xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[MLSXFRM]: Default labeling of socket specific IPSec policies

Browse Source 
This defaults the label of socket-specific IPSec policies to be the
same as the socket they are set on.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Venkat Yekkirala
2006-07-24 23:32:20 -07:00
committed by David S. Miller
parent beb8d13bed
commit cb969f072b
8 changed files with 66 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
security/selinux/xfrm.c
View File

@@ -208,10 +208,8 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
BUG_ON(uctx && pol);
if (pol)
goto from_policy;
BUG_ON(!uctx);
if (!uctx)
goto not_from_user;
if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX)
return -EINVAL;
@@ -251,11 +249,14 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
return rc;
from_policy:
BUG_ON(!pol);
rc = security_sid_mls_copy(pol->ctx_sid, sid, &ctx_sid);
if (rc)
goto out;
not_from_user:
if (pol) {
rc = security_sid_mls_copy(pol->ctx_sid, sid, &ctx_sid);
if (rc)
goto out;
}
else
ctx_sid = sid;
rc = security_sid_to_context(ctx_sid, &ctx_str, &str_len);
if (rc)
@@ -293,13 +294,23 @@ out2:
* LSM hook implementation that allocs and transfers uctx spec to
* xfrm_policy.
*/
int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *uctx)
int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
struct xfrm_user_sec_ctx *uctx, struct sock *sk)
{
int err;
u32 sid;
BUG_ON(!xp);
BUG_ON(uctx && sk);
err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, NULL, 0);
if (sk) {
struct sk_security_struct *ssec = sk->sk_security;
sid = ssec->sid;
}
else
sid = SECSID_NULL;
err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, NULL, sid);
return err;
}