[PATCH] LSM networking: netdevice hooks for 2.5.42 (1/7)

@@ -437,6 +437,7 @@
 	/* this will get initialized at each interface type init routine */
 	struct divert_blk	*divert;
 #endif /* CONFIG_NET_DIVERT */
+	void			*security;
 };
 
 

@@ -616,6 +616,20 @@
  *	deallocate security struct for this semaphore
  *	@sma contains the semaphore structure.
  *
+ * Security hooks for network devices.
+ * @netdev_unregister:
+ *	Update the module's state when a network device is unregistered,
+ *	deallocating the dev->security field if it was previously allocated.
+ *	@dev contains the network device
+ *
+ * These are the hooks for network device operations.  Since it would be quite
+ * invasive to provide hooks in every location where a network device might be
+ * probed or initialized, there are no separate hooks for allocation or
+ * initialization.  Security modules can allocate and initialize the
+ * dev->security field on the first access to the device, but should be careful
+ * to use nonblocking allocation.
+ * 
+ *
  * @ptrace:
  *	Check permission before allowing the @parent process to trace the
  *	@child process.

@@ -830,6 +844,8 @@
 	void (*task_kmod_set_label) (void);
 	void (*task_reparent_to_init) (struct task_struct * p);
 
+	void (*netdev_unregister) (struct net_device * dev);
+	
 	int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
 
 	int (*msg_queue_alloc_security) (struct msg_queue * msq);

@@ -105,6 +105,7 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/module.h>
+#include <linux/security.h>
 #if defined(CONFIG_NET_RADIO) || defined(CONFIG_NET_PCMCIA_RADIO)
 #include <linux/wireless.h>		/* Note : will define WIRELESS_EXT */
 #include <net/iw_handler.h>

@@ -2592,6 +2593,8 @@
 	free_divert_blk(dev);
 #endif
 
+	security_ops->netdev_unregister(dev);
+
 	if (dev->features & NETIF_F_DYNALLOC) {
 #ifdef NET_REFCNT_DEBUG
 		if (atomic_read(&dev->refcnt) != 1)

@@ -714,6 +714,11 @@
 	return;
 }
 
+static void cap_netdev_unregister (struct net_device *dev)
+{
+	return;
+}
+
 static int cap_register (const char *name, struct security_operations *ops)
 {
 	return -EINVAL;

@@ -828,6 +833,8 @@
 	.sem_alloc_security =		cap_sem_alloc_security,
 	.sem_free_security =		cap_sem_free_security,
 
+	.netdev_unregister =		cap_netdev_unregister,
+	
 	.register_security =		cap_register,
 	.unregister_security =		cap_unregister,
 };

@@ -529,6 +529,11 @@
 	return;
 }
 
+static void dummy_netdev_unregister (struct net_device *dev)
+{
+	return;
+}
+
 static int dummy_register (const char *name, struct security_operations *ops)
 {
 	return -EINVAL;

@@ -643,6 +648,8 @@
 	.sem_alloc_security =		dummy_sem_alloc_security,
 	.sem_free_security =		dummy_sem_free_security,
 
+	.netdev_unregister =		dummy_netdev_unregister,
+	
 	.register_security =		dummy_register,
 	.unregister_security =		dummy_unregister,
 };