[NetLabel]: change the SELinux permissions
Change NetLabel to use the 'recvfrom' socket permission and the SECINITSID_NETMSG SELinux SID as the NetLabel base SID for incoming packets. This patch effectively makes the old, and currently unused, SELinux NETMSG permissions NetLabel permissions. Signed-of-by: Paul Moore <paul.moore@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
609c92feea
commit
df2115c313
|
@ -2611,7 +2611,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
|
|||
u32 netlbl_sid;
|
||||
u32 recv_perm;
|
||||
|
||||
rc = selinux_netlbl_skbuff_getsid(skb, sksec->sid, &netlbl_sid);
|
||||
rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &netlbl_sid);
|
||||
if (rc != 0)
|
||||
return rc;
|
||||
|
||||
|
@ -2620,13 +2620,13 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
|
|||
|
||||
switch (sksec->sclass) {
|
||||
case SECCLASS_UDP_SOCKET:
|
||||
recv_perm = UDP_SOCKET__RECV_MSG;
|
||||
recv_perm = UDP_SOCKET__RECVFROM;
|
||||
break;
|
||||
case SECCLASS_TCP_SOCKET:
|
||||
recv_perm = TCP_SOCKET__RECV_MSG;
|
||||
recv_perm = TCP_SOCKET__RECVFROM;
|
||||
break;
|
||||
default:
|
||||
recv_perm = RAWIP_SOCKET__RECV_MSG;
|
||||
recv_perm = RAWIP_SOCKET__RECVFROM;
|
||||
}
|
||||
|
||||
rc = avc_has_perm(sksec->sid,
|
||||
|
|
Loading…
Reference in a new issue