1. 15 10月, 2008 6 次提交
  2. 14 10月, 2008 5 次提交
  3. 13 10月, 2008 4 次提交
  4. 12 10月, 2008 2 次提交
  5. 11 10月, 2008 19 次提交
  6. 10 10月, 2008 4 次提交
    • P
      netlabel: Add configuration support for local labeling · d91d4079
      Paul Moore 提交于
      Add the necessary NetLabel support for the new CIPSO mapping,
      CIPSO_V4_MAP_LOCAL, which allows full LSM label/context support.
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      Reviewed-by: NJames Morris <jmorris@namei.org>
      d91d4079
    • P
      cipso: Add support for native local labeling and fixup mapping names · 15c45f7b
      Paul Moore 提交于
      This patch accomplishes three minor tasks: add a new tag type for local
      labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
      replace some of the CIPSO "magic numbers" with constants from the header
      file.  The first change allows CIPSO to support full LSM labels/contexts,
      not just MLS attributes.  The second change brings the mapping names inline
      with what userspace is using, compatibility is preserved since we don't
      actually change the value.  The last change is to aid readability and help
      prevent mistakes.
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      15c45f7b
    • P
      selinux: Set socket NetLabel based on connection endpoint · 014ab19a
      Paul Moore 提交于
      Previous work enabled the use of address based NetLabel selectors, which while
      highly useful, brought the potential for additional per-packet overhead when
      used.  This patch attempts to solve that by applying NetLabel socket labels
      when sockets are connect()'d.  This should alleviate the per-packet NetLabel
      labeling for all connected sockets (yes, it even works for connected DGRAM
      sockets).
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      Reviewed-by: NJames Morris <jmorris@namei.org>
      014ab19a
    • P
      netlabel: Add functionality to set the security attributes of a packet · 948bf85c
      Paul Moore 提交于
      This patch builds upon the new NetLabel address selector functionality by
      providing the NetLabel KAPI and CIPSO engine support needed to enable the
      new packet-based labeling.  The only new addition to the NetLabel KAPI at
      this point is shown below:
      
       * int netlbl_skbuff_setattr(skb, family, secattr)
      
      ... and is designed to be called from a Netfilter hook after the packet's
      IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.
      
      This patch also provides the necessary SELinux hooks to support this new
      functionality.  Smack support is not currently included due to uncertainty
      regarding the permissions needed to expand the Smack network access controls.
      Signed-off-by: NPaul Moore <paul.moore@hp.com>
      Reviewed-by: NJames Morris <jmorris@namei.org>
      948bf85c