2 * Simplified MAC Kernel (smack) security module
4 * This file contains the Smack netfilter implementation
7 * Casey Schaufler <casey@schaufler-ca.com>
9 * Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
10 * Copyright (C) 2014 Intel Corporation.
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License version 2,
14 * as published by the Free Software Foundation.
17 #include <linux/netfilter_ipv4.h>
18 #include <linux/netfilter_ipv6.h>
19 #include <linux/netdevice.h>
22 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
24 static unsigned int smack_ipv6_output(void *priv,
26 const struct nf_hook_state *state)
28 struct socket_smack *ssp;
29 struct smack_known *skp;
31 if (skb && skb->sk && skb->sk->sk_security) {
32 ssp = skb->sk->sk_security;
34 skb->secmark = skp->smk_secid;
41 static unsigned int smack_ipv4_output(void *priv,
43 const struct nf_hook_state *state)
45 struct socket_smack *ssp;
46 struct smack_known *skp;
48 if (skb && skb->sk && skb->sk->sk_security) {
49 ssp = skb->sk->sk_security;
51 skb->secmark = skp->smk_secid;
57 static struct nf_hook_ops smack_nf_ops[] = {
59 .hook = smack_ipv4_output,
61 .hooknum = NF_INET_LOCAL_OUT,
62 .priority = NF_IP_PRI_SELINUX_FIRST,
64 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
66 .hook = smack_ipv6_output,
68 .hooknum = NF_INET_LOCAL_OUT,
69 .priority = NF_IP6_PRI_SELINUX_FIRST,
74 static int __init smack_nf_ip_init(void)
78 if (smack_enabled == 0)
81 printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
83 err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
85 pr_info("Smack: nf_register_hooks: error %d\n", err);
90 __initcall(smack_nf_ip_init);