Skip to content

GitLab

Switch branch/tag
History Find file
Clone
selinux: add a skb_owned_by() hook
Eric Dumazet authored 
Commit 90ba9b19

 (tcp: tcp_make_synack() can use alloc_skb())
broke certain SELinux/NetLabel configurations by no longer correctly
assigning the sock to the outgoing SYNACK packet.

Cost of atomic operations on the LISTEN socket is quite big,
and we would like it to happen only if really needed.

This patch introduces a new security_ops->skb_owned_by() method,
that is a void operation unless selinux is active.
Reported-by: default avatarMiroslav Vadkerti <mvadkert@redhat.com>
Diagnosed-by: default avatarPaul Moore <pmoore@redhat.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-security-module@vger.kernel.org
Acked-by: default avatarJames Morris <james.l.morris@oracle.com>
Tested-by: default avatarPaul Moore <pmoore@redhat.com>
Acked-by: default avatarPaul Moore <pmoore@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
ca10b9e9
Name Last commit Last update
..
apparmor new helper: file_inode(file)
integrity hlist: drop the node parameter from iterators
keys Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys
selinux selinux: add a skb_owned_by() hook
smack new helper: file_inode(file)
tomoyo new helper: file_inode(file)
yama yama: Better permission check for ptraceme
Kconfig KEYS: Move the key config into security/keys/Kconfig
Makefile security: Yama LSM
capability.c selinux: add a skb_owned_by() hook
commoncap.c kill f_vfsmnt
device_cgroup.c device_cgroup: don't grab mutex in rcu callback
inode.c securityfs: fix object creation races
lsm_audit.c LSM: BUILD_BUG_ON if the common_audit_data union ever grows
min_addr.c mmap_min_addr check CAP_SYS_RAWIO only for write
security.c selinux: add a skb_owned_by() hook