1 /*
2  *  Simplified MAC Kernel (smack) security module
3  *
4  *  This file contains the Smack netfilter implementation
5  *
6  *  Author:
7  *	Casey Schaufler <casey@schaufler-ca.com>
8  *
9  *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
10  *  Copyright (C) 2014 Intel Corporation.
11  *
12  *	This program is free software; you can redistribute it and/or modify
13  *	it under the terms of the GNU General Public License version 2,
14  *	as published by the Free Software Foundation.
15  */
16 
17 #include <linux/netfilter_ipv4.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netdevice.h>
20 #include <net/inet_sock.h>
21 #include "smack.h"
22 
23 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
24 
25 static unsigned int smack_ipv6_output(void *priv,
26 					struct sk_buff *skb,
27 					const struct nf_hook_state *state)
28 {
29 	struct sock *sk = skb_to_full_sk(skb);
30 	struct socket_smack *ssp;
31 	struct smack_known *skp;
32 
33 	if (sk && sk->sk_security) {
34 		ssp = sk->sk_security;
35 		skp = ssp->smk_out;
36 		skb->secmark = skp->smk_secid;
37 	}
38 
39 	return NF_ACCEPT;
40 }
41 #endif	/* IPV6 */
42 
43 static unsigned int smack_ipv4_output(void *priv,
44 					struct sk_buff *skb,
45 					const struct nf_hook_state *state)
46 {
47 	struct sock *sk = skb_to_full_sk(skb);
48 	struct socket_smack *ssp;
49 	struct smack_known *skp;
50 
51 	if (sk && sk->sk_security) {
52 		ssp = sk->sk_security;
53 		skp = ssp->smk_out;
54 		skb->secmark = skp->smk_secid;
55 	}
56 
57 	return NF_ACCEPT;
58 }
59 
60 static struct nf_hook_ops smack_nf_ops[] = {
61 	{
62 		.hook =		smack_ipv4_output,
63 		.pf =		NFPROTO_IPV4,
64 		.hooknum =	NF_INET_LOCAL_OUT,
65 		.priority =	NF_IP_PRI_SELINUX_FIRST,
66 	},
67 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
68 	{
69 		.hook =		smack_ipv6_output,
70 		.pf =		NFPROTO_IPV6,
71 		.hooknum =	NF_INET_LOCAL_OUT,
72 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
73 	},
74 #endif	/* IPV6 */
75 };
76 
77 static int __init smack_nf_ip_init(void)
78 {
79 	int err;
80 
81 	if (smack_enabled == 0)
82 		return 0;
83 
84 	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
85 
86 	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
87 	if (err)
88 		pr_info("Smack: nf_register_hooks: error %d\n", err);
89 
90 	return 0;
91 }
92 
93 __initcall(smack_nf_ip_init);
94