You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Paul Moore 389fb800ac netlabel: Label incoming TCP connections correctly in SELinux ... The current NetLabel/SELinux behavior for incoming TCP connections works but only through a series of happy coincidences that rely on the limited nature of standard CIPSO (only able to convey MLS attributes) and the write equality imposed by the SELinux MLS constraints. The problem is that network sockets created as the result of an incoming TCP connection were not on-the-wire labeled based on the security attributes of the parent socket but rather based on the wire label of the remote peer. The issue had to do with how IP options were managed as part of the network stack and where the LSM hooks were in relation to the code which set the IP options on these newly created child sockets. While NetLabel/SELinux did correctly set the socket's on-the-wire label it was promptly cleared by the network stack and reset based on the IP options of the remote peer. This patch, in conjunction with a prior patch that adjusted the LSM hook locations, works to set the correct on-the-wire label format for new incoming connections through the security_inet_conn_request() hook. Besides the correct behavior there are many advantages to this change, the most significant is that all of the NetLabel socket labeling code in SELinux now lives in hooks which can return error codes to the core stack which allows us to finally get ride of the selinux_netlbl_inode_permission() logic which greatly simplfies the NetLabel/SELinux glue code. In the process of developing this patch I also ran into a small handful of AF_INET6 cleanliness issues that have been fixed which should make the code safer and easier to extend in the future. Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: James Morris <jmorris@namei.org>		16 years ago
..
audit.h	SELinux: keep the code clean formating and syntax	17 years ago
av_inherit.h	[SELinux]: Add support for DCCP	18 years ago
av_perm_to_string.h	SELinux: new permission between tty audit and audit socket	16 years ago
av_permissions.h	SELinux: new permission between tty audit and audit socket	16 years ago
avc.h	SELinux: add boundary support and thread context assignment	17 years ago
avc_ss.h	SELinux: shrink sizeof av_inhert selinux_class_perm and context	16 years ago
class_to_string.h	CRED: Add a kernel_service object class to SELinux	16 years ago
common_perm_to_string.h	Linux-2.6.12-rc2	20 years ago
conditional.h	Linux-2.6.12-rc2	20 years ago
flask.h	CRED: Add a kernel_service object class to SELinux	16 years ago
initial_sid_to_string.h	Linux-2.6.12-rc2	20 years ago
netif.h	SELinux: Convert the netif code to use ifindex values	17 years ago
netlabel.h	netlabel: Label incoming TCP connections correctly in SELinux	16 years ago
netnode.h	SELinux: Add a network node caching mechanism similar to the sel_netif_*() functions	17 years ago
netport.h	SELinux: add netport.[ch]	17 years ago
objsec.h	SELinux: Condense super block security structure flags and cleanup necessary code.	16 years ago
security.h	SELinux: remove unused av.decided field	16 years ago
xfrm.h	LSM: Make the Labeled IPsec hooks more stack friendly	17 years ago