James Morris 1340258002 [PATCH] SELinux - fix SCTP socket bug and general IP protocol handling ... The following patch updates the way SELinux classifies and handles IP based protocols. Currently, IP sockets are classified by SELinux as being either TCP, UDP or 'Raw', the latter being a default for IP socket that is not TCP or UDP. The classification code is out of date and uses only the socket type parameter to socket(2) to determine the class of IP socket. So, any socket created with SOCK_STREAM will be classified by SELinux as TCP, and SOCK_DGRAM as UDP. Also, other socket types such as SOCK_SEQPACKET and SOCK_DCCP are currently ignored by SELinux, which classifies them as generic sockets, which means they don't even get basic IP level checking. This patch changes the SELinux IP socket classification logic, so that only an IPPROTO_IP protocol value passed to socket(2) classify the socket as TCP or UDP. The patch also drops the check for SOCK_RAW and converts it into a default, so that socket types like SOCK_DCCP and SOCK_SEQPACKET are classified as SECCLASS_RAWIP_SOCKET (instead of generic sockets). Note that protocol-specific support for SCTP, DCCP etc. is not addressed here, we're just getting these protocols checked at the IP layer. This fixes a reported problem where SCTP sockets were being recognized as generic SELinux sockets yet still being passed in one case to an IP level check, which then fails for generic sockets. It will also fix bugs where any SOCK_STREAM socket is classified as TCP or any SOCK_DGRAM socket is classified as UDP. This patch also unifies the way IP sockets classes are determined in selinux_socket_bind(), so we use the already calculated value instead of trying to recalculate it. Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		2005-09-30 11:36:04 -07:00
..
keys	[PATCH] Keys: Add possessor permissions to keys [try #3]	2005-09-28 09:10:47 -07:00
selinux	[PATCH] SELinux - fix SCTP socket bug and general IP protocol handling	2005-09-30 11:36:04 -07:00
capability.c
commoncap.c	[PATCH] setuid core dump	2005-06-23 09:45:26 -07:00
dummy.c	[PATCH] remove the inode_post_link and inode_post_rename LSM hooks	2005-09-09 13:57:28 -07:00
inode.c	[PATCH] add securityfs for all LSMs to use	2005-07-08 18:48:41 -07:00
Kconfig	[PATCH] SECURITY must depend on SYSFS	2005-08-22 14:10:22 -07:00
Makefile	[PATCH] add securityfs for all LSMs to use	2005-07-08 18:48:41 -07:00
root_plug.c
seclvl.c	[PATCH] seclvl: use securityfs (fix)	2005-09-17 11:50:01 -07:00
security.c