1/* 2 * "security" table 3 * 4 * This is for use by Mandatory Access Control (MAC) security models, 5 * which need to be able to manage security policy in separate context 6 * to DAC. 7 * 8 * Based on iptable_mangle.c 9 * 10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 11 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org> 12 * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com> 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License version 2 as 16 * published by the Free Software Foundation. 17 */ 18#include <linux/module.h> 19#include <linux/netfilter_ipv4/ip_tables.h> 20#include <linux/slab.h> 21#include <net/ip.h> 22 23MODULE_LICENSE("GPL"); 24MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>"); 25MODULE_DESCRIPTION("iptables security table, for MAC rules"); 26 27#define SECURITY_VALID_HOOKS (1 << NF_INET_LOCAL_IN) | \ 28 (1 << NF_INET_FORWARD) | \ 29 (1 << NF_INET_LOCAL_OUT) 30 31static const struct xt_table security_table = { 32 .name = "security", 33 .valid_hooks = SECURITY_VALID_HOOKS, 34 .me = THIS_MODULE, 35 .af = NFPROTO_IPV4, 36 .priority = NF_IP_PRI_SECURITY, 37}; 38 39static unsigned int 40iptable_security_hook(unsigned int hook, struct sk_buff *skb, 41 const struct net_device *in, 42 const struct net_device *out, 43 int (*okfn)(struct sk_buff *)) 44{ 45 const struct net *net; 46 47 if (hook == NF_INET_LOCAL_OUT && 48 (skb->len < sizeof(struct iphdr) || 49 ip_hdrlen(skb) < sizeof(struct iphdr))) 50 /* Somebody is playing with raw sockets. */ 51 return NF_ACCEPT; 52 53 net = dev_net((in != NULL) ? in : out); 54 return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security); 55} 56 57static struct nf_hook_ops *sectbl_ops __read_mostly; 58 59static int __net_init iptable_security_net_init(struct net *net) 60{ 61 struct ipt_replace *repl; 62 63 repl = ipt_alloc_initial_table(&security_table); 64 if (repl == NULL) 65 return -ENOMEM; 66 net->ipv4.iptable_security = 67 ipt_register_table(net, &security_table, repl); 68 kfree(repl); 69 if (IS_ERR(net->ipv4.iptable_security)) 70 return PTR_ERR(net->ipv4.iptable_security); 71 72 return 0; 73} 74 75static void __net_exit iptable_security_net_exit(struct net *net) 76{ 77 ipt_unregister_table(net, net->ipv4.iptable_security); 78} 79 80static struct pernet_operations iptable_security_net_ops = { 81 .init = iptable_security_net_init, 82 .exit = iptable_security_net_exit, 83}; 84 85static int __init iptable_security_init(void) 86{ 87 int ret; 88 89 ret = register_pernet_subsys(&iptable_security_net_ops); 90 if (ret < 0) 91 return ret; 92 93 sectbl_ops = xt_hook_link(&security_table, iptable_security_hook); 94 if (IS_ERR(sectbl_ops)) { 95 ret = PTR_ERR(sectbl_ops); 96 goto cleanup_table; 97 } 98 99 return ret; 100 101cleanup_table: 102 unregister_pernet_subsys(&iptable_security_net_ops); 103 return ret; 104} 105 106static void __exit iptable_security_fini(void) 107{ 108 xt_hook_unlink(&security_table, sectbl_ops); 109 unregister_pernet_subsys(&iptable_security_net_ops); 110} 111 112module_init(iptable_security_init); 113module_exit(iptable_security_fini); 114