[NetLabel]: SELinux support

Add NetLabel support to the SELinux LSM and modify the
socket_post_create() LSM hook to return an error code.  The most
significant part of this patch is the addition of NetLabel hooks into
the following SELinux LSM hooks:

 * selinux_file_permission()
 * selinux_socket_sendmsg()
 * selinux_socket_post_create()
 * selinux_socket_sock_rcv_skb()
 * selinux_socket_getpeersec_stream()
 * selinux_socket_getpeersec_dgram()
 * selinux_sock_graft()
 * selinux_inet_conn_request()

The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security
attributes are checked via the additional hook in
selinux_socket_sock_rcv_skb().  NetLabel itself is only a labeling
mechanism, similar to filesystem extended attributes, it is up to the
SELinux enforcement mechanism to perform the actual access checks.

In addition to the changes outlined above this patch also includes
some changes to the extended bitmap (ebitmap) and multi-level security
(mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 13 insertions, 12 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index bb4c80fdfe7a..9f56fb8a4a6c 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1341,8 +1341,8 @@ struct security_operations {
         int (*unix_may_send) (struct socket * sock, struct socket * other);
 
         int (*socket_create) (int family, int type, int protocol, int kern);
-        void (*socket_post_create) (struct socket * sock, int family,
-                                    int type, int protocol, int kern);
+        int (*socket_post_create) (struct socket * sock, int family,
+                                   int type, int protocol, int kern);
         int (*socket_bind) (struct socket * sock,
                             struct sockaddr * address, int addrlen);
         int (*socket_connect) (struct socket * sock,
@@ -2824,13 +2824,13 @@ static inline int security_socket_create (int family, int type,
         return security_ops->socket_create(family, type, protocol, kern);
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                               int family,
-                                               int type, 
-                                               int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                              int family,
+                                              int type,
+                                              int protocol, int kern)
 {
-        security_ops->socket_post_create(sock, family, type,
-                                         protocol, kern);
+        return security_ops->socket_post_create(sock, family, type,
+                                                protocol, kern);
 }
 
 static inline int security_socket_bind(struct socket * sock, 
@@ -2982,11 +2982,12 @@ static inline int security_socket_create (int family, int type,
         return 0;
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                               int family,
-                                               int type, 
-                                               int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                              int family,
+                                              int type,
+                                              int protocol, int kern)
 {
+        return 0;
 }
 
 static inline int security_socket_bind(struct socket * sock,