GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-19 21:21:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[NetLabel]: SELinux support

Browse source 
Add NetLabel support to the SELinux LSM and modify the
socket_post_create() LSM hook to return an error code.  The most
significant part of this patch is the addition of NetLabel hooks into
the following SELinux LSM hooks:

 * selinux_file_permission()
 * selinux_socket_sendmsg()
 * selinux_socket_post_create()
 * selinux_socket_sock_rcv_skb()
 * selinux_socket_getpeersec_stream()
 * selinux_socket_getpeersec_dgram()
 * selinux_sock_graft()
 * selinux_inet_conn_request()

The basic reasoning behind this patch is that outgoing packets are
"NetLabel'd" by labeling their socket and the NetLabel security
attributes are checked via the additional hook in
selinux_socket_sock_rcv_skb().  NetLabel itself is only a labeling
mechanism, similar to filesystem extended attributes, it is up to the
SELinux enforcement mechanism to perform the actual access checks.

In addition to the changes outlined above this patch also includes
some changes to the extended bitmap (ebitmap) and multi-level security
(mls) code to import and export SELinux TE/MLS attributes into and out
of NetLabel.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Venkat Yekkirala 2006-08-04 23:17:57 -07:00 • committed by David S. Miller
parent 96cb8e3313
commit 7420ed23a4
11 changed files with 1020 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

13
net/socket.c
View file

@ -973,11 +973,18 @@ int sock_create_lite(int family, int type, int protocol, struct socket **res)
goto out;
}
security_socket_post_create(sock, family, type, protocol, 1);
sock->type = type;
err = security_socket_post_create(sock, family, type, protocol, 1);
if (err)
goto out_release;
out:
*res = sock;
return err;
out_release:
sock_release(sock);
sock = NULL;
goto out;
}
/* No kernel lock held - perfect */
@ -1214,7 +1221,9 @@ static int __sock_create(int family, int type, int protocol, struct socket **res
*/
module_put(net_families[family]->owner);
*res = sock;
security_socket_post_create(sock, family, type, protocol, kern);
err = security_socket_post_create(sock, family, type, protocol, kern);
if (err)
goto out_release;
out:
net_family_read_unlock();