|author||Paul Moore <firstname.lastname@example.org>||2008-01-29 08:38:13 -0500|
|committer||James Morris <email@example.com>||2008-01-30 08:17:23 +1100|
SELinux: Add a network node caching mechanism similar to the sel_netif_*() functions
This patch adds a SELinux IP address/node SID caching mechanism similar to the sel_netif_*() functions. The node SID queries in the SELinux hooks files are also modified to take advantage of this new functionality. In addition, remove the address length information from the sk_buff parsing routines as it is redundant since we already have the address family. Signed-off-by: Paul Moore <firstname.lastname@example.org> Signed-off-by: James Morris <email@example.com>
Diffstat (limited to 'security/selinux/include/netnode.h')
1 files changed, 32 insertions, 0 deletions
diff --git a/security/selinux/include/netnode.h b/security/selinux/include/netnode.h
new file mode 100644
@@ -0,0 +1,32 @@
+ * Network node table
+ * SELinux must keep a mapping of network nodes to labels/SIDs. This
+ * mapping is maintained as part of the normal policy but a fast cache is
+ * needed to reduce the lookup overhead since most of these queries happen on
+ * a per-packet basis.
+ * Author: Paul Moore <firstname.lastname@example.org>
+ * (c) Copyright Hewlett-Packard Development Company, L.P., 2007
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+int sel_netnode_sid(void *addr, u16 family, u32 *sid);