Skip to contentSkip to conversation

selinux: recognize netlink messages for 'ip addrlabel'

PATCH In review Michal Schmidt 3 participants 3 messages Nov 5, 2008

Subsystems (3)
Networking Network drivers SELinux security module
lore
Share & tools
lore

Michal Schmidt

author
#0 lore raw

PATCH 1/1 selinux: recognize netlink messages for 'ip addrlabel'

In enforcing mode '/sbin/ip addrlabel' results in a SELinux error:
type=SELINUX_ERR msg=audit(1225698822.073:42): SELinux: unrecognized netlink message type=74 for sclass=43

The problem is missing RTM_*ADDRLABEL entries in SELinux's netlink message types table.

Reported in https://bugzilla.redhat.com/show_bug.cgi?id=469423

Signed-off-by Michal Schmidt <[email protected]>
---
 security/selinux/nlmsgtab.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
security/selinux/nlmsgtab.c +3 -0
index ff59c0c..4ed7bab 100644
@@ -63,6 +63,9 @@ static struct nlmsg_perm nlmsg_route_perms[] =
 	{ RTM_GETANYCAST,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 	{ RTM_GETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 	{ RTM_SETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_NEWADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_DELADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_GETADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 };
 
 static struct nlmsg_perm nlmsg_firewall_perms[] =
Signature · 1 line
1.6.0.3
Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · Michal Schmidt

In enforcing mode '/sbin/ip addrlabel' results in a SELinux error:
type=SELINUX_ERR msg=audit(1225698822.073:42): SELinux: unrecognized netlink message type=74 for sclass=43

The problem is missing RTM_*ADDRLABEL entries in SELinux's netlink message types table.

Reported in https://bugzilla.redhat.com/show_bug.cgi?id=469423

Signed-off-by Michal Schmidt <[email protected]>
Acked-by Stephen Smalley <[email protected]>
Quoted 18 lines
---
 security/selinux/nlmsgtab.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
security/selinux/nlmsgtab.c +3 -0
index ff59c0c..4ed7bab 100644
@@ -63,6 +63,9 @@ static struct nlmsg_perm nlmsg_route_perms[] =
 	{ RTM_GETANYCAST,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 	{ RTM_GETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 	{ RTM_SETNEIGHTBL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_NEWADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_DELADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+	{ RTM_GETADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 };
 
 static struct nlmsg_perm nlmsg_firewall_perms[] =
Signature · 2 lines
Stephen Smalley
National Security Agency
#2 lore raw
In reply to Michal Schmidt
Quoted 7 lines · Michal Schmidt

In enforcing mode '/sbin/ip addrlabel' results in a SELinux error:
type=SELINUX_ERR msg=audit(1225698822.073:42): SELinux: unrecognized netlink message type=74 for sclass=43

The problem is missing RTM_*ADDRLABEL entries in SELinux's netlink message types table.

Quoted 6 lines

Reported in https://bugzilla.redhat.com/show_bug.cgi?id=469423

Signed-off-by Michal Schmidt <[email protected]>
---
 security/selinux/nlmsgtab.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

Applied to

git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

Signature · 2 lines
James Morris
<[email protected]>