[PATCH 0/2] Fix for the unlabeled NetLabel access check patch

["Paul Moore" <paul.moore@hp.com>]

This patchset consists of two patches, both based against Linus' tree of about
an hour ago. the first is largely a resend of a previous patch which was
accepted into 2.6.23, the second is a fix for the first patch because it broke
stuff :/   More information about the breakage can be found in the link in the
patch description.

The first patch is the patch which converted NetLabel to make use of the netmsg
initial SID for MLS labeled packets so that the unlabeled initial SID could be
used for truly unlabeled packets.  Unfortunately, this turned out to cause
problems on systems with older policy.  The second patch in this series
addresses this problem by providing a runtime enable/disable status flag for
NetLabel which SELinux (and other LSMs for that matter) can use to decide if
they should perform NetLabel label enforcement.

I've given this patchset a quick test and everything behaves as I would expect,
that is to say the following happens:

 1. When the system is booted NetLabel is disabled (no NetLabel config present)
    - no NetLabel access checks for labeled or unlabeled packets
 2. Once NetLabel is configured (netlabelctl cipsov4 add ...) NetLabel is
    enabled
    - NetLabel access checks are performed for both labeled and unlabeled
      packets
 3. If all of the NetLabel labeled protocol configurations are removed
    (netlabelctl cipsov4 del ...) then NetLabel is disabled again
    - no NetLabel access checks for labeled or unlabeled packets

This should solve the problems seen in the early 2.6.23 git kernels.

Michal, if you're not sick of verifying things yet - could you test this
patchset on your configuration and verify that you do not see any regressions?

Thank you all for your patience, and sorry for all the confusion.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.