NetLabel: convert to an extensibile/sparse category bitmap

The original NetLabel category bitmap was a straight char bitmap which worked
fine for the initial release as it only supported 240 bits due to limitations
in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
straight char bitmap into an extensibile/sparse bitmap in order to lay the
foundation for other CIPSO tag types and protocols.

This patch also has a nice side effect in that all of the security attributes
passed by NetLabel into the LSM are now in a format which is in the host's
native byte/bit ordering which makes the LSM specific code much simpler; look
at the changes in security/selinux/ss/ebitmap.c as an example.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 99 insertions, 3 deletions

diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index d605d7954013..83da7e1f0d3d 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -111,6 +111,22 @@ struct netlbl_lsm_cache {
         void (*free) (const void *data);
         void *data;
 };
+/* The catmap bitmap field MUST be a power of two in length and large
+ * enough to hold at least 240 bits.  Special care (i.e. check the code!)
+ * should be used when changing these values as the LSM implementation
+ * probably has functions which rely on the sizes of these types to speed
+ * processing. */
+#define NETLBL_CATMAP_MAPTYPE           u64
+#define NETLBL_CATMAP_MAPCNT            4
+#define NETLBL_CATMAP_MAPSIZE           (sizeof(NETLBL_CATMAP_MAPTYPE) * 8)
+#define NETLBL_CATMAP_SIZE              (NETLBL_CATMAP_MAPSIZE * \
+                                         NETLBL_CATMAP_MAPCNT)
+#define NETLBL_CATMAP_BIT               (NETLBL_CATMAP_MAPTYPE)0x01
+struct netlbl_lsm_secattr_catmap {
+        u32 startbit;
+        NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT];
+        struct netlbl_lsm_secattr_catmap *next;
+};
 #define NETLBL_SECATTR_NONE             0x00000000
 #define NETLBL_SECATTR_DOMAIN           0x00000001
 #define NETLBL_SECATTR_CACHE            0x00000002
@@ -122,8 +138,7 @@ struct netlbl_lsm_secattr {
         char *domain;
 
         u32 mls_lvl;
-        unsigned char *mls_cat;
-        size_t mls_cat_len;
+        struct netlbl_lsm_secattr_catmap *mls_cat;
 
         struct netlbl_lsm_cache *cache;
 };
@@ -171,6 +186,41 @@ static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
 }
 
 /**
+ * netlbl_secattr_catmap_alloc - Allocate a LSM secattr catmap
+ * @flags: memory allocation flags
+ *
+ * Description:
+ * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL
+ * on failure.
+ *
+ */
+static inline struct netlbl_lsm_secattr_catmap *netlbl_secattr_catmap_alloc(
+                                                                   gfp_t flags)
+{
+        return kzalloc(sizeof(struct netlbl_lsm_secattr_catmap), flags);
+}
+
+/**
+ * netlbl_secattr_catmap_free - Free a LSM secattr catmap
+ * @catmap: the category bitmap
+ *
+ * Description:
+ * Free a LSM secattr catmap.
+ *
+ */
+static inline void netlbl_secattr_catmap_free(
+                                      struct netlbl_lsm_secattr_catmap *catmap)
+{
+        struct netlbl_lsm_secattr_catmap *iter;
+
+        do {
+                iter = catmap;
+                catmap = catmap->next;
+                kfree(iter);
+        } while (catmap);
+}
+
+/**
  * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct
  * @secattr: the struct to initialize
  *
@@ -200,7 +250,8 @@ static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr)
         if (secattr->cache)
                 netlbl_secattr_cache_free(secattr->cache);
         kfree(secattr->domain);
-        kfree(secattr->mls_cat);
+        if (secattr->mls_cat)
+                netlbl_secattr_catmap_free(secattr->mls_cat);
 }
 
 /**
@@ -231,6 +282,51 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
         kfree(secattr);
 }
 
+#ifdef CONFIG_NETLABEL
+int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
+                               u32 offset);
+int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
+                                   u32 offset);
+int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
+                                 u32 bit,
+                                 gfp_t flags);
+int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
+                                 u32 start,
+                                 u32 end,
+                                 gfp_t flags);
+#else
+static inline int netlbl_secattr_catmap_walk(
+                                      struct netlbl_lsm_secattr_catmap *catmap,
+                                      u32 offset)
+{
+        return -ENOENT;
+}
+
+static inline int netlbl_secattr_catmap_walk_rng(
+                                      struct netlbl_lsm_secattr_catmap *catmap,
+                                      u32 offset)
+{
+        return -ENOENT;
+}
+
+static inline int netlbl_secattr_catmap_setbit(
+                                      struct netlbl_lsm_secattr_catmap *catmap,
+                                      u32 bit,
+                                      gfp_t flags)
+{
+        return 0;
+}
+
+static inline int netlbl_secattr_catmap_setrng(
+                                      struct netlbl_lsm_secattr_catmap *catmap,
+                                      u32 start,
+                                      u32 end,
+                                      gfp_t flags)
+{
+        return 0;
+}
+#endif
+
 /*
  * LSM protocol operations
  */