android_kernel_motorola_sm6225/net/netlabel
Paul Moore 23bcdc1ade SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement
Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the
current runtime status of NetLabel based on the existing configuration.  LSMs
that make use of NetLabel, i.e. SELinux, can use this new function to determine
if they should perform NetLabel access checks.  This patch changes the
NetLabel/SELinux glue code such that SELinux only enforces NetLabel related
access checks when netlbl_enabled() returns true.

At present NetLabel is considered to be enabled when there is at least one
labeled protocol configuration present.  The result is that by default NetLabel
is considered to be disabled, however, as soon as an administrator configured
a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing
NetLabel related access controls - including unlabeled packet controls.

This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL"
blocks into a single block to ease future review as recommended by Linus.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-07-19 10:21:11 -04:00
..
Kconfig [NETLABEL]: Fix build failure. 2006-11-05 16:44:06 -08:00
Makefile [NetLabel]: core NetLabel subsystem 2006-09-22 14:53:34 -07:00
netlabel_cipso_v4.c SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement 2007-07-19 10:21:11 -04:00
netlabel_cipso_v4.h [NetLabel]: rework the Netlink attribute handling (part 2) 2006-09-25 15:56:37 -07:00
netlabel_domainhash.c NetLabel: honor the audit_enabled flag 2006-12-02 21:24:15 -08:00
netlabel_domainhash.h [NetLabel]: audit fixups due to delayed feedback 2006-09-29 17:05:05 -07:00
netlabel_kapi.c SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement 2007-07-19 10:21:11 -04:00
netlabel_mgmt.c SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement 2007-07-19 10:21:11 -04:00
netlabel_mgmt.h SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement 2007-07-19 10:21:11 -04:00
netlabel_unlabeled.c [NETLINK]: Mark netlink policies const 2007-06-07 13:40:10 -07:00
netlabel_unlabeled.h [NetLabel]: rework the Netlink attribute handling (part 2) 2006-09-25 15:56:37 -07:00
netlabel_user.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
netlabel_user.h [GENL]: Add genlmsg_put_reply() to simplify building reply headers 2006-12-02 21:22:42 -08:00