[SELINUX]: increment flow cache genid

Currently, old flow cache entries remain valid even after a reload of SELinux policy. This patch increments the flow cache generation id on policy (re)loads so that flow cache entries are revalidated as needed. Thanks to Herbet Xu for pointing this out. See: http://marc.theaimsgroup.com/?l=linux-netdev&m=116841378704536&w=2 There's also a general issue as well as a solution proposed by David Miller for when flow_cache_genid wraps. I might be submitting a separate patch for that later. I request that this be applied to 2.6.20 since it's a security relevant fix. Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com> Signed-off-by: David S. Miller <davem@davemloft.net>

[SELINUX]: increment flow cache genid
Currently, old flow cache entries remain valid even after a reload of SELinux policy. This patch increments the flow cache generation id on policy (re)loads so that flow cache entries are revalidated as needed. Thanks to Herbet Xu for pointing this out. See: http://marc.theaimsgroup.com/?l=linux-netdev&m=116841378704536&w=2 There's also a general issue as well as a solution proposed by David Miller for when flow_cache_genid wraps. I might be submitting a separate patch for that later. I request that this be applied to 2.6.20 since it's a security relevant fix. Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Venkat Yekkirala · David S. Miller
1 parent d88ae4cc97
Showing 1 changed file with 3 additions and 0 deletions Side-by-side Diff
security/selinux/ss/services.c
@@ -1299,6 +1299,7 @@
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
 		selinux_netlbl_cache_invalidate();
+		atomic_inc(&flow_cache_genid);
 		return 0;
 	}
  
@@ -1354,6 +1355,7 @@
 	avc_ss_reset(seqno);
 	selnl_notify_policyload(seqno);
 	selinux_netlbl_cache_invalidate();
+	atomic_inc(&flow_cache_genid);
  
 	return 0;
  
@@ -1853,6 +1855,7 @@
 	if (!rc) {
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
+		atomic_inc(&flow_cache_genid);
 	}
 	return rc;
 }
...	...	@@ -1299,6 +1299,7 @@
1299	1299	avc_ss_reset(seqno);
1300	1300	selnl_notify_policyload(seqno);
1301	1301	selinux_netlbl_cache_invalidate();
	1302	+ atomic_inc(&flow_cache_genid);
1302	1303	return 0;
1303	1304	}
1304	1305
...	...	@@ -1354,6 +1355,7 @@
1354	1355	avc_ss_reset(seqno);
1355	1356	selnl_notify_policyload(seqno);
1356	1357	selinux_netlbl_cache_invalidate();
	1358	+ atomic_inc(&flow_cache_genid);
1357	1359
1358	1360	return 0;
1359	1361
...	...	@@ -1853,6 +1855,7 @@
1853	1855	if (!rc) {
1854	1856	avc_ss_reset(seqno);
1855	1857	selnl_notify_policyload(seqno);
	1858	+ atomic_inc(&flow_cache_genid);
1856	1859	}
1857	1860	return rc;
1858	1861	}