[2/2] SELinux: indicate fatal error in compat netfilter code

Submitted by Eric Paris on Nov. 23, 2010, 4:28 p.m.

Details

Message ID 20101123162808.3588.18495.stgit@paris.rdu.redhat.com
State Accepted
Delegated to: David Miller
Headers show

Commit Message

Eric Paris Nov. 23, 2010, 4:28 p.m.
The SELinux ip postroute code indicates when policy rejected a packet and
passes the error back up the stack.  The compat code does not.  This patch
sends the same kind of error back up the stack in the compat code.

Based-on-patch-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

 security/selinux/hooks.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Paul Moore Nov. 23, 2010, 4:32 p.m.
On Tue, 2010-11-23 at 11:28 -0500, Eric Paris wrote:
> The SELinux ip postroute code indicates when policy rejected a packet and
> passes the error back up the stack.  The compat code does not.  This patch
> sends the same kind of error back up the stack in the compat code.
> 
> Based-on-patch-by: Paul Moore <paul.moore@hp.com>
> Signed-off-by: Eric Paris <eparis@redhat.com>

Reviewed-by: Paul Moore <paul.moore@hp.com>

> ---
> 
>  security/selinux/hooks.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index bd6dc16..dd1690f 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -4529,11 +4529,11 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
>  	if (selinux_secmark_enabled())
>  		if (avc_has_perm(sksec->sid, skb->secmark,
>  				 SECCLASS_PACKET, PACKET__SEND, &ad))
> -			return NF_DROP;
> +			return NF_DROP_ERR(-ECONNREFUSED);
>  
>  	if (selinux_policycap_netpeer)
>  		if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
> -			return NF_DROP;
> +			return NF_DROP_ERR(-ECONNREFUSED);
>  
>  	return NF_ACCEPT;
>  }
>
David Miller Nov. 23, 2010, 6:59 p.m.
From: Paul Moore <paul.moore@hp.com>
Date: Tue, 23 Nov 2010 11:32:08 -0500

> On Tue, 2010-11-23 at 11:28 -0500, Eric Paris wrote:
>> The SELinux ip postroute code indicates when policy rejected a packet and
>> passes the error back up the stack.  The compat code does not.  This patch
>> sends the same kind of error back up the stack in the compat code.
>> 
>> Based-on-patch-by: Paul Moore <paul.moore@hp.com>
>> Signed-off-by: Eric Paris <eparis@redhat.com>
> 
> Reviewed-by: Paul Moore <paul.moore@hp.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch hide | download patch | download mbox

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index bd6dc16..dd1690f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4529,11 +4529,11 @@  static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
 	if (selinux_secmark_enabled())
 		if (avc_has_perm(sksec->sid, skb->secmark,
 				 SECCLASS_PACKET, PACKET__SEND, &ad))
-			return NF_DROP;
+			return NF_DROP_ERR(-ECONNREFUSED);
 
 	if (selinux_policycap_netpeer)
 		if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
-			return NF_DROP;
+			return NF_DROP_ERR(-ECONNREFUSED);
 
 	return NF_ACCEPT;
 }