diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2022-05-03 23:43:00 +0300 |
---|---|---|
committer | Topi Miettinen <topimiettinen@users.noreply.github.com> | 2022-06-06 18:24:10 +0000 |
commit | 3cf63830acdef9d8afdc9ef1cf25aa7e85a5e4d5 (patch) | |
tree | da068c2af170caaba91e6163fdf18a5e21e1fc60 /src/network/networkd-netlabel.h | |
parent | cc9e3a55d3d3558c309b1ebbde0f2cc26d69ee54 (diff) | |
download | systemd-3cf63830acdef9d8afdc9ef1cf25aa7e85a5e4d5.tar.gz |
networkd: NetLabel integration
New directive `NetLabel=` provides a method for integrating dynamic network
configuration into Linux NetLabel subsystem rules, used by Linux security
modules (LSMs) for network access control. The option expects a whitespace
separated list of NetLabel labels. The labels must conform to lexical
restrictions of LSM labels. When an interface is configured with IP addresses,
the addresses and subnetwork masks will be appended to the NetLabel Fallback
Peer Labeling rules. They will be removed when the interface is
deconfigured. Failures to manage the labels will be ignored.
Example:
```
[DHCP]
NetLabel=system_u:object_r:localnet_peer_t:s0
```
With the above rules for interface `eth0`, when the interface is configured with
an IPv4 address of 10.0.0.0/8, `systemd-networkd` performs the equivalent of
`netlabelctl` operation
```
$ sudo netlabelctl unlbl add interface eth0 address:10.0.0.0/8 label:system_u:object_r:localnet_peer_t:s0
```
Result:
```
$ sudo netlabelctl -p unlbl list
...
interface: eth0
address: 10.0.0.0/8
label: "system_u:object_r:localnet_peer_t:s0"
...
```
Diffstat (limited to 'src/network/networkd-netlabel.h')
-rw-r--r-- | src/network/networkd-netlabel.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/network/networkd-netlabel.h b/src/network/networkd-netlabel.h new file mode 100644 index 0000000000..92f614fc73 --- /dev/null +++ b/src/network/networkd-netlabel.h @@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ +#pragma once + +void address_add_netlabel(const Address *address); +void address_del_netlabel(const Address *address); + +CONFIG_PARSER_PROTOTYPE(config_parse_netlabel); |