1 /* SPDX-License-Identifier: GPL-2.0 */ <<
2 /* 1 /*
3 * SELinux support for the XFRM LSM hooks 2 * SELinux support for the XFRM LSM hooks
4 * 3 *
5 * Author : Trent Jaeger, <jaegert@us.ibm.com> 4 * Author : Trent Jaeger, <jaegert@us.ibm.com>
6 * Updated : Venkat Yekkirala, <vyekkirala@Tru 5 * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
7 */ 6 */
8 <<
9 #ifndef _SELINUX_XFRM_H_ 7 #ifndef _SELINUX_XFRM_H_
10 #define _SELINUX_XFRM_H_ 8 #define _SELINUX_XFRM_H_
11 9
12 #include <linux/lsm_audit.h> <<
13 #include <net/flow.h> <<
14 #include <net/xfrm.h> <<
15 <<
16 int selinux_xfrm_policy_alloc(struct xfrm_sec_ 10 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
17 struct xfrm_user !! 11 struct xfrm_user_sec_ctx *sec_ctx);
18 int selinux_xfrm_policy_clone(struct xfrm_sec_ 12 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
19 struct xfrm_sec_ 13 struct xfrm_sec_ctx **new_ctxp);
20 void selinux_xfrm_policy_free(struct xfrm_sec_ 14 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
21 int selinux_xfrm_policy_delete(struct xfrm_sec 15 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
22 int selinux_xfrm_state_alloc(struct xfrm_state 16 int selinux_xfrm_state_alloc(struct xfrm_state *x,
23 struct xfrm_user_ !! 17 struct xfrm_user_sec_ctx *sec_ctx, u32 secid);
24 int selinux_xfrm_state_alloc_acquire(struct xf <<
25 struct xf <<
26 void selinux_xfrm_state_free(struct xfrm_state 18 void selinux_xfrm_state_free(struct xfrm_state *x);
27 int selinux_xfrm_state_delete(struct xfrm_stat 19 int selinux_xfrm_state_delete(struct xfrm_state *x);
28 int selinux_xfrm_policy_lookup(struct xfrm_sec !! 20 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
29 int selinux_xfrm_state_pol_flow_match(struct x 21 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
30 struct x !! 22 struct xfrm_policy *xp, struct flowi *fl);
31 const st !! 23
>> 24 /*
>> 25 * Extract the security blob from the sock (it's actually on the socket)
>> 26 */
>> 27 static inline struct inode_security_struct *get_sock_isec(struct sock *sk)
>> 28 {
>> 29 if (!sk->sk_socket)
>> 30 return NULL;
>> 31
>> 32 return SOCK_INODE(sk->sk_socket)->i_security;
>> 33 }
32 34
33 #ifdef CONFIG_SECURITY_NETWORK_XFRM 35 #ifdef CONFIG_SECURITY_NETWORK_XFRM
34 extern atomic_t selinux_xfrm_refcount; 36 extern atomic_t selinux_xfrm_refcount;
35 37
36 static inline int selinux_xfrm_enabled(void) 38 static inline int selinux_xfrm_enabled(void)
37 { 39 {
38 return (atomic_read(&selinux_xfrm_refc 40 return (atomic_read(&selinux_xfrm_refcount) > 0);
39 } 41 }
40 42
41 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, stru !! 43 int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb,
42 struct common_au !! 44 struct common_audit_data *ad);
43 int selinux_xfrm_postroute_last(u32 sk_sid, st !! 45 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
44 struct common_ !! 46 struct common_audit_data *ad, u8 proto);
45 int selinux_xfrm_decode_session(struct sk_buff 47 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
46 int selinux_xfrm_skb_sid(struct sk_buff *skb, <<
47 48
48 static inline void selinux_xfrm_notify_policyl 49 static inline void selinux_xfrm_notify_policyload(void)
49 { 50 {
50 struct net *net; !! 51 atomic_inc(&flow_cache_genid);
51 <<
52 down_read(&net_rwsem); <<
53 for_each_net(net) <<
54 rt_genid_bump_all(net); <<
55 up_read(&net_rwsem); <<
56 } 52 }
57 #else 53 #else
58 static inline int selinux_xfrm_enabled(void) 54 static inline int selinux_xfrm_enabled(void)
59 { 55 {
60 return 0; 56 return 0;
61 } 57 }
62 58
63 static inline int selinux_xfrm_sock_rcv_skb(u3 !! 59 static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
64 st !! 60 struct common_audit_data *ad)
65 { 61 {
66 return 0; 62 return 0;
67 } 63 }
68 64
69 static inline int selinux_xfrm_postroute_last( !! 65 static inline int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
70 !! 66 struct common_audit_data *ad, u8 proto)
71 <<
72 { 67 {
73 return 0; 68 return 0;
74 } 69 }
75 70
76 static inline int selinux_xfrm_decode_session( !! 71 static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
77 <<
78 { 72 {
79 *sid = SECSID_NULL; 73 *sid = SECSID_NULL;
80 return 0; 74 return 0;
81 } 75 }
82 76
83 static inline void selinux_xfrm_notify_policyl 77 static inline void selinux_xfrm_notify_policyload(void)
84 { 78 {
85 } 79 }
>> 80 #endif
86 81
87 static inline int selinux_xfrm_skb_sid(struct !! 82 static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
88 { 83 {
89 *sid = SECSID_NULL; !! 84 int err = selinux_xfrm_decode_session(skb, sid, 0);
90 return 0; !! 85 BUG_ON(err);
91 } 86 }
92 #endif <<
93 87
94 #endif /* _SELINUX_XFRM_H_ */ 88 #endif /* _SELINUX_XFRM_H_ */
95 89
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.