From 23bcdc1adebd3cb47d5666f2e9ecada95c0134e4 Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Wed, 18 Jul 2007 12:28:45 -0400 Subject: SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement Create a new NetLabel KAPI interface, netlbl_enabled(), which reports on the current runtime status of NetLabel based on the existing configuration. LSMs that make use of NetLabel, i.e. SELinux, can use this new function to determine if they should perform NetLabel access checks. This patch changes the NetLabel/SELinux glue code such that SELinux only enforces NetLabel related access checks when netlbl_enabled() returns true. At present NetLabel is considered to be enabled when there is at least one labeled protocol configuration present. The result is that by default NetLabel is considered to be disabled, however, as soon as an administrator configured a CIPSO DOI definition NetLabel is enabled and SELinux starts enforcing NetLabel related access controls - including unlabeled packet controls. This patch also tries to consolidate the multiple "#ifdef CONFIG_NETLABEL" blocks into a single block to ease future review as recommended by Linus. Signed-off-by: Paul Moore Signed-off-by: James Morris --- net/netlabel/netlabel_mgmt.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'net/netlabel/netlabel_mgmt.h') diff --git a/net/netlabel/netlabel_mgmt.h b/net/netlabel/netlabel_mgmt.h index 3642d3bfc8eb..ccb2b3923591 100644 --- a/net/netlabel/netlabel_mgmt.h +++ b/net/netlabel/netlabel_mgmt.h @@ -168,4 +168,9 @@ enum { /* NetLabel protocol functions */ int netlbl_mgmt_genl_init(void); +/* NetLabel misc management functions */ +void netlbl_mgmt_protocount_inc(void); +void netlbl_mgmt_protocount_dec(void); +u32 netlbl_mgmt_protocount_value(void); + #endif -- cgit v1.2.3