diff options
author | Eric Paris <eparis@redhat.com> | 2010-11-23 01:28:02 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-11-23 13:50:17 -0500 |
commit | 04f6d70f6e64900a5d70a5fc199dd9d5fa787738 (patch) | |
tree | 68d369f422f98842031ae4ada17e391140165b54 | |
parent | eb06acdc85585f28864261f28659157848762ee4 (diff) |
SELinux: Only return netlink error when we know the return is fatal
Some of the SELinux netlink code returns a fatal error when the error might
actually be transient. This patch just silently drops packets on
potentially transient errors but continues to return a permanant error
indicator when the denial was because of policy.
Based-on-comments-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | security/selinux/hooks.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 2c145f12d991..f590fb8e9143 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c | |||
@@ -4589,7 +4589,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4589 | } | 4589 | } |
4590 | if (secmark_perm == PACKET__FORWARD_OUT) { | 4590 | if (secmark_perm == PACKET__FORWARD_OUT) { |
4591 | if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) | 4591 | if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) |
4592 | return NF_DROP_ERR(-ECONNREFUSED); | 4592 | return NF_DROP; |
4593 | } else | 4593 | } else |
4594 | peer_sid = SECINITSID_KERNEL; | 4594 | peer_sid = SECINITSID_KERNEL; |
4595 | } else { | 4595 | } else { |
@@ -4602,7 +4602,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4602 | ad.u.net.netif = ifindex; | 4602 | ad.u.net.netif = ifindex; |
4603 | ad.u.net.family = family; | 4603 | ad.u.net.family = family; |
4604 | if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) | 4604 | if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) |
4605 | return NF_DROP_ERR(-ECONNREFUSED); | 4605 | return NF_DROP; |
4606 | 4606 | ||
4607 | if (secmark_active) | 4607 | if (secmark_active) |
4608 | if (avc_has_perm(peer_sid, skb->secmark, | 4608 | if (avc_has_perm(peer_sid, skb->secmark, |
@@ -4614,13 +4614,13 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4614 | u32 node_sid; | 4614 | u32 node_sid; |
4615 | 4615 | ||
4616 | if (sel_netif_sid(ifindex, &if_sid)) | 4616 | if (sel_netif_sid(ifindex, &if_sid)) |
4617 | return NF_DROP_ERR(-ECONNREFUSED); | 4617 | return NF_DROP; |
4618 | if (avc_has_perm(peer_sid, if_sid, | 4618 | if (avc_has_perm(peer_sid, if_sid, |
4619 | SECCLASS_NETIF, NETIF__EGRESS, &ad)) | 4619 | SECCLASS_NETIF, NETIF__EGRESS, &ad)) |
4620 | return NF_DROP_ERR(-ECONNREFUSED); | 4620 | return NF_DROP_ERR(-ECONNREFUSED); |
4621 | 4621 | ||
4622 | if (sel_netnode_sid(addrp, family, &node_sid)) | 4622 | if (sel_netnode_sid(addrp, family, &node_sid)) |
4623 | return NF_DROP_ERR(-ECONNREFUSED); | 4623 | return NF_DROP; |
4624 | if (avc_has_perm(peer_sid, node_sid, | 4624 | if (avc_has_perm(peer_sid, node_sid, |
4625 | SECCLASS_NODE, NODE__SENDTO, &ad)) | 4625 | SECCLASS_NODE, NODE__SENDTO, &ad)) |
4626 | return NF_DROP_ERR(-ECONNREFUSED); | 4626 | return NF_DROP_ERR(-ECONNREFUSED); |