Skip to content

Labeled networking patches for 2.6.28

Paul Moore netdev selinux 7 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v7 Latest17 patches 1 replyIn review
  2. v6 RFC16 patches 26 repliesSuperseded
  3. v5 RFC14 patches 1 replySuperseded
Earlier versions · 4
VersionPostedPatchesRepliesStatus
v4 RFC14 patches11 repliesSuperseded
v3 RFC13 patches1 replySuperseded
v2 RFC7 patches1 replySuperseded
v1 RFC6 patches6 repliesSuperseded

Patches in v7 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/17netlabel: Fix some sparse warningsnet/netlabel/netlabel_cipso_v4.c net/netlabel/netlabel_domainhash.c net/netlabel/netlabel_unlabeled.c+14 -141 reply
2/17selinux: Cleanup the NetLabel glue codesecurity/selinux/netlabel.c+10 -280 replies
3/17selinux: Correctly handle IPv4 packets on IPv6 sockets in all casessecurity/selinux/hooks.c+17 -50 replies
4/17netlabel: Remove unneeded in-kernel API functionsinclude/net/netlabel.h net/netlabel/netlabel_kapi.c+23 -740 replies
5/17selinux: Better local/forward check in selinux_ip_postroute()security/selinux/hooks.c+81 -450 replies
6/17selinux: Fix a problem in security_netlbl_sid_to_secattr()security/selinux/ss/services.c+8 -20 replies
7/17selinux: Fix missing calls to netlbl_skbuff_err()include/net/netlabel.h net/netlabel/netlabel_kapi.c security/selinux/hooks.c +2 more+50 -90 replies
8/17smack: Fix missing calls to netlbl_skbuff_err()security/smack/smack_lsm.c+4 -10 replies
9/17netlabel: Replace protocol/NetLabel linking with refrerence countsinclude/net/cipso_ipv4.h net/ipv4/cipso_ipv4.c net/netlabel/netlabel_cipso_v4.c +5 more+235 -2660 replies
10/17netlabel: Add a generic way to create ordered linked lists of network addrsnet/netlabel/Makefile net/netlabel/netlabel_addrlist.c net/netlabel/netlabel_addrlist.h +1 more+569 -2160 replies
11/17netlabel: Add network address selectors to the NetLabel/LSM domain mappinginclude/net/netlabel.h net/netlabel/netlabel_addrlist.c net/netlabel/netlabel_addrlist.h +6 more+816 -2240 replies
12/17netlabel: Add functionality to set the security attributes of a packetinclude/net/cipso_ipv4.h include/net/netlabel.h net/ipv4/cipso_ipv4.c +5 more+393 -420 replies
13/17selinux: Set socket NetLabel based on connection endpointinclude/net/cipso_ipv4.h include/net/netlabel.h net/ipv4/cipso_ipv4.c +5 more+311 -370 replies
14/17selinux: Cache NetLabel secattrs in the socket's security structsecurity/selinux/hooks.c security/selinux/include/netlabel.h security/selinux/include/objsec.h +1 more+91 -390 replies
15/17netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contextsinclude/net/netlabel.h security/selinux/ss/services.c+3 -20 replies
16/17cipso: Add support for native local labeling and fixup mapping namesinclude/net/cipso_ipv4.h net/ipv4/cipso_ipv4.c net/ipv4/ip_options.c +3 more+128 -360 replies
17/17netlabel: Add configuration support for local labelinginclude/net/netlabel.h net/netlabel/netlabel_cipso_v4.c net/netlabel/netlabel_cipso_v4.h +1 more+50 -30 replies

Reviews trailers per patch

16 of 17 patches have a Reviewed-by or Acked-by.

PatchJames MorrisCasey Schaufler
1/17R-b
2/17A-b
3/17A-b
4/17R-b
5/17A-b
6/17A-b
7/17A-b
8/17A-b
9/17R-b
10/17R-b
11/17R-b
12/17R-b
13/17R-b
14/17A-b
15/17A-b
16/17
17/17R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v7 thread

Cover letter [PATCH v7 00/17] Labeled networking patches for 2.6.28

You will notice the lack of a "RFC" prefix to this patchset, that is because this should be the last revision prior to the 2.6.28 merge window opening. The changes between v6 and v7 are very minor and mostly involve sparse fixes and the conversion of some "magic" numbers in net/ipv4/cipso_ipv4.c to constants defined in the CIPSO header file. I just updated both the lblnet-2.6_{testing,next} git trees so anyone interested should feel free to grab the latest bits from here:

* git://git.infradead.org/users/pcmoore/lblnet-2.6_testing

Thanks to everyone who has helped review and test these patches.

--
paul moore
linux @ hp

Read the cover letter in its thread