Skip to content

GitLab

Switch branch/tag
History Find file
Clone
selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()
Paul Moore authored 
commit c0828e50

 upstream.

Due to difficulty in arriving at the proper security label for
TCP SYN-ACK packets in selinux_ip_postroute(), we need to check packets
while/before they are undergoing XFRM transforms instead of waiting
until afterwards so that we can determine the correct security label.
Reported-by: default avatarJanak Desai <Janak.Desai@gtri.gatech.edu>
Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
6594af6a
Name Last commit Last update
..
apparmor apparmor: fix bad lock balance when introspecting policy
integrity Revert "ima: policy for RAMFS"
keys aio: don't include aio.h in sched.h
selinux selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()
smack Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
tomoyo Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
yama yama: Better permission check for ptraceme
Kconfig KEYS: Move the key config into security/keys/Kconfig
Makefile security: Yama LSM
capability.c xattr: Constify ->name member of "struct xattr".
commoncap.c capabilities: allow nice if we are privileged
device_cgroup.c cgroup: make css_for_each_descendant() and friends include the origin css in the iteration
inode.c securityfs: fix object creation races
lsm_audit.c LSM: BUILD_BUG_ON if the common_audit_data union ever grows
min_addr.c mmap_min_addr check CAP_SYS_RAWIO only for write
security.c xattr: Constify ->name member of "struct xattr".