diff options
| author | Paul Moore <paul.moore@hp.com> | 2006-09-25 15:53:13 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2006-09-25 15:53:13 -0700 |
| commit | df2115c3134d0d1a18c1f37f5192394e7f64d1e0 (patch) | |
| tree | 6a248318fa84838967376269fbd2e999ebeef3f2 | |
| parent | 609c92feea5652809319bb77f19d24a44615687d (diff) | |
| download | op-kernel-dev-df2115c3134d0d1a18c1f37f5192394e7f64d1e0.zip op-kernel-dev-df2115c3134d0d1a18c1f37f5192394e7f64d1e0.tar.gz | |
[NetLabel]: change the SELinux permissions
Change NetLabel to use the 'recvfrom' socket permission and the
SECINITSID_NETMSG SELinux SID as the NetLabel base SID for incoming packets.
This patch effectively makes the old, and currently unused, SELinux NETMSG
permissions NetLabel permissions.
Signed-of-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | security/selinux/ss/services.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index d67f7e6..22ed17c 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2611,7 +2611,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, u32 netlbl_sid; u32 recv_perm; - rc = selinux_netlbl_skbuff_getsid(skb, sksec->sid, &netlbl_sid); + rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &netlbl_sid); if (rc != 0) return rc; @@ -2620,13 +2620,13 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, switch (sksec->sclass) { case SECCLASS_UDP_SOCKET: - recv_perm = UDP_SOCKET__RECV_MSG; + recv_perm = UDP_SOCKET__RECVFROM; break; case SECCLASS_TCP_SOCKET: - recv_perm = TCP_SOCKET__RECV_MSG; + recv_perm = TCP_SOCKET__RECVFROM; break; default: - recv_perm = RAWIP_SOCKET__RECV_MSG; + recv_perm = RAWIP_SOCKET__RECVFROM; } rc = avc_has_perm(sksec->sid, |
