4 * This is for use by Mandatory Access Control (MAC) security models,
5 * which need to be able to manage security policy in separate context
8 * Based on iptable_mangle.c
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
12 * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2 as
16 * published by the Free Software Foundation.
18 #include <linux/module.h>
19 #include <linux/netfilter_ipv4/ip_tables.h>
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
24 MODULE_DESCRIPTION("iptables security table, for MAC rules");
26 #define SECURITY_VALID_HOOKS (1 << NF_INET_LOCAL_IN) | \
27 (1 << NF_INET_FORWARD) | \
28 (1 << NF_INET_LOCAL_OUT)
32 struct ipt_replace repl;
33 struct ipt_standard entries[3];
34 struct ipt_error term;
35 } initial_table __net_initdata = {
38 .valid_hooks = SECURITY_VALID_HOOKS,
40 .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
42 [NF_INET_LOCAL_IN] = 0,
43 [NF_INET_FORWARD] = sizeof(struct ipt_standard),
44 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
47 [NF_INET_LOCAL_IN] = 0,
48 [NF_INET_FORWARD] = sizeof(struct ipt_standard),
49 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
53 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
54 IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
55 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
57 .term = IPT_ERROR_INIT, /* ERROR */
60 static const struct xt_table security_table = {
62 .valid_hooks = SECURITY_VALID_HOOKS,
68 iptable_security_hook(unsigned int hook, struct sk_buff *skb,
69 const struct net_device *in,
70 const struct net_device *out,
71 int (*okfn)(struct sk_buff *))
73 const struct net *net;
75 if (hook == NF_INET_LOCAL_OUT &&
76 (skb->len < sizeof(struct iphdr) ||
77 ip_hdrlen(skb) < sizeof(struct iphdr)))
78 /* Somebody is playing with raw sockets. */
81 net = dev_net((in != NULL) ? in : out);
82 return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
85 static struct nf_hook_ops ipt_ops[] __read_mostly = {
87 .hook = iptable_security_hook,
90 .hooknum = NF_INET_LOCAL_IN,
91 .priority = NF_IP_PRI_SECURITY,
94 .hook = iptable_security_hook,
97 .hooknum = NF_INET_FORWARD,
98 .priority = NF_IP_PRI_SECURITY,
101 .hook = iptable_security_hook,
102 .owner = THIS_MODULE,
104 .hooknum = NF_INET_LOCAL_OUT,
105 .priority = NF_IP_PRI_SECURITY,
109 static int __net_init iptable_security_net_init(struct net *net)
111 net->ipv4.iptable_security =
112 ipt_register_table(net, &security_table, &initial_table.repl);
114 if (IS_ERR(net->ipv4.iptable_security))
115 return PTR_ERR(net->ipv4.iptable_security);
120 static void __net_exit iptable_security_net_exit(struct net *net)
122 ipt_unregister_table(net, net->ipv4.iptable_security);
125 static struct pernet_operations iptable_security_net_ops = {
126 .init = iptable_security_net_init,
127 .exit = iptable_security_net_exit,
130 static int __init iptable_security_init(void)
134 ret = register_pernet_subsys(&iptable_security_net_ops);
138 ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
145 unregister_pernet_subsys(&iptable_security_net_ops);
149 static void __exit iptable_security_fini(void)
151 nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
152 unregister_pernet_subsys(&iptable_security_net_ops);
155 module_init(iptable_security_init);
156 module_exit(iptable_security_fini);