1. 30 1月, 2008 1 次提交
  2. 19 7月, 2007 1 次提交
    • P
      SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement · 23bcdc1a
      Paul Moore 提交于
      Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the
      current runtime status of NetLabel based on the existing configuration.  LSMs
      that make use of NetLabel, i.e. SELinux, can use this new function to determine
      if they should perform NetLabel access checks.  This patch changes the
      NetLabel/SELinux glue code such that SELinux only enforces NetLabel related
      access checks when netlbl_enabled() returns true.
      
      At present NetLabel is considered to be enabled when there is at least one
      labeled protocol configuration present.  The result is that by default NetLabel
      is considered to be disabled, however, as soon as an administrator configured
      a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing
      NetLabel related access controls - including unlabeled packet controls.
      
      This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL"
      blocks into a single block to ease future review as recommended by Linus.
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      Signed-off-by: NJames Morris <jmorris@namei.org>
      23bcdc1a
  3. 26 9月, 2006 1 次提交
  4. 23 9月, 2006 1 次提交
    • P
      [NetLabel]: core NetLabel subsystem · d15c345f
      Paul Moore 提交于
      Add a new kernel subsystem, NetLabel, to provide explicit packet
      labeling services (CIPSO, RIPSO, etc.) to LSM developers.  NetLabel is
      designed to work in conjunction with a LSM to intercept and decode
      security labels on incoming network packets as well as ensure that
      outgoing network packets are labeled according to the security
      mechanism employed by the LSM.  The NetLabel subsystem is configured
      through a Generic NETLINK interface described in the header files
      included in this patch.
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d15c345f