selinux: Set socket NetLabel based on connection endpoint
Previous work enabled the use of address based NetLabel selectors, which while highly useful, brought the potential for additional per-packet overhead when used. This patch attempts to solve that by applying NetLabel socket labels when sockets are connect()'d. This should alleviate the per-packet NetLabel labeling for all connected sockets (yes, it even works for connected DGRAM sockets). Signed-off-by: Paul Moore <paul.moore@hp.com> Reviewed-by: James Morris <jmorris@namei.org>
This commit is contained in:
@@ -118,6 +118,7 @@ struct sk_security_struct {
|
||||
NLBL_REQUIRE,
|
||||
NLBL_LABELED,
|
||||
NLBL_REQSKB,
|
||||
NLBL_CONNLABELED,
|
||||
} nlbl_state;
|
||||
#endif
|
||||
};
|
||||
|
Reference in New Issue
Block a user