selinux: Set socket NetLabel based on connection endpoint

Browse source

Previous work enabled the use of address based NetLabel selectors, which while
highly useful, brought the potential for additional per-packet overhead when
used.  This patch attempts to solve that by applying NetLabel socket labels
when sockets are connect()'d.  This should alleviate the per-packet NetLabel
labeling for all connected sockets (yes, it even works for connected DGRAM
sockets).

Signed-off-by: Paul Moore <paul.moore@hp.com>
Reviewed-by: James Morris <jmorris@namei.org>

...

This commit is contained in:

Paul Moore 2008-10-10 10:16:33 -04:00

parent 948bf85c1b

commit 014ab19a69

8 changed files with 311 additions and 37 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

include/net/cipso_ipv4.h

View file

13

include/net/netlabel.h

View file

74

net/ipv4/cipso_ipv4.c

View file

78

net/netlabel/netlabel_kapi.c

View file

11

security/selinux/hooks.c

View file

19

security/selinux/include/netlabel.h

View file

1

security/selinux/include/objsec.h

View file

147

security/selinux/netlabel.c

View file