netdev - Re: [PATCH] netlabel: use domain based selectors when address based selectors are not available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20130802.165723.552710416990351120.davem@davemloft.net>
Date:	Fri, 02 Aug 2013 16:57:23 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	pmoore@...hat.com
Cc:	netdev@...r.kernel.org, linux-security-module@...r.kernel.org,
	selinux@...ho.nsa.gov
Subject: Re: [PATCH] netlabel: use domain based selectors when address
 based selectors are not available

From: Paul Moore <pmoore@...hat.com>
Date: Fri, 02 Aug 2013 14:45:08 -0400

> NetLabel has the ability to selectively assign network security labels
> to outbound traffic based on either the LSM's "domain" (different for
> each LSM), the network destination, or a combination of both.  Depending
> on the type of traffic, local or forwarded, and the type of traffic
> selector, domain or address based, different hooks are used to label the
> traffic; the goal being minimal overhead.
> 
> Unfortunately, there is a bug such that a system using NetLabel domain
> based traffic selectors does not correctly label outbound local traffic
> that is not assigned to a socket.  The issue is that in these cases
> the associated NetLabel hook only looks at the address based selectors
> and not the domain based selectors.  This patch corrects this by
> checking both the domain and address based selectors so that the correct
> labeling is applied, regardless of the configuration type.
> 
> In order to acomplish this fix, this patch also simplifies some of the
> NetLabel domainhash structures to use a more common outbound traffic
> mapping type: struct netlbl_dommap_def.  This simplifies some of the code
> in this patch and paves the way for further simplifications in the
> future.
> 
> Signed-off-by: Paul Moore <pmoore@...hat.com>

Applied, thanks Paul.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html