lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[MLSXFRM]: Flow based matching of xfrm policy and state

Browse Source 
This implements a seemless mechanism for xfrm policy selection and
state matching based on the flow sid. This also includes the necessary
SELinux enforcement pieces.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Venkat Yekkirala
2006-07-24 23:29:07 -07:00
committed by David S. Miller
parent b6340fcd76
commit e0d1caa7b0
9 changed files with 329 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
security/selinux/hooks.c
View File

@ -3468,7 +3468,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
if (err)
goto out;
err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
err = selinux_xfrm_sock_rcv_skb(sock_sid, skb, &ad);
out:
return err;
}
@ -3720,7 +3720,7 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
if (err)
goto out;
err = selinux_xfrm_postroute_last(isec->sid, skb);
err = selinux_xfrm_postroute_last(isec->sid, skb, &ad);
out:
return err ? NF_DROP : NF_ACCEPT;
}
@ -4633,6 +4633,9 @@ static struct security_operations selinux_ops = {
.xfrm_state_free_security = selinux_xfrm_state_free,
.xfrm_state_delete_security = selinux_xfrm_state_delete,
.xfrm_policy_lookup = selinux_xfrm_policy_lookup,
.xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
.xfrm_flow_state_match = selinux_xfrm_flow_state_match,
.xfrm_decode_session = selinux_xfrm_decode_session,
#endif
#ifdef CONFIG_KEYS