SELinux: Fix SA selection semantics

Fix the selection of an SA for an outgoing packet to be at the same
context as the originating socket/flow. This eliminates the SELinux
policy's ability to use/sendto SAs with contexts other than the socket's.

With this patch applied, the SELinux policy will require one or more of the
following for a socket to be able to communicate with/without SAs:

1. To enable a socket to communicate without using labeled-IPSec SAs:

allow socket_t unlabeled_t:association { sendto recvfrom }

2. To enable a socket to communicate with labeled-IPSec SAs:

allow socket_t self:association { sendto };
allow socket_t peer_sa_t:association { recvfrom };

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 0 insertions, 7 deletions

diff --git a/security/dummy.c b/security/dummy.c
index 0148d1518dd1..558795b237d6 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -886,12 +886,6 @@ static int dummy_xfrm_state_pol_flow_match(struct xfrm_state *x,
         return 1;
 }
 
-static int dummy_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
-                                struct xfrm_policy *xp)
-{
-        return 1;
-}
-
 static int dummy_xfrm_decode_session(struct sk_buff *skb, u32 *fl, int ckall)
 {
         return 0;
@@ -1126,7 +1120,6 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, xfrm_state_delete_security);
         set_to_dummy_if_null(ops, xfrm_policy_lookup);
         set_to_dummy_if_null(ops, xfrm_state_pol_flow_match);
-        set_to_dummy_if_null(ops, xfrm_flow_state_match);
         set_to_dummy_if_null(ops, xfrm_decode_session);
 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 #ifdef CONFIG_KEYS