aboutsummaryrefslogtreecommitdiffstats
path: root/security/dummy.c
diff options
context:
space:
mode:
authorVenkat Yekkirala <vyekkirala@trustedcs.com>2006-11-08 18:04:26 -0500
committerDavid S. Miller <davem@sunset.davemloft.net>2006-12-03 00:21:34 -0500
commit67f83cbf081a70426ff667e8d14f94e13ed3bdca (patch)
tree776a40733eacb9071478f865e6791daa3f6fd602 /security/dummy.c
parent6b877699c6f1efede4545bcecc367786a472eedb (diff)
SELinux: Fix SA selection semantics
Fix the selection of an SA for an outgoing packet to be at the same context as the originating socket/flow. This eliminates the SELinux policy's ability to use/sendto SAs with contexts other than the socket's. With this patch applied, the SELinux policy will require one or more of the following for a socket to be able to communicate with/without SAs: 1. To enable a socket to communicate without using labeled-IPSec SAs: allow socket_t unlabeled_t:association { sendto recvfrom } 2. To enable a socket to communicate with labeled-IPSec SAs: allow socket_t self:association { sendto }; allow socket_t peer_sa_t:association { recvfrom }; Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/dummy.c')
-rw-r--r--security/dummy.c7
1 files changed, 0 insertions, 7 deletions
diff --git a/security/dummy.c b/security/dummy.c
index 0148d1518dd1..558795b237d6 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -886,12 +886,6 @@ static int dummy_xfrm_state_pol_flow_match(struct xfrm_state *x,
886 return 1; 886 return 1;
887} 887}
888 888
889static int dummy_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
890 struct xfrm_policy *xp)
891{
892 return 1;
893}
894
895static int dummy_xfrm_decode_session(struct sk_buff *skb, u32 *fl, int ckall) 889static int dummy_xfrm_decode_session(struct sk_buff *skb, u32 *fl, int ckall)
896{ 890{
897 return 0; 891 return 0;
@@ -1126,7 +1120,6 @@ void security_fixup_ops (struct security_operations *ops)
1126 set_to_dummy_if_null(ops, xfrm_state_delete_security); 1120 set_to_dummy_if_null(ops, xfrm_state_delete_security);
1127 set_to_dummy_if_null(ops, xfrm_policy_lookup); 1121 set_to_dummy_if_null(ops, xfrm_policy_lookup);
1128 set_to_dummy_if_null(ops, xfrm_state_pol_flow_match); 1122 set_to_dummy_if_null(ops, xfrm_state_pol_flow_match);
1129 set_to_dummy_if_null(ops, xfrm_flow_state_match);
1130 set_to_dummy_if_null(ops, xfrm_decode_session); 1123 set_to_dummy_if_null(ops, xfrm_decode_session);
1131#endif /* CONFIG_SECURITY_NETWORK_XFRM */ 1124#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1132#ifdef CONFIG_KEYS 1125#ifdef CONFIG_KEYS