netlabelctl - NetLabel management utility

Author

       Paul Moore <paul@paul-moore.com>

Description

       The  NetLabel  management  utility,  netlabelctl,  is  a  command  line  program designed to allow system
       administrators to configure the NetLabel system in the kernel.  The utility  is  based  around  different
       "modules" which correspond to the different types of NetLabel commands supported by the kernel.

Examples

netlabelctlcipsoaddpassdoi:16tags:1
Add a CIPSO/IPv4 configuration with a DOI value of "16", using CIPSO tag "1" (the permissive bitmap
tag). The CIPSO and LSM levels/categories are passed through the NetLabel subsystem without any
translation.

netlabelctlcipsoaddtransdoi:8tags:1levels:0=0,1=1categories:0=1,1=0
Add a CIPSO/IPv4 configuration with a DOI value of "8", using CIPSO tag "1" (the permissive bitmap
tag). The specified mapping converts local LSM levels "0" and "1" to CIPSO levels "0" and "1"
respectively while local LSM categories "0" and "1" are mapped to CIPSO categories "1" and "0"
respectively.

netlabelctl-pcipsolist
Display all of the CIPSO/IPv4 configurations in a human readable format.

netlabelctl-pcipsolistdoi:16
Display specific information about the CIPSO/IPv4 DOI 16 configuration.

netlabelctlcipsodeldoi:8
Delete the CIPSO/IPv4 configuration assigned to DOI 8. In addition to removing the CIPSO/IPv4
configuration any domain mappings using this configuration will also be removed.

netlabelctlmapadddomain:lsm_domainprotocol:cipso,8
Add a domain mapping so that all outgoing packets sent from the "lsm_domain" will be labeled
according to the CIPSO/IPv4 protocol using DOI 8.

netlabelctlmapadddomain:lsm_domainaddress:192.168.1.0/24protocol:cipso,8
Add a mapping so that all outgoing packets sent from the "lsm_domain" to the 192.168.1.0/24 network
will be labeled according to the CIPSO/IPv4 protocol using DOI 8.

netlabelctl-pmaplist
Display all of the domain mappings in a human readable format.

netlabelctldeldomain:lsm_domain
Delete the domain mapping for the "lsm_domain", packets sent from the "lsm_domain" will fallback to
the default NetLabel mapping.

netlabelctlunlbladdinterface:loaddress:::1label:foo
Add a static/fallback label to assign the "foo" security label to unlabeled packets entering the
system over the "lo" (loopback) interface with an IPv6 source address of "::1" (localhost).

netlabelctlunlbladddefaultaddress:192.168.0.0/16label:bar
Add a static/fallback label to assign the "bar" security label to unlabeled packets entering the
system over any interface with an IPv4 source address in the 192.168.0.0/16 network.

Exit Status

       Returns zero on success, errno values on failure.

Name

       netlabelctl - NetLabel management utility

Notes

       The NetLabel subsystem is supported on Linux Kernels version 2.6.19 and later.  The static, or  fallback,
       labels  are  only  supported  on  Linux  Kernels  version  2.6.25  and later.  The domain mapping address
       selectors are only supported on Linux Kernels 2.6.28 and later and CALIPSO/RFC5570 is only  supported  on
       Linux Kernels 4.8.0 and later.

       The  NetLabel  project  site, with more information including the source code repository, can be found at
       https://github.com/netlabel.  Please report any bugs at the project site or directly to the author.

Options

GlobalFlags-h Help message

-p Attempt to make the output human readable or "pretty"

-t<seconds>
Set a timeout to be used when waiting for the NetLabel subsystem to respond

-v Enable extra output

-V Display the version information

ModulesandCommandsmgmt

The management module is used to perform general queries about the NetLabel subsystem within the kernel.
The different commands and their syntax are listed below.

version
Display the kernel's NetLabel management protocol version.

protocols
Display the kernel's list of supported labeling protocols.

map

The domain mapping module is used to map different NetLabel labeling protocols to either individual LSM
domains or the default domain mapping. It is up to each LSM to determine what defines a domain. With
SELinux, the normal SELinux domain should be used, i.e. "ping_t". In addition to protocol selection
based only on the LSM domain, it is also possible to select the labeling protocol based on both the LSM
domain and destination address. The network address selectors can specify either single hosts or entire
networks and work for both IPv4 and IPv6, although the labeling protocol chosen must support the IP
version chosen. When specifying the labeling protocol to use for each mapping there is an optional
"extra" field which is used to further identify the specific labeling protocol configuration. When
specifying the unlabeled protocol, "unlbl", an extra value of either "4" or "6" may be used. This
restricts the mapping to IPv4 or IPv6 addresses. Omitting the extra value will result in a mapping for
all address families. When specifying the CIPSO/IPv4 or the CALIPSO/IPv6 protocol, "cipso" or "calipso",
the DOI value should be specified; see the EXAMPLES section for details. The different commands and
their syntax are listed below.

adddefault|domain:<domain>[address:<ADDR>[/<MASK>]]protocol:<protocol>[,<extra>]
Add a new LSM domain / network address to NetLabel protocol mapping.

deldefault|domain:<domain>
Delete an existing LSM domain to NetLabel protocol mapping.

list
Display all of the configured LSM domain to NetLabel protocol mappings.

unlbl

The unlabeled (unlbl) module controls the unlabeled protocol which is used both when labeling outgoing
traffic is not desired as well as when unlabeled traffic is received by the system. This module allows
administrators to block all unlabeled packets from the system through the "accept" flag and assign
static, or fallback, security labels to unlabeled traffic based on the inbound network interface and
source address.

accepton|off
Toggle the unlabeled traffic accept flag.

adddefault|interface:<dev>address:<addr>[/<mask>]label:<label>
Add a new static/fallback entry.

deldefault|interface:<dev>address:<addr>[/<mask>]
Delete an existing static/fallback entry.

list
Display the status of the unlabeled accept flag.

cipso

The CIPSO/IPv4 (cipso) module controls the CIPSO/IPv4 labeling engine in the kernel. The CIPSO/IPv4
engine provided by NetLabel supports multiple Domains Of Interpretation (DOI) and the CIPSO/IPv4 module
allows for different configurations for each DOI. At present there are three types of configurations,
the "trans" configuration which allows on-the-fly translation of MLS sensitivity labels, the "pass"
configuration which does not perform any translation of the MLS sensitivity label and the "local"
configuration which conveys the full LSM security label over localhost/loopback connections. Regardless
of which configuration type is chosen a DOI value must be specified and if the "trans" or "pass"
configurations are specified then a list of the CIPSO/IPv4 tag types to use when generating the
CIPSO/IPv4 packet labels must also be specified. The list of CIPSO/IPv4 tags is ordered such that when
possible the first tag type listed is used when a CIPSO/IPv4 label is generated. However, if it is not
possible to use the first tag type then each tag type is checked, in order, until a suitable tag type is
found. If a valid tag type can not be found then the operation causing the CIPSO/IPv4 label will fail,
typically this occurs whenever a new socket is created. The different commands and their syntax are
listed below.

addtransdoi:<DOI>tags:<T1>,<Tn>levels:<LL1>=<RL1>,<LLn>=<RLn>categories:<LC1>=<RC1>,<LCn>=<RCn>
Add a new CIPSO/IPv4 configuration using the standard/translated mapping with the given level and
category translations. The levels are translated in such a way that the local level "LLn" is
translated to the remote, on-the-wire level of "RLn"; the reverse translation is done for incoming
packets. The same translation is done for the categories using "LCn" and "RCn". In order for a
packet to be accepted, or a socket created by an application, there must be a translation for the
sensitivity level and all the categories present in the MLS sensitivity label; if the entire
requested sensitivity label can not be translated the application will fail.

addpassdoi:<DOI>tags:<T1>,<Tn>
Add a new CIPSO/IPv4 configuration without any level or category translations.

addlocaldoi:<DOI>
Add a new CIPSO/IPv4 configuration for localhost/loopback connections.

deldoi:<DOI>
Delete an existing CIPSO/IPv4 configuration with the given DOI value. If any LSM domain mappings
are present which make use of this DOI they will also be deleted.

list[doi:<DOI>]
Display a list of all the CIPSO/IPv4 configurations or just the configuration matching the
optionally specified DOI.

calipso

The CALIPSO/IPv6 (calipso) module controls the CALIPSO/IPv6 labeling engine in the kernel. This behaves
in a very similar way to the CIPSO/IPv4 engine, however the protocol only specifies one tag-type
(equivalent to CIPSO tag-type 1) and so the tag-type should not be specified. In addition there is no
support for the "local" or "trans" configuration. The different commands and their syntax are listed
below.

addpassdoi:<DOI>
Add a new CALIPSO/IPv6 configuration without any level or category translations.

deldoi:<DOI>
Delete an existing CALIPSO/IPv6 configuration with the given DOI value. If any LSM domain
mappings are present which make use of this DOI they will also be deleted.

list[doi:<DOI>]
Display a list of all the CALIPSO/IPv6 configurations or just the configuration matching the
optionally specified DOI.

Synopsis

netlabelctl [<global_flags>] <module> [<module_commands>]