[PATCH] Refpolicy: Add rawip_socket to the recvfrom MLS constraints

["Paul Moore" <paul.moore@hp.com>]

It was just pointed out to me that the raw IP socket class is missing from the
recvfrom MLS constraint.

Signed-off-by: Paul Moore <paul.moore@hp.com>
---
 policy/mls |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: refpolicy/policy/mls
===================================================================
--- refpolicy.orig/policy/mls
+++ refpolicy/policy/mls
@@ -183,7 +183,7 @@ mlsconstrain { socket tcp_socket udp_soc
 	 ( t1 == mlsnetwrite ));
 
 # used by netlabel to restrict normal domains to same level connections
-mlsconstrain { tcp_socket udp_socket } recvfrom
+mlsconstrain { tcp_socket udp_socket rawip_socket } recvfrom
 	(( l1 eq l2 ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));

--
paul moore
linux security @ hp


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.