This patchset is relative to davem's net-2.6.git
The following are the changes included in this patchset since the previous post:
- Retain secmark (from the originating socket/flow) on loopback traffic;
this traffic is now flow controlled on the outbound only.
- When multiple iptables labeling rules are present (e.g.: both on PREROUTING
and INPUT)
INBOUND: The label in the last rule will prevail.
OUTBOUND: secmark (from the originating socket) is flow-controlled
against
the label on the first rule, and, if it passes, the label on the
first rule overrides the secmark (from the originating socket).
This secmark is flow controlled against labels on the subsequent
rules, each time, overridden by those labels.
- Forwarded packets: The FORWARD chain is treated as an outbound chain for flow
control purposes. e.g: label with PREROUTING and flow-control with FORWARD or
POSTROUTING.
- Simplification of the flow_out hook for SELinux: deleted the redundant
flow_out
check against the xfrm secid and the transition between the xfrm secid and the
netfilter secid.
- SELinux postroute_last hook: unfortunately, the secmark Vs. UNLABELED SID
check
will now be done for ALL traffic (I couldn't except traffic already processed
by (CONN)SECMARK outbound rules; a better understanding of iptabels resulted
in realizing that the SECSID_WILD thing attempted in the previous patchset
won't
work well).
Please consider for inclusion in 2.6.19.
PATCHES TO BE POSTED BY COB FRIDAY (tomorrow):
NOTE: These patches were originally planned/desired to be included in this set
but I didn't want to hold this critical patchset up for one more day since
it needs a good extensive review.
- Create IPSec SAs to be acquired with the creating sock's context as opposed
to that of the matching SPD rule, resulting in a simpler SPD as well as
policy.
- Set peer_sid on tcp sockets to the reconciled secmark so trusted applications
can retrieve and service the data at the appropriate context.
include/linux/security.h | 35 ++++
include/linux/skbuff.h | 29 +++
include/net/ip.h | 32 ++++
include/net/request_sock.h | 17 ++
include/net/xfrm.h | 45 ++---
net/dccp/ipv4.c | 5
net/ipv4/icmp.c | 4
net/ipv4/ip_output.c | 6
net/ipv4/tcp_ipv4.c | 1
net/ipv6/ip6_output.c | 5
net/ipv6/netfilter/ip6t_REJECT.c | 2
net/netfilter/xt_CONNSECMARK.c | 70 +++++++--
net/netfilter/xt_SECMARK.c | 33 ++++
security/dummy.c | 13 +
security/selinux/hooks.c | 129 +++++++++++++----
security/selinux/include/av_perm_to_string.h | 2
security/selinux/include/av_permissions.h | 2
security/selinux/include/xfrm.h | 5
security/selinux/ss/mls.c | 2
security/selinux/ss/services.c | 2
security/selinux/xfrm.c | 28 +++
21 files changed, 399 insertions(+), 68 deletions(-)
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
