Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9534f71c authored by Paul Moore's avatar Paul Moore Committed by James Morris
Browse files

SELinux: restore proper NetLabel caching behavior 



A small fix to the SELinux/NetLabel glue code to ensure that the NetLabel
cache is utilized when possible.  This was broken when the SELinux/NetLabel
glue code was reorganized in the last kernel release.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 1ed43950

include/net/netlabel.h

+2 −0
Original line number Diff line number Diff line
@@ -132,6 +132,8 @@ struct netlbl_lsm_secattr_catmap { 
#define NETLBL_SECATTR_CACHE            0x00000002

#define NETLBL_SECATTR_MLS_LVL          0x00000004

#define NETLBL_SECATTR_MLS_CAT          0x00000008

#define NETLBL_SECATTR_CACHEABLE        (NETLBL_SECATTR_MLS_LVL | \

					 NETLBL_SECATTR_MLS_CAT)

struct netlbl_lsm_secattr {

	u32 flags;

security/selinux/netlabel.c

+12 −4
Original line number Diff line number Diff line
@@ -162,9 +162,13 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid) 


	netlbl_secattr_init(&secattr);

	rc = netlbl_skbuff_getattr(skb, &secattr);

	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)

	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {

		rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);

	else

		if (rc == 0 &&

		    (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&

		    (secattr.flags & NETLBL_SECATTR_CACHE))

			netlbl_cache_add(skb, &secattr);

	} else

		*sid = SECSID_NULL;

	netlbl_secattr_destroy(&secattr);
@@ -307,11 +311,15 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, 


	netlbl_secattr_init(&secattr);

	rc = netlbl_skbuff_getattr(skb, &secattr);

	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)

	if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {

		rc = security_netlbl_secattr_to_sid(&secattr,

						    SECINITSID_NETMSG,

						    &nlbl_sid);

	else

		if (rc == 0 &&

		    (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&

		    (secattr.flags & NETLBL_SECATTR_CACHE))

			netlbl_cache_add(skb, &secattr);

	} else

		nlbl_sid = SECINITSID_UNLABELED;

	netlbl_secattr_destroy(&secattr);

	if (rc != 0)