0001 ========================================
0002 NetLabel Linux Security Module Interface
0003 ========================================
0004
0005 Paul Moore, paul.moore@hp.com
0006
0007 May 17, 2006
0008
0009 Overview
0010 ========
0011
0012 NetLabel is a mechanism which can set and retrieve security attributes from
0013 network packets. It is intended to be used by LSM developers who want to make
0014 use of a common code base for several different packet labeling protocols.
0015 The NetLabel security module API is defined in 'include/net/netlabel.h' but a
0016 brief overview is given below.
0017
0018 NetLabel Security Attributes
0019 ============================
0020
0021 Since NetLabel supports multiple different packet labeling protocols and LSMs
0022 it uses the concept of security attributes to refer to the packet's security
0023 labels. The NetLabel security attributes are defined by the
0024 'netlbl_lsm_secattr' structure in the NetLabel header file. Internally the
0025 NetLabel subsystem converts the security attributes to and from the correct
0026 low-level packet label depending on the NetLabel build time and run time
0027 configuration. It is up to the LSM developer to translate the NetLabel
0028 security attributes into whatever security identifiers are in use for their
0029 particular LSM.
0030
0031 NetLabel LSM Protocol Operations
0032 ================================
0033
0034 These are the functions which allow the LSM developer to manipulate the labels
0035 on outgoing packets as well as read the labels on incoming packets. Functions
0036 exist to operate both on sockets as well as the sk_buffs directly. These high
0037 level functions are translated into low level protocol operations based on how
0038 the administrator has configured the NetLabel subsystem.
0039
0040 NetLabel Label Mapping Cache Operations
0041 =======================================
0042
0043 Depending on the exact configuration, translation between the network packet
0044 label and the internal LSM security identifier can be time consuming. The
0045 NetLabel label mapping cache is a caching mechanism which can be used to
0046 sidestep much of this overhead once a mapping has been established. Once the
0047 LSM has received a packet, used NetLabel to decode its security attributes,
0048 and translated the security attributes into a LSM internal identifier the LSM
0049 can use the NetLabel caching functions to associate the LSM internal
0050 identifier with the network packet's label. This means that in the future
0051 when a incoming packet matches a cached value not only are the internal
0052 NetLabel translation mechanisms bypassed but the LSM translation mechanisms are
0053 bypassed as well which should result in a significant reduction in overhead.
