Message-ID: <CAHC9VhTcTifp1v9JfGLNw+4HPvqMjYsX0gM2tXZDOhmxUHt+oA@mail.gmail.com>
Date:   Wed, 17 Apr 2019 10:36:16 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Mauro Carvalho Chehab <mchehab+samsung@...nel.org>
Cc:     Linux Doc Mailing List <linux-doc@...r.kernel.org>,
        Mauro Carvalho Chehab <mchehab@...radead.org>,
        linux-kernel@...r.kernel.org, Jonathan Corbet <corbet@....net>,
        netdev@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH 23/57] docs: netlabel: convert it to ReST

On Mon, Apr 15, 2019 at 10:56 PM Mauro Carvalho Chehab
<mchehab+samsung@...nel.org> wrote:
>
> Convert netlabel documentation to ReST.
>
> This was trivial: just add proper title markups.
>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@...nel.org>
> ---
>  Documentation/netlabel/cipso_ipv4.txt    | 19 +++++++++++++------
>  Documentation/netlabel/introduction.txt  | 16 +++++++++++-----
>  Documentation/netlabel/lsm_interface.txt | 16 +++++++++++-----
>  3 files changed, 35 insertions(+), 16 deletions(-)

Thanks for doing this.  I should probably revisit these docs to make
sure they are still valid/correct; if nothing else that email address
is from two employers ago (my apologies to the current email address
holder).

Acked-by: Paul Moore <paul@...l-moore.com>

> diff --git a/Documentation/netlabel/cipso_ipv4.txt b/Documentation/netlabel/cipso_ipv4.txt
> index a6075481fd60..cbd3f3231221 100644
> --- a/Documentation/netlabel/cipso_ipv4.txt
> +++ b/Documentation/netlabel/cipso_ipv4.txt
> @@ -1,10 +1,13 @@
> +===================================
>  NetLabel CIPSO/IPv4 Protocol Engine
> -==============================================================================
> +===================================
> +
>  Paul Moore, paul.moore@...com
>
>  May 17, 2006
>
> - * Overview
> +Overview
> +========
>
>  The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial
>  IP Security Option (CIPSO) draft from July 16, 1992.  A copy of this
> @@ -13,7 +16,8 @@ draft can be found in this directory
>  it to an RFC standard it has become a de-facto standard for labeled
>  networking and is used in many trusted operating systems.
>
> - * Outbound Packet Processing
> +Outbound Packet Processing
> +==========================
>
>  The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by
>  adding the CIPSO label to the socket.  This causes all packets leaving the
> @@ -24,7 +28,8 @@ label by using the NetLabel security module API; if the NetLabel "domain" is
>  configured to use CIPSO for packet labeling then a CIPSO IP option will be
>  generated and attached to the socket.
>
> - * Inbound Packet Processing
> +Inbound Packet Processing
> +=========================
>
>  The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the
>  IP layer without any special handling required by the LSM.  However, in order
> @@ -33,7 +38,8 @@ NetLabel security module API to extract the security attributes of the packet.
>  This is typically done at the socket layer using the 'socket_sock_rcv_skb()'
>  LSM hook.
>
> - * Label Translation
> +Label Translation
> +=================
>
>  The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security
>  attributes such as sensitivity level and category to values which are
> @@ -42,7 +48,8 @@ Domain Of Interpretation (DOI) definition and are configured through the
>  NetLabel user space communication layer.  Each DOI definition can have a
>  different security attribute mapping table.
>
> - * Label Translation Cache
> +Label Translation Cache
> +=======================
>
>  The NetLabel system provides a framework for caching security attribute
>  mappings from the network labels to the corresponding LSM identifiers.  The
> diff --git a/Documentation/netlabel/introduction.txt b/Documentation/netlabel/introduction.txt
> index 3caf77bcff0f..9333bbb0adc1 100644
> --- a/Documentation/netlabel/introduction.txt
> +++ b/Documentation/netlabel/introduction.txt
> @@ -1,10 +1,13 @@
> +=====================
>  NetLabel Introduction
> -==============================================================================
> +=====================
> +
>  Paul Moore, paul.moore@...com
>
>  August 2, 2006
>
> - * Overview
> +Overview
> +========
>
>  NetLabel is a mechanism which can be used by kernel security modules to attach
>  security attributes to outgoing network packets generated from user space
> @@ -12,7 +15,8 @@ applications and read security attributes from incoming network packets.  It
>  is composed of three main components, the protocol engines, the communication
>  layer, and the kernel security module API.
>
> - * Protocol Engines
> +Protocol Engines
> +================
>
>  The protocol engines are responsible for both applying and retrieving the
>  network packet's security attributes.  If any translation between the network
> @@ -24,7 +28,8 @@ the NetLabel kernel security module API described below.
>  Detailed information about each NetLabel protocol engine can be found in this
>  directory.
>
> - * Communication Layer
> +Communication Layer
> +===================
>
>  The communication layer exists to allow NetLabel configuration and monitoring
>  from user space.  The NetLabel communication layer uses a message based
> @@ -33,7 +38,8 @@ formatting of these NetLabel messages as well as the Generic NETLINK family
>  names can be found in the 'net/netlabel/' directory as comments in the
>  header files as well as in 'include/net/netlabel.h'.
>
> - * Security Module API
> +Security Module API
> +===================
>
>  The purpose of the NetLabel security module API is to provide a protocol
>  independent interface to the underlying NetLabel protocol engines.  In addition
> diff --git a/Documentation/netlabel/lsm_interface.txt b/Documentation/netlabel/lsm_interface.txt
> index 638c74f7de7f..026fc267f798 100644
> --- a/Documentation/netlabel/lsm_interface.txt
> +++ b/Documentation/netlabel/lsm_interface.txt
> @@ -1,10 +1,13 @@
> +========================================
>  NetLabel Linux Security Module Interface
> -==============================================================================
> +========================================
> +
>  Paul Moore, paul.moore@...com
>
>  May 17, 2006
>
> - * Overview
> +Overview
> +========
>
>  NetLabel is a mechanism which can set and retrieve security attributes from
>  network packets.  It is intended to be used by LSM developers who want to make
> @@ -12,7 +15,8 @@ use of a common code base for several different packet labeling protocols.
>  The NetLabel security module API is defined in 'include/net/netlabel.h' but a
>  brief overview is given below.
>
> - * NetLabel Security Attributes
> +NetLabel Security Attributes
> +============================
>
>  Since NetLabel supports multiple different packet labeling protocols and LSMs
>  it uses the concept of security attributes to refer to the packet's security
> @@ -24,7 +28,8 @@ configuration.  It is up to the LSM developer to translate the NetLabel
>  security attributes into whatever security identifiers are in use for their
>  particular LSM.
>
> - * NetLabel LSM Protocol Operations
> +NetLabel LSM Protocol Operations
> +================================
>
>  These are the functions which allow the LSM developer to manipulate the labels
>  on outgoing packets as well as read the labels on incoming packets.  Functions
> @@ -32,7 +37,8 @@ exist to operate both on sockets as well as the sk_buffs directly.  These high
>  level functions are translated into low level protocol operations based on how
>  the administrator has configured the NetLabel subsystem.
>
> - * NetLabel Label Mapping Cache Operations
> +NetLabel Label Mapping Cache Operations
> +=======================================
>
>  Depending on the exact configuration, translation between the network packet
>  label and the internal LSM security identifier can be time consuming.  The
> --
> 2.20.1
>


-- 
paul moore
www.paul-moore.com

Powered by blists - more mailing lists