1/*
  2 *  Simplified MAC Kernel (smack) security module
  3 *
  4 *  This file contains the Smack netfilter implementation
  5 *
  6 *  Author:
  7 *	Casey Schaufler <casey@schaufler-ca.com>
  8 *
  9 *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
 10 *  Copyright (C) 2014 Intel Corporation.
 11 *
 12 *	This program is free software; you can redistribute it and/or modify
 13 *	it under the terms of the GNU General Public License version 2,
 14 *	as published by the Free Software Foundation.
 15 */
 16
 17#include <linux/netfilter_ipv4.h>
 18#include <linux/netfilter_ipv6.h>
 19#include <linux/netdevice.h>
 20#include <net/inet_sock.h>
 21#include <net/net_namespace.h>
 22#include "smack.h"
 23
 24#if IS_ENABLED(CONFIG_IPV6)
 25
 26static unsigned int smack_ipv6_output(void *priv,
 27					struct sk_buff *skb,
 28					const struct nf_hook_state *state)
 29{
 30	struct sock *sk = skb_to_full_sk(skb);
 31	struct socket_smack *ssp;
 32	struct smack_known *skp;
 33
 34	if (sk && sk->sk_security) {
 35		ssp = sk->sk_security;
 36		skp = ssp->smk_out;
 37		skb->secmark = skp->smk_secid;
 38	}
 39
 40	return NF_ACCEPT;
 41}
 42#endif	/* IPV6 */
 43
 44static unsigned int smack_ipv4_output(void *priv,
 45					struct sk_buff *skb,
 46					const struct nf_hook_state *state)
 47{
 48	struct sock *sk = skb_to_full_sk(skb);
 49	struct socket_smack *ssp;
 50	struct smack_known *skp;
 51
 52	if (sk && sk->sk_security) {
 53		ssp = sk->sk_security;
 54		skp = ssp->smk_out;
 55		skb->secmark = skp->smk_secid;
 56	}
 57
 58	return NF_ACCEPT;
 59}
 60
 61static const struct nf_hook_ops smack_nf_ops[] = {
 62	{
 63		.hook =		smack_ipv4_output,
 64		.pf =		NFPROTO_IPV4,
 65		.hooknum =	NF_INET_LOCAL_OUT,
 66		.priority =	NF_IP_PRI_SELINUX_FIRST,
 67	},
 68#if IS_ENABLED(CONFIG_IPV6)
 69	{
 70		.hook =		smack_ipv6_output,
 71		.pf =		NFPROTO_IPV6,
 72		.hooknum =	NF_INET_LOCAL_OUT,
 73		.priority =	NF_IP6_PRI_SELINUX_FIRST,
 74	},
 75#endif	/* IPV6 */
 76};
 77
 78static int __net_init smack_nf_register(struct net *net)
 79{
 80	return nf_register_net_hooks(net, smack_nf_ops,
 81				     ARRAY_SIZE(smack_nf_ops));
 82}
 83
 84static void __net_exit smack_nf_unregister(struct net *net)
 85{
 86	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
 87}
 88
 89static struct pernet_operations smack_net_ops = {
 90	.init = smack_nf_register,
 91	.exit = smack_nf_unregister,
 92};
 93
 94static int __init smack_nf_ip_init(void)
 95{
 
 
 96	if (smack_enabled == 0)
 97		return 0;
 98
 99	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
100	return register_pernet_subsys(&smack_net_ops);
 
 
 
 
 
101}
102
103__initcall(smack_nf_ip_init);

 1/*
 2 *  Simplified MAC Kernel (smack) security module
 3 *
 4 *  This file contains the Smack netfilter implementation
 5 *
 6 *  Author:
 7 *	Casey Schaufler <casey@schaufler-ca.com>
 8 *
 9 *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
10 *  Copyright (C) 2014 Intel Corporation.
11 *
12 *	This program is free software; you can redistribute it and/or modify
13 *	it under the terms of the GNU General Public License version 2,
14 *	as published by the Free Software Foundation.
15 */
16
17#include <linux/netfilter_ipv4.h>
18#include <linux/netfilter_ipv6.h>
19#include <linux/netdevice.h>
20#include <net/inet_sock.h>
 
21#include "smack.h"
22
23#if IS_ENABLED(CONFIG_IPV6)
24
25static unsigned int smack_ipv6_output(void *priv,
26					struct sk_buff *skb,
27					const struct nf_hook_state *state)
28{
29	struct sock *sk = skb_to_full_sk(skb);
30	struct socket_smack *ssp;
31	struct smack_known *skp;
32
33	if (sk && sk->sk_security) {
34		ssp = sk->sk_security;
35		skp = ssp->smk_out;
36		skb->secmark = skp->smk_secid;
37	}
38
39	return NF_ACCEPT;
40}
41#endif	/* IPV6 */
42
43static unsigned int smack_ipv4_output(void *priv,
44					struct sk_buff *skb,
45					const struct nf_hook_state *state)
46{
47	struct sock *sk = skb_to_full_sk(skb);
48	struct socket_smack *ssp;
49	struct smack_known *skp;
50
51	if (sk && sk->sk_security) {
52		ssp = sk->sk_security;
53		skp = ssp->smk_out;
54		skb->secmark = skp->smk_secid;
55	}
56
57	return NF_ACCEPT;
58}
59
60static struct nf_hook_ops smack_nf_ops[] = {
61	{
62		.hook =		smack_ipv4_output,
63		.pf =		NFPROTO_IPV4,
64		.hooknum =	NF_INET_LOCAL_OUT,
65		.priority =	NF_IP_PRI_SELINUX_FIRST,
66	},
67#if IS_ENABLED(CONFIG_IPV6)
68	{
69		.hook =		smack_ipv6_output,
70		.pf =		NFPROTO_IPV6,
71		.hooknum =	NF_INET_LOCAL_OUT,
72		.priority =	NF_IP6_PRI_SELINUX_FIRST,
73	},
74#endif	/* IPV6 */
75};
76
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
77static int __init smack_nf_ip_init(void)
78{
79	int err;
80
81	if (smack_enabled == 0)
82		return 0;
83
84	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
85
86	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
87	if (err)
88		pr_info("Smack: nf_register_hooks: error %d\n", err);
89
90	return 0;
91}
92
93__initcall(smack_nf_ip_init);