xref: /linux/security/selinux/include/xfrm.h (revision c411ed854584a71b0e86ac3019b60e4789d88086)
1 /*
2  * SELinux support for the XFRM LSM hooks
3  *
4  * Author : Trent Jaeger, <jaegert@us.ibm.com>
5  * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
6  */
7 #ifndef _SELINUX_XFRM_H_
8 #define _SELINUX_XFRM_H_
9 
10 #include <net/flow.h>
11 
12 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
13 			      struct xfrm_user_sec_ctx *uctx,
14 			      gfp_t gfp);
15 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
16 			      struct xfrm_sec_ctx **new_ctxp);
17 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
18 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
19 int selinux_xfrm_state_alloc(struct xfrm_state *x,
20 			     struct xfrm_user_sec_ctx *uctx);
21 int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
22 				     struct xfrm_sec_ctx *polsec, u32 secid);
23 void selinux_xfrm_state_free(struct xfrm_state *x);
24 int selinux_xfrm_state_delete(struct xfrm_state *x);
25 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
26 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
27 				      struct xfrm_policy *xp,
28 				      const struct flowi *fl);
29 
30 #ifdef CONFIG_SECURITY_NETWORK_XFRM
31 extern atomic_t selinux_xfrm_refcount;
32 
33 static inline int selinux_xfrm_enabled(void)
34 {
35 	return (atomic_read(&selinux_xfrm_refcount) > 0);
36 }
37 
38 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
39 			      struct common_audit_data *ad);
40 int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
41 				struct common_audit_data *ad, u8 proto);
42 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
43 int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
44 
45 static inline void selinux_xfrm_notify_policyload(void)
46 {
47 	struct net *net;
48 
49 	rtnl_lock();
50 	for_each_net(net)
51 		rt_genid_bump_all(net);
52 	rtnl_unlock();
53 }
54 #else
55 static inline int selinux_xfrm_enabled(void)
56 {
57 	return 0;
58 }
59 
60 static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
61 					    struct common_audit_data *ad)
62 {
63 	return 0;
64 }
65 
66 static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
67 					      struct common_audit_data *ad,
68 					      u8 proto)
69 {
70 	return 0;
71 }
72 
73 static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
74 					      int ckall)
75 {
76 	*sid = SECSID_NULL;
77 	return 0;
78 }
79 
80 static inline void selinux_xfrm_notify_policyload(void)
81 {
82 }
83 
84 static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
85 {
86 	*sid = SECSID_NULL;
87 	return 0;
88 }
89 #endif
90 
91 #endif /* _SELINUX_XFRM_H_ */
92