Home
last modified time | relevance | path

Searched refs:secmark (Results 1 – 17 of 17) sorted by relevance

/linux/net/netfilter/
H A Dxt_CONNSECMARK.c34 if (skb->secmark) { in secmark_save()
39 if (ct && !ct->secmark) { in secmark_save()
40 ct->secmark = skb->secmark; in secmark_save()
52 if (!skb->secmark) { in secmark_restore()
57 if (ct && ct->secmark) in secmark_restore()
58 skb->secmark = ct->secmark; in secmark_restore()
H A Dxt_SECMARK.c29 u32 secmark = 0; in secmark_tg() local
33 secmark = info->secid; in secmark_tg()
39 skb->secmark = secmark; in secmark_tg()
H A Dnft_meta.c419 *dest = skb->secmark; in nft_meta_get_eval()
507 skb->secmark = value; in nft_meta_set_eval()
955 skb->secmark = priv->secid; in nft_secmark_obj_eval()
H A Dnft_ct.c98 *dest = ct->secmark; in nft_ct_get_eval()
301 if (ct->secmark != value) { in nft_ct_set_eval()
302 ct->secmark = value; in nft_ct_set_eval()
H A Dnf_conntrack_netlink.c363 ret = security_secid_to_secctx(ct->secmark, &ctx); in ctnetlink_dump_secctx()
685 ret = security_secid_to_secctx(ct->secmark, NULL); in ctnetlink_secctx_size()
836 if ((events & (1 << IPCT_SECMARK) || ct->secmark) in ctnetlink_conntrack_event()
2718 if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0) in __ctnetlink_glue_build()
H A Dnfnetlink_queue.c609 if (skb->secmark) in nfqnl_get_sk_secctx()
610 seclen = security_secid_to_secctx(skb->secmark, ctx); in nfqnl_get_sk_secctx()
H A Dnf_conntrack_standalone.c191 ret = security_secid_to_secctx(ct->secmark, &ctx); in ct_show_secctx()
H A Dnf_conntrack_core.c1829 ct->secmark = exp->master->secmark; in init_conntrack()
/linux/security/apparmor/
H A Dnet.c349 static int apparmor_secmark_init(struct aa_secmark *secmark) in apparmor_secmark_init() argument
353 if (secmark->label[0] == '*') { in apparmor_secmark_init()
354 secmark->secid = AA_SECID_WILDCARD; in apparmor_secmark_init()
359 secmark->label, strlen(secmark->label), in apparmor_secmark_init()
365 secmark->secid = label->secid; in apparmor_secmark_init()
382 if (!rules->secmark[i].secid) { in aa_secmark_perm()
383 ret = apparmor_secmark_init(&rules->secmark[i]); in aa_secmark_perm()
388 if (rules->secmark[i].secid == secid || in aa_secmark_perm()
389 rules->secmark[i].secid == AA_SECID_WILDCARD) { in aa_secmark_perm()
390 if (rules->secmark[i].deny) in aa_secmark_perm()
[all …]
H A Dpolicy_unpack.c631 rules->secmark = kzalloc_objs(struct aa_secmark, size); in unpack_secmark()
632 if (!rules->secmark) in unpack_secmark()
638 if (!unpack_u8(e, &rules->secmark[i].audit, NULL)) in unpack_secmark()
640 if (!unpack_u8(e, &rules->secmark[i].deny, NULL)) in unpack_secmark()
642 if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL)) in unpack_secmark()
654 if (rules->secmark) { in unpack_secmark()
656 kfree_sensitive(rules->secmark[i].label); in unpack_secmark()
657 kfree_sensitive(rules->secmark); in unpack_secmark()
659 rules->secmark = NULL; in unpack_secmark()
H A Dlsm.c1671 if (!skb->secmark) in apparmor_socket_sock_rcv_skb()
1683 AA_MAY_RECEIVE, skb->secmark, sk); in apparmor_socket_sock_rcv_skb()
1695 if (!skb->secmark) in apparmor_inet_conn_request()
1700 AA_MAY_CONNECT, skb->secmark, sk); in apparmor_inet_conn_request()
1716 if (!skb->secmark) in apparmor_ip_postroute()
1726 AA_MAY_SEND, skb->secmark, sk); in apparmor_ip_postroute()
H A Dpolicy.c301 kfree_sensitive(rules->secmark[i].label); in free_ruleset()
302 kfree_sensitive(rules->secmark); in free_ruleset()
/linux/security/smack/
H A Dsmack_netfilter.c32 skb->secmark = skp->smk_secid; in smack_ip_output()
H A Dsmack_lsm.c4215 * smack_from_skb - Smack data from the secmark in an skb
4218 * Returns smack_known of the secmark or NULL if that won't work.
4223 if (skb == NULL || skb->secmark == 0) in smack_from_netlbl()
4226 return smack_from_secid(skb->secmark); in smack_from_netlbl()
4297 * If there is a secmark use it rather than the CIPSO label. in smack_socket_sock_rcv_skb()
4298 * If there is no secmark fall back to CIPSO. in smack_socket_sock_rcv_skb()
4299 * The secmark is assumed to reflect policy better. in smack_socket_sock_rcv_skb()
4502 * If there is a secmark use it rather than the CIPSO label. in smack_inet_conn_request()
4503 * If there is no secmark fall back to CIPSO. in smack_inet_conn_request()
4504 * The secmark i in smack_inet_conn_request()
[all...]
/linux/security/apparmor/include/
H A Dpolicy.h201 struct aa_secmark *secmark; member
/linux/security/selinux/
H A Dhooks.c5419 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, in selinux_sock_rcv_skb_compat()
5488 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, in selinux_socket_sock_rcv_skb()
6022 if (avc_has_perm(peer_sid, skb->secmark, in selinux_ip_forward()
6099 if (avc_has_perm(sksec->sid, skb->secmark, in selinux_ip_postroute_compat()
6221 if (avc_has_perm(peer_sid, skb->secmark, in selinux_ip_postroute()
/linux/net/core/
H A Dskbuff.c1588 CHECK_SKB_FIELD(secmark); in __copy_skb_header()