redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

[PATCH] selinux: require SECURITY_NETWORK

Browse source 
Make SELinux depend on SECURITY_NETWORK (which depends on SECURITY), as it
requires the socket hooks for proper operation even in the local case.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Stephen Smalley 2006-02-04 23:27:50 -08:00 committed by Linus Torvalds
parent 5c0d5d262a
commit c2b507fda3
3 changed files with 5 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
security/selinux/Kconfig
View file

@ -1,6 +1,6 @@
config SECURITY_SELINUX config SECURITY_SELINUX
bool "NSA SELinux Support" bool "NSA SELinux Support"
depends on SECURITY && NET && INET depends on SECURITY_NETWORK && NET && INET
default n default n
help help
This selects NSA Security-Enhanced Linux (SELinux). This selects NSA Security-Enhanced Linux (SELinux).

4
security/selinux/Makefile
View file

@ -4,9 +4,7 @@
obj-$(CONFIG_SECURITY_SELINUX) := selinux.o ss/ obj-$(CONFIG_SECURITY_SELINUX) := selinux.o ss/
selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o
selinux-$(CONFIG_SECURITY_NETWORK) += netif.o
selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o

21
security/selinux/hooks.c
View file

@ -232,7 +232,6 @@ static void superblock_free_security(struct super_block *sb)
kfree(sbsec); kfree(sbsec);
} }
#ifdef CONFIG_SECURITY_NETWORK
static int sk_alloc_security(struct sock *sk, int family, gfp_t priority) static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
{ {
struct sk_security_struct *ssec; struct sk_security_struct *ssec;
@ -261,7 +260,6 @@ static void sk_free_security(struct sock *sk)
sk->sk_security = NULL; sk->sk_security = NULL;
kfree(ssec); kfree(ssec);
} }
#endif /* CONFIG_SECURITY_NETWORK */
/* The security server must be initialized before /* The security server must be initialized before
any labeling or access decisions can be provided. */ any labeling or access decisions can be provided. */
@ -2736,8 +2734,6 @@ static void selinux_task_to_inode(struct task_struct *p,
return; return;
} }
#ifdef CONFIG_SECURITY_NETWORK
/* Returns error only if unable to parse addresses */ /* Returns error only if unable to parse addresses */
static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad) static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
{ {
@ -3556,15 +3552,6 @@ static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
#endif /* CONFIG_NETFILTER */ #endif /* CONFIG_NETFILTER */
#else
static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
{
return 0;
}
#endif /* CONFIG_SECURITY_NETWORK */
static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb) static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
{ {
struct task_security_struct *tsec; struct task_security_struct *tsec;
@ -4340,7 +4327,6 @@ static struct security_operations selinux_ops = {
.getprocattr = selinux_getprocattr, .getprocattr = selinux_getprocattr,
.setprocattr = selinux_setprocattr, .setprocattr = selinux_setprocattr,
#ifdef CONFIG_SECURITY_NETWORK
.unix_stream_connect = selinux_socket_unix_stream_connect, .unix_stream_connect = selinux_socket_unix_stream_connect,
.unix_may_send = selinux_socket_unix_may_send, .unix_may_send = selinux_socket_unix_may_send,
@ -4362,7 +4348,6 @@ static struct security_operations selinux_ops = {
.sk_alloc_security = selinux_sk_alloc_security, .sk_alloc_security = selinux_sk_alloc_security,
.sk_free_security = selinux_sk_free_security, .sk_free_security = selinux_sk_free_security,
.sk_getsid = selinux_sk_getsid_security, .sk_getsid = selinux_sk_getsid_security,
#endif
#ifdef CONFIG_SECURITY_NETWORK_XFRM #ifdef CONFIG_SECURITY_NETWORK_XFRM
.xfrm_policy_alloc_security = selinux_xfrm_policy_alloc, .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
@ -4440,7 +4425,7 @@ next_sb:
all processes and objects when they are created. */ all processes and objects when they are created. */
security_initcall(selinux_init); security_initcall(selinux_init);
#if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER) #if defined(CONFIG_NETFILTER)
static struct nf_hook_ops selinux_ipv4_op = { static struct nf_hook_ops selinux_ipv4_op = {
.hook = selinux_ipv4_postroute_last, .hook = selinux_ipv4_postroute_last,
@ -4501,13 +4486,13 @@ static void selinux_nf_ip_exit(void)
} }
#endif #endif
#else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */ #else /* CONFIG_NETFILTER */
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
#define selinux_nf_ip_exit() #define selinux_nf_ip_exit()
#endif #endif
#endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */ #endif /* CONFIG_NETFILTER */
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
int selinux_disable(void) int selinux_disable(void)