00

This patch introduces a mechanism for checking when labeled IPsec or SECMARK
are in use by keeping introducing a configuration reference counter for each
subsystem.  In the case of labeled IPsec, whenever a labeled SA or SPD entry
is created the labeled IPsec/XFRM reference count is increased and when the
entry is removed it is decreased.  In the case of SECMARK, when a SECMARK
target is created the reference count is increased and later decreased when the
target is removed.  These reference counters allow SELinux to quickly determine
if either of these subsystems are enabled.

NetLabel already has a similar mechanism which provides the netlbl_enabled()
function.

This patch also renames the selinux_relabel_packet_permission() function to
selinux_secmark_relabel_packet_permission() as the original name and
description were misleading in that they referenced a single packet label which
is not the case.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

SELinux: return EOPNOTSUPP not ENOTSUPP

2007-11-16T23:38:16+00:00

ENOTSUPP is not a valid error code in the kernel (it is defined in some
NFS internal error codes and has been improperly used other places).  In
the !CONFIG_SECURITY_SELINUX case though it is possible that we could
return this from selinux_audit_rule_init().  This patch just returns the
userspace valid EOPNOTSUPP.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

[PATCH] selinux: replace ctxid with sid in selinux_audit_rule_match interface

2006-09-26T15:48:52+00:00

Replace ctxid with sid in selinux_audit_rule_match interface for
consistency with other interfaces.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: rename selinux_ctxid_to_string

2006-09-26T15:48:52+00:00

Rename selinux_ctxid_to_string to selinux_sid_to_string to be
consistent with other interfaces.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] selinux: eliminate selinux_task_ctxid

2006-09-26T15:48:52+00:00

Eliminate selinux_task_ctxid since it duplicates selinux_task_get_sid.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds