linux-toradex.git/net/netlabel, branch v2.6.28.9

netlabel: Compiler warning and NULL pointer dereference fix

2008-12-12T05:31:50+00:00

Fix the two compiler warnings show below.  Thanks to Geert Uytterhoeven for
finding and reporting the problem.

 net/netlabel/netlabel_unlabeled.c:567: warning: 'entry' may be used
   uninitialized in this function
 net/netlabel/netlabel_unlabeled.c:629: warning: 'entry' may be used
   uninitialized in this function

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

netlabel: Fix a potential NULL pointer dereference

2008-12-03T08:37:04+00:00

Fix a potential NULL pointer dereference seen when trying to remove a
static label configuration with an invalid address/mask combination.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller

netlabel: Fix compilation warnings in net/netlabel/netlabel_addrlist.c

2008-10-30T14:44:48+00:00

Enable netlabel auditing functions only when CONFIG_AUDIT is set

Signed-off-by: Manish Katiyar 
Signed-off-by: Paul Moore

netlabel: Fix compiler warnings in netlabel_mgmt.c

2008-10-29T20:09:12+00:00

Fix the compiler warnings below, thanks to Andrew Morton for finding them.

 net/netlabel/netlabel_mgmt.c: In function `netlbl_mgmt_listentry':
 net/netlabel/netlabel_mgmt.c:268: warning: 'ret_val' might be used
  uninitialized in this function

Signed-off-by: Paul Moore

netlabel: Add configuration support for local labeling

2008-10-10T14:16:34+00:00

Add the necessary NetLabel support for the new CIPSO mapping,
CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.

Signed-off-by: Paul Moore 
Reviewed-by: James Morris

cipso: Add support for native local labeling and fixup mapping names

2008-10-10T14:16:34+00:00

This patch accomplishes three minor tasks: add a new tag type for local
labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
replace some of the CIPSO "magic numbers" with constants from the header
file.  The first change allows CIPSO to support full LSM labels/contexts,
not just MLS attributes.  The second change brings the mapping names inline
with what userspace is using, compatibility is preserved since we don't
actually change the value.  The last change is to aid readability and help
prevent mistakes.

Signed-off-by: Paul Moore

selinux: Set socket NetLabel based on connection endpoint

2008-10-10T14:16:33+00:00

Previous work enabled the use of address based NetLabel selectors, which while
highly useful, brought the potential for additional per-packet overhead when
used.  This patch attempts to solve that by applying NetLabel socket labels
when sockets are connect()'d.  This should alleviate the per-packet NetLabel
labeling for all connected sockets (yes, it even works for connected DGRAM
sockets).

Signed-off-by: Paul Moore 
Reviewed-by: James Morris

netlabel: Add functionality to set the security attributes of a packet

2008-10-10T14:16:32+00:00

This patch builds upon the new NetLabel address selector functionality by
providing the NetLabel KAPI and CIPSO engine support needed to enable the
new packet-based labeling.  The only new addition to the NetLabel KAPI at
this point is shown below:

 * int netlbl_skbuff_setattr(skb, family, secattr)

... and is designed to be called from a Netfilter hook after the packet's
IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.

This patch also provides the necessary SELinux hooks to support this new
functionality.  Smack support is not currently included due to uncertainty
regarding the permissions needed to expand the Smack network access controls.

Signed-off-by: Paul Moore 
Reviewed-by: James Morris

netlabel: Add network address selectors to the NetLabel/LSM domain mapping

2008-10-10T14:16:32+00:00

This patch extends the NetLabel traffic labeling capabilities to individual
packets based not only on the LSM domain but the by the destination address
as well.  The changes here only affect the core NetLabel infrastructre,
changes to the NetLabel KAPI and individial protocol engines are also
required but are split out into a different patch to ease review.

Signed-off-by: Paul Moore 
Reviewed-by: James Morris

netlabel: Add a generic way to create ordered linked lists of network addrs

2008-10-10T14:16:32+00:00

Create an ordered IP address linked list mechanism similar to the core
kernel's linked list construct.  The idea behind this list functionality
is to create an extensibile linked list ordered by IP address mask to
ease the matching of network addresses.  The linked list is ordered with
larger address masks at the front of the list and shorter address masks
at the end to facilitate overriding network entries with individual host
or subnet entries.

Signed-off-by: Paul Moore 
Reviewed-by: James Morris