linux-toradex.git/include/net/netlabel.h, branch v2.6.24.2

SELinux: restore proper NetLabel caching behavior

2007-08-02T15:52:21+00:00

A small fix to the SELinux/NetLabel glue code to ensure that the NetLabel
cache is utilized when possible.  This was broken when the SELinux/NetLabel
glue code was reorganized in the last kernel release.

Signed-off-by: Paul Moore 
Acked-by:  Stephen Smalley 
Signed-off-by: James Morris

SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement

2007-07-19T14:21:11+00:00

Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the
current runtime status of NetLabel based on the existing configuration.  LSMs
that make use of NetLabel, i.e. SELinux, can use this new function to determine
if they should perform NetLabel access checks.  This patch changes the
NetLabel/SELinux glue code such that SELinux only enforces NetLabel related
access checks when netlbl_enabled() returns true.

At present NetLabel is considered to be enabled when there is at least one
labeled protocol configuration present.  The result is that by default NetLabel
is considered to be disabled, however, as soon as an administrator configured
a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing
NetLabel related access controls - including unlabeled packet controls.

This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL"
blocks into a single block to ease future review as recommended by Linus.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

[NetLabel]: consolidate the struct socket/sock handling to just struct sock

2007-06-08T20:33:09+00:00

The current NetLabel code has some redundant APIs which allow both
"struct socket" and "struct sock" types to be used; this may have made
sense at some point but it is wasteful now.  Remove the functions that
operate on sockets and convert the callers.  Not only does this make
the code smaller and more consistent but it pushes the locking burden
up to the caller which can be more intelligent about the locks.  Also,
perform the same conversion (socket to sock) on the SELinux/NetLabel
glue code where it make sense.

Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

NetLabel: convert to an extensibile/sparse category bitmap

2006-12-03T05:31:36+00:00

The original NetLabel category bitmap was a straight char bitmap which worked
fine for the initial release as it only supported 240 bits due to limitations
in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
straight char bitmap into an extensibile/sparse bitmap in order to lay the
foundation for other CIPSO tag types and protocols.

This patch also has a nice side effect in that all of the security attributes
passed by NetLabel into the LSM are now in a format which is in the host's
native byte/bit ordering which makes the LSM specific code much simpler; look
at the changes in security/selinux/ss/ebitmap.c as an example.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand

2006-12-03T05:24:07+00:00

The existing netlbl_lsm_secattr struct required the LSM to check all of the
fields to determine if any security attributes were present resulting in a lot
of work in the common case of no attributes.  This patch adds a 'flags' field
which is used to indicate which attributes are present in the structure; this
should allow the LSM to do a quick comparison to determine if the structure
holds any security attributes.

Example:

 if (netlbl_lsm_secattr->flags)
	/* security attributes present */
 else
	/* NO security attributes present */

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: change netlbl_secattr_init() to return void

2006-12-03T05:24:06+00:00

The netlbl_secattr_init() function would always return 0 making it pointless
to have a return value.  This patch changes the function to return void.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: use gfp_t instead of int where it makes sense

2006-12-03T05:24:04+00:00

There were a few places in the NetLabel code where the int type was being used
instead of the gfp_t type, this patch corrects this mistake.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

[PATCH] gfp_t in netlabel

2006-10-15T18:00:58+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

NetLabel: fix a cache race condition

2006-10-12T06:59:29+00:00

Testing revealed a problem with the NetLabel cache where a cached entry could
be freed while in use by the LSM layer causing an oops and other problems.
This patch fixes that problem by introducing a reference counter to the cache
entry so that it is only freed when it is no longer in use.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

[NetLabel]: audit fixups due to delayed feedback

2006-09-30T00:05:05+00:00

Fix some issues Steve Grubb had with the way NetLabel was using the audit
subsystem.  This should make NetLabel more consistent with other kernel
generated audit messages specifying configuration changes.

Signed-off-by: Paul Moore 
Acked-by: Steve Grubb 
Signed-off-by: David S. Miller