diff options
| author | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-06-12 20:52:52 +0300 |
|---|---|---|
| committer | Jonathan Corbet <corbet@lwn.net> | 2019-06-14 23:23:30 +0300 |
| commit | 593733ab80ac2c607acc1fc3fbaba5031d38253a (patch) | |
| tree | d7cc25050c596e7843fc2ad013812aeebc35a793 /Documentation/netlabel/cipso_ipv4.txt | |
| parent | 09bbf055c3329008522b4a9814afe412c202daa7 (diff) | |
| download | linux-593733ab80ac2c607acc1fc3fbaba5031d38253a.tar.xz | |
docs: netlabel: convert docs to ReST and rename to *.rst
Convert netlabel documentation to ReST.
This was trivial: just add proper title markups.
At its new index.rst, let's add a :orphan: while this is not linked to
the main index.rst file, in order to avoid build warnings.
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Diffstat (limited to 'Documentation/netlabel/cipso_ipv4.txt')
| -rw-r--r-- | Documentation/netlabel/cipso_ipv4.txt | 49 |
1 files changed, 0 insertions, 49 deletions
diff --git a/Documentation/netlabel/cipso_ipv4.txt b/Documentation/netlabel/cipso_ipv4.txt deleted file mode 100644 index a6075481fd60..000000000000 --- a/Documentation/netlabel/cipso_ipv4.txt +++ /dev/null @@ -1,49 +0,0 @@ -NetLabel CIPSO/IPv4 Protocol Engine -============================================================================== -Paul Moore, paul.moore@hp.com - -May 17, 2006 - - * Overview - -The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial -IP Security Option (CIPSO) draft from July 16, 1992. A copy of this -draft can be found in this directory -(draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made -it to an RFC standard it has become a de-facto standard for labeled -networking and is used in many trusted operating systems. - - * Outbound Packet Processing - -The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by -adding the CIPSO label to the socket. This causes all packets leaving the -system through the socket to have the CIPSO IP option applied. The socket's -CIPSO label can be changed at any point in time, however, it is recommended -that it is set upon the socket's creation. The LSM can set the socket's CIPSO -label by using the NetLabel security module API; if the NetLabel "domain" is -configured to use CIPSO for packet labeling then a CIPSO IP option will be -generated and attached to the socket. - - * Inbound Packet Processing - -The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the -IP layer without any special handling required by the LSM. However, in order -to decode and translate the CIPSO label on the packet the LSM must use the -NetLabel security module API to extract the security attributes of the packet. -This is typically done at the socket layer using the 'socket_sock_rcv_skb()' -LSM hook. - - * Label Translation - -The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security -attributes such as sensitivity level and category to values which are -appropriate for the host. These mappings are defined as part of a CIPSO -Domain Of Interpretation (DOI) definition and are configured through the -NetLabel user space communication layer. Each DOI definition can have a -different security attribute mapping table. - - * Label Translation Cache - -The NetLabel system provides a framework for caching security attribute -mappings from the network labels to the corresponding LSM identifiers. The -CIPSO/IPv4 protocol engine supports this caching mechanism. |