diff options
Diffstat (limited to 'security/selinux/hooks.c')
-rw-r--r-- | security/selinux/hooks.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 65fa8bf596f5..c82538a4b1a4 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c | |||
@@ -4520,11 +4520,11 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, | |||
4520 | if (selinux_secmark_enabled()) | 4520 | if (selinux_secmark_enabled()) |
4521 | if (avc_has_perm(sksec->sid, skb->secmark, | 4521 | if (avc_has_perm(sksec->sid, skb->secmark, |
4522 | SECCLASS_PACKET, PACKET__SEND, &ad)) | 4522 | SECCLASS_PACKET, PACKET__SEND, &ad)) |
4523 | return NF_DROP; | 4523 | return NF_DROP_ERR(-ECONNREFUSED); |
4524 | 4524 | ||
4525 | if (selinux_policycap_netpeer) | 4525 | if (selinux_policycap_netpeer) |
4526 | if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) | 4526 | if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) |
4527 | return NF_DROP; | 4527 | return NF_DROP_ERR(-ECONNREFUSED); |
4528 | 4528 | ||
4529 | return NF_ACCEPT; | 4529 | return NF_ACCEPT; |
4530 | } | 4530 | } |
@@ -4581,7 +4581,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4581 | secmark_perm = PACKET__SEND; | 4581 | secmark_perm = PACKET__SEND; |
4582 | break; | 4582 | break; |
4583 | default: | 4583 | default: |
4584 | return NF_DROP; | 4584 | return NF_DROP_ERR(-ECONNREFUSED); |
4585 | } | 4585 | } |
4586 | if (secmark_perm == PACKET__FORWARD_OUT) { | 4586 | if (secmark_perm == PACKET__FORWARD_OUT) { |
4587 | if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) | 4587 | if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) |
@@ -4603,7 +4603,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4603 | if (secmark_active) | 4603 | if (secmark_active) |
4604 | if (avc_has_perm(peer_sid, skb->secmark, | 4604 | if (avc_has_perm(peer_sid, skb->secmark, |
4605 | SECCLASS_PACKET, secmark_perm, &ad)) | 4605 | SECCLASS_PACKET, secmark_perm, &ad)) |
4606 | return NF_DROP; | 4606 | return NF_DROP_ERR(-ECONNREFUSED); |
4607 | 4607 | ||
4608 | if (peerlbl_active) { | 4608 | if (peerlbl_active) { |
4609 | u32 if_sid; | 4609 | u32 if_sid; |
@@ -4613,13 +4613,13 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, | |||
4613 | return NF_DROP; | 4613 | return NF_DROP; |
4614 | if (avc_has_perm(peer_sid, if_sid, | 4614 | if (avc_has_perm(peer_sid, if_sid, |
4615 | SECCLASS_NETIF, NETIF__EGRESS, &ad)) | 4615 | SECCLASS_NETIF, NETIF__EGRESS, &ad)) |
4616 | return NF_DROP; | 4616 | return NF_DROP_ERR(-ECONNREFUSED); |
4617 | 4617 | ||
4618 | if (sel_netnode_sid(addrp, family, &node_sid)) | 4618 | if (sel_netnode_sid(addrp, family, &node_sid)) |
4619 | return NF_DROP; | 4619 | return NF_DROP; |
4620 | if (avc_has_perm(peer_sid, node_sid, | 4620 | if (avc_has_perm(peer_sid, node_sid, |
4621 | SECCLASS_NODE, NODE__SENDTO, &ad)) | 4621 | SECCLASS_NODE, NODE__SENDTO, &ad)) |
4622 | return NF_DROP; | 4622 | return NF_DROP_ERR(-ECONNREFUSED); |
4623 | } | 4623 | } |
4624 | 4624 | ||
4625 | return NF_ACCEPT; | 4625 | return NF_ACCEPT; |