path: root/security/selinux/nlmsgtab.c
diff options
authoretienne <etienne.basset@numericable.fr>2009-03-04 07:33:51 +0100
committerJames Morris <jmorris@namei.org>2009-03-05 08:30:01 +1100
commit113a0e4590881ce579ca992a80ddc562b3372ede (patch)
tree29dd1cd1c5f594efb51cdf9530a90ba2f3f2854e /security/selinux/nlmsgtab.c
parent454804ab0302b354e35d992d08e53fe03313baaf (diff)
smack: fixes for unlabeled host support
The following patch (against 2.6.29rc5) fixes a few issues in the smack/netlabel "unlabeled host support" functionnality that was added in 2.6.29rc. It should go in before -final. 1) smack_host_label disregard a " @" rule (or other label), preventing 'tagged' tasks to access Internet (many systems drop packets with IP options) 2) netmasks were not handled correctly, they were stored in a way _not equivalent_ to conversion to be32 (it was equivalent for /0, /8, /16, /24, /32 masks but not other masks) 3) smack_netlbladdr prefixes (IP/mask) were not consistent (mask&IP was not done), so there could have been different list entries for the same IP prefix; if those entries had different labels, well ... 4) they were not sorted 1) 2) 3) are bugs, 4) is a more cosmetic issue. The patch : -creates a new helper smk_netlbladdr_insert to insert a smk_netlbladdr, -sorted by netmask length -use the new sorted nature of smack_netlbladdrs list to simplify smack_host_label : the first match _will_ be the more specific -corrects endianness issues in smk_write_netlbladdr & netlbladdr_seq_show Signed-off-by: <etienne.basset@numericable.fr> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/nlmsgtab.c')
0 files changed, 0 insertions, 0 deletions