next up previous contents
Next: IP Labeling Access Control Up: LinSec IP Labeling Previous: LinSec IP Labeling   Contents

IP Labeling Information Storage

As IP Labeling (IPL) (Chapter 4, Section 4.4) information is, by its definition, closely related to executable files it is, therefore, kept in extended file system attributes of executable files. IPL lists of an executable file are described in terms of IPL Groups file is a member of. In implementation terms, extended attribute describing IPL list of an executable file just holds a 64 bit bitmap in which each IPL Group is represented by a single bit. IPL information is retrieved from extended attributes by linsec_read_file_ipl (kernel/linsec_attr.c) when the executable is loaded in memory for execution (do_execve function, fs/exec.c). Once read, the bitmap is transformed into a linked list of IPL Elements that is stored in linsec_task structure of the process that called do_execve.