xfrm.h 2.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475
  1. /*
  2. * SELinux support for the XFRM LSM hooks
  3. *
  4. * Author : Trent Jaeger, <jaegert@us.ibm.com>
  5. * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
  6. */
  7. #ifndef _SELINUX_XFRM_H_
  8. #define _SELINUX_XFRM_H_
  9. int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
  10. struct xfrm_user_sec_ctx *sec_ctx);
  11. int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new);
  12. void selinux_xfrm_policy_free(struct xfrm_policy *xp);
  13. int selinux_xfrm_policy_delete(struct xfrm_policy *xp);
  14. int selinux_xfrm_state_alloc(struct xfrm_state *x,
  15. struct xfrm_user_sec_ctx *sec_ctx, u32 secid);
  16. void selinux_xfrm_state_free(struct xfrm_state *x);
  17. int selinux_xfrm_state_delete(struct xfrm_state *x);
  18. int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
  19. int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
  20. struct xfrm_policy *xp, struct flowi *fl);
  21. /*
  22. * Extract the security blob from the sock (it's actually on the socket)
  23. */
  24. static inline struct inode_security_struct *get_sock_isec(struct sock *sk)
  25. {
  26. if (!sk->sk_socket)
  27. return NULL;
  28. return SOCK_INODE(sk->sk_socket)->i_security;
  29. }
  30. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  31. int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb,
  32. struct avc_audit_data *ad);
  33. int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
  34. struct avc_audit_data *ad, u8 proto);
  35. int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
  36. static inline void selinux_xfrm_notify_policyload(void)
  37. {
  38. atomic_inc(&flow_cache_genid);
  39. }
  40. #else
  41. static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
  42. struct avc_audit_data *ad)
  43. {
  44. return 0;
  45. }
  46. static inline int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
  47. struct avc_audit_data *ad, u8 proto)
  48. {
  49. return 0;
  50. }
  51. static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
  52. {
  53. *sid = SECSID_NULL;
  54. return 0;
  55. }
  56. static inline void selinux_xfrm_notify_policyload(void)
  57. {
  58. }
  59. #endif
  60. static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
  61. {
  62. int err = selinux_xfrm_decode_session(skb, sid, 0);
  63. BUG_ON(err);
  64. }
  65. #endif /* _SELINUX_XFRM_H_ */