netlabel: Add functionality to set the security attributes of a packet
commit948bf85c1bc9a84754786a9d5dd99b7ecc46451e
authorPaul Moore <paul.moore@hp.com>
Fri, 10 Oct 2008 14:16:32 +0000 (10 10:16 -0400)
committerPaul Moore <paul.moore@hp.com>
Fri, 10 Oct 2008 14:16:32 +0000 (10 10:16 -0400)
treea4706be1f4a5a37408774ef3c4cab8cf2e7775b5
parent63c41688743760631188cf0f4ae986a6793ccb0a
netlabel: Add functionality to set the security attributes of a packet

This patch builds upon the new NetLabel address selector functionality by
providing the NetLabel KAPI and CIPSO engine support needed to enable the
new packet-based labeling.  The only new addition to the NetLabel KAPI at
this point is shown below:

 * int netlbl_skbuff_setattr(skb, family, secattr)

... and is designed to be called from a Netfilter hook after the packet's
IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.

This patch also provides the necessary SELinux hooks to support this new
functionality.  Smack support is not currently included due to uncertainty
regarding the permissions needed to expand the Smack network access controls.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Reviewed-by: James Morris <jmorris@namei.org>
include/net/cipso_ipv4.h
include/net/netlabel.h
net/ipv4/cipso_ipv4.c
net/netlabel/netlabel_kapi.c
security/selinux/hooks.c
security/selinux/include/netlabel.h
security/selinux/include/objsec.h
security/selinux/netlabel.c