1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * SELinux support for the XFRM LSM hooks
4 *
5 * Author : Trent Jaeger, <jaegert@us.ibm.com>
6 * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
7 */
8 #ifndef _SELINUX_XFRM_H_
9 #define _SELINUX_XFRM_H_
10
11 #include <linux/lsm_audit.h>
12 #include <net/flow.h>
13 #include <net/xfrm.h>
14
15 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
16 struct xfrm_user_sec_ctx *uctx,
17 gfp_t gfp);
18 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
19 struct xfrm_sec_ctx **new_ctxp);
20 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
21 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
22 int selinux_xfrm_state_alloc(struct xfrm_state *x,
23 struct xfrm_user_sec_ctx *uctx);
24 int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
25 struct xfrm_sec_ctx *polsec, u32 secid);
26 void selinux_xfrm_state_free(struct xfrm_state *x);
27 int selinux_xfrm_state_delete(struct xfrm_state *x);
28 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
29 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
30 struct xfrm_policy *xp,
31 const struct flowi_common *flic);
32
33 #ifdef CONFIG_SECURITY_NETWORK_XFRM
34 extern atomic_t selinux_xfrm_refcount;
35
selinux_xfrm_enabled(void)36 static inline int selinux_xfrm_enabled(void)
37 {
38 return (atomic_read(&selinux_xfrm_refcount) > 0);
39 }
40
41 int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
42 struct common_audit_data *ad);
43 int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
44 struct common_audit_data *ad, u8 proto);
45 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
46 int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
47
selinux_xfrm_notify_policyload(void)48 static inline void selinux_xfrm_notify_policyload(void)
49 {
50 struct net *net;
51
52 down_read(&net_rwsem);
53 for_each_net(net)
54 rt_genid_bump_all(net);
55 up_read(&net_rwsem);
56 }
57 #else
selinux_xfrm_enabled(void)58 static inline int selinux_xfrm_enabled(void)
59 {
60 return 0;
61 }
62
selinux_xfrm_sock_rcv_skb(u32 sk_sid,struct sk_buff * skb,struct common_audit_data * ad)63 static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
64 struct common_audit_data *ad)
65 {
66 return 0;
67 }
68
selinux_xfrm_postroute_last(u32 sk_sid,struct sk_buff * skb,struct common_audit_data * ad,u8 proto)69 static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
70 struct common_audit_data *ad,
71 u8 proto)
72 {
73 return 0;
74 }
75
selinux_xfrm_decode_session(struct sk_buff * skb,u32 * sid,int ckall)76 static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
77 int ckall)
78 {
79 *sid = SECSID_NULL;
80 return 0;
81 }
82
selinux_xfrm_notify_policyload(void)83 static inline void selinux_xfrm_notify_policyload(void)
84 {
85 }
86
selinux_xfrm_skb_sid(struct sk_buff * skb,u32 * sid)87 static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
88 {
89 *sid = SECSID_NULL;
90 return 0;
91 }
92 #endif
93
94 #endif /* _SELINUX_XFRM_H_ */
95