1 /* 2 * NetLabel System 3 * 4 * The NetLabel system manages static and dynamic label mappings for network 5 * protocols such as CIPSO and RIPSO. 6 * 7 * Author: Paul Moore <paul.moore@hp.com> 8 * 9 */ 10 11 /* 12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License as published by 16 * the Free Software Foundation; either version 2 of the License, or 17 * (at your option) any later version. 18 * 19 * This program is distributed in the hope that it will be useful, 20 * but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 22 * the GNU General Public License for more details. 23 * 24 * You should have received a copy of the GNU General Public License 25 * along with this program; if not, write to the Free Software 26 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 27 * 28 */ 29 30 #ifndef _NETLABEL_H 31 #define _NETLABEL_H 32 33 #include <linux/types.h> 34 #include <linux/net.h> 35 #include <linux/skbuff.h> 36 #include <net/netlink.h> 37 #include <asm/atomic.h> 38 39 struct cipso_v4_doi; 40 41 /* 42 * NetLabel - A management interface for maintaining network packet label 43 * mapping tables for explicit packet labling protocols. 44 * 45 * Network protocols such as CIPSO and RIPSO require a label translation layer 46 * to convert the label on the packet into something meaningful on the host 47 * machine. In the current Linux implementation these mapping tables live 48 * inside the kernel; NetLabel provides a mechanism for user space applications 49 * to manage these mapping tables. 50 * 51 * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to 52 * send messages between kernel and user space. The general format of a 53 * NetLabel message is shown below: 54 * 55 * +-----------------+-------------------+--------- --- -- - 56 * | struct nlmsghdr | struct genlmsghdr | payload 57 * +-----------------+-------------------+--------- --- -- - 58 * 59 * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. 60 * The payload is dependent on the subsystem specified in the 61 * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions 62 * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c 63 * file. All of the fields in the NetLabel payload are NETLINK attributes, see 64 * the include/net/netlink.h file for more information on NETLINK attributes. 65 * 66 */ 67 68 /* 69 * NetLabel NETLINK protocol 70 */ 71 72 /* NetLabel NETLINK protocol version 73 * 1: initial version 74 * 2: added static labels for unlabeled connections 75 * 3: network selectors added to the NetLabel/LSM domain mapping 76 */ 77 #define NETLBL_PROTO_VERSION 3 78 79 /* NetLabel NETLINK types/families */ 80 #define NETLBL_NLTYPE_NONE 0 81 #define NETLBL_NLTYPE_MGMT 1 82 #define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT" 83 #define NETLBL_NLTYPE_RIPSO 2 84 #define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO" 85 #define NETLBL_NLTYPE_CIPSOV4 3 86 #define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4" 87 #define NETLBL_NLTYPE_CIPSOV6 4 88 #define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6" 89 #define NETLBL_NLTYPE_UNLABELED 5 90 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" 91 #define NETLBL_NLTYPE_ADDRSELECT 6 92 #define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL" 93 94 /* 95 * NetLabel - Kernel API for accessing the network packet label mappings. 96 * 97 * The following functions are provided for use by other kernel modules, 98 * specifically kernel LSM modules, to provide a consistent, transparent API 99 * for dealing with explicit packet labeling protocols such as CIPSO and 100 * RIPSO. The functions defined here are implemented in the 101 * net/netlabel/netlabel_kapi.c file. 102 * 103 */ 104 105 /* NetLabel audit information */ 106 struct netlbl_audit { 107 u32 secid; 108 uid_t loginuid; 109 u32 sessionid; 110 }; 111 112 /* 113 * LSM security attributes 114 */ 115 116 /** 117 * struct netlbl_lsm_cache - NetLabel LSM security attribute cache 118 * @refcount: atomic reference counter 119 * @free: LSM supplied function to free the cache data 120 * @data: LSM supplied cache data 121 * 122 * Description: 123 * This structure is provided for LSMs which wish to make use of the NetLabel 124 * caching mechanism to store LSM specific data/attributes in the NetLabel 125 * cache. If the LSM has to perform a lot of translation from the NetLabel 126 * security attributes into it's own internal representation then the cache 127 * mechanism can provide a way to eliminate some or all of that translation 128 * overhead on a cache hit. 129 * 130 */ 131 struct netlbl_lsm_cache { 132 atomic_t refcount; 133 void (*free) (const void *data); 134 void *data; 135 }; 136 137 /** 138 * struct netlbl_lsm_secattr_catmap - NetLabel LSM secattr category bitmap 139 * @startbit: the value of the lowest order bit in the bitmap 140 * @bitmap: the category bitmap 141 * @next: pointer to the next bitmap "node" or NULL 142 * 143 * Description: 144 * This structure is used to represent category bitmaps. Due to the large 145 * number of categories supported by most labeling protocols it is not 146 * practical to transfer a full bitmap internally so NetLabel adopts a sparse 147 * bitmap structure modeled after SELinux's ebitmap structure. 148 * The catmap bitmap field MUST be a power of two in length and large 149 * enough to hold at least 240 bits. Special care (i.e. check the code!) 150 * should be used when changing these values as the LSM implementation 151 * probably has functions which rely on the sizes of these types to speed 152 * processing. 153 * 154 */ 155 #define NETLBL_CATMAP_MAPTYPE u64 156 #define NETLBL_CATMAP_MAPCNT 4 157 #define NETLBL_CATMAP_MAPSIZE (sizeof(NETLBL_CATMAP_MAPTYPE) * 8) 158 #define NETLBL_CATMAP_SIZE (NETLBL_CATMAP_MAPSIZE * \ 159 NETLBL_CATMAP_MAPCNT) 160 #define NETLBL_CATMAP_BIT (NETLBL_CATMAP_MAPTYPE)0x01 161 struct netlbl_lsm_secattr_catmap { 162 u32 startbit; 163 NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT]; 164 struct netlbl_lsm_secattr_catmap *next; 165 }; 166 167 /** 168 * struct netlbl_lsm_secattr - NetLabel LSM security attributes 169 * @flags: indicate structure attributes, see NETLBL_SECATTR_* 170 * @type: indicate the NLTYPE of the attributes 171 * @domain: the NetLabel LSM domain 172 * @cache: NetLabel LSM specific cache 173 * @attr.mls: MLS sensitivity label 174 * @attr.mls.cat: MLS category bitmap 175 * @attr.mls.lvl: MLS sensitivity level 176 * @attr.secid: LSM specific secid token 177 * 178 * Description: 179 * This structure is used to pass security attributes between NetLabel and the 180 * LSM modules. The flags field is used to specify which fields within the 181 * struct are valid and valid values can be created by bitwise OR'ing the 182 * NETLBL_SECATTR_* defines. The domain field is typically set by the LSM to 183 * specify domain specific configuration settings and is not usually used by 184 * NetLabel itself when returning security attributes to the LSM. 185 * 186 */ 187 struct netlbl_lsm_secattr { 188 u32 flags; 189 /* bitmap values for 'flags' */ 190 #define NETLBL_SECATTR_NONE 0x00000000 191 #define NETLBL_SECATTR_DOMAIN 0x00000001 192 #define NETLBL_SECATTR_DOMAIN_CPY (NETLBL_SECATTR_DOMAIN | \ 193 NETLBL_SECATTR_FREE_DOMAIN) 194 #define NETLBL_SECATTR_CACHE 0x00000002 195 #define NETLBL_SECATTR_MLS_LVL 0x00000004 196 #define NETLBL_SECATTR_MLS_CAT 0x00000008 197 #define NETLBL_SECATTR_SECID 0x00000010 198 /* bitmap meta-values for 'flags' */ 199 #define NETLBL_SECATTR_FREE_DOMAIN 0x01000000 200 #define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ 201 NETLBL_SECATTR_MLS_CAT | \ 202 NETLBL_SECATTR_SECID) 203 u32 type; 204 char *domain; 205 struct netlbl_lsm_cache *cache; 206 union { 207 struct { 208 struct netlbl_lsm_secattr_catmap *cat; 209 u32 lvl; 210 } mls; 211 u32 secid; 212 } attr; 213 }; 214 215 /* 216 * LSM security attribute operations (inline) 217 */ 218 219 /** 220 * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache 221 * @flags: the memory allocation flags 222 * 223 * Description: 224 * Allocate and initialize a netlbl_lsm_cache structure. Returns a pointer 225 * on success, NULL on failure. 226 * 227 */ 228 static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags) 229 { 230 struct netlbl_lsm_cache *cache; 231 232 cache = kzalloc(sizeof(*cache), flags); 233 if (cache) 234 atomic_set(&cache->refcount, 1); 235 return cache; 236 } 237 238 /** 239 * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct 240 * @cache: the struct to free 241 * 242 * Description: 243 * Frees @secattr including all of the internal buffers. 244 * 245 */ 246 static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache) 247 { 248 if (!atomic_dec_and_test(&cache->refcount)) 249 return; 250 251 if (cache->free) 252 cache->free(cache->data); 253 kfree(cache); 254 } 255 256 /** 257 * netlbl_secattr_catmap_alloc - Allocate a LSM secattr catmap 258 * @flags: memory allocation flags 259 * 260 * Description: 261 * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL 262 * on failure. 263 * 264 */ 265 static inline struct netlbl_lsm_secattr_catmap *netlbl_secattr_catmap_alloc( 266 gfp_t flags) 267 { 268 return kzalloc(sizeof(struct netlbl_lsm_secattr_catmap), flags); 269 } 270 271 /** 272 * netlbl_secattr_catmap_free - Free a LSM secattr catmap 273 * @catmap: the category bitmap 274 * 275 * Description: 276 * Free a LSM secattr catmap. 277 * 278 */ 279 static inline void netlbl_secattr_catmap_free( 280 struct netlbl_lsm_secattr_catmap *catmap) 281 { 282 struct netlbl_lsm_secattr_catmap *iter; 283 284 do { 285 iter = catmap; 286 catmap = catmap->next; 287 kfree(iter); 288 } while (catmap); 289 } 290 291 /** 292 * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct 293 * @secattr: the struct to initialize 294 * 295 * Description: 296 * Initialize an already allocated netlbl_lsm_secattr struct. 297 * 298 */ 299 static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr) 300 { 301 memset(secattr, 0, sizeof(*secattr)); 302 } 303 304 /** 305 * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct 306 * @secattr: the struct to clear 307 * 308 * Description: 309 * Destroys the @secattr struct, including freeing all of the internal buffers. 310 * The struct must be reset with a call to netlbl_secattr_init() before reuse. 311 * 312 */ 313 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr) 314 { 315 if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN) 316 kfree(secattr->domain); 317 if (secattr->flags & NETLBL_SECATTR_CACHE) 318 netlbl_secattr_cache_free(secattr->cache); 319 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) 320 netlbl_secattr_catmap_free(secattr->attr.mls.cat); 321 } 322 323 /** 324 * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct 325 * @flags: the memory allocation flags 326 * 327 * Description: 328 * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid 329 * pointer on success, or NULL on failure. 330 * 331 */ 332 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(gfp_t flags) 333 { 334 return kzalloc(sizeof(struct netlbl_lsm_secattr), flags); 335 } 336 337 /** 338 * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct 339 * @secattr: the struct to free 340 * 341 * Description: 342 * Frees @secattr including all of the internal buffers. 343 * 344 */ 345 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) 346 { 347 netlbl_secattr_destroy(secattr); 348 kfree(secattr); 349 } 350 351 #ifdef CONFIG_NETLABEL 352 /* 353 * LSM configuration operations 354 */ 355 int netlbl_cfg_map_del(const char *domain, struct netlbl_audit *audit_info); 356 int netlbl_cfg_unlbl_add_map(const char *domain, 357 struct netlbl_audit *audit_info); 358 int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def, 359 const char *domain, 360 struct netlbl_audit *audit_info); 361 362 /* 363 * LSM security attribute operations 364 */ 365 int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap, 366 u32 offset); 367 int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap, 368 u32 offset); 369 int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap, 370 u32 bit, 371 gfp_t flags); 372 int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap, 373 u32 start, 374 u32 end, 375 gfp_t flags); 376 377 /* 378 * LSM protocol operations (NetLabel LSM/kernel API) 379 */ 380 int netlbl_enabled(void); 381 int netlbl_sock_setattr(struct sock *sk, 382 const struct netlbl_lsm_secattr *secattr); 383 int netlbl_sock_getattr(struct sock *sk, 384 struct netlbl_lsm_secattr *secattr); 385 int netlbl_skbuff_getattr(const struct sk_buff *skb, 386 u16 family, 387 struct netlbl_lsm_secattr *secattr); 388 void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway); 389 390 /* 391 * LSM label mapping cache operations 392 */ 393 void netlbl_cache_invalidate(void); 394 int netlbl_cache_add(const struct sk_buff *skb, 395 const struct netlbl_lsm_secattr *secattr); 396 #else 397 static inline int netlbl_cfg_map_del(const char *domain, 398 struct netlbl_audit *audit_info) 399 { 400 return -ENOSYS; 401 } 402 static inline int netlbl_cfg_unlbl_add_map(const char *domain, 403 struct netlbl_audit *audit_info) 404 { 405 return -ENOSYS; 406 } 407 static inline int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def, 408 const char *domain, 409 struct netlbl_audit *audit_info) 410 { 411 return -ENOSYS; 412 } 413 static inline int netlbl_secattr_catmap_walk( 414 struct netlbl_lsm_secattr_catmap *catmap, 415 u32 offset) 416 { 417 return -ENOENT; 418 } 419 static inline int netlbl_secattr_catmap_walk_rng( 420 struct netlbl_lsm_secattr_catmap *catmap, 421 u32 offset) 422 { 423 return -ENOENT; 424 } 425 static inline int netlbl_secattr_catmap_setbit( 426 struct netlbl_lsm_secattr_catmap *catmap, 427 u32 bit, 428 gfp_t flags) 429 { 430 return 0; 431 } 432 static inline int netlbl_secattr_catmap_setrng( 433 struct netlbl_lsm_secattr_catmap *catmap, 434 u32 start, 435 u32 end, 436 gfp_t flags) 437 { 438 return 0; 439 } 440 static inline int netlbl_enabled(void) 441 { 442 return 0; 443 } 444 static inline int netlbl_sock_setattr(struct sock *sk, 445 const struct netlbl_lsm_secattr *secattr) 446 { 447 return -ENOSYS; 448 } 449 static inline int netlbl_sock_getattr(struct sock *sk, 450 struct netlbl_lsm_secattr *secattr) 451 { 452 return -ENOSYS; 453 } 454 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, 455 u16 family, 456 struct netlbl_lsm_secattr *secattr) 457 { 458 return -ENOSYS; 459 } 460 static inline void netlbl_skbuff_err(struct sk_buff *skb, 461 int error, 462 int gateway) 463 { 464 return; 465 } 466 static inline void netlbl_cache_invalidate(void) 467 { 468 return; 469 } 470 static inline int netlbl_cache_add(const struct sk_buff *skb, 471 const struct netlbl_lsm_secattr *secattr) 472 { 473 return 0; 474 } 475 #endif /* CONFIG_NETLABEL */ 476 477 #endif /* _NETLABEL_H */ 478