linux/net
Paul Moore d621d35e57 SELinux: Enable dynamic enable/disable of the network access checks
This patch introduces a mechanism for checking when labeled IPsec or SECMARK
are in use by keeping introducing a configuration reference counter for each
subsystem.  In the case of labeled IPsec, whenever a labeled SA or SPD entry
is created the labeled IPsec/XFRM reference count is increased and when the
entry is removed it is decreased.  In the case of SECMARK, when a SECMARK
target is created the reference count is increased and later decreased when the
target is removed.  These reference counters allow SELinux to quickly determine
if either of these subsystems are enabled.

NetLabel already has a similar mechanism which provides the netlbl_enabled()
function.

This patch also renames the selinux_relabel_packet_permission() function to
selinux_secmark_relabel_packet_permission() as the original name and
description were misleading in that they referenced a single packet label which
is not the case.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-01-30 08:17:26 +11:00
..
9p 9p: add missing end-of-options record for trans_fd 2007-11-06 08:02:53 -06:00
802 [TR]: Use ctl paths to register net/token-ring/ table 2008-01-28 14:56:28 -08:00
8021q [VLAN]: sparse warning fix 2008-01-28 15:10:17 -08:00
appletalk [APPLETALK]: Annotations to clear sparse warnings 2008-01-28 15:02:43 -08:00
atm [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
ax25 [AX25]: sparse cleanups 2008-01-28 15:02:03 -08:00
bluetooth [BLUETOOTH]: Use sockfd_put() 2008-01-28 15:00:48 -08:00
bridge [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
can [CAN]: Add virtual CAN netdevice driver 2008-01-28 14:54:12 -08:00
core [NET_SCHED]: Convert packet schedulers from rtnetlink to new netlink API 2008-01-28 15:11:10 -08:00
dccp [NETNS]: Add namespace parameter to ip_route_output_flow. 2008-01-28 15:11:06 -08:00
decnet [NETNS]: FIB rules API cleanup. 2008-01-28 15:08:13 -08:00
econet [NET]: Convert init_timer into setup_timer 2008-01-28 14:53:35 -08:00
ethernet [ETH]: Combine format_addr() with print_mac(). 2008-01-28 15:00:05 -08:00
ieee80211 ieee80211: beacon->capability is little-endian 2008-01-28 15:08:48 -08:00
ipv4 NetLabel: Add secid token support to the NetLabel secattr struct 2008-01-30 08:17:19 +11:00
ipv6 [IPV6] ADDRLABEL: Fix double free on label deletion. 2008-01-28 15:46:02 -08:00
ipx [NET]: Simple ctl_table to ctl_path conversions. 2008-01-28 15:01:07 -08:00
irda [IrDA]: LMP discovery timer not started by default 2008-01-28 15:10:54 -08:00
iucv [IUCV]: use LIST_HEAD instead of LIST_HEAD_INIT 2008-01-28 14:56:54 -08:00
key [XFRM] xfrm_policy_destroy: Rename and relative fixes. 2008-01-28 15:00:46 -08:00
lapb [LAPB] net/lapb/lapb_iface.c: use LIST_HEAD instead of LIST_HEAD_INIT 2008-01-28 14:56:52 -08:00
llc [NET]: Simple ctl_table to ctl_path conversions. 2008-01-28 15:01:07 -08:00
mac80211 [NET_SCHED]: Convert packet schedulers from rtnetlink to new netlink API 2008-01-28 15:11:10 -08:00
netfilter SELinux: Enable dynamic enable/disable of the network access checks 2008-01-30 08:17:26 +11:00
netlabel NetLabel: Add IP address family information to the netlbl_skbuff_getattr() function 2008-01-30 08:17:20 +11:00
netlink [NETLINK]: Add nla_append() 2008-01-28 15:11:09 -08:00
netrom [NET]: Simple ctl_table to ctl_path conversions. 2008-01-28 15:01:07 -08:00
packet [PACKET]: Fix sparse warnings in af_packet.c 2008-01-28 15:00:48 -08:00
rfkill rfkill: call rfkill_led_trigger_unregister() on error 2008-01-20 20:31:36 -08:00
rose [ROSE]: Supress sparse warnings 2008-01-28 15:02:44 -08:00
rxrpc [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
sched [NET_SCHED]: Use nla_policy for attribute validation in ematches 2008-01-28 15:11:24 -08:00
sctp [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
sunrpc [NET]: Add some acquires/releases sparse annotations. 2008-01-28 15:00:31 -08:00
tipc [TIPC]: Use tipc_port_unlock 2008-01-28 15:01:05 -08:00
unix [NET]: Add some acquires/releases sparse annotations. 2008-01-28 15:00:31 -08:00
wanrouter [NET]: Make /proc/net per network namespace 2007-10-10 16:49:06 -07:00
wireless WEXT: remove unused variable 2008-01-28 15:10:48 -08:00
x25 [AF_X25]: constify function pointer tables 2008-01-28 15:10:55 -08:00
xfrm [NETNS]: Consolidate kernel netlink socket destruction. 2008-01-28 15:08:07 -08:00
compat.c [NETFILTER]: ip6_tables: add compat support 2008-01-28 14:58:36 -08:00
Kconfig [NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option 2008-01-28 14:59:12 -08:00
Makefile [CAN]: Add PF_CAN core module 2008-01-28 14:54:10 -08:00
nonet.c
socket.c [NET] sysctl: make sysctl_somaxconn per-namespace 2008-01-28 14:56:57 -08:00
sysctl_net.c [NET]: Remove the empty net_table 2008-01-28 14:56:29 -08:00
TUNABLE