Paul Moore c0828e5048 selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute() ...

Due to difficulty in arriving at the proper security label for
TCP SYN-ACK packets in selinux_ip_postroute(), we need to check packets
while/before they are undergoing XFRM transforms instead of waiting
until afterwards so that we can determine the correct security label.

Reported-by: Janak Desai <Janak.Desai@gtri.gatech.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>

2013-12-12 17:21:31 -05:00

..

include

selinux: look for IPsec labels on both inbound and outbound packets

2013-12-12 17:21:31 -05:00

ss

Merge git://git.infradead.org/users/eparis/selinux

2013-09-18 13:52:20 -04:00

.gitignore

SELinux: add .gitignore files for dynamic classes

2009-10-24 09:42:27 +08:00

avc.c

selinux: remove 'flags' parameter from avc_audit()

2013-10-04 14:13:25 -07:00

exports.c

selinux: sparse fix: include selinux.h in exports.c

2011-09-09 16:56:32 -07:00

hooks.c

selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()

2013-12-12 17:21:31 -05:00

Kconfig

selinux: Deprecate and schedule the removal of the the compat_net functionality

2008-12-31 12:54:11 -05:00

Makefile

selinux: change to new flag variable

2010-10-21 10:12:40 +11:00

netif.c

net: pass info struct via netdevice notifier

2013-05-28 13:11:01 -07:00

netlabel.c

selinux: correct locking in selinux_netlbl_socket_connect)

2013-09-26 17:00:46 -04:00

netlink.c

selinux: replace obsolete NLMSG_* with type safe nlmsg_*

2013-03-28 14:25:49 -04:00

netnode.c

selinux: fix problems in netnode when BUG() is compiled out

2013-07-25 13:03:27 -04:00

netport.c

SELinux: avc: remove the useless fields in avc_add_callback

2012-04-09 12:23:44 -04:00

nlmsgtab.c

bridge: update selinux perm table for RTM_NEWMDB and RTM_DELMDB

2012-12-15 17:14:38 -08:00

selinuxfs.c

Add SELinux policy capability for always checking packet and peer classes.

2013-07-25 13:03:38 -04:00

xfrm.c

selinux: look for IPsec labels on both inbound and outbound packets

2013-12-12 17:21:31 -05:00