Fix for the unlabeled NetLabel access check patch
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest2 patches 5 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabelsecurity/ security/ | +24 | 0 replies | |
| 2/2 | NetLabel: enable dynamic activation/deactivation of NetLabel/SELinux enforcementinclude/ net/ net/ +3 more | +120 | 5 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/2] Fix for the unlabeled NetLabel access check patch
This patchset consists of two patches, both based against Linus' tree of about an hour ago. the first is largely a resend of a previous patch which was accepted into 2.6.23, the second is a fix for the first patch because it broke
stuff :/ More information about the breakage can be found in the link in the
patch description.
The first patch is the patch which converted NetLabel to make use of the netmsg initial SID for MLS labeled packets so that the unlabeled initial SID could be used for truly unlabeled packets. Unfortunately, this turned out to cause problems on systems with older policy. The second patch in this series addresses this problem by providing a runtime enable/disable status flag for NetLabel which SELinux (and other LSMs for that matter) can use to decide if they should perform NetLabel label enforcement.
I've given this patchset a quick test and everything behaves as I would expect, that is to say the following happens:
1. When the system is booted NetLabel is disabled (no NetLabel config present)
- no NetLabel access checks for labeled or unlabeled packets
2. Once NetLabel is configured (netlabelctl cipsov4 add ...) NetLabel is enabled
- NetLabel access checks are performed for both labeled and unlabeled packets
3. If all of the NetLabel labeled protocol configurations are removed (netlabelctl cipsov4 del ...) then NetLabel is disabled again
- no NetLabel access checks for labeled or unlabeled packets
This should solve the problems seen in the early 2.6.23 git kernels.
Michal, if you're not sick of verifying things yet - could you test this patchset on your configuration and verify that you do not see any regressions?
Thank you all for your patience, and sorry for all the confusion.
Signature · 7 lines
paul moore linux security @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.