summaryrefslogtreecommitdiffstats
path: root/samples
diff options
context:
space:
mode:
authorPaul Moore <pmoore@redhat.com>2013-12-04 16:10:45 -0500
committerPaul Moore <pmoore@redhat.com>2013-12-12 17:21:31 -0500
commit47180068276a04ed31d24fe04c673138208b07a9 (patch)
tree957e58757aa1373a9e8696761f00f26d6b6704f8 /samples
parent0af901643fe3f1f8d44e41115d36609ee4bda2bf (diff)
downloadop-kernel-dev-47180068276a04ed31d24fe04c673138208b07a9.zip
op-kernel-dev-47180068276a04ed31d24fe04c673138208b07a9.tar.gz
selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()
In selinux_ip_output() we always label packets based on the parent socket. While this approach works in almost all cases, it doesn't work in the case of TCP SYN-ACK packets when the correct label is not the label of the parent socket, but rather the label of the larval socket represented by the request_sock struct. Unfortunately, since the request_sock isn't queued on the parent socket until *after* the SYN-ACK packet is sent, we can't lookup the request_sock to determine the correct label for the packet; at this point in time the best we can do is simply pass/NF_ACCEPT the packet. It must be said that simply passing the packet without any explicit labeling action, while far from ideal, is not terrible as the SYN-ACK packet will inherit any IP option based labeling from the initial connection request so the label *should* be correct and all our access controls remain in place so we shouldn't have to worry about information leaks. Reported-by: Janak Desai <Janak.Desai@gtri.gatech.edu> Tested-by: Janak Desai <Janak.Desai@gtri.gatech.edu> Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <pmoore@redhat.com>
Diffstat (limited to 'samples')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud