aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2010-11-23 01:28:08 -0500
committerDavid S. Miller <davem@davemloft.net>2010-11-23 13:50:17 -0500
commit2fe66ec242d3f76e3b0101f36419e7e5405bcff3 (patch)
tree2091420d53ae1bf9e7673c2275b36c6b1e6aac1b /security/selinux
parent04f6d70f6e64900a5d70a5fc199dd9d5fa787738 (diff)
SELinux: indicate fatal error in compat netfilter code
The SELinux ip postroute code indicates when policy rejected a packet and passes the error back up the stack. The compat code does not. This patch sends the same kind of error back up the stack in the compat code. Based-on-patch-by: Paul Moore <paul.moore@hp.com> Signed-off-by: Eric Paris <eparis@redhat.com> Reviewed-by: Paul Moore <paul.moore@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/hooks.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f590fb8e9143..156ef93d6f7d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4524,11 +4524,11 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4524 if (selinux_secmark_enabled()) 4524 if (selinux_secmark_enabled())
4525 if (avc_has_perm(sksec->sid, skb->secmark, 4525 if (avc_has_perm(sksec->sid, skb->secmark,
4526 SECCLASS_PACKET, PACKET__SEND, &ad)) 4526 SECCLASS_PACKET, PACKET__SEND, &ad))
4527 return NF_DROP; 4527 return NF_DROP_ERR(-ECONNREFUSED);
4528 4528
4529 if (selinux_policycap_netpeer) 4529 if (selinux_policycap_netpeer)
4530 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) 4530 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4531 return NF_DROP; 4531 return NF_DROP_ERR(-ECONNREFUSED);
4532 4532
4533 return NF_ACCEPT; 4533 return NF_ACCEPT;
4534} 4534}