linux-toradex.git/include/net/cipso_ipv4.h, branch v2.6.23.8

[NetLabel]: consolidate the struct socket/sock handling to just struct sock

2007-06-08T20:33:09+00:00

The current NetLabel code has some redundant APIs which allow both
"struct socket" and "struct sock" types to be used; this may have made
sense at some point but it is wasteful now.  Remove the functions that
operate on sockets and convert the callers.  Not only does this make
the code smaller and more consistent but it pushes the locking burden
up to the caller which can be more intelligent about the locks.  Also,
perform the same conversion (socket to sock) on the SELinux/NetLabel
glue code where it make sense.

Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

[SK_BUFF]: Introduce skb_network_header()

2007-04-26T05:24:59+00:00

For the places where we need a pointer to the network header, it is still legal
to touch skb->nh.raw directly if just adding to, subtracting from or setting it
to another layer header.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

NetLabel: use the correct CIPSOv4 MLS label limits

2006-12-03T05:24:12+00:00

The CIPSOv4 engine currently has MLS label limits which are slightly larger
than what the draft allows.  This is not a major problem due to the current
implementation but we should fix this so it doesn't bite us later.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

[NetLabel]: audit fixups due to delayed feedback

2006-09-30T00:05:05+00:00

Fix some issues Steve Grubb had with the way NetLabel was using the audit
subsystem.  This should make NetLabel more consistent with other kernel
generated audit messages specifying configuration changes.

Signed-off-by: Paul Moore 
Acked-by: Steve Grubb 
Signed-off-by: David S. Miller

[NetLabel]: add audit support for configuration changes

2006-09-29T01:03:09+00:00

This patch adds audit support to NetLabel, including six new audit message
types shown below.

 #define AUDIT_MAC_UNLBL_ACCEPT 1406
 #define AUDIT_MAC_UNLBL_DENY   1407
 #define AUDIT_MAC_CIPSOV4_ADD  1408
 #define AUDIT_MAC_CIPSOV4_DEL  1409
 #define AUDIT_MAC_MAP_ADD      1410
 #define AUDIT_MAC_MAP_DEL      1411

Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

[NetLabel]: rework the Netlink attribute handling (part 1)

2006-09-25T22:56:09+00:00

At the suggestion of Thomas Graf, rewrite NetLabel's use of Netlink attributes
to better follow the common Netlink attribute usage.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

[NetLabel]: correct improper handling of non-NetLabel peer contexts

2006-09-25T22:52:01+00:00

Fix a problem where NetLabel would always set the value of 
sk_security_struct->peer_sid in selinux_netlbl_sock_graft() to the context of
the socket, causing problems when users would query the context of the
connection.  This patch fixes this so that the value in
sk_security_struct->peer_sid is only set when the connection is NetLabel based,
otherwise the value is untouched.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

[NetLabel]: add some missing #includes to various header files

2006-09-22T22:18:39+00:00

Add some missing include files to the NetLabel related header files.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

[NetLabel]: remove unused function prototypes

2006-09-22T22:18:35+00:00

Removed some older function prototypes for functions that no longer exist.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

[NetLabel]: core network changes

2006-09-22T21:53:32+00:00

Changes to the core network stack to support the NetLabel subsystem.  This
includes changes to the IPv4 option handling to support CIPSO labels.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller