Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df2115c3 authored by Paul Moore's avatar Paul Moore Committed by David S. Miller
Browse files

[NetLabel]: change the SELinux permissions 



Change NetLabel to use the 'recvfrom' socket permission and the
SECINITSID_NETMSG SELinux SID as the NetLabel base SID for incoming packets.
This patch effectively makes the old, and currently unused, SELinux NETMSG
permissions NetLabel permissions.

Signed-of-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 609c92fe

security/selinux/ss/services.c

+4 −4
Original line number Diff line number Diff line
@@ -2611,7 +2611,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, 
	u32 netlbl_sid;

	u32 recv_perm;



	rc = selinux_netlbl_skbuff_getsid(skb, sksec->sid, &netlbl_sid);

	rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &netlbl_sid);

	if (rc != 0)

		return rc;
@@ -2620,13 +2620,13 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, 


	switch (sksec->sclass) {

	case SECCLASS_UDP_SOCKET:

		recv_perm = UDP_SOCKET__RECV_MSG;

		recv_perm = UDP_SOCKET__RECVFROM;

		break;

	case SECCLASS_TCP_SOCKET:

		recv_perm = TCP_SOCKET__RECV_MSG;

		recv_perm = TCP_SOCKET__RECVFROM;

		break;

	default:

		recv_perm = RAWIP_SOCKET__RECV_MSG;

		recv_perm = RAWIP_SOCKET__RECVFROM;

	}



	rc = avc_has_perm(sksec->sid,