lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: ip_tables: add iptables security table for mandatory access control rules

Browse Source 
The following patch implements a new "security" table for iptables, so
that MAC (SELinux etc.) networking rules can be managed separately to
standard DAC rules.

This is to help with distro integration of the new secmark-based
network controls, per various previous discussions.

The need for a separate table arises from the fact that existing tools
and usage of iptables will likely clash with centralized MAC policy
management.

The SECMARK and CONNSECMARK targets will still be valid in the mangle
table to prevent breakage of existing users.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
James Morris
2008-06-09 15:57:24 -07:00
committed by David S. Miller
parent a258860e01
commit 560ee653b6
7 changed files with 209 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/netns/ipv4.h
View File

@ -36,6 +36,7 @@ struct netns_ipv4 {
struct xt_table *iptable_mangle;
struct xt_table *iptable_raw;
struct xt_table *arptable_filter;
struct xt_table *iptable_security;
#endif
int sysctl_icmp_echo_ignore_all;