diff options
| author | Casey Schaufler <[email protected]> | 2008-02-15 15:24:25 -0800 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2008-02-19 07:51:00 -0800 |
| commit | 4bc87e62775052aac0be7574d5f84ff06f61c6b4 (patch) | |
| tree | 23063e82de8f7b7506d795919d7d4c13725e74a0 /net/unix/sysctl_net_unix.c | |
| parent | 9a4c8546f3e7c893888bccc2b3416d6214f2664a (diff) | |
Smack: unlabeled outgoing ambient packets
Smack uses CIPSO labeling, but allows for unlabeled packets by
specifying an "ambient" label that is applied to incoming unlabeled
packets.
Because the other end of the connection may dislike IP options, and ssh
is one know application that behaves thus, it is prudent to respond in
kind.
This patch changes the network labeling behavior such that an outgoing
packet that would be given a CIPSO label that matches the ambient label
is left unlabeled. An "unlbl" domain is added and the netlabel
defaulting mechanism invoked rather than assuming that everything is
CIPSO. Locking has been added around changes to the ambient label as
the mechanisms used to do so are more involved.
Signed-off-by: Casey Schaufler <[email protected]>
Acked-by: Paul Moore <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'net/unix/sysctl_net_unix.c')
0 files changed, 0 insertions, 0 deletions