Skip to contentSkip to conversation

Various NetLabel fixes and cleanups

PATCH Applied [email protected] 3 participants 19 messages Aug 29, 2006 – Aug 30, 2006

Subsystems (4)
Networking Network drivers SELinux security module Labeled networking (NetLabel)
lore
Share & tools
lore

[email protected]

author
#0 lore raw

cover Various NetLabel fixes and cleanups

This patchset contains a series of small patches to fix a bug and some general ugliness from the original author (that moron ...). All of the following patches are against David's net-2.6.19 tree.

Please consider these for 2.6.19, thanks.

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#1 lore raw

PATCH 1/6 NetLabel: correctly initialize the NetLabel fields

Fix a problem where the NetLabel specific fields of the sk_security_struct structure were not being initialized early enough in some cases.

Signed-off-by Paul Moore <[email protected]>
---
 security/selinux/hooks.c                    |    6 +++
 security/selinux/include/selinux_netlabel.h |   18 +++++++++++
 security/selinux/ss/services.c              |   45 ++++++++++++++++++++++++++--
 3 files changed, 67 insertions(+), 2 deletions(-)
security/selinux/hooks.c +6 -0
Index: net-2.6.19/security/selinux/hooks.c
===================================================================
@@ -281,6 +281,8 @@ static int sk_alloc_security(struct sock
 	ssec->sid = SECINITSID_UNLABELED;
 	sk->sk_security = ssec;
 
+	selinux_netlbl_sk_security_init(ssec, family);
+
 	return 0;
 }
 

@@ -3585,6 +3587,8 @@ static void selinux_sk_clone_security(co
 
 	newssec->sid = ssec->sid;
 	newssec->peer_sid = ssec->peer_sid;
+
+	selinux_netlbl_sk_clone_security(ssec, newssec);
 }
 
 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)

@@ -3648,6 +3652,8 @@ static void selinux_inet_csk_clone(struc
 	   new socket in sync, but we don't have the isec available yet.
 	   So we will wait until sock_graft to do it, by which
 	   time it will have been created and available. */
+
+	selinux_netlbl_sk_security_init(newsksec, req->rsk_ops->family);
 }
 
 static void selinux_req_classify_flow(const struct request_sock *req,
security/selinux/include/selinux_netlabel.h +18 -0
Index: net-2.6.19/security/selinux/include/selinux_netlabel.h
===================================================================
@@ -39,6 +39,10 @@ int selinux_netlbl_sock_rcv_skb(struct s
 				struct avc_audit_data *ad);
 u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock);
 u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb);
+void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
+				     int family);
+void selinux_netlbl_sk_clone_security(struct sk_security_struct *ssec,
+				      struct sk_security_struct *newssec);
 
 int __selinux_netlbl_inode_permission(struct inode *inode, int mask);
 /**

@@ -115,6 +119,20 @@ static inline u32 selinux_netlbl_socket_
 	return SECSID_NULL;
 }
 
+static inline void selinux_netlbl_sk_security_init(
+	                                       struct sk_security_struct *ssec,
+					       int family)
+{
+	return;
+}
+
+static inline void selinux_netlbl_sk_clone_security(
+	                                   struct sk_security_struct *ssec,
+					   struct sk_security_struct *newssec)
+{
+	return;
+}
+
 static inline int selinux_netlbl_inode_permission(struct inode *inode,
 						  int mask)
 {
security/selinux/ss/services.c +43 -2

71 lines not on this page · raw message

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

#2 lore raw

Re: [PATCH 1/6] NetLabel: correctly initialize the NetLabel fields

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2438

Quoted 4 lines · On Tue, 29 Aug 2006, [email protected] wrote:
security/selinux/ss/services.c +4 -0
+void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
+				     int family)
+{
+        if (family == PF_INET)

No tab.

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2442

Quoted 4 lines
security/selinux/ss/services.c +4 -0
+		ssec->nlbl_state = NLBL_REQUIRE;
+	else
+		ssec->nlbl_state = NLBL_UNSET;
+}

It doesn't look like this code handles ipv4 packets mapped on ipv6 sockets. See the test elsewhere in the SELinux code:

	if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))

Also, can you verify that you've tested these fixes and that they resolve all issues that you've encountered?

Signature · 2 lines
James Morris
<[email protected]>
author
#3 lore raw

Re: [PATCH 1/6] NetLabel: correctly initialize the NetLabel fields

Quoted 7 lines · James Morris

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2438

Quoted 4 lines · On Tue, 29 Aug 2006, [email protected] wrote:
security/selinux/ss/services.c +4 -0
+void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
+				     int family)
+{
+        if (family == PF_INET)

No tab.

I see you already ack'd this patch, should I resubmit with the tab correction or just leave it alone?

Quoted 9 lines

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2442

Quoted 4 lines
security/selinux/ss/services.c +4 -0
+		ssec->nlbl_state = NLBL_REQUIRE;
+	else
+		ssec->nlbl_state = NLBL_UNSET;
+}

It doesn't look like this code handles ipv4 packets mapped on ipv6 sockets. See the test elsewhere in the SELinux code:

	if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))

This is an issue which I am still thinking about, but I haven't devoted to much time to it because in the one example case I have tried everything works as expected.

Example case:

1. Configure NetLabel so that packets are labeled with CIPSO
2. Ensure SSH is listening for both IPv4 and IPv6 connections and restart the daemon
3. Connect to the SSH daemon using IPv4

I haven't looked at the sshd code enough in detail to see what it is doing exactly but simply running 'netstat -nl' shows that sshd is listening for connections with an IPv6 socket (at least it is listening on port ':::22'). Once the connection is established the daemon continues to use an IPv6 socket, '::ffff:127.0.0.1:22', whereas the client uses a traditional IPv4 socket. Sniffing the connection indicates that both directions of network traffic are labeled with the correct CIPSO tags.

On the receive side in selinux_socket_sock_rcv_skb() the socket's IP address family is not consulted, only the SELinux socket class and the skbuff's CIPSO tag if present.

On the outbound side, yes, we only NetLabel sockets which are PF_INET but I didn't think I could set an IPv4 option on a PF_INET6 socket can I? It just sounds wrong ...

Quoted 2 lines

Also, can you verify that you've tested these fixes and that they resolve all issues that you've encountered?

I have verified that this patchset fixes all the issues that I've encountered. In addition I have run the patches overnight on a test machine while hitting the machine pretty hard and I have not noticed any other problems or regressions.

Signature · 7 lines
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.
#4 lore raw

Re: [PATCH 1/6] NetLabel: correctly initialize the NetLabel fields

Quoted 11 lines · Paul Moore
Quoted 7 lines · James Morris

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2438

Quoted 4 lines · On Tue, 29 Aug 2006, [email protected] wrote:
security/selinux/ss/services.c +4 -0
+void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
+				     int family)
+{
+        if (family == PF_INET)

No tab.

I see you already ack'd this patch, should I resubmit with the tab correction or just leave it alone?

Probably easiest to fix it as it's applied.

Quoted 7 lines

Example case:

1. Configure NetLabel so that packets are labeled with CIPSO
2. Ensure SSH is listening for both IPv4 and IPv6 connections and restart the daemon
3. Connect to the SSH daemon using IPv4

Quoted 8 lines

I haven't looked at the sshd code enough in detail to see what it is doing exactly but simply running 'netstat -nl' shows that sshd is listening for connections with an IPv6 socket (at least it is listening on port ':::22'). Once the connection is established the daemon continues to use an IPv6 socket, '::ffff:127.0.0.1:22', whereas the client uses a traditional IPv4 socket. Sniffing the connection indicates that both directions of network traffic are labeled with the correct CIPSO tags.

IIRC, the way I originally tested this was to write a simple app. I wonder if something has changed in the networking code which means we don't need to test for this now.

Quoted 3 lines

On the outbound side, yes, we only NetLabel sockets which are PF_INET but I didn't think I could set an IPv4 option on a PF_INET6 socket can I? It just sounds wrong ...

If it's carrying IPv4 traffic, it may make sense in some cases.

- James

Signature · 2 lines
James Morris
<[email protected]>
author
#5 lore raw

Re: [PATCH 1/6] NetLabel: correctly initialize the NetLabel fields

Quoted 36 lines · James Morris
Quoted 10 lines · Paul Moore
Quoted 8 lines · James Morris

security/selinux/ss/services.c netlbl_socket_setsid_return: · line 2438

Quoted 4 lines · On Tue, 29 Aug 2006, [email protected] wrote:
security/selinux/ss/services.c +4 -0
+void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
+				     int family)
+{
+        if (family == PF_INET)

No tab.

Quoted 2 lines

I see you already ack'd this patch, should I resubmit with the tab correction or just leave it alone?

Probably easiest to fix it as it's applied.

Quoted 7 lines

Example case:

1. Configure NetLabel so that packets are labeled with CIPSO
2. Ensure SSH is listening for both IPv4 and IPv6 connections and restart the daemon
3. Connect to the SSH daemon using IPv4

Quoted 8 lines

I haven't looked at the sshd code enough in detail to see what it is doing exactly but simply running 'netstat -nl' shows that sshd is listening for connections with an IPv6 socket (at least it is listening on port ':::22'). Once the connection is established the daemon continues to use an IPv6 socket, '::ffff:127.0.0.1:22', whereas the client uses a traditional IPv4 socket. Sniffing the connection indicates that both directions of network traffic are labeled with the correct CIPSO tags.

IIRC, the way I originally tested this was to write a simple app. I wonder if something has changed in the networking code which means we don't need to test for this now.

Quoted 6 lines
Quoted 3 lines

On the outbound side, yes, we only NetLabel sockets which are PF_INET but I didn't think I could set an IPv4 option on a PF_INET6 socket can I? It just sounds wrong ...

If it's carrying IPv4 traffic, it may make sense in some cases.

My concern was if the stack would honor the inet_sock->opt field and after talking to a coworker here it sounds like it would do the right thing. I'll work on a patch to label PF_INET6 sockets as well, but like you said earlier, I don't think it should hold up this patchset.

Signature · 7 lines
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.
Acked-by on v1 1/6
#6 lore raw

Re: [PATCH 1/6] NetLabel: correctly initialize the NetLabel fields

In reply to [email protected]
Quoted 4 lines · On Tue, 29 Aug 2006, [email protected] wrote:

Fix a problem where the NetLabel specific fields of the sk_security_struct structure were not being initialized early enough in some cases.

Signed-off-by Paul Moore <[email protected]>

Regardless of the mapped ipv6 socket issue, I think these should be applied as fixes in their own right. The mapped ipv6 socket stuff can be done separately if required.

Acked-by James Morris <[email protected]>
Signature · 2 lines
James Morris
<[email protected]>
author
#7 lore raw

PATCH 2/6 NetLabel: remove unused function prototypes

In reply to [email protected]

Removed some older function prototypes for functions that no longer exist.

Signed-off-by Paul Moore <[email protected]>
---
 include/net/cipso_ipv4.h |    6 ------
 1 file changed, 6 deletions(-)
include/net/cipso_ipv4.h +0 -6
Index: linux-2.6.17.i686/include/net/cipso_ipv4.h
===================================================================
@@ -200,15 +200,9 @@ static inline int cipso_v4_cache_add(con
 
 #ifdef CONFIG_NETLABEL
 void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
-int cipso_v4_socket_setopt(struct socket *sock,
-			   unsigned char *opt,
-			   u32 opt_len);
 int cipso_v4_socket_setattr(const struct socket *sock,
 			    const struct cipso_v4_doi *doi_def,
 			    const struct netlbl_lsm_secattr *secattr);
-int cipso_v4_socket_getopt(const struct socket *sock,
-			   unsigned char **opt,
-			   u32 *opt_len);
 int cipso_v4_socket_getattr(const struct socket *sock,
 			    struct netlbl_lsm_secattr *secattr);
 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#9 lore raw

PATCH 3/6 NetLabel: comment corrections

In reply to [email protected]

Fix some incorrect comments.

Signed-off-by Paul Moore <[email protected]>
---
 security/selinux/ss/services.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)
security/selinux/ss/services.c +1 -1
Index: net-2.6.19/security/selinux/ss/services.c
===================================================================
@@ -2617,7 +2617,7 @@ int selinux_netlbl_sock_rcv_skb(struct s
 }
 
 /**
- * selinux_netlbl_socket_peersid - Return the peer SID of a connected socket
+ * selinux_netlbl_socket_getpeersec_stream - Return the connected peer's SID
  * @sock: the socket
  *
  * Description:

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#11 lore raw

PATCH 4/6 NetLabel: cleanup ebitmap_import()

In reply to [email protected]

Rewrite ebitmap_import() so it is a bit cleaner and easier to read.

Signed-off-by Paul Moore <[email protected]>
---
 security/selinux/ss/ebitmap.c |   36 ++++++++++++++++--------------------
 1 files changed, 16 insertions(+), 20 deletions(-)
security/selinux/ss/ebitmap.c +16 -20
Index: net-2.6.19/security/selinux/ss/ebitmap.c
===================================================================
@@ -145,29 +145,28 @@ int ebitmap_import(const unsigned char *
 		   struct ebitmap *dst)
 {
 	size_t src_off = 0;
+	size_t node_limit;
 	struct ebitmap_node *node_new;
 	struct ebitmap_node *node_last = NULL;
-	size_t iter;
-	size_t iter_bit;
-	size_t iter_limit;
+	u32 i_byte;
+	u32 i_bit;
 	unsigned char src_byte;
 
-	do {
-		iter_limit = src_len - src_off;
-		if (iter_limit >= sizeof(MAPTYPE)) {
+	while (src_off < src_len) {
+		if (src_len - src_off >= sizeof(MAPTYPE)) {
 			if (*(MAPTYPE *)&src[src_off] == 0) {
 				src_off += sizeof(MAPTYPE);
 				continue;
 			}
-			iter_limit = sizeof(MAPTYPE);
+			node_limit = sizeof(MAPTYPE);
 		} else {
-			iter = src_off;
-			src_byte = 0;
-			do {
-				src_byte |= src[iter++];
-			} while (iter < src_len && src_byte == 0);
+			for (src_byte = 0, i_byte = src_off;
+			     i_byte < src_len && src_byte == 0;
+			     i_byte++)
+				src_byte |= src[i_byte];
 			if (src_byte == 0)
 				break;
+			node_limit = src_len - src_off;
 		}
 
 		node_new = kzalloc(sizeof(*node_new), GFP_ATOMIC);

@@ -176,24 +175,21 @@ int ebitmap_import(const unsigned char *
 			return -ENOMEM;
 		}
 		node_new->startbit = src_off * 8;
-		iter = 0;
-		do {
+		for (i_byte = 0; i_byte < node_limit; i_byte++) {
 			src_byte = src[src_off++];
-			iter_bit = iter++ * 8;
-			while (src_byte != 0) {
+			for (i_bit = i_byte * 8; src_byte != 0; i_bit++) {
 				if (src_byte & 0x80)
-					node_new->map |= MAPBIT << iter_bit;
-				iter_bit++;
+					node_new->map |= MAPBIT << i_bit;
 				src_byte <<= 1;
 			}
-		} while (iter < iter_limit);
+		}
 
 		if (node_last != NULL)
 			node_last->next = node_new;
 		else
 			dst->node = node_new;
 		node_last = node_new;
-	} while (src_off < src_len);
+	}
 
 	if (likely(node_last != NULL))
 		dst->highbit = node_last->startbit + MAPSIZE;

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#13 lore raw

PATCH 5/6 NetLabel: uninline selinux_netlbl_inode_permission()

In reply to [email protected]

Uninline the selinux_netlbl_inode_permission() at the request of Andrew Morton.

Signed-off-by Paul Moore <[email protected]>
---
 security/selinux/include/selinux_netlabel.h |   35 ----------------------------
 security/selinux/ss/services.c              |   33 +++++++++++++++++++-------
 2 files changed, 25 insertions(+), 43 deletions(-)
security/selinux/include/selinux_netlabel.h +1 -34
Index: net-2.6.19/security/selinux/include/selinux_netlabel.h
===================================================================
@@ -43,40 +43,7 @@ void selinux_netlbl_sk_security_init(str
 				     int family);
 void selinux_netlbl_sk_clone_security(struct sk_security_struct *ssec,
 				      struct sk_security_struct *newssec);
-
-int __selinux_netlbl_inode_permission(struct inode *inode, int mask);
-/**
- * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
- * @inode: the file descriptor's inode
- * @mask: the permission mask
- *
- * Description:
- * Looks at a file's inode and if it is marked as a socket protected by
- * NetLabel then verify that the socket has been labeled, if not try to label
- * the socket now with the inode's SID.  Returns zero on success, negative
- * values on failure.
- *
- */
-static inline int selinux_netlbl_inode_permission(struct inode *inode,
-						  int mask)
-{
-	int rc = 0;
-	struct inode_security_struct *isec;
-	struct sk_security_struct *sksec;
-
-	if (!S_ISSOCK(inode->i_mode))
-		return 0;
-
-	isec = inode->i_security;
-	sksec = SOCKET_I(inode)->sk->sk_security;
-	down(&isec->sem);
-	if (unlikely(sksec->nlbl_state == NLBL_REQUIRE &&
-		     (mask & (MAY_WRITE | MAY_APPEND))))
-		rc = __selinux_netlbl_inode_permission(inode, mask);
-	up(&isec->sem);
-
-	return rc;
-}
+int selinux_netlbl_inode_permission(struct inode *inode, int mask);
 #else
 static inline void selinux_netlbl_cache_invalidate(void)
 {
security/selinux/ss/services.c +24 -9
Index: net-2.6.19/security/selinux/ss/services.c
===================================================================
@@ -2544,24 +2544,39 @@ u32 selinux_netlbl_inet_conn_request(str
 }
 
 /**
- * __selinux_netlbl_inode_permission - Label a socket using NetLabel
+ * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
  * @inode: the file descriptor's inode
  * @mask: the permission mask
  *
  * Description:
- * Try to label a socket with the inode's SID using NetLabel.  Returns zero on
- * success, negative values on failure.
+ * Looks at a file's inode and if it is marked as a socket protected by
+ * NetLabel then verify that the socket has been labeled, if not try to label
+ * the socket now with the inode's SID.  Returns zero on success, negative
+ * values on failure.
  *
  */
-int __selinux_netlbl_inode_permission(struct inode *inode, int mask)
+int selinux_netlbl_inode_permission(struct inode *inode, int mask)
 {
 	int rc;
-	struct socket *sock = SOCKET_I(inode);
-	struct sk_security_struct *sksec = sock->sk->sk_security;
+	struct inode_security_struct *isec;
+	struct sk_security_struct *sksec;
+	struct socket *sock;
+
+	if (!S_ISSOCK(inode->i_mode))
+		return 0;
 
-	lock_sock(sock->sk);
-	rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
-	release_sock(sock->sk);
+	sock = SOCKET_I(inode);
+	isec = inode->i_security;
+	sksec = sock->sk->sk_security;
+	down(&isec->sem);
+	if (unlikely(sksec->nlbl_state == NLBL_REQUIRE &&
+		     (mask & (MAY_WRITE | MAY_APPEND)))) {
+		lock_sock(sock->sk);
+		rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
+		release_sock(sock->sk);
+	} else
+		rc = 0;
+	up(&isec->sem);
 
 	return rc;
 }

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#15 lore raw

PATCH 6/6 NetLabel: add some missing #includes to various header files

In reply to [email protected]

Add some missing include files to the NetLabel related header files.

Signed-off-by Paul Moore <[email protected]>
---
 include/net/cipso_ipv4.h                    |    2 ++
 include/net/netlabel.h                      |    1 +
 net/netlabel/netlabel_domainhash.h          |    4 ++++
 net/netlabel/netlabel_user.h                |    5 +++--
 security/selinux/include/selinux_netlabel.h |    9 +++++++++
 5 files changed, 19 insertions(+), 2 deletions(-)
include/net/cipso_ipv4.h +2 -0
Index: net-2.6.19/include/net/cipso_ipv4.h
===================================================================
@@ -37,6 +37,8 @@
 #include <linux/types.h>
 #include <linux/rcupdate.h>
 #include <linux/list.h>
+#include <linux/net.h>
+#include <linux/skbuff.h>
 #include <net/netlabel.h>
 
 /* known doi values */
include/net/netlabel.h +1 -0
Index: net-2.6.19/include/net/netlabel.h
===================================================================
@@ -31,6 +31,7 @@
 #define _NETLABEL_H
 
 #include <linux/types.h>
+#include <linux/net.h>
 #include <linux/skbuff.h>
 #include <net/netlink.h>
net/netlabel/netlabel_domainhash.h +4 -0
Index: net-2.6.19/net/netlabel/netlabel_domainhash.h
===================================================================
@@ -32,6 +32,10 @@
 #ifndef _NETLABEL_DOMAINHASH_H
 #define _NETLABEL_DOMAINHASH_H
 
+#include <linux/types.h>
+#include <linux/rcupdate.h>
+#include <linux/list.h>
+
 /* Domain hash table size */
 /* XXX - currently this number is an uneducated guess */
 #define NETLBL_DOMHSH_BITSIZE       7
net/netlabel/netlabel_user.h +3 -2
Index: net-2.6.19/net/netlabel/netlabel_user.h
===================================================================
@@ -31,11 +31,12 @@
 #ifndef _NETLABEL_USER_H
 #define _NETLABEL_USER_H
 
+#include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/capability.h>
-#include <linux/genetlink.h>
-#include <net/netlabel.h>
+#include <net/netlink.h>
 #include <net/genetlink.h>
+#include <net/netlabel.h>
 
 /* NetLabel NETLINK helper functions */
security/selinux/include/selinux_netlabel.h +9 -0
Index: net-2.6.19/security/selinux/include/selinux_netlabel.h
===================================================================
@@ -27,6 +27,15 @@
 #ifndef _SELINUX_NETLABEL_H_
 #define _SELINUX_NETLABEL_H_
 
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/net.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+
+#include "avc.h"
+#include "objsec.h"
+
 #ifdef CONFIG_NETLABEL
 void selinux_netlbl_cache_invalidate(void);
 int selinux_netlbl_socket_post_create(struct socket *sock,

--
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

maintainer Applied
#17 lore raw
In reply to [email protected]

From: [email protected]
Date: Tue, 29 Aug 2006 10:42:51 -0400

Quoted 5 lines

This patchset contains a series of small patches to fix a bug and some general ugliness from the original author (that moron ...). All of the following patches are against David's net-2.6.19 tree.

Please consider these for 2.6.19, thanks.

Applied to net-2.6.19, thanks a lot Paul.

Does the bug fix in that first patch fix the ssh problem?

author
#18 lore raw
Quoted 11 lines · David Miller

From: [email protected]
Date: Tue, 29 Aug 2006 10:42:51 -0400

Quoted 5 lines

This patchset contains a series of small patches to fix a bug and some general ugliness from the original author (that moron ...). All of the following patches are against David's net-2.6.19 tree.

Please consider these for 2.6.19, thanks.

Applied to net-2.6.19, thanks a lot Paul.

No problem.

Quoted 1 line

Does the bug fix in that first patch fix the ssh problem?

As far as the kernel is concerned, yes. There was a problem in the kernel of the sk_security_struct->sclass variable not being initialized correctly which the posted patch fixes as well as a problem with the ssh daemon rejecting all connections with IP options. Looking at the ssh code it appears that they wanted to reject source routed connections but they were a bit heavy handed and simply rejected connections if any options were present.

There is more information in this Fedora Bugzilla:

* https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=202856

Signature · 7 lines
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.