From: "Dr. David Alan Gilbert" <linux@treblig.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: paul@paul-moore.com, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net-next] netlabel: Remove unused cfg_calipso funcs
Date: Thu, 20 Feb 2025 16:48:04 +0000 [thread overview]
Message-ID: <Z7dcxAYj_jsG9WL6@gallifrey> (raw)
In-Reply-To: <aa6c6f4c-7d46-4e7e-bafc-f042436f47b6@schaufler-ca.com>
* Casey Schaufler (casey@schaufler-ca.com) wrote:
> On 2/20/2025 6:08 AM, linux@treblig.org wrote:
> > From: "Dr. David Alan Gilbert" <linux@treblig.org>
> >
> > netlbl_cfg_calipso_map_add(), netlbl_cfg_calipso_add() and
> > netlbl_cfg_calipso_del() were added in 2016 as part of
> > commit 3f09354ac84c ("netlabel: Implement CALIPSO config functions for
> > SMACK.")
> >
> > Remove them.
>
> Please don't. The Smack CALIPSO implementation has been delayed
> for a number of reasons, some better than others, but is still on
> the roadmap.
Hmm OK.
If it makes it to 10 years next year then perhaps it should hold
a birthday party!
Dave
>
> >
> > (I see a few other changes in that original commit, whether they
> > are reachable I'm not sure).
> >
> > Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
> > ---
> > include/net/netlabel.h | 26 -------
> > net/netlabel/netlabel_kapi.c | 133 -----------------------------------
> > 2 files changed, 159 deletions(-)
> >
> > diff --git a/include/net/netlabel.h b/include/net/netlabel.h
> > index 02914b1df38b..37c9bcfd5345 100644
> > --- a/include/net/netlabel.h
> > +++ b/include/net/netlabel.h
> > @@ -435,14 +435,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
> > const struct in_addr *addr,
> > const struct in_addr *mask,
> > struct netlbl_audit *audit_info);
> > -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> > - struct netlbl_audit *audit_info);
> > -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
> > -int netlbl_cfg_calipso_map_add(u32 doi,
> > - const char *domain,
> > - const struct in6_addr *addr,
> > - const struct in6_addr *mask,
> > - struct netlbl_audit *audit_info);
> > /*
> > * LSM security attribute operations
> > */
> > @@ -561,24 +553,6 @@ static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
> > {
> > return -ENOSYS;
> > }
> > -static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> > - struct netlbl_audit *audit_info)
> > -{
> > - return -ENOSYS;
> > -}
> > -static inline void netlbl_cfg_calipso_del(u32 doi,
> > - struct netlbl_audit *audit_info)
> > -{
> > - return;
> > -}
> > -static inline int netlbl_cfg_calipso_map_add(u32 doi,
> > - const char *domain,
> > - const struct in6_addr *addr,
> > - const struct in6_addr *mask,
> > - struct netlbl_audit *audit_info)
> > -{
> > - return -ENOSYS;
> > -}
> > static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
> > u32 offset)
> > {
> > diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
> > index cd9160bbc919..13b4bc1c30ec 100644
> > --- a/net/netlabel/netlabel_kapi.c
> > +++ b/net/netlabel/netlabel_kapi.c
> > @@ -394,139 +394,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
> > return ret_val;
> > }
> >
> > -/**
> > - * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
> > - * @doi_def: CALIPSO DOI definition
> > - * @audit_info: NetLabel audit information
> > - *
> > - * Description:
> > - * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on
> > - * success and negative values on failure.
> > - *
> > - */
> > -int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
> > - struct netlbl_audit *audit_info)
> > -{
> > -#if IS_ENABLED(CONFIG_IPV6)
> > - return calipso_doi_add(doi_def, audit_info);
> > -#else /* IPv6 */
> > - return -ENOSYS;
> > -#endif /* IPv6 */
> > -}
> > -
> > -/**
> > - * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
> > - * @doi: CALIPSO DOI
> > - * @audit_info: NetLabel audit information
> > - *
> > - * Description:
> > - * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on
> > - * success and negative values on failure.
> > - *
> > - */
> > -void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
> > -{
> > -#if IS_ENABLED(CONFIG_IPV6)
> > - calipso_doi_remove(doi, audit_info);
> > -#endif /* IPv6 */
> > -}
> > -
> > -/**
> > - * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
> > - * @doi: the CALIPSO DOI
> > - * @domain: the domain mapping to add
> > - * @addr: IP address
> > - * @mask: IP address mask
> > - * @audit_info: NetLabel audit information
> > - *
> > - * Description:
> > - * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
> > - * NetLabel subsystem. A @domain value of NULL adds a new default domain
> > - * mapping. Returns zero on success, negative values on failure.
> > - *
> > - */
> > -int netlbl_cfg_calipso_map_add(u32 doi,
> > - const char *domain,
> > - const struct in6_addr *addr,
> > - const struct in6_addr *mask,
> > - struct netlbl_audit *audit_info)
> > -{
> > -#if IS_ENABLED(CONFIG_IPV6)
> > - int ret_val = -ENOMEM;
> > - struct calipso_doi *doi_def;
> > - struct netlbl_dom_map *entry;
> > - struct netlbl_domaddr_map *addrmap = NULL;
> > - struct netlbl_domaddr6_map *addrinfo = NULL;
> > -
> > - doi_def = calipso_doi_getdef(doi);
> > - if (doi_def == NULL)
> > - return -ENOENT;
> > -
> > - entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
> > - if (entry == NULL)
> > - goto out_entry;
> > - entry->family = AF_INET6;
> > - if (domain != NULL) {
> > - entry->domain = kstrdup(domain, GFP_ATOMIC);
> > - if (entry->domain == NULL)
> > - goto out_domain;
> > - }
> > -
> > - if (addr == NULL && mask == NULL) {
> > - entry->def.calipso = doi_def;
> > - entry->def.type = NETLBL_NLTYPE_CALIPSO;
> > - } else if (addr != NULL && mask != NULL) {
> > - addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
> > - if (addrmap == NULL)
> > - goto out_addrmap;
> > - INIT_LIST_HEAD(&addrmap->list4);
> > - INIT_LIST_HEAD(&addrmap->list6);
> > -
> > - addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
> > - if (addrinfo == NULL)
> > - goto out_addrinfo;
> > - addrinfo->def.calipso = doi_def;
> > - addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
> > - addrinfo->list.addr = *addr;
> > - addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
> > - addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
> > - addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
> > - addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
> > - addrinfo->list.mask = *mask;
> > - addrinfo->list.valid = 1;
> > - ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
> > - if (ret_val != 0)
> > - goto cfg_calipso_map_add_failure;
> > -
> > - entry->def.addrsel = addrmap;
> > - entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
> > - } else {
> > - ret_val = -EINVAL;
> > - goto out_addrmap;
> > - }
> > -
> > - ret_val = netlbl_domhsh_add(entry, audit_info);
> > - if (ret_val != 0)
> > - goto cfg_calipso_map_add_failure;
> > -
> > - return 0;
> > -
> > -cfg_calipso_map_add_failure:
> > - kfree(addrinfo);
> > -out_addrinfo:
> > - kfree(addrmap);
> > -out_addrmap:
> > - kfree(entry->domain);
> > -out_domain:
> > - kfree(entry);
> > -out_entry:
> > - calipso_doi_putdef(doi_def);
> > - return ret_val;
> > -#else /* IPv6 */
> > - return -ENOSYS;
> > -#endif /* IPv6 */
> > -}
> > -
> > /*
> > * Security Attribute Functions
> > */
>
--
-----Open up your eyes, open up your mind, open up your code -------
/ Dr. David Alan Gilbert | Running GNU/Linux | Happy \
\ dave @ treblig.org | | In Hex /
\ _________________________|_____ http://www.treblig.org |_______/
next prev parent reply other threads:[~2025-02-20 16:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-20 14:08 [PATCH net-next] netlabel: Remove unused cfg_calipso funcs linux
2025-02-20 15:35 ` Casey Schaufler
2025-02-20 16:48 ` Dr. David Alan Gilbert [this message]
2025-02-20 17:03 ` Casey Schaufler
2025-02-20 17:37 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z7dcxAYj_jsG9WL6@gallifrey \
--to=linux@treblig.org \
--cc=casey@schaufler-ca.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).