On Tue, 2006-06-13 at 17:09 -0500, Venkat Yekkirala wrote:
> This patch adds a security sid to the flow key itself making the flow cache
> lookps based on the sid seemless.
>
> This patch also adds support for handling security for sock. Security at the
> sock level is needed to enforce the SELinux security policy for security
> associations
> even when a sock is orphaned (such as in the TCP LAST_ACK state).
>
> Signed-off-by: Venkat Yekkirala <[EMAIL PROTECTED]>
>
> ---
> include/net/flow.h | 5 +++--
> net/core/flow.c | 7 ++-----
> net/core/sock.c | 4 ++++
> 3 files changed, 9 insertions(+), 7 deletions(-)
>
> --- linux-2.6.16.vanilla/net/core/sock.c 2006-06-12 17:49:39.000000000
> -0500
> +++ linux-2.6.16/net/core/sock.c 2006-06-13 08:40:48.000000000 -0500
> @@ -841,7 +841,11 @@ struct sock *sk_clone(const struct sock
> if (newsk != NULL) {
> struct sk_filter *filter;
>
> + /* Save/restore the LSM security pointer around the copy */
> + void *sptr = newsk->sk_security;
> memcpy(newsk, sk, sk->sk_prot->obj_size);
> + newsk->sk_security = sptr;
> + security_sk_clone(sk, newsk);
>
> /* SANITY */
> sk_node_init(&newsk->sk_node);
At this point in the patch series, it won't compile, since you haven't
yet defined security_sk_clone(). Also, the entire sequence above likely
belongs in a single static inline.
--
Stephen Smalley
National Security Agency
--
redhat-lspp mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/redhat-lspp
