Fix for IPsec leakage with SELinux enabled - V.03
Subsystems (3)
cover Fix for IPsec leakage with SELinux enabled - V.03
This version takes into account David Miller's comments regarding treatment of security layer errors in the case of socket policies. Specifically, these errors will be treated like how these kind of errors are treated for the main/sub policies, which is to return a full lookup failure.
include/linux/security.h | 24 ++----- include/net/flow.h | 2 include/net/xfrm.h | 3 net/core/flow.c | 42 ++++++++---- net/ipv4/xfrm4_policy.c | 2 net/ipv6/xfrm6_policy.c | 2 net/key/af_key.c | 5 - net/xfrm/xfrm_policy.c | 101 ++++++++++++++++++++++-------- net/xfrm/xfrm_user.c | 9 -- security/dummy.c | 3 security/selinux/include/xfrm.h | 3 security/selinux/xfrm.c | 53 ++++++++++++--- 12 files changed, 162 insertions(+), 87 deletions(-)
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
David Miller
maintainerFrom: Venkat Yekkirala <[email protected]>
Date: Thu, 05 Oct 2006 15:42:13 -0500
Quoted 6 lines
This version takes into account David Miller's comments regarding treatment of security layer errors in the case of socket policies. Specifically, these errors will be treated like how these kind of errors are treated for the main/sub policies, which is to return a full lookup failure.
I only have patches "1" and "3" in my inbox, did you forget to send the second one out or are they simply misnumbered?
These patches look ok to me. I've tested them and applied them to the git tree [1].
Stephen, please let me know if you see any problems.
Signature · 6 lines
James Morris <[email protected]> [1] Git - git://git.infradead.org/~jmorris/selinux-2.6.git Web - http://git.infradead.org/?p=users/jmorris/selinux-2.6.git;a=summary
Quoted 6 lines · Venkat Yekkirala
This version takes into account David Miller's comments regarding treatment of security layer errors in the case of socket policies. Specifically, these errors will be treated like how these kind of errors are treated for the main/sub policies, which is to return a full lookup failure.
I applied all three patches and rerun my acrypto tests, which do not show any unencrypted packets anymore, so I ack this changes since they fix the problem.
Thanks.
Signature · 1 line
Evgeniy Polyakov