[PATCH] Refpolicy: Add rawip_socket to the recvfrom MLS constraints

[PATCH] Refpolicy: Add rawip_socket to the recvfrom MLS constraints

[Paul Moore]

It was just pointed out to me that the raw IP socket class is missing from the
recvfrom MLS constraint.

Signed-off-by: Paul Moore <paul.moore@hp.com>
---
 policy/mls |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: refpolicy/policy/mls
===================================================================
--- refpolicy.orig/policy/mls
+++ refpolicy/policy/mls
@@ -183,7 +183,7 @@ mlsconstrain { socket tcp_socket udp_soc
 	 ( t1 == mlsnetwrite ));
 
 # used by netlabel to restrict normal domains to same level connections
-mlsconstrain { tcp_socket udp_socket } recvfrom
+mlsconstrain { tcp_socket udp_socket rawip_socket } recvfrom
 	(( l1 eq l2 ) or
 	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
 	 ( t1 == mlsnetread ));

--
paul moore
linux security @ hp


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] Refpolicy: Add rawip_socket to the recvfrom MLS constraints

[Christopher J. PeBenito]

On Wed, 2007-02-28 at 16:55 -0500, Paul Moore wrote:
> plain text document attachment (mls-netlabel_rawip_support)
> It was just pointed out to me that the raw IP socket class is missing from the
> recvfrom MLS constraint.
> 
> Signed-off-by: Paul Moore <paul.moore@hp.com>

Merged.

> ---
>  policy/mls |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: refpolicy/policy/mls
> ===================================================================
> --- refpolicy.orig/policy/mls
> +++ refpolicy/policy/mls
> @@ -183,7 +183,7 @@ mlsconstrain { socket tcp_socket udp_soc
>  	 ( t1 == mlsnetwrite ));
>  
>  # used by netlabel to restrict normal domains to same level connections
> -mlsconstrain { tcp_socket udp_socket } recvfrom
> +mlsconstrain { tcp_socket udp_socket rawip_socket } recvfrom
>  	(( l1 eq l2 ) or
>  	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
>  	 ( t1 == mlsnetread ));
> 
> --
> paul moore
> linux security @ hp
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.