lsm_interface.txt 2.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647
  1. NetLabel Linux Security Module Interface
  2. ==============================================================================
  3. Paul Moore, paul.moore@hp.com
  4. May 17, 2006
  5. * Overview
  6. NetLabel is a mechanism which can set and retrieve security attributes from
  7. network packets. It is intended to be used by LSM developers who want to make
  8. use of a common code base for several different packet labeling protocols.
  9. The NetLabel security module API is defined in 'include/net/netlabel.h' but a
  10. brief overview is given below.
  11. * NetLabel Security Attributes
  12. Since NetLabel supports multiple different packet labeling protocols and LSMs
  13. it uses the concept of security attributes to refer to the packet's security
  14. labels. The NetLabel security attributes are defined by the
  15. 'netlbl_lsm_secattr' structure in the NetLabel header file. Internally the
  16. NetLabel subsystem converts the security attributes to and from the correct
  17. low-level packet label depending on the NetLabel build time and run time
  18. configuration. It is up to the LSM developer to translate the NetLabel
  19. security attributes into whatever security identifiers are in use for their
  20. particular LSM.
  21. * NetLabel LSM Protocol Operations
  22. These are the functions which allow the LSM developer to manipulate the labels
  23. on outgoing packets as well as read the labels on incoming packets. Functions
  24. exist to operate both on sockets as well as the sk_buffs directly. These high
  25. level functions are translated into low level protocol operations based on how
  26. the administrator has configured the NetLabel subsystem.
  27. * NetLabel Label Mapping Cache Operations
  28. Depending on the exact configuration, translation between the network packet
  29. label and the internal LSM security identifier can be time consuming. The
  30. NetLabel label mapping cache is a caching mechanism which can be used to
  31. sidestep much of this overhead once a mapping has been established. Once the
  32. LSM has received a packet, used NetLabel to decode it's security attributes,
  33. and translated the security attributes into a LSM internal identifier the LSM
  34. can use the NetLabel caching functions to associate the LSM internal
  35. identifier with the network packet's label. This means that in the future
  36. when a incoming packet matches a cached value not only are the internal
  37. NetLabel translation mechanisms bypassed but the LSM translation mechanisms are
  38. bypassed as well which should result in a significant reduction in overhead.