1 /* 2 * NetLabel System 3 * 4 * The NetLabel system manages static and dynamic label mappings for network 5 * protocols such as CIPSO and RIPSO. 6 * 7 * Author: Paul Moore <paul@paul-moore.com> 8 * 9 */ 10 11 /* 12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License as published by 16 * the Free Software Foundation; either version 2 of the License, or 17 * (at your option) any later version. 18 * 19 * This program is distributed in the hope that it will be useful, 20 * but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 22 * the GNU General Public License for more details. 23 * 24 * You should have received a copy of the GNU General Public License 25 * along with this program; if not, see <http://www.gnu.org/licenses/>. 26 * 27 */ 28 29 #ifndef _NETLABEL_H 30 #define _NETLABEL_H 31 32 #include <linux/types.h> 33 #include <linux/slab.h> 34 #include <linux/net.h> 35 #include <linux/skbuff.h> 36 #include <linux/in.h> 37 #include <linux/in6.h> 38 #include <net/netlink.h> 39 #include <net/request_sock.h> 40 #include <linux/refcount.h> 41 42 struct cipso_v4_doi; 43 struct calipso_doi; 44 45 /* 46 * NetLabel - A management interface for maintaining network packet label 47 * mapping tables for explicit packet labling protocols. 48 * 49 * Network protocols such as CIPSO and RIPSO require a label translation layer 50 * to convert the label on the packet into something meaningful on the host 51 * machine. In the current Linux implementation these mapping tables live 52 * inside the kernel; NetLabel provides a mechanism for user space applications 53 * to manage these mapping tables. 54 * 55 * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to 56 * send messages between kernel and user space. The general format of a 57 * NetLabel message is shown below: 58 * 59 * +-----------------+-------------------+--------- --- -- - 60 * | struct nlmsghdr | struct genlmsghdr | payload 61 * +-----------------+-------------------+--------- --- -- - 62 * 63 * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. 64 * The payload is dependent on the subsystem specified in the 65 * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions 66 * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c 67 * file. All of the fields in the NetLabel payload are NETLINK attributes, see 68 * the include/net/netlink.h file for more information on NETLINK attributes. 69 * 70 */ 71 72 /* 73 * NetLabel NETLINK protocol 74 */ 75 76 /* NetLabel NETLINK protocol version 77 * 1: initial version 78 * 2: added static labels for unlabeled connections 79 * 3: network selectors added to the NetLabel/LSM domain mapping and the 80 * CIPSO_V4_MAP_LOCAL CIPSO mapping was added 81 */ 82 #define NETLBL_PROTO_VERSION 3 83 84 /* NetLabel NETLINK types/families */ 85 #define NETLBL_NLTYPE_NONE 0 86 #define NETLBL_NLTYPE_MGMT 1 87 #define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT" 88 #define NETLBL_NLTYPE_RIPSO 2 89 #define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO" 90 #define NETLBL_NLTYPE_CIPSOV4 3 91 #define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4" 92 #define NETLBL_NLTYPE_CIPSOV6 4 93 #define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6" 94 #define NETLBL_NLTYPE_UNLABELED 5 95 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" 96 #define NETLBL_NLTYPE_ADDRSELECT 6 97 #define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL" 98 #define NETLBL_NLTYPE_CALIPSO 7 99 #define NETLBL_NLTYPE_CALIPSO_NAME "NLBL_CALIPSO" 100 101 /* 102 * NetLabel - Kernel API for accessing the network packet label mappings. 103 * 104 * The following functions are provided for use by other kernel modules, 105 * specifically kernel LSM modules, to provide a consistent, transparent API 106 * for dealing with explicit packet labeling protocols such as CIPSO and 107 * RIPSO. The functions defined here are implemented in the 108 * net/netlabel/netlabel_kapi.c file. 109 * 110 */ 111 112 /* NetLabel audit information */ 113 struct netlbl_audit { 114 u32 secid; 115 kuid_t loginuid; 116 unsigned int sessionid; 117 }; 118 119 /* 120 * LSM security attributes 121 */ 122 123 /** 124 * struct netlbl_lsm_cache - NetLabel LSM security attribute cache 125 * @refcount: atomic reference counter 126 * @free: LSM supplied function to free the cache data 127 * @data: LSM supplied cache data 128 * 129 * Description: 130 * This structure is provided for LSMs which wish to make use of the NetLabel 131 * caching mechanism to store LSM specific data/attributes in the NetLabel 132 * cache. If the LSM has to perform a lot of translation from the NetLabel 133 * security attributes into it's own internal representation then the cache 134 * mechanism can provide a way to eliminate some or all of that translation 135 * overhead on a cache hit. 136 * 137 */ 138 struct netlbl_lsm_cache { 139 refcount_t refcount; 140 void (*free) (const void *data); 141 void *data; 142 }; 143 144 /** 145 * struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap 146 * @startbit: the value of the lowest order bit in the bitmap 147 * @bitmap: the category bitmap 148 * @next: pointer to the next bitmap "node" or NULL 149 * 150 * Description: 151 * This structure is used to represent category bitmaps. Due to the large 152 * number of categories supported by most labeling protocols it is not 153 * practical to transfer a full bitmap internally so NetLabel adopts a sparse 154 * bitmap structure modeled after SELinux's ebitmap structure. 155 * The catmap bitmap field MUST be a power of two in length and large 156 * enough to hold at least 240 bits. Special care (i.e. check the code!) 157 * should be used when changing these values as the LSM implementation 158 * probably has functions which rely on the sizes of these types to speed 159 * processing. 160 * 161 */ 162 #define NETLBL_CATMAP_MAPTYPE u64 163 #define NETLBL_CATMAP_MAPCNT 4 164 #define NETLBL_CATMAP_MAPSIZE (sizeof(NETLBL_CATMAP_MAPTYPE) * 8) 165 #define NETLBL_CATMAP_SIZE (NETLBL_CATMAP_MAPSIZE * \ 166 NETLBL_CATMAP_MAPCNT) 167 #define NETLBL_CATMAP_BIT (NETLBL_CATMAP_MAPTYPE)0x01 168 struct netlbl_lsm_catmap { 169 u32 startbit; 170 NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT]; 171 struct netlbl_lsm_catmap *next; 172 }; 173 174 /** 175 * struct netlbl_lsm_secattr - NetLabel LSM security attributes 176 * @flags: indicate structure attributes, see NETLBL_SECATTR_* 177 * @type: indicate the NLTYPE of the attributes 178 * @domain: the NetLabel LSM domain 179 * @cache: NetLabel LSM specific cache 180 * @attr.mls: MLS sensitivity label 181 * @attr.mls.cat: MLS category bitmap 182 * @attr.mls.lvl: MLS sensitivity level 183 * @attr.secid: LSM specific secid token 184 * 185 * Description: 186 * This structure is used to pass security attributes between NetLabel and the 187 * LSM modules. The flags field is used to specify which fields within the 188 * struct are valid and valid values can be created by bitwise OR'ing the 189 * NETLBL_SECATTR_* defines. The domain field is typically set by the LSM to 190 * specify domain specific configuration settings and is not usually used by 191 * NetLabel itself when returning security attributes to the LSM. 192 * 193 */ 194 struct netlbl_lsm_secattr { 195 u32 flags; 196 /* bitmap values for 'flags' */ 197 #define NETLBL_SECATTR_NONE 0x00000000 198 #define NETLBL_SECATTR_DOMAIN 0x00000001 199 #define NETLBL_SECATTR_DOMAIN_CPY (NETLBL_SECATTR_DOMAIN | \ 200 NETLBL_SECATTR_FREE_DOMAIN) 201 #define NETLBL_SECATTR_CACHE 0x00000002 202 #define NETLBL_SECATTR_MLS_LVL 0x00000004 203 #define NETLBL_SECATTR_MLS_CAT 0x00000008 204 #define NETLBL_SECATTR_SECID 0x00000010 205 /* bitmap meta-values for 'flags' */ 206 #define NETLBL_SECATTR_FREE_DOMAIN 0x01000000 207 #define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ 208 NETLBL_SECATTR_MLS_CAT | \ 209 NETLBL_SECATTR_SECID) 210 u32 type; 211 char *domain; 212 struct netlbl_lsm_cache *cache; 213 struct { 214 struct { 215 struct netlbl_lsm_catmap *cat; 216 u32 lvl; 217 } mls; 218 u32 secid; 219 } attr; 220 }; 221 222 /** 223 * struct netlbl_calipso_ops - NetLabel CALIPSO operations 224 * @doi_add: add a CALIPSO DOI 225 * @doi_free: free a CALIPSO DOI 226 * @doi_getdef: returns a reference to a DOI 227 * @doi_putdef: releases a reference of a DOI 228 * @doi_walk: enumerate the DOI list 229 * @sock_getattr: retrieve the socket's attr 230 * @sock_setattr: set the socket's attr 231 * @sock_delattr: remove the socket's attr 232 * @req_setattr: set the req socket's attr 233 * @req_delattr: remove the req socket's attr 234 * @opt_getattr: retrieve attr from memory block 235 * @skbuff_optptr: find option in packet 236 * @skbuff_setattr: set the skbuff's attr 237 * @skbuff_delattr: remove the skbuff's attr 238 * @cache_invalidate: invalidate cache 239 * @cache_add: add cache entry 240 * 241 * Description: 242 * This structure is filled out by the CALIPSO engine and passed 243 * to the NetLabel core via a call to netlbl_calipso_ops_register(). 244 * It enables the CALIPSO engine (and hence IPv6) to be compiled 245 * as a module. 246 */ 247 struct netlbl_calipso_ops { 248 int (*doi_add)(struct calipso_doi *doi_def, 249 struct netlbl_audit *audit_info); 250 void (*doi_free)(struct calipso_doi *doi_def); 251 int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info); 252 struct calipso_doi *(*doi_getdef)(u32 doi); 253 void (*doi_putdef)(struct calipso_doi *doi_def); 254 int (*doi_walk)(u32 *skip_cnt, 255 int (*callback)(struct calipso_doi *doi_def, void *arg), 256 void *cb_arg); 257 int (*sock_getattr)(struct sock *sk, 258 struct netlbl_lsm_secattr *secattr); 259 int (*sock_setattr)(struct sock *sk, 260 const struct calipso_doi *doi_def, 261 const struct netlbl_lsm_secattr *secattr); 262 void (*sock_delattr)(struct sock *sk); 263 int (*req_setattr)(struct request_sock *req, 264 const struct calipso_doi *doi_def, 265 const struct netlbl_lsm_secattr *secattr); 266 void (*req_delattr)(struct request_sock *req); 267 int (*opt_getattr)(const unsigned char *calipso, 268 struct netlbl_lsm_secattr *secattr); 269 unsigned char *(*skbuff_optptr)(const struct sk_buff *skb); 270 int (*skbuff_setattr)(struct sk_buff *skb, 271 const struct calipso_doi *doi_def, 272 const struct netlbl_lsm_secattr *secattr); 273 int (*skbuff_delattr)(struct sk_buff *skb); 274 void (*cache_invalidate)(void); 275 int (*cache_add)(const unsigned char *calipso_ptr, 276 const struct netlbl_lsm_secattr *secattr); 277 }; 278 279 /* 280 * LSM security attribute operations (inline) 281 */ 282 283 /** 284 * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache 285 * @flags: the memory allocation flags 286 * 287 * Description: 288 * Allocate and initialize a netlbl_lsm_cache structure. Returns a pointer 289 * on success, NULL on failure. 290 * 291 */ 292 static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags) 293 { 294 struct netlbl_lsm_cache *cache; 295 296 cache = kzalloc(sizeof(*cache), flags); 297 if (cache) 298 refcount_set(&cache->refcount, 1); 299 return cache; 300 } 301 302 /** 303 * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct 304 * @cache: the struct to free 305 * 306 * Description: 307 * Frees @secattr including all of the internal buffers. 308 * 309 */ 310 static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache) 311 { 312 if (!refcount_dec_and_test(&cache->refcount)) 313 return; 314 315 if (cache->free) 316 cache->free(cache->data); 317 kfree(cache); 318 } 319 320 /** 321 * netlbl_catmap_alloc - Allocate a LSM secattr catmap 322 * @flags: memory allocation flags 323 * 324 * Description: 325 * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL 326 * on failure. 327 * 328 */ 329 static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc(gfp_t flags) 330 { 331 return kzalloc(sizeof(struct netlbl_lsm_catmap), flags); 332 } 333 334 /** 335 * netlbl_catmap_free - Free a LSM secattr catmap 336 * @catmap: the category bitmap 337 * 338 * Description: 339 * Free a LSM secattr catmap. 340 * 341 */ 342 static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap) 343 { 344 struct netlbl_lsm_catmap *iter; 345 346 while (catmap) { 347 iter = catmap; 348 catmap = catmap->next; 349 kfree(iter); 350 } 351 } 352 353 /** 354 * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct 355 * @secattr: the struct to initialize 356 * 357 * Description: 358 * Initialize an already allocated netlbl_lsm_secattr struct. 359 * 360 */ 361 static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr) 362 { 363 memset(secattr, 0, sizeof(*secattr)); 364 } 365 366 /** 367 * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct 368 * @secattr: the struct to clear 369 * 370 * Description: 371 * Destroys the @secattr struct, including freeing all of the internal buffers. 372 * The struct must be reset with a call to netlbl_secattr_init() before reuse. 373 * 374 */ 375 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr) 376 { 377 if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN) 378 kfree(secattr->domain); 379 if (secattr->flags & NETLBL_SECATTR_CACHE) 380 netlbl_secattr_cache_free(secattr->cache); 381 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) 382 netlbl_catmap_free(secattr->attr.mls.cat); 383 } 384 385 /** 386 * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct 387 * @flags: the memory allocation flags 388 * 389 * Description: 390 * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid 391 * pointer on success, or NULL on failure. 392 * 393 */ 394 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(gfp_t flags) 395 { 396 return kzalloc(sizeof(struct netlbl_lsm_secattr), flags); 397 } 398 399 /** 400 * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct 401 * @secattr: the struct to free 402 * 403 * Description: 404 * Frees @secattr including all of the internal buffers. 405 * 406 */ 407 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) 408 { 409 netlbl_secattr_destroy(secattr); 410 kfree(secattr); 411 } 412 413 #ifdef CONFIG_NETLABEL 414 /* 415 * LSM configuration operations 416 */ 417 int netlbl_cfg_map_del(const char *domain, 418 u16 family, 419 const void *addr, 420 const void *mask, 421 struct netlbl_audit *audit_info); 422 int netlbl_cfg_unlbl_map_add(const char *domain, 423 u16 family, 424 const void *addr, 425 const void *mask, 426 struct netlbl_audit *audit_info); 427 int netlbl_cfg_unlbl_static_add(struct net *net, 428 const char *dev_name, 429 const void *addr, 430 const void *mask, 431 u16 family, 432 u32 secid, 433 struct netlbl_audit *audit_info); 434 int netlbl_cfg_unlbl_static_del(struct net *net, 435 const char *dev_name, 436 const void *addr, 437 const void *mask, 438 u16 family, 439 struct netlbl_audit *audit_info); 440 int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, 441 struct netlbl_audit *audit_info); 442 void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info); 443 int netlbl_cfg_cipsov4_map_add(u32 doi, 444 const char *domain, 445 const struct in_addr *addr, 446 const struct in_addr *mask, 447 struct netlbl_audit *audit_info); 448 int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, 449 struct netlbl_audit *audit_info); 450 void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info); 451 int netlbl_cfg_calipso_map_add(u32 doi, 452 const char *domain, 453 const struct in6_addr *addr, 454 const struct in6_addr *mask, 455 struct netlbl_audit *audit_info); 456 /* 457 * LSM security attribute operations 458 */ 459 int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset); 460 int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset); 461 int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, 462 u32 *offset, 463 unsigned long *bitmap); 464 int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, 465 u32 bit, 466 gfp_t flags); 467 int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, 468 u32 start, 469 u32 end, 470 gfp_t flags); 471 int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, 472 u32 offset, 473 unsigned long bitmap, 474 gfp_t flags); 475 476 /* Bitmap functions 477 */ 478 int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, 479 u32 offset, u8 state); 480 void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state); 481 482 /* 483 * LSM protocol operations (NetLabel LSM/kernel API) 484 */ 485 int netlbl_enabled(void); 486 int netlbl_sock_setattr(struct sock *sk, 487 u16 family, 488 const struct netlbl_lsm_secattr *secattr); 489 void netlbl_sock_delattr(struct sock *sk); 490 int netlbl_sock_getattr(struct sock *sk, 491 struct netlbl_lsm_secattr *secattr); 492 int netlbl_conn_setattr(struct sock *sk, 493 struct sockaddr *addr, 494 const struct netlbl_lsm_secattr *secattr); 495 int netlbl_req_setattr(struct request_sock *req, 496 const struct netlbl_lsm_secattr *secattr); 497 void netlbl_req_delattr(struct request_sock *req); 498 int netlbl_skbuff_setattr(struct sk_buff *skb, 499 u16 family, 500 const struct netlbl_lsm_secattr *secattr); 501 int netlbl_skbuff_getattr(const struct sk_buff *skb, 502 u16 family, 503 struct netlbl_lsm_secattr *secattr); 504 void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway); 505 506 /* 507 * LSM label mapping cache operations 508 */ 509 void netlbl_cache_invalidate(void); 510 int netlbl_cache_add(const struct sk_buff *skb, u16 family, 511 const struct netlbl_lsm_secattr *secattr); 512 513 /* 514 * Protocol engine operations 515 */ 516 struct audit_buffer *netlbl_audit_start(int type, 517 struct netlbl_audit *audit_info); 518 #else 519 static inline int netlbl_cfg_map_del(const char *domain, 520 u16 family, 521 const void *addr, 522 const void *mask, 523 struct netlbl_audit *audit_info) 524 { 525 return -ENOSYS; 526 } 527 static inline int netlbl_cfg_unlbl_map_add(const char *domain, 528 u16 family, 529 void *addr, 530 void *mask, 531 struct netlbl_audit *audit_info) 532 { 533 return -ENOSYS; 534 } 535 static inline int netlbl_cfg_unlbl_static_add(struct net *net, 536 const char *dev_name, 537 const void *addr, 538 const void *mask, 539 u16 family, 540 u32 secid, 541 struct netlbl_audit *audit_info) 542 { 543 return -ENOSYS; 544 } 545 static inline int netlbl_cfg_unlbl_static_del(struct net *net, 546 const char *dev_name, 547 const void *addr, 548 const void *mask, 549 u16 family, 550 struct netlbl_audit *audit_info) 551 { 552 return -ENOSYS; 553 } 554 static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, 555 struct netlbl_audit *audit_info) 556 { 557 return -ENOSYS; 558 } 559 static inline void netlbl_cfg_cipsov4_del(u32 doi, 560 struct netlbl_audit *audit_info) 561 { 562 return; 563 } 564 static inline int netlbl_cfg_cipsov4_map_add(u32 doi, 565 const char *domain, 566 const struct in_addr *addr, 567 const struct in_addr *mask, 568 struct netlbl_audit *audit_info) 569 { 570 return -ENOSYS; 571 } 572 static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, 573 struct netlbl_audit *audit_info) 574 { 575 return -ENOSYS; 576 } 577 static inline void netlbl_cfg_calipso_del(u32 doi, 578 struct netlbl_audit *audit_info) 579 { 580 return; 581 } 582 static inline int netlbl_cfg_calipso_map_add(u32 doi, 583 const char *domain, 584 const struct in6_addr *addr, 585 const struct in6_addr *mask, 586 struct netlbl_audit *audit_info) 587 { 588 return -ENOSYS; 589 } 590 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, 591 u32 offset) 592 { 593 return -ENOENT; 594 } 595 static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, 596 u32 offset) 597 { 598 return -ENOENT; 599 } 600 static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, 601 u32 *offset, 602 unsigned long *bitmap) 603 { 604 return 0; 605 } 606 static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, 607 u32 bit, 608 gfp_t flags) 609 { 610 return 0; 611 } 612 static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, 613 u32 start, 614 u32 end, 615 gfp_t flags) 616 { 617 return 0; 618 } 619 static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, 620 u32 offset, 621 unsigned long bitmap, 622 gfp_t flags) 623 { 624 return 0; 625 } 626 static inline int netlbl_enabled(void) 627 { 628 return 0; 629 } 630 static inline int netlbl_sock_setattr(struct sock *sk, 631 u16 family, 632 const struct netlbl_lsm_secattr *secattr) 633 { 634 return -ENOSYS; 635 } 636 static inline void netlbl_sock_delattr(struct sock *sk) 637 { 638 } 639 static inline int netlbl_sock_getattr(struct sock *sk, 640 struct netlbl_lsm_secattr *secattr) 641 { 642 return -ENOSYS; 643 } 644 static inline int netlbl_conn_setattr(struct sock *sk, 645 struct sockaddr *addr, 646 const struct netlbl_lsm_secattr *secattr) 647 { 648 return -ENOSYS; 649 } 650 static inline int netlbl_req_setattr(struct request_sock *req, 651 const struct netlbl_lsm_secattr *secattr) 652 { 653 return -ENOSYS; 654 } 655 static inline void netlbl_req_delattr(struct request_sock *req) 656 { 657 return; 658 } 659 static inline int netlbl_skbuff_setattr(struct sk_buff *skb, 660 u16 family, 661 const struct netlbl_lsm_secattr *secattr) 662 { 663 return -ENOSYS; 664 } 665 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, 666 u16 family, 667 struct netlbl_lsm_secattr *secattr) 668 { 669 return -ENOSYS; 670 } 671 static inline void netlbl_skbuff_err(struct sk_buff *skb, 672 int error, 673 int gateway) 674 { 675 return; 676 } 677 static inline void netlbl_cache_invalidate(void) 678 { 679 return; 680 } 681 static inline int netlbl_cache_add(const struct sk_buff *skb, u16 family, 682 const struct netlbl_lsm_secattr *secattr) 683 { 684 return 0; 685 } 686 static inline struct audit_buffer *netlbl_audit_start(int type, 687 struct netlbl_audit *audit_info) 688 { 689 return NULL; 690 } 691 #endif /* CONFIG_NETLABEL */ 692 693 const struct netlbl_calipso_ops * 694 netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops); 695 696 #endif /* _NETLABEL_H */ 697