linux/security
Casey Schaufler 6d3dc07cbb smack: Add support for unlabeled network hosts and networks
Add support for unlabeled network hosts and networks.
Relies heavily on Paul Moore's netlabel support.

Creates a new entry in /smack called netlabel. Writes to /smack/netlabel
take the form:

    A.B.C.D LABEL
or
    A.B.C.D/N LABEL

where A.B.C.D is a network address, N is an integer between 0-32,
and LABEL is the Smack label to be used. If /N is omitted /32 is
assumed. N designates the netmask for the address. Entries are
matched by the most specific address/mask pair. 0.0.0.0/0 will
match everything, while 192.168.1.117/32 will match exactly one
host.

A new system label "@", pronounced "web", is defined. Processes
can not be assigned the web label. An address assigned the web
label can be written to by any process, and packets coming from
a web address can be written to any socket. Use of the web label
is a violation of any strict MAC policy, but the web label has
been requested many times.

The nltype entry has been removed from /smack. It did not work right
and the netlabel interface can be used to specify that all hosts
be treated as unlabeled.

CIPSO labels on incoming packets will be honored, even from designated
single label hosts. Single label hosts can only be written to by
processes with labels that can write to the label of the host.
Packets sent to single label hosts will always be unlabeled.

Once added a single label designation cannot be removed, however
the label may be changed.

The behavior of the ambient label remains unchanged.


Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul.moore@hp.com>
2008-12-31 12:54:12 -05:00
..
keys KEYS: Fix variable uninitialisation warnings 2008-12-29 14:24:43 +11:00
selinux selinux: Deprecate and schedule the removal of the the compat_net functionality 2008-12-31 12:54:11 -05:00
smack smack: Add support for unlabeled network hosts and networks 2008-12-31 12:54:12 -05:00
capability.c security: pass mount flags to security_sb_kern_mount() 2008-12-20 09:02:39 +11:00
commoncap.c capabilities: define get_vfs_caps_from_disk when file caps are not enabled 2008-11-15 08:50:52 +11:00
device_cgroup.c devcgroup: remove spin_lock() 2008-10-20 08:52:38 -07:00
inode.c integrity: special fs magic 2008-10-13 09:47:43 +11:00
Kconfig securityfs: do not depend on CONFIG_SECURITY 2008-08-28 10:47:42 +10:00
Makefile securityfs: do not depend on CONFIG_SECURITY 2008-08-28 10:47:42 +10:00
root_plug.c CRED: Make execve() take advantage of copy-on-write credentials 2008-11-14 10:39:24 +11:00
security.c security: pass mount flags to security_sb_kern_mount() 2008-12-20 09:02:39 +11:00