diff options
| author | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-14 03:53:18 +0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-14 03:53:18 +0400 |
| commit | 8d9107e8c50e1c4ff43c91c8841805833f3ecfb9 (patch) | |
| tree | abc57f38cf659d4031d5a9915a088f2c47b2cc7e /security/selinux/netlabel.c | |
| parent | 16cefa8c3863721fd40445a1b34dea18cd16ccfe (diff) | |
| download | linux-8d9107e8c50e1c4ff43c91c8841805833f3ecfb9.tar.xz | |
Revert "SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabel"
This reverts commit 9faf65fb6ee2b4e08325ba2d69e5ccf0c46453d0.
It bit people like Michal Piotrowski:
"My system is too secure, I can not login :)"
because it changed how CONFIG_NETLABEL worked, and broke older SElinux
policies.
As a result, quoth James Morris:
"Can you please revert this patch?
We thought it only affected people running MLS, but it will affect others.
Sorry for the hassle."
Cc: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security/selinux/netlabel.c')
| -rw-r--r-- | security/selinux/netlabel.c | 34 |
1 files changed, 21 insertions, 13 deletions
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 8192e8bc9f5a..e64eca246f1a 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -158,7 +158,9 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid) netlbl_secattr_init(&secattr); rc = netlbl_skbuff_getattr(skb, &secattr); if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) - rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid); + rc = security_netlbl_secattr_to_sid(&secattr, + base_sid, + sid); else *sid = SECSID_NULL; netlbl_secattr_destroy(&secattr); @@ -196,7 +198,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock) if (netlbl_sock_getattr(sk, &secattr) == 0 && secattr.flags != NETLBL_SECATTR_NONE && security_netlbl_secattr_to_sid(&secattr, - SECINITSID_NETMSG, + SECINITSID_UNLABELED, &nlbl_peer_sid) == 0) sksec->peer_sid = nlbl_peer_sid; netlbl_secattr_destroy(&secattr); @@ -293,32 +295,38 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, struct avc_audit_data *ad) { int rc; - u32 nlbl_sid; - u32 perm; + u32 netlbl_sid; + u32 recv_perm; - rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &nlbl_sid); + rc = selinux_netlbl_skbuff_getsid(skb, + SECINITSID_UNLABELED, + &netlbl_sid); if (rc != 0) return rc; - if (nlbl_sid == SECSID_NULL) - nlbl_sid = SECINITSID_UNLABELED; + + if (netlbl_sid == SECSID_NULL) + return 0; switch (sksec->sclass) { case SECCLASS_UDP_SOCKET: - perm = UDP_SOCKET__RECVFROM; + recv_perm = UDP_SOCKET__RECVFROM; break; case SECCLASS_TCP_SOCKET: - perm = TCP_SOCKET__RECVFROM; + recv_perm = TCP_SOCKET__RECVFROM; break; default: - perm = RAWIP_SOCKET__RECVFROM; + recv_perm = RAWIP_SOCKET__RECVFROM; } - rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad); + rc = avc_has_perm(sksec->sid, + netlbl_sid, + sksec->sclass, + recv_perm, + ad); if (rc == 0) return 0; - if (nlbl_sid != SECINITSID_UNLABELED) - netlbl_skbuff_err(skb, rc); + netlbl_skbuff_err(skb, rc); return rc; } |