Eric Lee / smarc-fsl-linux-kernel

21 Oct, 2010

2 commits

  • 2606fd1fa   secmark: make secmark object handling generic ... Browse Code »

    Right now secmark has lots of direct selinux calls. Use all LSM calls and
    remove all SELinux specific knowledge. The only SELinux specific knowledge
    we leave is the mode. The only point is to make sure that other LSMs at
    least test this generic code before they assume it works. (They may also
    have to make changes if they do not represent labels as strings)

    Signed-off-by: Eric Paris
    Acked-by: Paul Moore
    Acked-by: Patrick McHardy
    Signed-off-by: James Morris

    Eric Paris
     
  • 15714f7b5   secmark: do not return early if there was no error ... Browse Code »

    Commit 4a5a5c73 attempted to pass decent error messages back to userspace for
    netfilter errors. In xt_SECMARK.c however the patch screwed up and returned
    on 0 (aka no error) early and didn't finish setting up secmark. This results
    in a kernel BUG if you use SECMARK.

    Signed-off-by: Eric Paris
    Acked-by: Paul Moore
    Signed-off-by: James Morris

    Eric Paris
     

12 May, 2010

1 commit

25 Mar, 2010

3 commits

18 Mar, 2010

1 commit

08 Oct, 2008

5 commits

10 Jun, 2008

1 commit

  • 560ee653b   netfilter: ip_tables: add iptables security table for mandatory access control rules ... Browse Code »

    The following patch implements a new "security" table for iptables, so
    that MAC (SELinux etc.) networking rules can be managed separately to
    standard DAC rules.

    This is to help with distro integration of the new secmark-based
    network controls, per various previous discussions.

    The need for a separate table arises from the fact that existing tools
    and usage of iptables will likely clash with centralized MAC policy
    management.

    The SECMARK and CONNSECMARK targets will still be valid in the mangle
    table to prevent breakage of existing users.

    Signed-off-by: James Morris
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    James Morris
     

14 Feb, 2008

1 commit

30 Jan, 2008

1 commit

  • d621d35e5   SELinux: Enable dynamic enable/disable of the network access checks ... Browse Code »

    This patch introduces a mechanism for checking when labeled IPsec or SECMARK
    are in use by keeping introducing a configuration reference counter for each
    subsystem. In the case of labeled IPsec, whenever a labeled SA or SPD entry
    is created the labeled IPsec/XFRM reference count is increased and when the
    entry is removed it is decreased. In the case of SECMARK, when a SECMARK
    target is created the reference count is increased and later decreased when the
    target is removed. These reference counters allow SELinux to quickly determine
    if either of these subsystems are enabled.

    NetLabel already has a similar mechanism which provides the netlbl_enabled()
    function.

    This patch also renames the selinux_relabel_packet_permission() function to
    selinux_secmark_relabel_packet_permission() as the original name and
    description were misleading in that they referenced a single packet label which
    is not the case.

    Signed-off-by: Paul Moore
    Signed-off-by: James Morris

    Paul Moore
     

29 Jan, 2008

2 commits

16 Oct, 2007

1 commit

11 Jul, 2007

2 commits

13 Feb, 2007

1 commit

09 Feb, 2007

1 commit

23 Sep, 2006

4 commits

03 Aug, 2006

1 commit

  • a280b8998   [SECURITY] secmark: nul-terminate secdata ... Browse Code »

    The patch below fixes a problem in the iptables SECMARK target, where
    the user-supplied 'selctx' string may not be nul-terminated.

    From initial analysis, it seems that the strlen() called from
    selinux_string_to_sid() could run until it arbitrarily finds a zero,
    and possibly cause a kernel oops before then.

    The impact of this appears limited because the operation requires
    CAP_NET_ADMIN, which is essentially always root. Also, the module is
    not yet in wide use.

    Signed-off-by: James Morris
    Signed-off-by: Stephen Smalley
    Signed-off-by: David S. Miller

    James Morris
     

18 Jun, 2006

1 commit

  • 5e6874cdb   [SECMARK]: Add xtables SECMARK target ... Browse Code »

    Add a SECMARK target to xtables, allowing the admin to apply security
    marks to packets via both iptables and ip6tables.

    The target currently handles SELinux security marking, but can be
    extended for other purposes as needed.

    Signed-off-by: James Morris
    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    James Morris