1 /* SPDX-License-Identifier: GPL-2.0 */ 1 /* SPDX-License-Identifier: GPL-2.0 */
2 /* 2 /*
3 * SELinux support for the XFRM LSM hooks 3 * SELinux support for the XFRM LSM hooks
4 * 4 *
5 * Author : Trent Jaeger, <jaegert@us.ibm.com> 5 * Author : Trent Jaeger, <jaegert@us.ibm.com>
6 * Updated : Venkat Yekkirala, <vyekkirala@Tru 6 * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
7 */ 7 */
8 <<
9 #ifndef _SELINUX_XFRM_H_ 8 #ifndef _SELINUX_XFRM_H_
10 #define _SELINUX_XFRM_H_ 9 #define _SELINUX_XFRM_H_
11 10
12 #include <linux/lsm_audit.h> <<
13 #include <net/flow.h> 11 #include <net/flow.h>
14 #include <net/xfrm.h> <<
15 12
16 int selinux_xfrm_policy_alloc(struct xfrm_sec_ 13 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
17 struct xfrm_user !! 14 struct xfrm_user_sec_ctx *uctx,
>> 15 gfp_t gfp);
18 int selinux_xfrm_policy_clone(struct xfrm_sec_ 16 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
19 struct xfrm_sec_ 17 struct xfrm_sec_ctx **new_ctxp);
20 void selinux_xfrm_policy_free(struct xfrm_sec_ 18 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
21 int selinux_xfrm_policy_delete(struct xfrm_sec 19 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
22 int selinux_xfrm_state_alloc(struct xfrm_state 20 int selinux_xfrm_state_alloc(struct xfrm_state *x,
23 struct xfrm_user_ 21 struct xfrm_user_sec_ctx *uctx);
24 int selinux_xfrm_state_alloc_acquire(struct xf 22 int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
25 struct xf 23 struct xfrm_sec_ctx *polsec, u32 secid);
26 void selinux_xfrm_state_free(struct xfrm_state 24 void selinux_xfrm_state_free(struct xfrm_state *x);
27 int selinux_xfrm_state_delete(struct xfrm_stat 25 int selinux_xfrm_state_delete(struct xfrm_state *x);
28 int selinux_xfrm_policy_lookup(struct xfrm_sec !! 26 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
29 int selinux_xfrm_state_pol_flow_match(struct x 27 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
30 struct x 28 struct xfrm_policy *xp,
31 const st 29 const struct flowi_common *flic);
32 30
33 #ifdef CONFIG_SECURITY_NETWORK_XFRM 31 #ifdef CONFIG_SECURITY_NETWORK_XFRM
34 extern atomic_t selinux_xfrm_refcount; 32 extern atomic_t selinux_xfrm_refcount;
35 33
36 static inline int selinux_xfrm_enabled(void) 34 static inline int selinux_xfrm_enabled(void)
37 { 35 {
38 return (atomic_read(&selinux_xfrm_refc 36 return (atomic_read(&selinux_xfrm_refcount) > 0);
39 } 37 }
40 38
41 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, stru 39 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
42 struct common_au 40 struct common_audit_data *ad);
43 int selinux_xfrm_postroute_last(u32 sk_sid, st 41 int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
44 struct common_ 42 struct common_audit_data *ad, u8 proto);
45 int selinux_xfrm_decode_session(struct sk_buff 43 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
46 int selinux_xfrm_skb_sid(struct sk_buff *skb, 44 int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
47 45
48 static inline void selinux_xfrm_notify_policyl 46 static inline void selinux_xfrm_notify_policyload(void)
49 { 47 {
50 struct net *net; 48 struct net *net;
51 49
52 down_read(&net_rwsem); 50 down_read(&net_rwsem);
53 for_each_net(net) 51 for_each_net(net)
54 rt_genid_bump_all(net); 52 rt_genid_bump_all(net);
55 up_read(&net_rwsem); 53 up_read(&net_rwsem);
56 } 54 }
57 #else 55 #else
58 static inline int selinux_xfrm_enabled(void) 56 static inline int selinux_xfrm_enabled(void)
59 { 57 {
60 return 0; 58 return 0;
61 } 59 }
62 60
63 static inline int selinux_xfrm_sock_rcv_skb(u3 61 static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
64 st 62 struct common_audit_data *ad)
65 { 63 {
66 return 0; 64 return 0;
67 } 65 }
68 66
69 static inline int selinux_xfrm_postroute_last( 67 static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
70 68 struct common_audit_data *ad,
71 69 u8 proto)
72 { 70 {
73 return 0; 71 return 0;
74 } 72 }
75 73
76 static inline int selinux_xfrm_decode_session( 74 static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
77 75 int ckall)
78 { 76 {
79 *sid = SECSID_NULL; 77 *sid = SECSID_NULL;
80 return 0; 78 return 0;
81 } 79 }
82 80
83 static inline void selinux_xfrm_notify_policyl 81 static inline void selinux_xfrm_notify_policyload(void)
84 { 82 {
85 } 83 }
86 84
87 static inline int selinux_xfrm_skb_sid(struct 85 static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
88 { 86 {
89 *sid = SECSID_NULL; 87 *sid = SECSID_NULL;
90 return 0; 88 return 0;
91 } 89 }
92 #endif 90 #endif
93 91
94 #endif /* _SELINUX_XFRM_H_ */ 92 #endif /* _SELINUX_XFRM_H_ */
95 93
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.