secid reconciliation-v04: Repost patchset with updates
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest9 patches 5 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/9 | secid reconciliation-v04security/ security/ | +4 | 0 replies | |
| 2/9 | secid reconciliation-v04: Add LSM hooksinclude/ security/ | +53 | 1 reply | |
| 3/9 | secid reconciliation-v04: Invoke LSM hook for inbound trafficinclude/ | +22 | 0 replies | |
| 4/9 | secid reconciliation-v04: Invoke LSM hook for outbound trafficnet/ net/ | +100 | 0 replies | |
| 5/9 | secid reconciliation-v04: Label locally generated IPv6 trafficinclude/ net/ net/ | +36 | 0 replies | |
| 6/9 | secid reconciliation-v04: Label locally generated IPv4 trafficinclude/ include/ net/ +3 more | +65 | 0 replies | |
| 7/9 | secid reconciliation-v04: Enforcement for SELinuxsecurity/ security/ security/ | +150 | 4 replies | |
| 8/9 | secid reconciliation-v04: Use secmark when classifying flow using skbinclude/ include/ | +20 | 0 replies | |
| 9/9 | secid reconciliation-v04: Track peersecid at connection establishmentinclude/ net/ security/ +1 more | +31 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/9] secid reconciliation-v04: Repost patchset with updates
This patchset is relative to davem's net-2.6.git
The following are the changes included in this patchset since the previous post:
- Create IPSec SAs to be acquired with the creating sock's context as opposed to that of the matching SPD rule, resulting in a simpler SPD as well as policy.
- Set peer_sid on tcp sockets to the reconciled secmark so trusted applications can retrieve and service the data at the appropriate context. Also return secmark when security is queried for a UDP packet.
- Fix minor things from James Morris' review.
Paul, please spin a new patch to bring NetLabel into the reconciliation path as well as to address any NetLabel changes needed in regard to the above.
Please consider for inclusion in 2.6.19.
include/linux/security.h | 51 ++++- include/linux/skbuff.h | 49 +++++ include/net/ip.h | 31 +++ include/net/request_sock.h | 18 ++ include/net/xfrm.h | 45 ++--- net/dccp/ipv4.c | 5 net/ipv4/icmp.c | 4 net/ipv4/ip_output.c | 6 net/ipv4/tcp_ipv4.c | 1 net/ipv6/ip6_output.c | 5 net/ipv6/netfilter/ip6t_REJECT.c | 2 net/netfilter/xt_CONNSECMARK.c | 72 ++++++-- net/netfilter/xt_SECMARK.c | 45 ++++- security/dummy.c | 13 + security/selinux/hooks.c | 148 +++++++++++++---- security/selinux/include/av_perm_to_string.h | 2 security/selinux/include/av_permissions.h | 2 security/selinux/include/xfrm.h | 11 - security/selinux/xfrm.c | 66 +++---- 19 files changed, 450 insertions(+), 126 deletions(-)
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.