tmp_suning_uos_patched/security/selinux
Paul Moore d621d35e57 SELinux: Enable dynamic enable/disable of the network access checks
This patch introduces a mechanism for checking when labeled IPsec or SECMARK
are in use by keeping introducing a configuration reference counter for each
subsystem.  In the case of labeled IPsec, whenever a labeled SA or SPD entry
is created the labeled IPsec/XFRM reference count is increased and when the
entry is removed it is decreased.  In the case of SECMARK, when a SECMARK
target is created the reference count is increased and later decreased when the
target is removed.  These reference counters allow SELinux to quickly determine
if either of these subsystems are enabled.

NetLabel already has a similar mechanism which provides the netlbl_enabled()
function.

This patch also renames the selinux_relabel_packet_permission() function to
selinux_secmark_relabel_packet_permission() as the original name and
description were misleading in that they referenced a single packet label which
is not the case.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-01-30 08:17:26 +11:00
..
include SELinux: Enable dynamic enable/disable of the network access checks 2008-01-30 08:17:26 +11:00
ss SELinux: Better integration between peer labeling subsystems 2008-01-30 08:17:25 +11:00
avc.c SELinux: Only store the network interface's ifindex 2008-01-30 08:17:22 +11:00
exports.c SELinux: Enable dynamic enable/disable of the network access checks 2008-01-30 08:17:26 +11:00
hooks.c SELinux: Enable dynamic enable/disable of the network access checks 2008-01-30 08:17:26 +11:00
Kconfig SELinux: Add a capabilities bitmap to SELinux policy version 22 2008-01-30 08:17:23 +11:00
Makefile SELinux: Add a network node caching mechanism similar to the sel_netif_*() functions 2008-01-30 08:17:23 +11:00
netif.c SELinux: Convert the netif code to use ifindex values 2008-01-30 08:17:21 +11:00
netlabel.c SELinux: Better integration between peer labeling subsystems 2008-01-30 08:17:25 +11:00
netlink.c [NET]: Support multiple network namespaces with netlink 2007-10-10 16:49:09 -07:00
netnode.c SELinux: Add a network node caching mechanism similar to the sel_netif_*() functions 2008-01-30 08:17:23 +11:00
nlmsgtab.c Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
selinuxfs.c SELinux: Add a capabilities bitmap to SELinux policy version 22 2008-01-30 08:17:23 +11:00
xfrm.c SELinux: Enable dynamic enable/disable of the network access checks 2008-01-30 08:17:26 +11:00