2 * NetLabel Unlabeled Support
4 * This file defines functions for dealing with unlabeled packets for the
5 * NetLabel system. The NetLabel system manages static and dynamic label
6 * mappings for network protocols such as CIPSO and RIPSO.
8 * Author: Paul Moore <paul.moore@hp.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include <linux/types.h>
32 #include <linux/rcupdate.h>
33 #include <linux/list.h>
34 #include <linux/spinlock.h>
35 #include <linux/socket.h>
36 #include <linux/string.h>
37 #include <linux/skbuff.h>
38 #include <linux/audit.h>
40 #include <linux/in6.h>
42 #include <linux/ipv6.h>
43 #include <linux/notifier.h>
44 #include <linux/netdevice.h>
45 #include <linux/security.h>
46 #include <linux/slab.h>
48 #include <net/netlink.h>
49 #include <net/genetlink.h>
52 #include <net/net_namespace.h>
53 #include <net/netlabel.h>
55 #include <asm/atomic.h>
57 #include "netlabel_user.h"
58 #include "netlabel_addrlist.h"
59 #include "netlabel_domainhash.h"
60 #include "netlabel_unlabeled.h"
61 #include "netlabel_mgmt.h"
63 /* NOTE: at present we always use init's network namespace since we don't
64 * presently support different namespaces even though the majority of
65 * the functions in this file are "namespace safe" */
67 /* The unlabeled connection hash table which we use to map network interfaces
68 * and addresses of unlabeled packets to a user specified secid value for the
69 * LSM. The hash table is used to lookup the network interface entry
70 * (struct netlbl_unlhsh_iface) and then the interface entry is used to
71 * lookup an IP address match from an ordered list. If a network interface
72 * match can not be found in the hash table then the default entry
73 * (netlbl_unlhsh_def) is used. The IP address entry list
74 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
75 * larger netmask come first.
77 struct netlbl_unlhsh_tbl
{
78 struct list_head
*tbl
;
81 #define netlbl_unlhsh_addr4_entry(iter) \
82 container_of(iter, struct netlbl_unlhsh_addr4, list)
83 struct netlbl_unlhsh_addr4
{
86 struct netlbl_af4list list
;
89 #define netlbl_unlhsh_addr6_entry(iter) \
90 container_of(iter, struct netlbl_unlhsh_addr6, list)
91 struct netlbl_unlhsh_addr6
{
94 struct netlbl_af6list list
;
97 struct netlbl_unlhsh_iface
{
99 struct list_head addr4_list
;
100 struct list_head addr6_list
;
103 struct list_head list
;
107 /* Argument struct for netlbl_unlhsh_walk() */
108 struct netlbl_unlhsh_walk_arg
{
109 struct netlink_callback
*nl_cb
;
114 /* Unlabeled connection hash table */
115 /* updates should be so rare that having one spinlock for the entire
116 * hash table should be okay */
117 static DEFINE_SPINLOCK(netlbl_unlhsh_lock
);
118 #define netlbl_unlhsh_rcu_deref(p) \
119 rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
120 static struct netlbl_unlhsh_tbl
*netlbl_unlhsh
= NULL
;
121 static struct netlbl_unlhsh_iface
*netlbl_unlhsh_def
= NULL
;
123 /* Accept unlabeled packets flag */
124 static u8 netlabel_unlabel_acceptflg
= 0;
126 /* NetLabel Generic NETLINK unlabeled family */
127 static struct genl_family netlbl_unlabel_gnl_family
= {
128 .id
= GENL_ID_GENERATE
,
130 .name
= NETLBL_NLTYPE_UNLABELED_NAME
,
131 .version
= NETLBL_PROTO_VERSION
,
132 .maxattr
= NLBL_UNLABEL_A_MAX
,
135 /* NetLabel Netlink attribute policy */
136 static const struct nla_policy netlbl_unlabel_genl_policy
[NLBL_UNLABEL_A_MAX
+ 1] = {
137 [NLBL_UNLABEL_A_ACPTFLG
] = { .type
= NLA_U8
},
138 [NLBL_UNLABEL_A_IPV6ADDR
] = { .type
= NLA_BINARY
,
139 .len
= sizeof(struct in6_addr
) },
140 [NLBL_UNLABEL_A_IPV6MASK
] = { .type
= NLA_BINARY
,
141 .len
= sizeof(struct in6_addr
) },
142 [NLBL_UNLABEL_A_IPV4ADDR
] = { .type
= NLA_BINARY
,
143 .len
= sizeof(struct in_addr
) },
144 [NLBL_UNLABEL_A_IPV4MASK
] = { .type
= NLA_BINARY
,
145 .len
= sizeof(struct in_addr
) },
146 [NLBL_UNLABEL_A_IFACE
] = { .type
= NLA_NUL_STRING
,
147 .len
= IFNAMSIZ
- 1 },
148 [NLBL_UNLABEL_A_SECCTX
] = { .type
= NLA_BINARY
}
152 * Unlabeled Connection Hash Table Functions
156 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
157 * @entry: the entry's RCU field
160 * This function is designed to be used as a callback to the call_rcu()
161 * function so that memory allocated to a hash table interface entry can be
162 * released safely. It is important to note that this function does not free
163 * the IPv4 and IPv6 address lists contained as part of an interface entry. It
164 * is up to the rest of the code to make sure an interface entry is only freed
165 * once it's address lists are empty.
168 static void netlbl_unlhsh_free_iface(struct rcu_head
*entry
)
170 struct netlbl_unlhsh_iface
*iface
;
171 struct netlbl_af4list
*iter4
;
172 struct netlbl_af4list
*tmp4
;
173 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
174 struct netlbl_af6list
*iter6
;
175 struct netlbl_af6list
*tmp6
;
178 iface
= container_of(entry
, struct netlbl_unlhsh_iface
, rcu
);
180 /* no need for locks here since we are the only one with access to this
183 netlbl_af4list_foreach_safe(iter4
, tmp4
, &iface
->addr4_list
) {
184 netlbl_af4list_remove_entry(iter4
);
185 kfree(netlbl_unlhsh_addr4_entry(iter4
));
187 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
188 netlbl_af6list_foreach_safe(iter6
, tmp6
, &iface
->addr6_list
) {
189 netlbl_af6list_remove_entry(iter6
);
190 kfree(netlbl_unlhsh_addr6_entry(iter6
));
197 * netlbl_unlhsh_hash - Hashing function for the hash table
198 * @ifindex: the network interface/device to hash
201 * This is the hashing function for the unlabeled hash table, it returns the
202 * bucket number for the given device/interface. The caller is responsible for
203 * ensuring that the hash table is protected with either a RCU read lock or
204 * the hash table lock.
207 static u32
netlbl_unlhsh_hash(int ifindex
)
209 return ifindex
& (netlbl_unlhsh_rcu_deref(netlbl_unlhsh
)->size
- 1);
213 * netlbl_unlhsh_search_iface - Search for a matching interface entry
214 * @ifindex: the network interface
217 * Searches the unlabeled connection hash table and returns a pointer to the
218 * interface entry which matches @ifindex, otherwise NULL is returned. The
219 * caller is responsible for ensuring that the hash table is protected with
220 * either a RCU read lock or the hash table lock.
223 static struct netlbl_unlhsh_iface
*netlbl_unlhsh_search_iface(int ifindex
)
226 struct list_head
*bkt_list
;
227 struct netlbl_unlhsh_iface
*iter
;
229 bkt
= netlbl_unlhsh_hash(ifindex
);
230 bkt_list
= &netlbl_unlhsh_rcu_deref(netlbl_unlhsh
)->tbl
[bkt
];
231 list_for_each_entry_rcu(iter
, bkt_list
, list
)
232 if (iter
->valid
&& iter
->ifindex
== ifindex
)
239 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
240 * @iface: the associated interface entry
241 * @addr: IPv4 address in network byte order
242 * @mask: IPv4 address mask in network byte order
243 * @secid: LSM secid value for entry
246 * Add a new address entry into the unlabeled connection hash table using the
247 * interface entry specified by @iface. On success zero is returned, otherwise
248 * a negative value is returned.
251 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface
*iface
,
252 const struct in_addr
*addr
,
253 const struct in_addr
*mask
,
257 struct netlbl_unlhsh_addr4
*entry
;
259 entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
263 entry
->list
.addr
= addr
->s_addr
& mask
->s_addr
;
264 entry
->list
.mask
= mask
->s_addr
;
265 entry
->list
.valid
= 1;
266 entry
->secid
= secid
;
268 spin_lock(&netlbl_unlhsh_lock
);
269 ret_val
= netlbl_af4list_add(&entry
->list
, &iface
->addr4_list
);
270 spin_unlock(&netlbl_unlhsh_lock
);
277 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
279 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
280 * @iface: the associated interface entry
281 * @addr: IPv6 address in network byte order
282 * @mask: IPv6 address mask in network byte order
283 * @secid: LSM secid value for entry
286 * Add a new address entry into the unlabeled connection hash table using the
287 * interface entry specified by @iface. On success zero is returned, otherwise
288 * a negative value is returned.
291 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface
*iface
,
292 const struct in6_addr
*addr
,
293 const struct in6_addr
*mask
,
297 struct netlbl_unlhsh_addr6
*entry
;
299 entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
303 ipv6_addr_copy(&entry
->list
.addr
, addr
);
304 entry
->list
.addr
.s6_addr32
[0] &= mask
->s6_addr32
[0];
305 entry
->list
.addr
.s6_addr32
[1] &= mask
->s6_addr32
[1];
306 entry
->list
.addr
.s6_addr32
[2] &= mask
->s6_addr32
[2];
307 entry
->list
.addr
.s6_addr32
[3] &= mask
->s6_addr32
[3];
308 ipv6_addr_copy(&entry
->list
.mask
, mask
);
309 entry
->list
.valid
= 1;
310 entry
->secid
= secid
;
312 spin_lock(&netlbl_unlhsh_lock
);
313 ret_val
= netlbl_af6list_add(&entry
->list
, &iface
->addr6_list
);
314 spin_unlock(&netlbl_unlhsh_lock
);
323 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
324 * @ifindex: network interface
327 * Add a new, empty, interface entry into the unlabeled connection hash table.
328 * On success a pointer to the new interface entry is returned, on failure NULL
332 static struct netlbl_unlhsh_iface
*netlbl_unlhsh_add_iface(int ifindex
)
335 struct netlbl_unlhsh_iface
*iface
;
337 iface
= kzalloc(sizeof(*iface
), GFP_ATOMIC
);
341 iface
->ifindex
= ifindex
;
342 INIT_LIST_HEAD(&iface
->addr4_list
);
343 INIT_LIST_HEAD(&iface
->addr6_list
);
346 spin_lock(&netlbl_unlhsh_lock
);
348 bkt
= netlbl_unlhsh_hash(ifindex
);
349 if (netlbl_unlhsh_search_iface(ifindex
) != NULL
)
350 goto add_iface_failure
;
351 list_add_tail_rcu(&iface
->list
,
352 &netlbl_unlhsh_rcu_deref(netlbl_unlhsh
)->tbl
[bkt
]);
354 INIT_LIST_HEAD(&iface
->list
);
355 if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def
) != NULL
)
356 goto add_iface_failure
;
357 rcu_assign_pointer(netlbl_unlhsh_def
, iface
);
359 spin_unlock(&netlbl_unlhsh_lock
);
364 spin_unlock(&netlbl_unlhsh_lock
);
370 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
371 * @net: network namespace
372 * @dev_name: interface name
373 * @addr: IP address in network byte order
374 * @mask: address mask in network byte order
375 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
376 * @secid: LSM secid value for the entry
377 * @audit_info: NetLabel audit information
380 * Adds a new entry to the unlabeled connection hash table. Returns zero on
381 * success, negative values on failure.
384 int netlbl_unlhsh_add(struct net
*net
,
385 const char *dev_name
,
390 struct netlbl_audit
*audit_info
)
394 struct net_device
*dev
;
395 struct netlbl_unlhsh_iface
*iface
;
396 struct audit_buffer
*audit_buf
= NULL
;
400 if (addr_len
!= sizeof(struct in_addr
) &&
401 addr_len
!= sizeof(struct in6_addr
))
405 if (dev_name
!= NULL
) {
406 dev
= dev_get_by_name_rcu(net
, dev_name
);
409 goto unlhsh_add_return
;
411 ifindex
= dev
->ifindex
;
412 iface
= netlbl_unlhsh_search_iface(ifindex
);
415 iface
= rcu_dereference(netlbl_unlhsh_def
);
418 iface
= netlbl_unlhsh_add_iface(ifindex
);
421 goto unlhsh_add_return
;
424 audit_buf
= netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD
,
427 case sizeof(struct in_addr
): {
428 struct in_addr
*addr4
, *mask4
;
430 addr4
= (struct in_addr
*)addr
;
431 mask4
= (struct in_addr
*)mask
;
432 ret_val
= netlbl_unlhsh_add_addr4(iface
, addr4
, mask4
, secid
);
433 if (audit_buf
!= NULL
)
434 netlbl_af4list_audit_addr(audit_buf
, 1,
440 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
441 case sizeof(struct in6_addr
): {
442 struct in6_addr
*addr6
, *mask6
;
444 addr6
= (struct in6_addr
*)addr
;
445 mask6
= (struct in6_addr
*)mask
;
446 ret_val
= netlbl_unlhsh_add_addr6(iface
, addr6
, mask6
, secid
);
447 if (audit_buf
!= NULL
)
448 netlbl_af6list_audit_addr(audit_buf
, 1,
458 atomic_inc(&netlabel_mgmt_protocount
);
462 if (audit_buf
!= NULL
) {
463 if (security_secid_to_secctx(secid
,
466 audit_log_format(audit_buf
, " sec_obj=%s", secctx
);
467 security_release_secctx(secctx
, secctx_len
);
469 audit_log_format(audit_buf
, " res=%u", ret_val
== 0 ? 1 : 0);
470 audit_log_end(audit_buf
);
476 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
477 * @net: network namespace
478 * @iface: interface entry
480 * @mask: IP address mask
481 * @audit_info: NetLabel audit information
484 * Remove an IP address entry from the unlabeled connection hash table.
485 * Returns zero on success, negative values on failure.
488 static int netlbl_unlhsh_remove_addr4(struct net
*net
,
489 struct netlbl_unlhsh_iface
*iface
,
490 const struct in_addr
*addr
,
491 const struct in_addr
*mask
,
492 struct netlbl_audit
*audit_info
)
494 struct netlbl_af4list
*list_entry
;
495 struct netlbl_unlhsh_addr4
*entry
;
496 struct audit_buffer
*audit_buf
;
497 struct net_device
*dev
;
501 spin_lock(&netlbl_unlhsh_lock
);
502 list_entry
= netlbl_af4list_remove(addr
->s_addr
, mask
->s_addr
,
504 spin_unlock(&netlbl_unlhsh_lock
);
505 if (list_entry
!= NULL
)
506 entry
= netlbl_unlhsh_addr4_entry(list_entry
);
510 audit_buf
= netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL
,
512 if (audit_buf
!= NULL
) {
513 dev
= dev_get_by_index(net
, iface
->ifindex
);
514 netlbl_af4list_audit_addr(audit_buf
, 1,
515 (dev
!= NULL
? dev
->name
: NULL
),
516 addr
->s_addr
, mask
->s_addr
);
520 security_secid_to_secctx(entry
->secid
,
521 &secctx
, &secctx_len
) == 0) {
522 audit_log_format(audit_buf
, " sec_obj=%s", secctx
);
523 security_release_secctx(secctx
, secctx_len
);
525 audit_log_format(audit_buf
, " res=%u", entry
!= NULL
? 1 : 0);
526 audit_log_end(audit_buf
);
532 kfree_rcu(entry
, rcu
);
536 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
538 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
539 * @net: network namespace
540 * @iface: interface entry
542 * @mask: IP address mask
543 * @audit_info: NetLabel audit information
546 * Remove an IP address entry from the unlabeled connection hash table.
547 * Returns zero on success, negative values on failure.
550 static int netlbl_unlhsh_remove_addr6(struct net
*net
,
551 struct netlbl_unlhsh_iface
*iface
,
552 const struct in6_addr
*addr
,
553 const struct in6_addr
*mask
,
554 struct netlbl_audit
*audit_info
)
556 struct netlbl_af6list
*list_entry
;
557 struct netlbl_unlhsh_addr6
*entry
;
558 struct audit_buffer
*audit_buf
;
559 struct net_device
*dev
;
563 spin_lock(&netlbl_unlhsh_lock
);
564 list_entry
= netlbl_af6list_remove(addr
, mask
, &iface
->addr6_list
);
565 spin_unlock(&netlbl_unlhsh_lock
);
566 if (list_entry
!= NULL
)
567 entry
= netlbl_unlhsh_addr6_entry(list_entry
);
571 audit_buf
= netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL
,
573 if (audit_buf
!= NULL
) {
574 dev
= dev_get_by_index(net
, iface
->ifindex
);
575 netlbl_af6list_audit_addr(audit_buf
, 1,
576 (dev
!= NULL
? dev
->name
: NULL
),
581 security_secid_to_secctx(entry
->secid
,
582 &secctx
, &secctx_len
) == 0) {
583 audit_log_format(audit_buf
, " sec_obj=%s", secctx
);
584 security_release_secctx(secctx
, secctx_len
);
586 audit_log_format(audit_buf
, " res=%u", entry
!= NULL
? 1 : 0);
587 audit_log_end(audit_buf
);
593 kfree_rcu(entry
, rcu
);
599 * netlbl_unlhsh_condremove_iface - Remove an interface entry
600 * @iface: the interface entry
603 * Remove an interface entry from the unlabeled connection hash table if it is
604 * empty. An interface entry is considered to be empty if there are no
605 * address entries assigned to it.
608 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface
*iface
)
610 struct netlbl_af4list
*iter4
;
611 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
612 struct netlbl_af6list
*iter6
;
615 spin_lock(&netlbl_unlhsh_lock
);
616 netlbl_af4list_foreach_rcu(iter4
, &iface
->addr4_list
)
617 goto unlhsh_condremove_failure
;
618 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
619 netlbl_af6list_foreach_rcu(iter6
, &iface
->addr6_list
)
620 goto unlhsh_condremove_failure
;
623 if (iface
->ifindex
> 0)
624 list_del_rcu(&iface
->list
);
626 rcu_assign_pointer(netlbl_unlhsh_def
, NULL
);
627 spin_unlock(&netlbl_unlhsh_lock
);
629 call_rcu(&iface
->rcu
, netlbl_unlhsh_free_iface
);
632 unlhsh_condremove_failure
:
633 spin_unlock(&netlbl_unlhsh_lock
);
637 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
638 * @net: network namespace
639 * @dev_name: interface name
640 * @addr: IP address in network byte order
641 * @mask: address mask in network byte order
642 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
643 * @audit_info: NetLabel audit information
646 * Removes and existing entry from the unlabeled connection hash table.
647 * Returns zero on success, negative values on failure.
650 int netlbl_unlhsh_remove(struct net
*net
,
651 const char *dev_name
,
655 struct netlbl_audit
*audit_info
)
658 struct net_device
*dev
;
659 struct netlbl_unlhsh_iface
*iface
;
661 if (addr_len
!= sizeof(struct in_addr
) &&
662 addr_len
!= sizeof(struct in6_addr
))
666 if (dev_name
!= NULL
) {
667 dev
= dev_get_by_name_rcu(net
, dev_name
);
670 goto unlhsh_remove_return
;
672 iface
= netlbl_unlhsh_search_iface(dev
->ifindex
);
674 iface
= rcu_dereference(netlbl_unlhsh_def
);
677 goto unlhsh_remove_return
;
680 case sizeof(struct in_addr
):
681 ret_val
= netlbl_unlhsh_remove_addr4(net
,
685 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
686 case sizeof(struct in6_addr
):
687 ret_val
= netlbl_unlhsh_remove_addr6(net
,
696 netlbl_unlhsh_condremove_iface(iface
);
697 atomic_dec(&netlabel_mgmt_protocount
);
700 unlhsh_remove_return
:
706 * General Helper Functions
710 * netlbl_unlhsh_netdev_handler - Network device notification handler
711 * @this: notifier block
713 * @ptr: the network device (cast to void)
716 * Handle network device events, although at present all we care about is a
717 * network device going away. In the case of a device going away we clear any
718 * related entries from the unlabeled connection hash table.
721 static int netlbl_unlhsh_netdev_handler(struct notifier_block
*this,
725 struct net_device
*dev
= ptr
;
726 struct netlbl_unlhsh_iface
*iface
= NULL
;
728 if (!net_eq(dev_net(dev
), &init_net
))
731 /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
732 if (event
== NETDEV_DOWN
) {
733 spin_lock(&netlbl_unlhsh_lock
);
734 iface
= netlbl_unlhsh_search_iface(dev
->ifindex
);
735 if (iface
!= NULL
&& iface
->valid
) {
737 list_del_rcu(&iface
->list
);
740 spin_unlock(&netlbl_unlhsh_lock
);
744 call_rcu(&iface
->rcu
, netlbl_unlhsh_free_iface
);
750 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
751 * @value: desired value
752 * @audit_info: NetLabel audit information
755 * Set the value of the unlabeled accept flag to @value.
758 static void netlbl_unlabel_acceptflg_set(u8 value
,
759 struct netlbl_audit
*audit_info
)
761 struct audit_buffer
*audit_buf
;
764 old_val
= netlabel_unlabel_acceptflg
;
765 netlabel_unlabel_acceptflg
= value
;
766 audit_buf
= netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW
,
768 if (audit_buf
!= NULL
) {
769 audit_log_format(audit_buf
,
770 " unlbl_accept=%u old=%u", value
, old_val
);
771 audit_log_end(audit_buf
);
776 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
777 * @info: the Generic NETLINK info block
778 * @addr: the IP address
779 * @mask: the IP address mask
780 * @len: the address length
783 * Examine the Generic NETLINK message and extract the IP address information.
784 * Returns zero on success, negative values on failure.
787 static int netlbl_unlabel_addrinfo_get(struct genl_info
*info
,
794 if (info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
]) {
795 addr_len
= nla_len(info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
]);
796 if (addr_len
!= sizeof(struct in_addr
) &&
797 addr_len
!= nla_len(info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]))
800 *addr
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
]);
801 *mask
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]);
803 } else if (info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
]) {
804 addr_len
= nla_len(info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
]);
805 if (addr_len
!= sizeof(struct in6_addr
) &&
806 addr_len
!= nla_len(info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
]))
809 *addr
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
]);
810 *mask
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
]);
818 * NetLabel Command Handlers
822 * netlbl_unlabel_accept - Handle an ACCEPT message
823 * @skb: the NETLINK buffer
824 * @info: the Generic NETLINK info block
827 * Process a user generated ACCEPT message and set the accept flag accordingly.
828 * Returns zero on success, negative values on failure.
831 static int netlbl_unlabel_accept(struct sk_buff
*skb
, struct genl_info
*info
)
834 struct netlbl_audit audit_info
;
836 if (info
->attrs
[NLBL_UNLABEL_A_ACPTFLG
]) {
837 value
= nla_get_u8(info
->attrs
[NLBL_UNLABEL_A_ACPTFLG
]);
838 if (value
== 1 || value
== 0) {
839 netlbl_netlink_auditinfo(skb
, &audit_info
);
840 netlbl_unlabel_acceptflg_set(value
, &audit_info
);
849 * netlbl_unlabel_list - Handle a LIST message
850 * @skb: the NETLINK buffer
851 * @info: the Generic NETLINK info block
854 * Process a user generated LIST message and respond with the current status.
855 * Returns zero on success, negative values on failure.
858 static int netlbl_unlabel_list(struct sk_buff
*skb
, struct genl_info
*info
)
860 int ret_val
= -EINVAL
;
861 struct sk_buff
*ans_skb
;
864 ans_skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
867 data
= genlmsg_put_reply(ans_skb
, info
, &netlbl_unlabel_gnl_family
,
868 0, NLBL_UNLABEL_C_LIST
);
874 ret_val
= nla_put_u8(ans_skb
,
875 NLBL_UNLABEL_A_ACPTFLG
,
876 netlabel_unlabel_acceptflg
);
880 genlmsg_end(ans_skb
, data
);
881 return genlmsg_reply(ans_skb
, info
);
889 * netlbl_unlabel_staticadd - Handle a STATICADD message
890 * @skb: the NETLINK buffer
891 * @info: the Generic NETLINK info block
894 * Process a user generated STATICADD message and add a new unlabeled
895 * connection entry to the hash table. Returns zero on success, negative
899 static int netlbl_unlabel_staticadd(struct sk_buff
*skb
,
900 struct genl_info
*info
)
908 struct netlbl_audit audit_info
;
910 /* Don't allow users to add both IPv4 and IPv6 addresses for a
911 * single entry. However, allow users to create two entries, one each
912 * for IPv4 and IPv4, with the same LSM security context which should
913 * achieve the same result. */
914 if (!info
->attrs
[NLBL_UNLABEL_A_SECCTX
] ||
915 !info
->attrs
[NLBL_UNLABEL_A_IFACE
] ||
916 !((!info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
] ||
917 !info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]) ^
918 (!info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
] ||
919 !info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
])))
922 netlbl_netlink_auditinfo(skb
, &audit_info
);
924 ret_val
= netlbl_unlabel_addrinfo_get(info
, &addr
, &mask
, &addr_len
);
927 dev_name
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IFACE
]);
928 ret_val
= security_secctx_to_secid(
929 nla_data(info
->attrs
[NLBL_UNLABEL_A_SECCTX
]),
930 nla_len(info
->attrs
[NLBL_UNLABEL_A_SECCTX
]),
935 return netlbl_unlhsh_add(&init_net
,
936 dev_name
, addr
, mask
, addr_len
, secid
,
941 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
942 * @skb: the NETLINK buffer
943 * @info: the Generic NETLINK info block
946 * Process a user generated STATICADDDEF message and add a new default
947 * unlabeled connection entry. Returns zero on success, negative values on
951 static int netlbl_unlabel_staticadddef(struct sk_buff
*skb
,
952 struct genl_info
*info
)
959 struct netlbl_audit audit_info
;
961 /* Don't allow users to add both IPv4 and IPv6 addresses for a
962 * single entry. However, allow users to create two entries, one each
963 * for IPv4 and IPv6, with the same LSM security context which should
964 * achieve the same result. */
965 if (!info
->attrs
[NLBL_UNLABEL_A_SECCTX
] ||
966 !((!info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
] ||
967 !info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]) ^
968 (!info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
] ||
969 !info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
])))
972 netlbl_netlink_auditinfo(skb
, &audit_info
);
974 ret_val
= netlbl_unlabel_addrinfo_get(info
, &addr
, &mask
, &addr_len
);
977 ret_val
= security_secctx_to_secid(
978 nla_data(info
->attrs
[NLBL_UNLABEL_A_SECCTX
]),
979 nla_len(info
->attrs
[NLBL_UNLABEL_A_SECCTX
]),
984 return netlbl_unlhsh_add(&init_net
,
985 NULL
, addr
, mask
, addr_len
, secid
,
990 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
991 * @skb: the NETLINK buffer
992 * @info: the Generic NETLINK info block
995 * Process a user generated STATICREMOVE message and remove the specified
996 * unlabeled connection entry. Returns zero on success, negative values on
1000 static int netlbl_unlabel_staticremove(struct sk_buff
*skb
,
1001 struct genl_info
*info
)
1008 struct netlbl_audit audit_info
;
1010 /* See the note in netlbl_unlabel_staticadd() about not allowing both
1011 * IPv4 and IPv6 in the same entry. */
1012 if (!info
->attrs
[NLBL_UNLABEL_A_IFACE
] ||
1013 !((!info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
] ||
1014 !info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]) ^
1015 (!info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
] ||
1016 !info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
])))
1019 netlbl_netlink_auditinfo(skb
, &audit_info
);
1021 ret_val
= netlbl_unlabel_addrinfo_get(info
, &addr
, &mask
, &addr_len
);
1024 dev_name
= nla_data(info
->attrs
[NLBL_UNLABEL_A_IFACE
]);
1026 return netlbl_unlhsh_remove(&init_net
,
1027 dev_name
, addr
, mask
, addr_len
,
1032 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1033 * @skb: the NETLINK buffer
1034 * @info: the Generic NETLINK info block
1037 * Process a user generated STATICREMOVEDEF message and remove the default
1038 * unlabeled connection entry. Returns zero on success, negative values on
1042 static int netlbl_unlabel_staticremovedef(struct sk_buff
*skb
,
1043 struct genl_info
*info
)
1049 struct netlbl_audit audit_info
;
1051 /* See the note in netlbl_unlabel_staticadd() about not allowing both
1052 * IPv4 and IPv6 in the same entry. */
1053 if (!((!info
->attrs
[NLBL_UNLABEL_A_IPV4ADDR
] ||
1054 !info
->attrs
[NLBL_UNLABEL_A_IPV4MASK
]) ^
1055 (!info
->attrs
[NLBL_UNLABEL_A_IPV6ADDR
] ||
1056 !info
->attrs
[NLBL_UNLABEL_A_IPV6MASK
])))
1059 netlbl_netlink_auditinfo(skb
, &audit_info
);
1061 ret_val
= netlbl_unlabel_addrinfo_get(info
, &addr
, &mask
, &addr_len
);
1065 return netlbl_unlhsh_remove(&init_net
,
1066 NULL
, addr
, mask
, addr_len
,
1072 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1073 * @cmd: command/message
1074 * @iface: the interface entry
1075 * @addr4: the IPv4 address entry
1076 * @addr6: the IPv6 address entry
1077 * @arg: the netlbl_unlhsh_walk_arg structure
1080 * This function is designed to be used to generate a response for a
1081 * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6
1082 * can be specified, not both, the other unspecified entry should be set to
1083 * NULL by the caller. Returns the size of the message on success, negative
1084 * values on failure.
1087 static int netlbl_unlabel_staticlist_gen(u32 cmd
,
1088 const struct netlbl_unlhsh_iface
*iface
,
1089 const struct netlbl_unlhsh_addr4
*addr4
,
1090 const struct netlbl_unlhsh_addr6
*addr6
,
1093 int ret_val
= -ENOMEM
;
1094 struct netlbl_unlhsh_walk_arg
*cb_arg
= arg
;
1095 struct net_device
*dev
;
1101 data
= genlmsg_put(cb_arg
->skb
, NETLINK_CB(cb_arg
->nl_cb
->skb
).pid
,
1102 cb_arg
->seq
, &netlbl_unlabel_gnl_family
,
1105 goto list_cb_failure
;
1107 if (iface
->ifindex
> 0) {
1108 dev
= dev_get_by_index(&init_net
, iface
->ifindex
);
1111 goto list_cb_failure
;
1113 ret_val
= nla_put_string(cb_arg
->skb
,
1114 NLBL_UNLABEL_A_IFACE
, dev
->name
);
1117 goto list_cb_failure
;
1121 struct in_addr addr_struct
;
1123 addr_struct
.s_addr
= addr4
->list
.addr
;
1124 ret_val
= nla_put(cb_arg
->skb
,
1125 NLBL_UNLABEL_A_IPV4ADDR
,
1126 sizeof(struct in_addr
),
1129 goto list_cb_failure
;
1131 addr_struct
.s_addr
= addr4
->list
.mask
;
1132 ret_val
= nla_put(cb_arg
->skb
,
1133 NLBL_UNLABEL_A_IPV4MASK
,
1134 sizeof(struct in_addr
),
1137 goto list_cb_failure
;
1139 secid
= addr4
->secid
;
1141 ret_val
= nla_put(cb_arg
->skb
,
1142 NLBL_UNLABEL_A_IPV6ADDR
,
1143 sizeof(struct in6_addr
),
1146 goto list_cb_failure
;
1148 ret_val
= nla_put(cb_arg
->skb
,
1149 NLBL_UNLABEL_A_IPV6MASK
,
1150 sizeof(struct in6_addr
),
1153 goto list_cb_failure
;
1155 secid
= addr6
->secid
;
1158 ret_val
= security_secid_to_secctx(secid
, &secctx
, &secctx_len
);
1160 goto list_cb_failure
;
1161 ret_val
= nla_put(cb_arg
->skb
,
1162 NLBL_UNLABEL_A_SECCTX
,
1165 security_release_secctx(secctx
, secctx_len
);
1167 goto list_cb_failure
;
1170 return genlmsg_end(cb_arg
->skb
, data
);
1173 genlmsg_cancel(cb_arg
->skb
, data
);
1178 * netlbl_unlabel_staticlist - Handle a STATICLIST message
1179 * @skb: the NETLINK buffer
1180 * @cb: the NETLINK callback
1183 * Process a user generated STATICLIST message and dump the unlabeled
1184 * connection hash table in a form suitable for use in a kernel generated
1185 * STATICLIST message. Returns the length of @skb.
1188 static int netlbl_unlabel_staticlist(struct sk_buff
*skb
,
1189 struct netlink_callback
*cb
)
1191 struct netlbl_unlhsh_walk_arg cb_arg
;
1192 u32 skip_bkt
= cb
->args
[0];
1193 u32 skip_chain
= cb
->args
[1];
1194 u32 skip_addr4
= cb
->args
[2];
1195 u32 skip_addr6
= cb
->args
[3];
1197 u32 iter_chain
= 0, iter_addr4
= 0, iter_addr6
= 0;
1198 struct netlbl_unlhsh_iface
*iface
;
1199 struct list_head
*iter_list
;
1200 struct netlbl_af4list
*addr4
;
1201 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1202 struct netlbl_af6list
*addr6
;
1207 cb_arg
.seq
= cb
->nlh
->nlmsg_seq
;
1210 for (iter_bkt
= skip_bkt
;
1211 iter_bkt
< rcu_dereference(netlbl_unlhsh
)->size
;
1212 iter_bkt
++, iter_chain
= 0, iter_addr4
= 0, iter_addr6
= 0) {
1213 iter_list
= &rcu_dereference(netlbl_unlhsh
)->tbl
[iter_bkt
];
1214 list_for_each_entry_rcu(iface
, iter_list
, list
) {
1215 if (!iface
->valid
||
1216 iter_chain
++ < skip_chain
)
1218 netlbl_af4list_foreach_rcu(addr4
,
1219 &iface
->addr4_list
) {
1220 if (iter_addr4
++ < skip_addr4
)
1222 if (netlbl_unlabel_staticlist_gen(
1223 NLBL_UNLABEL_C_STATICLIST
,
1225 netlbl_unlhsh_addr4_entry(addr4
),
1230 goto unlabel_staticlist_return
;
1233 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1234 netlbl_af6list_foreach_rcu(addr6
,
1235 &iface
->addr6_list
) {
1236 if (iter_addr6
++ < skip_addr6
)
1238 if (netlbl_unlabel_staticlist_gen(
1239 NLBL_UNLABEL_C_STATICLIST
,
1242 netlbl_unlhsh_addr6_entry(addr6
),
1246 goto unlabel_staticlist_return
;
1253 unlabel_staticlist_return
:
1255 cb
->args
[0] = skip_bkt
;
1256 cb
->args
[1] = skip_chain
;
1257 cb
->args
[2] = skip_addr4
;
1258 cb
->args
[3] = skip_addr6
;
1263 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1264 * @skb: the NETLINK buffer
1265 * @cb: the NETLINK callback
1268 * Process a user generated STATICLISTDEF message and dump the default
1269 * unlabeled connection entry in a form suitable for use in a kernel generated
1270 * STATICLISTDEF message. Returns the length of @skb.
1273 static int netlbl_unlabel_staticlistdef(struct sk_buff
*skb
,
1274 struct netlink_callback
*cb
)
1276 struct netlbl_unlhsh_walk_arg cb_arg
;
1277 struct netlbl_unlhsh_iface
*iface
;
1278 u32 skip_addr4
= cb
->args
[0];
1279 u32 skip_addr6
= cb
->args
[1];
1281 struct netlbl_af4list
*addr4
;
1282 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1284 struct netlbl_af6list
*addr6
;
1289 cb_arg
.seq
= cb
->nlh
->nlmsg_seq
;
1292 iface
= rcu_dereference(netlbl_unlhsh_def
);
1293 if (iface
== NULL
|| !iface
->valid
)
1294 goto unlabel_staticlistdef_return
;
1296 netlbl_af4list_foreach_rcu(addr4
, &iface
->addr4_list
) {
1297 if (iter_addr4
++ < skip_addr4
)
1299 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF
,
1301 netlbl_unlhsh_addr4_entry(addr4
),
1305 goto unlabel_staticlistdef_return
;
1308 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1309 netlbl_af6list_foreach_rcu(addr6
, &iface
->addr6_list
) {
1310 if (iter_addr6
++ < skip_addr6
)
1312 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF
,
1315 netlbl_unlhsh_addr6_entry(addr6
),
1318 goto unlabel_staticlistdef_return
;
1323 unlabel_staticlistdef_return
:
1325 cb
->args
[0] = skip_addr4
;
1326 cb
->args
[1] = skip_addr6
;
1331 * NetLabel Generic NETLINK Command Definitions
1334 static struct genl_ops netlbl_unlabel_genl_ops
[] = {
1336 .cmd
= NLBL_UNLABEL_C_STATICADD
,
1337 .flags
= GENL_ADMIN_PERM
,
1338 .policy
= netlbl_unlabel_genl_policy
,
1339 .doit
= netlbl_unlabel_staticadd
,
1343 .cmd
= NLBL_UNLABEL_C_STATICREMOVE
,
1344 .flags
= GENL_ADMIN_PERM
,
1345 .policy
= netlbl_unlabel_genl_policy
,
1346 .doit
= netlbl_unlabel_staticremove
,
1350 .cmd
= NLBL_UNLABEL_C_STATICLIST
,
1352 .policy
= netlbl_unlabel_genl_policy
,
1354 .dumpit
= netlbl_unlabel_staticlist
,
1357 .cmd
= NLBL_UNLABEL_C_STATICADDDEF
,
1358 .flags
= GENL_ADMIN_PERM
,
1359 .policy
= netlbl_unlabel_genl_policy
,
1360 .doit
= netlbl_unlabel_staticadddef
,
1364 .cmd
= NLBL_UNLABEL_C_STATICREMOVEDEF
,
1365 .flags
= GENL_ADMIN_PERM
,
1366 .policy
= netlbl_unlabel_genl_policy
,
1367 .doit
= netlbl_unlabel_staticremovedef
,
1371 .cmd
= NLBL_UNLABEL_C_STATICLISTDEF
,
1373 .policy
= netlbl_unlabel_genl_policy
,
1375 .dumpit
= netlbl_unlabel_staticlistdef
,
1378 .cmd
= NLBL_UNLABEL_C_ACCEPT
,
1379 .flags
= GENL_ADMIN_PERM
,
1380 .policy
= netlbl_unlabel_genl_policy
,
1381 .doit
= netlbl_unlabel_accept
,
1385 .cmd
= NLBL_UNLABEL_C_LIST
,
1387 .policy
= netlbl_unlabel_genl_policy
,
1388 .doit
= netlbl_unlabel_list
,
1394 * NetLabel Generic NETLINK Protocol Functions
1398 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1401 * Register the unlabeled packet NetLabel component with the Generic NETLINK
1402 * mechanism. Returns zero on success, negative values on failure.
1405 int __init
netlbl_unlabel_genl_init(void)
1407 return genl_register_family_with_ops(&netlbl_unlabel_gnl_family
,
1408 netlbl_unlabel_genl_ops
, ARRAY_SIZE(netlbl_unlabel_genl_ops
));
1412 * NetLabel KAPI Hooks
1415 static struct notifier_block netlbl_unlhsh_netdev_notifier
= {
1416 .notifier_call
= netlbl_unlhsh_netdev_handler
,
1420 * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1421 * @size: the number of bits to use for the hash buckets
1424 * Initializes the unlabeled connection hash table and registers a network
1425 * device notification handler. This function should only be called by the
1426 * NetLabel subsystem itself during initialization. Returns zero on success,
1427 * non-zero values on error.
1430 int __init
netlbl_unlabel_init(u32 size
)
1433 struct netlbl_unlhsh_tbl
*hsh_tbl
;
1438 hsh_tbl
= kmalloc(sizeof(*hsh_tbl
), GFP_KERNEL
);
1439 if (hsh_tbl
== NULL
)
1441 hsh_tbl
->size
= 1 << size
;
1442 hsh_tbl
->tbl
= kcalloc(hsh_tbl
->size
,
1443 sizeof(struct list_head
),
1445 if (hsh_tbl
->tbl
== NULL
) {
1449 for (iter
= 0; iter
< hsh_tbl
->size
; iter
++)
1450 INIT_LIST_HEAD(&hsh_tbl
->tbl
[iter
]);
1453 spin_lock(&netlbl_unlhsh_lock
);
1454 rcu_assign_pointer(netlbl_unlhsh
, hsh_tbl
);
1455 spin_unlock(&netlbl_unlhsh_lock
);
1458 register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier
);
1464 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1466 * @family: protocol family
1467 * @secattr: the security attributes
1470 * Determine the security attributes, if any, for an unlabled packet and return
1471 * them in @secattr. Returns zero on success and negative values on failure.
1474 int netlbl_unlabel_getattr(const struct sk_buff
*skb
,
1476 struct netlbl_lsm_secattr
*secattr
)
1478 struct netlbl_unlhsh_iface
*iface
;
1481 iface
= netlbl_unlhsh_search_iface(skb
->skb_iif
);
1483 iface
= rcu_dereference(netlbl_unlhsh_def
);
1484 if (iface
== NULL
|| !iface
->valid
)
1485 goto unlabel_getattr_nolabel
;
1489 struct netlbl_af4list
*addr4
;
1492 addr4
= netlbl_af4list_search(hdr4
->saddr
,
1493 &iface
->addr4_list
);
1495 goto unlabel_getattr_nolabel
;
1496 secattr
->attr
.secid
= netlbl_unlhsh_addr4_entry(addr4
)->secid
;
1499 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1501 struct ipv6hdr
*hdr6
;
1502 struct netlbl_af6list
*addr6
;
1504 hdr6
= ipv6_hdr(skb
);
1505 addr6
= netlbl_af6list_search(&hdr6
->saddr
,
1506 &iface
->addr6_list
);
1508 goto unlabel_getattr_nolabel
;
1509 secattr
->attr
.secid
= netlbl_unlhsh_addr6_entry(addr6
)->secid
;
1514 goto unlabel_getattr_nolabel
;
1518 secattr
->flags
|= NETLBL_SECATTR_SECID
;
1519 secattr
->type
= NETLBL_NLTYPE_UNLABELED
;
1522 unlabel_getattr_nolabel
:
1524 if (netlabel_unlabel_acceptflg
== 0)
1526 secattr
->type
= NETLBL_NLTYPE_UNLABELED
;
1531 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1534 * Set the default NetLabel configuration to allow incoming unlabeled packets
1535 * and to send unlabeled network traffic by default.
1538 int __init
netlbl_unlabel_defconf(void)
1541 struct netlbl_dom_map
*entry
;
1542 struct netlbl_audit audit_info
;
1544 /* Only the kernel is allowed to call this function and the only time
1545 * it is called is at bootup before the audit subsystem is reporting
1546 * messages so don't worry to much about these values. */
1547 security_task_getsecid(current
, &audit_info
.secid
);
1548 audit_info
.loginuid
= 0;
1549 audit_info
.sessionid
= 0;
1551 entry
= kzalloc(sizeof(*entry
), GFP_KERNEL
);
1554 entry
->type
= NETLBL_NLTYPE_UNLABELED
;
1555 ret_val
= netlbl_domhsh_add_default(entry
, &audit_info
);
1559 netlbl_unlabel_acceptflg_set(1, &audit_info
);