1 /* SPDX-License-Identifier: GPL-2.0 */ <<
2 /* 1 /*
3 * SELinux support for the XFRM LSM hooks 2 * SELinux support for the XFRM LSM hooks
4 * 3 *
5 * Author : Trent Jaeger, <jaegert@us.ibm.com> 4 * Author : Trent Jaeger, <jaegert@us.ibm.com>
6 * Updated : Venkat Yekkirala, <vyekkirala@Tru 5 * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
7 */ 6 */
8 <<
9 #ifndef _SELINUX_XFRM_H_ 7 #ifndef _SELINUX_XFRM_H_
10 #define _SELINUX_XFRM_H_ 8 #define _SELINUX_XFRM_H_
11 9
12 #include <linux/lsm_audit.h> <<
13 #include <net/flow.h> 10 #include <net/flow.h>
14 #include <net/xfrm.h> <<
15 11
16 int selinux_xfrm_policy_alloc(struct xfrm_sec_ 12 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
17 struct xfrm_user !! 13 struct xfrm_user_sec_ctx *uctx,
>> 14 gfp_t gfp);
18 int selinux_xfrm_policy_clone(struct xfrm_sec_ 15 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
19 struct xfrm_sec_ 16 struct xfrm_sec_ctx **new_ctxp);
20 void selinux_xfrm_policy_free(struct xfrm_sec_ 17 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
21 int selinux_xfrm_policy_delete(struct xfrm_sec 18 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
22 int selinux_xfrm_state_alloc(struct xfrm_state 19 int selinux_xfrm_state_alloc(struct xfrm_state *x,
23 struct xfrm_user_ 20 struct xfrm_user_sec_ctx *uctx);
24 int selinux_xfrm_state_alloc_acquire(struct xf 21 int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
25 struct xf 22 struct xfrm_sec_ctx *polsec, u32 secid);
26 void selinux_xfrm_state_free(struct xfrm_state 23 void selinux_xfrm_state_free(struct xfrm_state *x);
27 int selinux_xfrm_state_delete(struct xfrm_stat 24 int selinux_xfrm_state_delete(struct xfrm_state *x);
28 int selinux_xfrm_policy_lookup(struct xfrm_sec !! 25 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
29 int selinux_xfrm_state_pol_flow_match(struct x 26 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
30 struct x 27 struct xfrm_policy *xp,
31 const st !! 28 const struct flowi *fl);
32 29
33 #ifdef CONFIG_SECURITY_NETWORK_XFRM 30 #ifdef CONFIG_SECURITY_NETWORK_XFRM
34 extern atomic_t selinux_xfrm_refcount; 31 extern atomic_t selinux_xfrm_refcount;
35 32
36 static inline int selinux_xfrm_enabled(void) 33 static inline int selinux_xfrm_enabled(void)
37 { 34 {
38 return (atomic_read(&selinux_xfrm_refc 35 return (atomic_read(&selinux_xfrm_refcount) > 0);
39 } 36 }
40 37
41 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, stru 38 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
42 struct common_au 39 struct common_audit_data *ad);
43 int selinux_xfrm_postroute_last(u32 sk_sid, st 40 int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
44 struct common_ 41 struct common_audit_data *ad, u8 proto);
45 int selinux_xfrm_decode_session(struct sk_buff 42 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
46 int selinux_xfrm_skb_sid(struct sk_buff *skb, 43 int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
47 44
48 static inline void selinux_xfrm_notify_policyl 45 static inline void selinux_xfrm_notify_policyload(void)
49 { 46 {
50 struct net *net; 47 struct net *net;
51 48
52 down_read(&net_rwsem); !! 49 rtnl_lock();
53 for_each_net(net) !! 50 for_each_net(net) {
>> 51 atomic_inc(&net->xfrm.flow_cache_genid);
54 rt_genid_bump_all(net); 52 rt_genid_bump_all(net);
55 up_read(&net_rwsem); !! 53 }
>> 54 rtnl_unlock();
56 } 55 }
57 #else 56 #else
58 static inline int selinux_xfrm_enabled(void) 57 static inline int selinux_xfrm_enabled(void)
59 { 58 {
60 return 0; 59 return 0;
61 } 60 }
62 61
63 static inline int selinux_xfrm_sock_rcv_skb(u3 62 static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
64 st 63 struct common_audit_data *ad)
65 { 64 {
66 return 0; 65 return 0;
67 } 66 }
68 67
69 static inline int selinux_xfrm_postroute_last( 68 static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
70 69 struct common_audit_data *ad,
71 70 u8 proto)
72 { 71 {
73 return 0; 72 return 0;
74 } 73 }
75 74
76 static inline int selinux_xfrm_decode_session( 75 static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
77 76 int ckall)
78 { 77 {
79 *sid = SECSID_NULL; 78 *sid = SECSID_NULL;
80 return 0; 79 return 0;
81 } 80 }
82 81
83 static inline void selinux_xfrm_notify_policyl 82 static inline void selinux_xfrm_notify_policyload(void)
84 { 83 {
85 } 84 }
86 85
87 static inline int selinux_xfrm_skb_sid(struct 86 static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
88 { 87 {
89 *sid = SECSID_NULL; 88 *sid = SECSID_NULL;
90 return 0; 89 return 0;
91 } 90 }
92 #endif 91 #endif
93 92
94 #endif /* _SELINUX_XFRM_H_ */ 93 #endif /* _SELINUX_XFRM_H_ */
95 94
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.