diff options
author | Harry Ciao <qingtao.cao@windriver.com> | 2011-03-02 00:32:33 -0500 |
---|---|---|
committer | Eric Paris <eparis@redhat.com> | 2011-03-03 15:19:43 -0500 |
commit | 6f5317e730505d5cbc851c435a2dfe3d5a21d343 (patch) | |
tree | 02088cf519a00db5c6fbdb2cc8776402413eb662 /security/selinux/ss/mls.c | |
parent | 4bc6c2d5d8386800fde23a8e78cd4f04a0ade0ad (diff) |
SELinux: Socket retains creator role and MLS attribute
The socket SID would be computed on creation and no longer inherit
its creator's SID by default. Socket may have a different type but
needs to retain the creator's role and MLS attribute in order not
to break labeled networking and network access control.
The kernel value for a class would be used to determine if the class
if one of socket classes. If security_compute_sid is called from
userspace the policy value for a class would be mapped to the relevant
kernel value first.
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'security/selinux/ss/mls.c')
-rw-r--r-- | security/selinux/ss/mls.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c index 1ef8e4e89880..e96174216bc9 100644 --- a/security/selinux/ss/mls.c +++ b/security/selinux/ss/mls.c | |||
@@ -512,7 +512,8 @@ int mls_compute_sid(struct context *scontext, | |||
512 | struct context *tcontext, | 512 | struct context *tcontext, |
513 | u16 tclass, | 513 | u16 tclass, |
514 | u32 specified, | 514 | u32 specified, |
515 | struct context *newcontext) | 515 | struct context *newcontext, |
516 | bool sock) | ||
516 | { | 517 | { |
517 | struct range_trans rtr; | 518 | struct range_trans rtr; |
518 | struct mls_range *r; | 519 | struct mls_range *r; |
@@ -531,7 +532,7 @@ int mls_compute_sid(struct context *scontext, | |||
531 | return mls_range_set(newcontext, r); | 532 | return mls_range_set(newcontext, r); |
532 | /* Fallthrough */ | 533 | /* Fallthrough */ |
533 | case AVTAB_CHANGE: | 534 | case AVTAB_CHANGE: |
534 | if (tclass == policydb.process_class) | 535 | if ((tclass == policydb.process_class) || (sock == true)) |
535 | /* Use the process MLS attributes. */ | 536 | /* Use the process MLS attributes. */ |
536 | return mls_context_cpy(newcontext, scontext); | 537 | return mls_context_cpy(newcontext, scontext); |
537 | else | 538 | else |