introduction.txt 2.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
  1. NetLabel Introduction
  2. ==============================================================================
  3. Paul Moore, paul.moore@hp.com
  4. August 2, 2006
  5. * Overview
  6. NetLabel is a mechanism which can be used by kernel security modules to attach
  7. security attributes to outgoing network packets generated from user space
  8. applications and read security attributes from incoming network packets. It
  9. is composed of three main components, the protocol engines, the communication
  10. layer, and the kernel security module API.
  11. * Protocol Engines
  12. The protocol engines are responsible for both applying and retrieving the
  13. network packet's security attributes. If any translation between the network
  14. security attributes and those on the host are required then the protocol
  15. engine will handle those tasks as well. Other kernel subsystems should
  16. refrain from calling the protocol engines directly, instead they should use
  17. the NetLabel kernel security module API described below.
  18. Detailed information about each NetLabel protocol engine can be found in this
  19. directory, consult '00-INDEX' for filenames.
  20. * Communication Layer
  21. The communication layer exists to allow NetLabel configuration and monitoring
  22. from user space. The NetLabel communication layer uses a message based
  23. protocol built on top of the Generic NETLINK transport mechanism. The exact
  24. formatting of these NetLabel messages as well as the Generic NETLINK family
  25. names can be found in the the 'net/netlabel/' directory as comments in the
  26. header files as well as in 'include/net/netlabel.h'.
  27. * Security Module API
  28. The purpose of the NetLabel security module API is to provide a protocol
  29. independent interface to the underlying NetLabel protocol engines. In addition
  30. to protocol independence, the security module API is designed to be completely
  31. LSM independent which should allow multiple LSMs to leverage the same code
  32. base.
  33. Detailed information about the NetLabel security module API can be found in the
  34. 'include/net/netlabel.h' header file as well as the 'lsm_interface.txt' file
  35. found in this directory.