Gitiles
Code Review Sign In
review.evervolv.com / android_kernel_oneplus_msm8996 / 7420ed23a4f77480b5b7b3245e5da30dd24b7575 / . / security / selinux / include / selinux_netlabel.h
blob: 88c463eef1e1be43f948ab1dd976bffeb3c624da [file] [log] [blame]
Venkat Yekkirala7420ed22006-08-04 23:17:57 -0700[diff] [blame^]1/*
2 * SELinux interface to the NetLabel subsystem
3 *
4 * Author : Paul Moore <paul.moore@hp.com>
5 *
6 */
7
8/*
9 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
19 * the GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 *
25 */
26
27#ifndef _SELINUX_NETLABEL_H_
28#define _SELINUX_NETLABEL_H_
29
30#ifdef CONFIG_NETLABEL
31void selinux_netlbl_cache_invalidate(void);
32int selinux_netlbl_socket_post_create(struct socket *sock,
33 int sock_family,
34 u32 sid);
35void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock);
36u32 selinux_netlbl_inet_conn_request(struct sk_buff *skb, u32 sock_sid);
37int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
38 struct sk_buff *skb,
39 struct avc_audit_data *ad);
40u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock);
41u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb);
42
43int __selinux_netlbl_inode_permission(struct inode *inode, int mask);
44/**
45 * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
46 * @inode: the file descriptor's inode
47 * @mask: the permission mask
48 *
49 * Description:
50 * Looks at a file's inode and if it is marked as a socket protected by
51 * NetLabel then verify that the socket has been labeled, if not try to label
52 * the socket now with the inode's SID. Returns zero on success, negative
53 * values on failure.
54 *
55 */
56static inline int selinux_netlbl_inode_permission(struct inode *inode,
57 int mask)
58{
59 int rc = 0;
60 struct inode_security_struct *isec;
61 struct sk_security_struct *sksec;
62
63 if (!S_ISSOCK(inode->i_mode))
64 return 0;
65
66 isec = inode->i_security;
67 sksec = SOCKET_I(inode)->sk->sk_security;
68 down(&isec->sem);
69 if (unlikely(sksec->nlbl_state == NLBL_REQUIRE &&
70 (mask & (MAY_WRITE | MAY_APPEND))))
71 rc = __selinux_netlbl_inode_permission(inode, mask);
72 up(&isec->sem);
73
74 return rc;
75}
76#else
77static inline void selinux_netlbl_cache_invalidate(void)
78{
79 return;
80}
81
82static inline int selinux_netlbl_socket_post_create(struct socket *sock,
83 int sock_family,
84 u32 sid)
85{
86 return 0;
87}
88
89static inline void selinux_netlbl_sock_graft(struct sock *sk,
90 struct socket *sock)
91{
92 return;
93}
94
95static inline u32 selinux_netlbl_inet_conn_request(struct sk_buff *skb,
96 u32 sock_sid)
97{
98 return SECSID_NULL;
99}
100
101static inline int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
102 struct sk_buff *skb,
103 struct avc_audit_data *ad)
104{
105 return 0;
106}
107
108static inline u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock)
109{
110 return SECSID_NULL;
111}
112
113static inline u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb)
114{
115 return SECSID_NULL;
116}
117
118static inline int selinux_netlbl_inode_permission(struct inode *inode,
119 int mask)
120{
121 return 0;
122}
123#endif /* CONFIG_NETLABEL */
124
125#endif