security/smack/smack_netfilter.c

   1 /*
   2  *  Simplified MAC Kernel (smack) security module
   3  *
   4  *  This file contains the Smack netfilter implementation
   5  *
   6  *  Author:
   7  *      Casey Schaufler <[email protected]>
   8  *
   9  *  Copyright (C) 2014 Casey Schaufler <[email protected]>
  10  *  Copyright (C) 2014 Intel Corporation.
  11  *
  12  *      This program is free software; you can redistribute it and/or modify
  13  *      it under the terms of the GNU General Public License version 2,
  14  *      as published by the Free Software Foundation.
  15  */
  16
  17 #include <linux/netfilter_ipv4.h>
  18 #include <linux/netfilter_ipv6.h>
  19 #include <linux/netdevice.h>
  20 #include "smack.h"
  21
  22 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
  23
  24 static unsigned int smack_ipv6_output(const struct nf_hook_ops *ops,
  25                                         struct sk_buff *skb,
  26                                         const struct net_device *in,
  27                                         const struct net_device *out,
  28                                         int (*okfn)(struct sk_buff *))
  29 {
  30         struct socket_smack *ssp;
  31         struct smack_known *skp;
  32
  33         if (skb && skb->sk && skb->sk->sk_security) {
  34                 ssp = skb->sk->sk_security;
  35                 skp = ssp->smk_out;
  36                 skb->secmark = skp->smk_secid;
  37         }
  38
  39         return NF_ACCEPT;
  40 }
  41 #endif  /* IPV6 */
  42
  43 static unsigned int smack_ipv4_output(const struct nf_hook_ops *ops,
  44                                         struct sk_buff *skb,
  45                                         const struct net_device *in,
  46                                         const struct net_device *out,
  47                                         int (*okfn)(struct sk_buff *))
  48 {
  49         struct socket_smack *ssp;
  50         struct smack_known *skp;
  51
  52         if (skb && skb->sk && skb->sk->sk_security) {
  53                 ssp = skb->sk->sk_security;
  54                 skp = ssp->smk_out;
  55                 skb->secmark = skp->smk_secid;
  56         }
  57
  58         return NF_ACCEPT;
  59 }
  60
  61 static struct nf_hook_ops smack_nf_ops[] = {
  62         {
  63                 .hook =         smack_ipv4_output,
  64                 .owner =        THIS_MODULE,
  65                 .pf =           NFPROTO_IPV4,
  66                 .hooknum =      NF_INET_LOCAL_OUT,
  67                 .priority =     NF_IP_PRI_SELINUX_FIRST,
  68         },
  69 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
  70         {
  71                 .hook =         smack_ipv6_output,
  72                 .owner =        THIS_MODULE,
  73                 .pf =           NFPROTO_IPV6,
  74                 .hooknum =      NF_INET_LOCAL_OUT,
  75                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
  76         },
  77 #endif  /* IPV6 */
  78 };
  79
  80 static int __init smack_nf_ip_init(void)
  81 {
  82         int err;
  83
  84         if (smack_enabled == 0)
  85                 return 0;
  86
  87         printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
  88
  89         err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
  90         if (err)
  91                 pr_info("Smack: nf_register_hooks: error %d\n", err);
  92
  93         return 0;
  94 }
  95
  96 __initcall(smack_nf_ip_init);