]> pilppa.com Git - linux-2.6-omap-h63xx.git/commit
SELinux: Fix SA selection semantics
authorVenkat Yekkirala <vyekkirala@trustedcs.com>
Wed, 8 Nov 2006 23:04:26 +0000 (17:04 -0600)
committerDavid S. Miller <davem@sunset.davemloft.net>
Sun, 3 Dec 2006 05:21:34 +0000 (21:21 -0800)
commit67f83cbf081a70426ff667e8d14f94e13ed3bdca
tree776a40733eacb9071478f865e6791daa3f6fd602
parent6b877699c6f1efede4545bcecc367786a472eedb
SELinux: Fix SA selection semantics

Fix the selection of an SA for an outgoing packet to be at the same
context as the originating socket/flow. This eliminates the SELinux
policy's ability to use/sendto SAs with contexts other than the socket's.

With this patch applied, the SELinux policy will require one or more of the
following for a socket to be able to communicate with/without SAs:

1. To enable a socket to communicate without using labeled-IPSec SAs:

allow socket_t unlabeled_t:association { sendto recvfrom }

2. To enable a socket to communicate with labeled-IPSec SAs:

allow socket_t self:association { sendto };
allow socket_t peer_sa_t:association { recvfrom };

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
include/linux/security.h
net/xfrm/xfrm_policy.c
security/dummy.c
security/selinux/hooks.c
security/selinux/include/xfrm.h
security/selinux/xfrm.c