aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2007-09-12 07:02:17 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 19:49:09 -0400
commite9dc86534051b78e41e5b746cccc291b57a3a311 (patch)
tree1cd4a1dde4c51b6311749428a22cc8a8f5436825 /security
parente730c15519d09ea528b4d2f1103681fa5937c0e6 (diff)
[NET]: Make device event notification network namespace safe
Every user of the network device notifiers is either a protocol stack or a pseudo device. If a protocol stack that does not have support for multiple network namespaces receives an event for a device that is not in the initial network namespace it quite possibly can get confused and do the wrong thing. To avoid problems until all of the protocol stacks are converted this patch modifies all netdev event handlers to ignore events on devices that are not in the initial network namespace. As the rest of the code is made network namespace aware these checks can be removed. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security')
-rw-r--r--security/selinux/netif.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index b10c34e8a743..e87ab948104c 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -20,6 +20,7 @@
20#include <linux/notifier.h> 20#include <linux/notifier.h>
21#include <linux/netdevice.h> 21#include <linux/netdevice.h>
22#include <linux/rcupdate.h> 22#include <linux/rcupdate.h>
23#include <net/net_namespace.h>
23 24
24#include "security.h" 25#include "security.h"
25#include "objsec.h" 26#include "objsec.h"
@@ -234,6 +235,9 @@ static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
234{ 235{
235 struct net_device *dev = ptr; 236 struct net_device *dev = ptr;
236 237
238 if (dev->nd_net != &init_net)
239 return NOTIFY_DONE;
240
237 if (event == NETDEV_DOWN) 241 if (event == NETDEV_DOWN)
238 sel_netif_kill(dev); 242 sel_netif_kill(dev);
239 243