1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Simplified MAC Kernel (smack) security module
4 *
5 * This file contains the Smack netfilter implementation
6 *
7 * Author:
8 * Casey Schaufler <casey@schaufler-ca.com>
9 *
10 * Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
11 * Copyright (C) 2014 Intel Corporation.
12 */
13
14 #include <linux/netfilter_ipv4.h>
15 #include <linux/netfilter_ipv6.h>
16 #include <linux/netdevice.h>
17 #include <net/inet_sock.h>
18 #include <net/net_namespace.h>
19 #include "smack.h"
20
smack_ip_output(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)21 static unsigned int smack_ip_output(void *priv,
22 struct sk_buff *skb,
23 const struct nf_hook_state *state)
24 {
25 struct sock *sk = skb_to_full_sk(skb);
26 struct socket_smack *ssp;
27 struct smack_known *skp;
28
29 if (sk) {
30 ssp = smack_sock(sk);
31 skp = ssp->smk_out;
32 skb->secmark = skp->smk_secid;
33 }
34
35 return NF_ACCEPT;
36 }
37
38 static const struct nf_hook_ops smack_nf_ops[] = {
39 {
40 .hook = smack_ip_output,
41 .pf = NFPROTO_IPV4,
42 .hooknum = NF_INET_LOCAL_OUT,
43 .priority = NF_IP_PRI_SELINUX_FIRST,
44 },
45 #if IS_ENABLED(CONFIG_IPV6)
46 {
47 .hook = smack_ip_output,
48 .pf = NFPROTO_IPV6,
49 .hooknum = NF_INET_LOCAL_OUT,
50 .priority = NF_IP6_PRI_SELINUX_FIRST,
51 },
52 #endif /* IPV6 */
53 };
54
smack_nf_register(struct net * net)55 static int __net_init smack_nf_register(struct net *net)
56 {
57 return nf_register_net_hooks(net, smack_nf_ops,
58 ARRAY_SIZE(smack_nf_ops));
59 }
60
smack_nf_unregister(struct net * net)61 static void __net_exit smack_nf_unregister(struct net *net)
62 {
63 nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
64 }
65
66 static struct pernet_operations smack_net_ops = {
67 .init = smack_nf_register,
68 .exit = smack_nf_unregister,
69 };
70
smack_nf_ip_init(void)71 static int __init smack_nf_ip_init(void)
72 {
73 if (smack_enabled == 0)
74 return 0;
75
76 printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
77 return register_pernet_subsys(&smack_net_ops);
78 }
79
80 __initcall(smack_nf_ip_init);
81