calipso: Allow the lsm to label the skbuff directly.

Browse source

In some cases, the lsm needs to add the label to the skbuff directly.
A NF_INET_LOCAL_OUT IPv6 hook is added to selinux to match the IPv4
behaviour.  This allows selinux to label the skbuffs that it requires.

Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Huw Davies 2016-06-27 15:06:15 -04:00 • committed by Paul Moore

parent 0868383b82

commit 2917f57b6b

6 changed files with 308 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

include/net/netlabel.h

View file

165

net/ipv6/calipso.c

View file

82

net/netlabel/netlabel_calipso.c

View file

7

net/netlabel/netlabel_calipso.h

View file

32

net/netlabel/netlabel_kapi.c

View file

15

security/selinux/hooks.c

View file