Linux 4.13.16
[linux/fpc-iii.git] / security / smack / smack_netfilter.c
blobcdeb0f3243dd635ced5e9efb49fb3fb61d37e4f3
1 /*
2 * Simplified MAC Kernel (smack) security module
4 * This file contains the Smack netfilter implementation
6 * Author:
7 * Casey Schaufler <casey@schaufler-ca.com>
9 * Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
10 * Copyright (C) 2014 Intel Corporation.
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License version 2,
14 * as published by the Free Software Foundation.
17 #include <linux/netfilter_ipv4.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netdevice.h>
20 #include <net/inet_sock.h>
21 #include <net/net_namespace.h>
22 #include "smack.h"
24 #if IS_ENABLED(CONFIG_IPV6)
26 static unsigned int smack_ipv6_output(void *priv,
27 struct sk_buff *skb,
28 const struct nf_hook_state *state)
30 struct sock *sk = skb_to_full_sk(skb);
31 struct socket_smack *ssp;
32 struct smack_known *skp;
34 if (sk && sk->sk_security) {
35 ssp = sk->sk_security;
36 skp = ssp->smk_out;
37 skb->secmark = skp->smk_secid;
40 return NF_ACCEPT;
42 #endif /* IPV6 */
44 static unsigned int smack_ipv4_output(void *priv,
45 struct sk_buff *skb,
46 const struct nf_hook_state *state)
48 struct sock *sk = skb_to_full_sk(skb);
49 struct socket_smack *ssp;
50 struct smack_known *skp;
52 if (sk && sk->sk_security) {
53 ssp = sk->sk_security;
54 skp = ssp->smk_out;
55 skb->secmark = skp->smk_secid;
58 return NF_ACCEPT;
61 static struct nf_hook_ops smack_nf_ops[] = {
63 .hook = smack_ipv4_output,
64 .pf = NFPROTO_IPV4,
65 .hooknum = NF_INET_LOCAL_OUT,
66 .priority = NF_IP_PRI_SELINUX_FIRST,
68 #if IS_ENABLED(CONFIG_IPV6)
70 .hook = smack_ipv6_output,
71 .pf = NFPROTO_IPV6,
72 .hooknum = NF_INET_LOCAL_OUT,
73 .priority = NF_IP6_PRI_SELINUX_FIRST,
75 #endif /* IPV6 */
78 static int __net_init smack_nf_register(struct net *net)
80 return nf_register_net_hooks(net, smack_nf_ops,
81 ARRAY_SIZE(smack_nf_ops));
84 static void __net_exit smack_nf_unregister(struct net *net)
86 nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
89 static struct pernet_operations smack_net_ops = {
90 .init = smack_nf_register,
91 .exit = smack_nf_unregister,
94 static int __init smack_nf_ip_init(void)
96 if (smack_enabled == 0)
97 return 0;
99 printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
100 return register_pernet_subsys(&smack_net_ops);
103 __initcall(smack_nf_ip_init);