diff options
| author | Harry Ciao <qingtao.cao@windriver.com> | 2011-03-02 06:32:33 +0100 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2011-03-03 21:19:43 +0100 |
| commit | 6f5317e730505d5cbc851c435a2dfe3d5a21d343 (patch) | |
| tree | 02088cf519a00db5c6fbdb2cc8776402413eb662 /security/selinux/ss/mls.h | |
| parent | SELinux: Auto-generate security_is_socket_class (diff) | |
| download | linux-6f5317e730505d5cbc851c435a2dfe3d5a21d343.tar.xz linux-6f5317e730505d5cbc851c435a2dfe3d5a21d343.zip | |
SELinux: Socket retains creator role and MLS attribute
The socket SID would be computed on creation and no longer inherit
its creator's SID by default. Socket may have a different type but
needs to retain the creator's role and MLS attribute in order not
to break labeled networking and network access control.
The kernel value for a class would be used to determine if the class
if one of socket classes. If security_compute_sid is called from
userspace the policy value for a class would be mapped to the relevant
kernel value first.
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'security/selinux/ss/mls.h')
| -rw-r--r-- | security/selinux/ss/mls.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h index cd9152632e54..037bf9d82d41 100644 --- a/security/selinux/ss/mls.h +++ b/security/selinux/ss/mls.h @@ -49,7 +49,8 @@ int mls_compute_sid(struct context *scontext, struct context *tcontext, u16 tclass, u32 specified, - struct context *newcontext); + struct context *newcontext, + bool sock); int mls_setup_user_range(struct context *fromcon, struct user_datum *user, struct context *usercon); |