This project is mirrored from The repository failed to update .
Repository mirroring has been paused due to too many failed attempts, and can be resumed by a project maintainer.
Last successful update .
  1. 22 Mar, 2012 1 commit
  2. 11 Dec, 2011 1 commit
  3. 29 Nov, 2011 1 commit
    • Paul Moore's avatar
      netlabel: Fix build problems when IPv6 is not enabled · 1281bc25
      Paul Moore authored
      A recent fix to the the NetLabel code caused build problem with
      configurations that did not have IPv6 enabled; see below:
       netlabel_kapi.c: In function 'netlbl_cfg_unlbl_map_add':
        error: implicit declaration of function 'netlbl_af6list_add'
      This patch fixes this problem by making the IPv6 specific code conditional
      on the IPv6 configuration flags as we done in the rest of NetLabel and the
      network stack as a whole.  We have to move some variable declarations
      around as a result so things may not be quite as pretty, but at least it
      builds cleanly now.
      Some additional IPv6 conditionals were added to the NetLabel code as well
      for the sake of consistency.
      Reported-by: default avatarRandy Dunlap <>
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarRandy Dunlap <>
      Signed-off-by: default avatarDavid S. Miller <>
  4. 25 Nov, 2011 1 commit
  5. 22 Nov, 2011 1 commit
  6. 11 Aug, 2011 1 commit
  7. 02 Aug, 2011 2 commits
  8. 26 Jul, 2011 1 commit
  9. 30 Mar, 2010 1 commit
    • Tejun Heo's avatar
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking... · 5a0e3ad6
      Tejun Heo authored
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
      percpu.h is included by sched.h and module.h and thus ends up being
      included when building most .c files.  percpu.h includes slab.h which
      in turn includes gfp.h making everything defined by the two files
      universally available and complicating inclusion dependencies.
      percpu.h -> slab.h dependency is about to be removed.  Prepare for
      this change by updating users of gfp and slab facilities include those
      headers directly instead of assuming availability.  As this conversion
      needs to touch large number of source files, the following script is
      used as the basis of conversion.
      The script does the followings.
      * Scan files for gfp and slab usages and update includes such that
        only the necessary includes are there.  ie. if only gfp is used,
        gfp.h, if slab is used, slab.h.
      * When the script inserts a new include, it looks at the include
        blocks and try to put the new include such that its order conforms
        to its surrounding.  It's put in the include block which contains
        core kernel includes, in the same order that the rest are ordered -
        alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
        doesn't seem to be any matching order.
      * If the script can't find a place to put a new include (mostly
        because the file doesn't have fitting include block), it prints out
        an error message indicating which .h file needs to be added to the
      The conversion was done in the following steps.
      1. The initial automatic conversion of all .c files updated slightly
         over 4000 files, deleting around 700 includes and adding ~480 gfp.h
         and ~3000 slab.h inclusions.  The script emitted errors for ~400
      2. Each error was manually checked.  Some didn't need the inclusion,
         some needed manual addition while adding it to implementation .h or
         embedding .c file was more appropriate for others.  This step added
         inclusions to around 150 files.
      3. The script was run again and the output was compared to the edits
         from #2 to make sure no file was left behind.
      4. Several build tests were done and a couple of problems were fixed.
         e.g. lib/decompress_*.c used malloc/free() wrappers around slab
         APIs requiring slab.h to be added manually.
      5. The script was run on all .h files but without automatically
         editing them as sprinkling gfp.h and slab.h inclusions around .h
         files could easily lead to inclusion dependency hell.  Most gfp.h
         inclusion directives were ignored as stuff from gfp.h was usually
         wildly available and often used in preprocessor macros.  Each
         slab.h inclusion directive was examined and added manually as
      6. percpu.h was updated not to include slab.h.
      7. Build test were done on the following configurations and failures
         were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
         distributed build env didn't work with gcov compiles) and a few
         more options had to be turned off depending on archs to make things
         build (like ipr on powerpc/64 which failed due to missing writeq).
         * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
         * powerpc and powerpc64 SMP allmodconfig
         * sparc and sparc64 SMP allmodconfig
         * ia64 SMP allmodconfig
         * s390 SMP allmodconfig
         * alpha SMP allmodconfig
         * um on x86_64 SMP allmodconfig
      8. percpu.h modifications were reverted so that it could be applied as
         a separate patch and serve as bisection point.
      Given the fact that I had only a couple of failures from tests on step
      6, I'm fairly confident about the coverage of this conversion patch.
      If there is a breakage, it's likely to be something in one of the arch
      headers which should be easily discoverable easily on most builds of
      the specific arch.
      Signed-off-by: default avatarTejun Heo <>
      Guess-its-ok-by: default avatarChristoph Lameter <>
      Cc: Ingo Molnar <>
      Cc: Lee Schermerhorn <>
  10. 30 Jul, 2009 1 commit
  11. 27 Jul, 2009 1 commit
  12. 28 Mar, 2009 2 commits
    • Paul Moore's avatar
      netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections · 07feee8f
      Paul Moore authored
      This patch cleans up a lot of the Smack network access control code.  The
      largest changes are to fix the labeling of incoming TCP connections in a
      manner similar to the recent SELinux changes which use the
      security_inet_conn_request() hook to label the request_sock and let the label
      move to the child socket via the normal network stack mechanisms.  In addition
      to the incoming TCP connection fixes this patch also removes the smk_labled
      field from the socket_smack struct as the minor optimization advantage was
      outweighed by the difficulty in maintaining it's proper state.
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarCasey Schaufler <>
      Signed-off-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Label incoming TCP connections correctly in SELinux · 389fb800
      Paul Moore authored
      The current NetLabel/SELinux behavior for incoming TCP connections works but
      only through a series of happy coincidences that rely on the limited nature of
      standard CIPSO (only able to convey MLS attributes) and the write equality
      imposed by the SELinux MLS constraints.  The problem is that network sockets
      created as the result of an incoming TCP connection were not on-the-wire
      labeled based on the security attributes of the parent socket but rather based
      on the wire label of the remote peer.  The issue had to do with how IP options
      were managed as part of the network stack and where the LSM hooks were in
      relation to the code which set the IP options on these newly created child
      sockets.  While NetLabel/SELinux did correctly set the socket's on-the-wire
      label it was promptly cleared by the network stack and reset based on the IP
      options of the remote peer.
      This patch, in conjunction with a prior patch that adjusted the LSM hook
      locations, works to set the correct on-the-wire label format for new incoming
      connections through the security_inet_conn_request() hook.  Besides the
      correct behavior there are many advantages to this change, the most significant
      is that all of the NetLabel socket labeling code in SELinux now lives in hooks
      which can return error codes to the core stack which allows us to finally get
      ride of the selinux_netlbl_inode_permission() logic which greatly simplfies
      the NetLabel/SELinux glue code.  In the process of developing this patch I
      also ran into a small handful of AF_INET6 cleanliness issues that have been
      fixed which should make the code safer and easier to extend in the future.
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarCasey Schaufler <>
      Signed-off-by: default avatarJames Morris <>
  13. 31 Dec, 2008 1 commit
  14. 10 Oct, 2008 8 commits
    • Paul Moore's avatar
      netlabel: Add configuration support for local labeling · d91d4079
      Paul Moore authored
      Add the necessary NetLabel support for the new CIPSO mapping,
      CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
    • Paul Moore's avatar
      cipso: Add support for native local labeling and fixup mapping names · 15c45f7b
      Paul Moore authored
      This patch accomplishes three minor tasks: add a new tag type for local
      labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
      replace some of the CIPSO "magic numbers" with constants from the header
      file.  The first change allows CIPSO to support full LSM labels/contexts,
      not just MLS attributes.  The second change brings the mapping names inline
      with what userspace is using, compatibility is preserved since we don't
      actually change the value.  The last change is to aid readability and help
      prevent mistakes.
      Signed-off-by: default avatarPaul Moore <>
    • Paul Moore's avatar
      selinux: Set socket NetLabel based on connection endpoint · 014ab19a
      Paul Moore authored
      Previous work enabled the use of address based NetLabel selectors, which while
      highly useful, brought the potential for additional per-packet overhead when
      used.  This patch attempts to solve that by applying NetLabel socket labels
      when sockets are connect()'d.  This should alleviate the per-packet NetLabel
      labeling for all connected sockets (yes, it even works for connected DGRAM
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Add functionality to set the security attributes of a packet · 948bf85c
      Paul Moore authored
      This patch builds upon the new NetLabel address selector functionality by
      providing the NetLabel KAPI and CIPSO engine support needed to enable the
      new packet-based labeling.  The only new addition to the NetLabel KAPI at
      this point is shown below:
       * int netlbl_skbuff_setattr(skb, family, secattr)
      ... and is designed to be called from a Netfilter hook after the packet's
      IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.
      This patch also provides the necessary SELinux hooks to support this new
      functionality.  Smack support is not currently included due to uncertainty
      regarding the permissions needed to expand the Smack network access controls.
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Add network address selectors to the NetLabel/LSM domain mapping · 63c41688
      Paul Moore authored
      This patch extends the NetLabel traffic labeling capabilities to individual
      packets based not only on the LSM domain but the by the destination address
      as well.  The changes here only affect the core NetLabel infrastructre,
      changes to the NetLabel KAPI and individial protocol engines are also
      required but are split out into a different patch to ease review.
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Replace protocol/NetLabel linking with refrerence counts · b1edeb10
      Paul Moore authored
      NetLabel has always had a list of backpointers in the CIPSO DOI definition
      structure which pointed to the NetLabel LSM domain mapping structures which
      referenced the CIPSO DOI struct.  The rationale for this was that when an
      administrator removed a CIPSO DOI from the system all of the associated
      NetLabel LSM domain mappings should be removed as well; a list of
      backpointers made this a simple operation.
      Unfortunately, while the backpointers did make the removal easier they were
      a bit of a mess from an implementation point of view which was making
      further development difficult.  Since the removal of a CIPSO DOI is a
      realtively rare event it seems to make sense to remove this backpointer
      list as the optimization was hurting us more then it was helping.  However,
      we still need to be able to track when a CIPSO DOI definition is being used
      so replace the backpointer list with a reference count.  In order to
      preserve the current functionality of removing the associated LSM domain
      mappings when a CIPSO DOI is removed we walk the LSM domain mapping table,
      removing the relevant entries.
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
    • Paul Moore's avatar
      selinux: Fix missing calls to netlbl_skbuff_err() · dfaebe98
      Paul Moore authored
      At some point I think I messed up and dropped the calls to netlbl_skbuff_err()
      which are necessary for CIPSO to send error notifications to remote systems.
      This patch re-introduces the error handling calls into the SELinux code.
      Signed-off-by: default avatarPaul Moore <>
      Acked-by: default avatarJames Morris <>
    • Paul Moore's avatar
      netlabel: Remove unneeded in-kernel API functions · 948a7243
      Paul Moore authored
      After some discussions with the Smack folks, well just Casey, I now have a
      better idea of what Smack wants out of NetLabel in the future so I think it
      is now safe to do some API "pruning".  If another LSM comes along that
      needs this functionality we can always add it back in, but I don't see any
      LSMs on the horizon which might make use of these functions.
      Thanks to Rami Rosen who suggested removing netlbl_cfg_cipsov4_del() back
      in February 2008.
      Signed-off-by: default avatarPaul Moore <>
      Reviewed-by: default avatarJames Morris <>
  15. 05 Feb, 2008 1 commit
  16. 29 Jan, 2008 3 commits
  17. 19 Jul, 2007 1 commit
    • Paul Moore's avatar
      SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement · 23bcdc1a
      Paul Moore authored
      Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the
      current runtime status of NetLabel based on the existing configuration.  LSMs
      that make use of NetLabel, i.e. SELinux, can use this new function to determine
      if they should perform NetLabel access checks.  This patch changes the
      NetLabel/SELinux glue code such that SELinux only enforces NetLabel related
      access checks when netlbl_enabled() returns true.
      At present NetLabel is considered to be enabled when there is at least one
      labeled protocol configuration present.  The result is that by default NetLabel
      is considered to be disabled, however, as soon as an administrator configured
      a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing
      NetLabel related access controls - including unlabeled packet controls.
      This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL"
      blocks into a single block to ease future review as recommended by Linus.
      Signed-off-by: default avatarPaul Moore <>
      Signed-off-by: default avatarJames Morris <>
  18. 08 Jun, 2007 1 commit
  19. 26 Apr, 2007 1 commit
  20. 03 Dec, 2006 3 commits
    • Paul Moore's avatar
      NetLabel: convert to an extensibile/sparse category bitmap · 02752760
      Paul Moore authored
      The original NetLabel category bitmap was a straight char bitmap which worked
      fine for the initial release as it only supported 240 bits due to limitations
      in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
      straight char bitmap into an extensibile/sparse bitmap in order to lay the
      foundation for other CIPSO tag types and protocols.
      This patch also has a nice side effect in that all of the security attributes
      passed by NetLabel into the LSM are now in a format which is in the host's
      native byte/bit ordering which makes the LSM specific code much simpler; look
      at the changes in security/selinux/ss/ebitmap.c as an example.
      Signed-off-by: default avatarPaul Moore <>
      Signed-off-by: default avatarJames Morris <>
    • Paul Moore's avatar
      NetLabel: check for a CIPSOv4 option before we do call into the CIPSOv4 layer · 05e00cbf
      Paul Moore authored
      Right now the NetLabel code always jumps into the CIPSOv4 layer to determine if
      a CIPSO IP option is present.  However, we can do this check directly in the
      NetLabel code by making use of the CIPSO_V4_OPTEXIST() macro which should save
      us a function call in the common case of not having a CIPSOv4 option present.
      Signed-off-by: default avatarPaul Moore <>
      Signed-off-by: default avatarJames Morris <>
    • Paul Moore's avatar
      NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand · 701a90ba
      Paul Moore authored
      The existing netlbl_lsm_secattr struct required the LSM to check all of the
      fields to determine if any security attributes were present resulting in a lot
      of work in the common case of no attributes.  This patch adds a 'flags' field
      which is used to indicate which attributes are present in the structure; this
      should allow the LSM to do a quick comparison to determine if the structure
      holds any security attributes.
       if (netlbl_lsm_secattr->flags)
      	/* security attributes present */
      	/* NO security attributes present */
      Signed-off-by: default avatarPaul Moore <>
      Signed-off-by: default avatarJames Morris <>
  21. 12 Oct, 2006 1 commit
  22. 25 Sep, 2006 1 commit
  23. 22 Sep, 2006 1 commit
    • Paul Moore's avatar
      [NetLabel]: core NetLabel subsystem · d15c345f
      Paul Moore authored
      Add a new kernel subsystem, NetLabel, to provide explicit packet
      labeling services (CIPSO, RIPSO, etc.) to LSM developers.  NetLabel is
      designed to work in conjunction with a LSM to intercept and decode
      security labels on incoming network packets as well as ensure that
      outgoing network packets are labeled according to the security
      mechanism employed by the LSM.  The NetLabel subsystem is configured
      through a Generic NETLINK interface described in the header files
      included in this patch.
      Signed-off-by: default avatarPaul Moore <>
      Signed-off-by: default avatarDavid S. Miller <>